@rubytech/create-maxy-code 0.1.441 → 0.1.443

package/dist/__tests__/converge-client-admins.test.js

@@ -0,0 +1,50 @@
+// Task 1623 — acceptance for the installer convergence that drops the vestigial
+// admins[] key from existing client account.json. Filesystem fixtures under a
+// tmp dir; no installer side effects. Runs under `node --test dist/__tests__/*`.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { removeClientAdminsKey } from "../converge-client-admins.js";
+function makeRoot() {
+    return mkdtempSync(join(tmpdir(), "conv-1623-"));
+}
+function acct(root, id, cfg) {
+    mkdirSync(join(root, id), { recursive: true });
+    writeFileSync(join(root, id, "account.json"), JSON.stringify(cfg, null, 2));
+}
+function hasAdmins(root, id) {
+    return "admins" in JSON.parse(readFileSync(join(root, id, "account.json"), "utf-8"));
+}
+test("removes admins from a client, keeps it on the house, is idempotent", () => {
+    const root = makeRoot();
+    try {
+        acct(root, "c1", { accountId: "c1", role: "client", admins: [] });
+        acct(root, "h1", { accountId: "h1", role: "house", admins: [{ userId: "u1", role: "owner" }] });
+        acct(root, "c2", { accountId: "c2", role: "client" }); // already stripped
+        const first = removeClientAdminsKey(root);
+        assert.equal(first.find((r) => r.accountId === "c1")?.action, "removed");
+        assert.equal(first.find((r) => r.accountId === "h1")?.action, "house-kept");
+        assert.equal(first.find((r) => r.accountId === "c2")?.action, "absent");
+        assert.equal(hasAdmins(root, "c1"), false);
+        assert.equal(hasAdmins(root, "h1"), true);
+        const second = removeClientAdminsKey(root);
+        assert.equal(second.find((r) => r.accountId === "c1")?.action, "absent");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test("unreadable account.json is reported, not thrown", () => {
+    const root = makeRoot();
+    try {
+        mkdirSync(join(root, "bad"), { recursive: true });
+        writeFileSync(join(root, "bad", "account.json"), "{ not json");
+        const res = removeClientAdminsKey(root);
+        assert.equal(res.find((r) => r.accountId === "bad")?.action, "unreadable");
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/converge-client-admins.js

@@ -0,0 +1,67 @@
+// Task 1623 — installer convergence. A client sub-account never carries admins[]
+// (Task 999 retired the seats, Task 1596 the inbound read). This removes the
+// vestigial key from every existing role:'client' account.json on each install,
+// reaching all installs and brands without a per-box script. The house keeps its
+// admins[] (the real install-wide access surface). Atomic temp-write + rename,
+// idempotent, one auditable line per file; contents are never echoed.
+import { existsSync, readdirSync, readFileSync, writeFileSync, renameSync, statSync, rmSync } from "node:fs";
+import { join } from "node:path";
+export function removeClientAdminsKey(accountsDir) {
+    const out = [];
+    let entries = [];
+    try {
+        entries = readdirSync(accountsDir);
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (entry.startsWith("."))
+            continue;
+        const dir = join(accountsDir, entry);
+        try {
+            if (!statSync(dir).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const cfgPath = join(dir, "account.json");
+        if (!existsSync(cfgPath))
+            continue;
+        let cfg;
+        try {
+            cfg = JSON.parse(readFileSync(cfgPath, "utf-8"));
+        }
+        catch {
+            out.push({ accountId: entry, action: "unreadable" });
+            continue;
+        }
+        if (cfg.role === "house") {
+            out.push({ accountId: entry, action: "house-kept" });
+            continue;
+        }
+        if (cfg.role !== "client" || !("admins" in cfg)) {
+            out.push({ accountId: entry, action: "absent" });
+            continue;
+        }
+        delete cfg.admins;
+        const tmp = `${cfgPath}.1623.tmp`;
+        try {
+            writeFileSync(tmp, JSON.stringify(cfg, null, 2) + "\n");
+            renameSync(tmp, cfgPath);
+            out.push({ accountId: entry, action: "removed" });
+        }
+        catch {
+            // A write/rename failure (full disk, permissions, file changed under us):
+            // remove any half-written temp so no .1623.tmp is orphaned, and label it
+            // write-failed (the file was readable — "unreadable" would misdescribe it).
+            try {
+                rmSync(tmp, { force: true });
+            }
+            catch { /* best-effort cleanup */ }
+            out.push({ accountId: entry, action: "write-failed" });
+        }
+    }
+    return out;
+}

