@underpostnet/cyberia 3.3.73 → 3.3.77

package/src/cli/repository.js

@@ -5,6 +5,7 @@
  */
 
 import dotenv from 'dotenv';
+import { execFileSync } from 'node:child_process';
 import { commitData } from '../client/components/core/CommonJs.js';
 import { pbcopy, shellArgumentFactory, shellCd, shellExec } from '../server/runtime/process.js';
 import { actionInitLog, loggerFactory, redactSensitiveText } from '../server/ops/logger.js';
@@ -788,6 +789,16 @@ class UnderpostRepository {
       return diffUntrackOutput.toString().split('\n').filter(Boolean);
     },
 
+    // Read tracked paths without changing the index or working tree.
+    getTrackedFiles(directory = '.') {
+      const options = { cwd: path.resolve(directory), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 };
+      const root = execFileSync('git', ['rev-parse', '--show-toplevel'], options).replace(/\r?\n$/, '');
+      return execFileSync('git', ['ls-files', '--cached', '--full-name', '-z', '--', '.'], options)
+        .split('\0')
+        .filter(Boolean)
+        .map((file) => path.resolve(root, file));
+    },
+
     /**
      * Gets a list of changed (modified and untracked) files in a Git repository.
      * @param {string} [path='.'] - The path to the repository.
@@ -1736,6 +1747,23 @@ Prevent build private config repo.`,
       }
     },
 
+    /**
+     * Reports whether a path already sits inside a git work tree, so callers can skip
+     * initializing a repository that would nest inside an existing one.
+     * @param {string} repoPath - Directory to probe.
+     * @returns {boolean} True when the path is tracked by an enclosing repository.
+     * @memberof UnderpostRepository
+     */
+    isInsideWorkTree(repoPath) {
+      const output = shellExec(`cd "${repoPath}" && git rev-parse --is-inside-work-tree`, {
+        stdout: true,
+        silent: true,
+        disableLog: true,
+        silentOnError: true,
+      });
+      return `${output ?? ''}`.trim() === 'true';
+    },
+
     /**
      * Declares a path safe for git, skipping the write when it is already declared so repeated
      * provisioning does not append duplicate global config entries.
@@ -2132,13 +2160,13 @@ Prevent build private config repo.`,
 
     /**
      * Ensures a deploy's public source repo (e.g. `engine-prototype`) is present
-     * next to the engine and reset to a pristine HEAD, so catalog `sourceMoves`
-     * can (re)pull custom sources even after a previous build moved them out of
-     * the source tree.
+     * next to the engine, so catalog `sourceMoves` the engine tree lacks can be
+     * copied in.
      *
-     * Clones `../<repoName>` when missing; otherwise restores a clean checkout
-     * (`git checkout .` brings back any moved-out tracked files) and pulls latest.
-     * Mirrors the sibling-repo handling used by `syncPrivateConf`.
+     * Clones `../<repoName>` when missing; otherwise fast-forwards it. The working
+     * tree is never reset: it is the git view of edits made in the engine tree,
+     * which ignores those paths, so a pending change there is review material, not
+     * something to discard.
      *
      * @param {string} repoName - Public source repo name (e.g. `engine-prototype`).
      * @returns {boolean} `true` when the repo is available on disk.
@@ -2154,9 +2182,7 @@ Prevent build private config repo.`,
       } else {
         const repoAbsPath = path.resolve(repoPath);
         shellExec(`git config --global --add safe.directory '${repoAbsPath}'`);
-        shellExec(`cd ${repoPath} && git checkout . && git clean -f -d && underpost pull . ${gitUri}`, {
-          silent: true,
-        });
+        shellExec(`cd ${repoPath} && underpost pull . ${gitUri}`, { silent: true });
       }
       return fs.existsSync(repoPath);
     },

package/src/cli/run.js

@@ -28,10 +28,10 @@ import {
   instancePortFactory,
   instanceProxyRoutesFactory,
   instanceStatusPageEntriesFactory,
+  instanceProjectPathFactory,
   loadConfInstances,
   loadProjectInstanceEnvBuilder,
   loadConfServerJson,
-  loadReplicas,
   resolveEnvScoped,
   selectConfInstances,
   waitForPort,
@@ -49,6 +49,7 @@ import {
   trafficFromRoutingInfoFactory,
 } from '../server/runtime/conf.js';
 import { buildKindPorts, deployRoutesExists, readDeployRoutes, resolveDeployList } from '../server/network/router.js';
+import { clientBundleHostFilter, pullClientBundle, pushClientBundle } from '../client-builder/client-bundle.js';
 import { cronDeployIdResolve } from '../server/ops/cron.js';
 import { deployEnvFactory, getNpmRootPath, writeEnv } from '../server/runtime/environment.js';
 import { actionInitLog, loggerFactory } from '../server/ops/logger.js';
@@ -62,6 +63,7 @@ import { domainContextFactory } from './domains.js';
 import Underpost from '../index.js';
 import dotenv from 'dotenv';
 import { MongoBootstrap } from '../db/mongo/MongoBootstrap.js';
+import { MongoExpress } from '../db/mongo/MongoExpress.js';
 import {
   UNDERPOST_GATEWAY,
   assertStaticAssets,
@@ -140,6 +142,7 @@ const logger = loggerFactory(import.meta);
  * @property {boolean} kind - Whether to run in kind mode.
  * @property {boolean} k3s - Whether to run in k3s mode.
  * @property {string} hosts - The hosts to use.
+ * @property {string} split - Zip part size in MB for push-bundle, or 'none' to upload a single zip.
  * @property {string} deployId - The deployment ID.
  * @property {string} instanceId - The instance ID.
  * @property {string} user - The user to run as.
@@ -238,6 +241,7 @@ const DEFAULT_OPTION = {
   kind: false,
   k3s: false,
   hosts: '',
+  split: '',
   deployId: '',
   instanceId: '',
   user: '',
@@ -2267,19 +2271,25 @@ EOF
      * If `--build` is supplied the image is built from the project Dockerfile and loaded into the
      * cluster before the manifest is written (kind by default; `--kubeadm` / `--k3s` override).
      *
-     * @param {string} path - Comma-separated: `deployId,instanceId[,projectPath]`.
-     *   `projectPath` is the root directory that contains the `Dockerfile` (e.g. `./cyberia-client`).
-     *   Artifacts are written to `<projectPath>/manifests/<env>/Dockerfile` and
-     *   `<projectPath>/manifests/<env>/deployment.yaml`.
-     *   In production, files are also copied