package/dist/index.js

@@ -10,6 +10,7 @@ import { buildHeartbeatCronBlock, mergeHeartbeatBlock } from "./cron-registratio
 import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
 import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
 import { findPeerBrandOnDefaultNeo4jPort } from "./peer-brand-detect.js";
+import { removeClientAdminsKey } from "./converge-client-admins.js";
 import { resolveNeo4jPidfileScrub } from "./neo4j-pidfile-scrub.js";
 import { runInitLogging } from "./init-logging.js";
 import { requireSupportedPlatform, detectPlatform } from "./platform-detect.js";
@@ -856,6 +857,89 @@ function installSystemDeps() {
     catch (err) {
         console.error(`  WARNING: failed to provision swap: ${err instanceof Error ? err.message : String(err)}`);
     }
+    // Task 1593 — zram compressed-RAM swap ahead of the SD dphys swapfile. On a
+    // Pi, swapping to the SD card thrashes I/O and turns an approach-to-OOM into
+    // an apparent hard-freeze (the muvin 2026-07-13 incident). zram swaps to
+    // compressed RAM first (default priority 100 vs dphys -2), removing the
+    // thrash and adding effective headroom; dphys stays as the low-priority
+    // last-resort overflow tier. Best-effort: a failure warns but never aborts.
+    try {
+        console.log("  [privileged] apt-get install zram-tools");
+        shell("apt-get", ["install", "-y", "zram-tools"], { sudo: true, bestEffort: true });
+        const desiredZram = "ALGO=zstd\nPERCENT=50\n";
+        const zramConfPath = "/etc/default/zramswap";
+        let zramCurrent = "";
+        if (existsSync(zramConfPath)) {
+            try {
+                zramCurrent = readFileSync(zramConfPath, "utf-8");
+            }
+            catch {
+                zramCurrent = "";
+            }
+        }
+        if (zramCurrent.includes("ALGO=zstd") && zramCurrent.includes("PERCENT=50")) {
+            logFile("  zram: already configured (ALGO=zstd PERCENT=50)");
+        }
+        else {
+            const zramTmp = `/tmp/zramswap.${process.pid}`;
+            writeFileSync(zramTmp, desiredZram);
+            console.log("  [privileged] install /etc/default/zramswap (ALGO=zstd PERCENT=50)");
+            shell("cp", [zramTmp, zramConfPath], { sudo: true });
+            spawnSync("rm", ["-f", zramTmp]);
+            console.log("  [privileged] systemctl restart zramswap");
+            shell("systemctl", ["restart", "zramswap"], { sudo: true, bestEffort: true });
+            logFile("  zram: configured ALGO=zstd PERCENT=50 and restarted zramswap");
+        }
+    }
+    catch (err) {
+        console.error(`  WARNING: failed to provision zram: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // Task 1593 — earlyoom userspace killer. Under sustained pressure it SIGTERMs
+    // the largest process at 10% MemAvailable (SIGKILL at 5%) BEFORE the kernel
+    // oom-killer wedges the box; systemd's Restart=on-failure then restarts the
+    // service, so a leak becomes "one process dies and comes back" instead of a
+    // hard freeze. --avoid protects sshd (keeps the box reachable, so SSH never
+    // drops during a kill) and systemd (init). Neo4j runs as comm=java and is
+    // crash-safe (recovers from its transaction log on restart), so it is
+    // intentionally not protected. Best-effort. The 10%/5% thresholds are the
+    // calibration target of the on-device induced-pressure test.
+    try {
+        console.log("  [privileged] apt-get install earlyoom");
+        shell("apt-get", ["install", "-y", "earlyoom"], { sudo: true, bestEffort: true });
+        // No inner quotes around the --avoid regex: the Debian earlyoom.service
+        // runs `ExecStart=/usr/bin/earlyoom $EARLYOOM_ARGS`, and systemd expands the
+        // variable by whitespace-splitting WITHOUT shell quote removal, so inner
+        // single-quotes would survive into the regex and never match sshd/systemd.
+        // The regex `^(sshd|systemd)$` contains no whitespace, so it stays one token.
+        const desiredEarlyoom = "EARLYOOM_ARGS=\"-m 10,5 -r 3600 --avoid ^(sshd|systemd)$\"\n";
+        const earlyoomConfPath = "/etc/default/earlyoom";
+        let earlyoomCurrent = "";
+        if (existsSync(earlyoomConfPath)) {
+            try {
+                earlyoomCurrent = readFileSync(earlyoomConfPath, "utf-8");
+            }
+            catch {
+                earlyoomCurrent = "";
+            }
+        }
+        if (earlyoomCurrent.includes("-m 10,5") && earlyoomCurrent.includes("--avoid ^(sshd|systemd)$")) {
+            logFile("  earlyoom: already configured (-m 10,5 --avoid sshd|systemd)");
+        }
+        else {
+            const eoTmp = `/tmp/earlyoom.${process.pid}`;
+            writeFileSync(eoTmp, desiredEarlyoom);
+            console.log("  [privileged] install /etc/default/earlyoom (-m 10,5 -r 3600)");
+            shell("cp", [eoTmp, earlyoomConfPath], { sudo: true });
+            spawnSync("rm", ["-f", eoTmp]);
+            console.log("  [privileged] systemctl enable --now earlyoom");
+            shell("systemctl", ["enable", "--now", "earlyoom"], { sudo: true, bestEffort: true });
+            shell("systemctl", ["restart", "earlyoom"], { sudo: true, bestEffort: true });
+            logFile("  earlyoom: configured -m 10,5 -r 3600 --avoid sshd|systemd and enabled");
+        }
+    }
+    catch (err) {
+        console.error(`  WARNING: failed to provision earlyoom: ${err instanceof Error ? err.message : String(err)}`);
+    }
     // Hostname resolution — four sources, in priority order:
     //   1. --hostname flag (unconditional — the caller is the authority)
     //   2. OS detection on same-brand upgrade (service exists → keep whatever is currently set)
@@ -2491,6 +2575,13 @@ function deployPayload() {
     // installer is its own npm package and doesn't bundle the platform lib.
     // Mirrors checkAdminAuthInvariant() in platform/lib/admins-write/src/index.ts;
     // future divergence between the two should be caught by the test suite.
+    // Task 1623 — converge existing client account.json to drop the vestigial
+    // admins[] key before the invariant check reads them. House untouched.
+    for (const r of removeClientAdminsKey(join(INSTALL_DIR, "data", "accounts"))) {
+        if (r.action === "removed" || r.action === "unreadable" || r.action === "write-failed") {
+            console.log(`  [converge-1623] account=${r.accountId.slice(0, 8)} admins=${r.action}`);
+        }
+    }
     runInstallInvariantCheck(persistentUsersFile, join(INSTALL_DIR, "data", "accounts"));
     // The version marker is NOT written here. It is stamped at the very end of a
     // fully-successful install (after plugin registration and every throwing
@@ -4218,6 +4309,17 @@ function installService() {
     const rssSamplerUnitName = `${BRAND.hostname}-rss-sampler.service`;
     const rssSamplerScriptPath = resolve(INSTALL_DIR, "platform/scripts/rss-sampler.sh");
     const rssSamplerLogPath = join(persistDir, "rss-sampler.log");
+    // Task 1593 — the per-service unit names the sampler reads for its
+    // op=mem-sample line, kept brand-agnostic by passing them as env. Neo4j runs
+    // as a dedicated per-brand unit when it is off the default port, else the
+    // shared system unit. MEM_PRESSURE_PCT sets the approach-to-OOM warning line
+    // as a percentage of MemTotal; 20% sits above earlyoom's 10% SIGTERM line on
+    // every fleet RAM size (8-16 GB), so the warning is logged before the kill
+    // (a fixed MB value cannot stay above a percentage kill line across both).
+    const memBrandService = `${BRAND.hostname}.service`;
+    const memEdgeService = edgeUnitName;
+    const memNeo4jUnit = NEO4J_DEDICATED ? `neo4j-${BRAND.hostname}.service` : "neo4j.service";
+    const memPressurePct = "20";
     const rssSamplerUnit = `[Unit]
 Description=${BRAND.productName} RSS Sampler
 
@@ -4225,6 +4327,10 @@ Description=${BRAND.productName} RSS Sampler
 Type=simple
 ExecStart=/bin/bash ${rssSamplerScriptPath}
 Environment=LOG_PATH=${rssSamplerLogPath}
+Environment=BRAND_SERVICE=${memBrandService}
+Environment=EDGE_SERVICE=${memEdgeService}
+Environment=NEO4J_UNIT=${memNeo4jUnit}
+Environment=MEM_PRESSURE_PCT=${memPressurePct}
 Restart=on-failure
 RestartSec=10
 
@@ -4232,7 +4338,7 @@ RestartSec=10
 WantedBy=default.target
 `;
     writeFileSync(join(serviceDir, rssSamplerUnitName), rssSamplerUnit);
-    logFile(`  rss-sampler installed: ${rssSamplerUnitName} LOG_PATH=${rssSamplerLogPath}`);
+    logFile(`  rss-sampler installed: ${rssSamplerUnitName} LOG_PATH=${rssSamplerLogPath} BRAND_SERVICE=${memBrandService} EDGE_SERVICE=${memEdgeService} NEO4J_UNIT=${memNeo4jUnit} MEM_PRESSURE_PCT=${memPressurePct}`);
     // the edge service: always-on front door that owns the public
     // port (PORT) and the VNC stack (Xtigervnc + websockify). Its lifecycle is
     // independent of the main brand service, so an in-place upgrade triggered

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.441",
+  "version": "0.1.443",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"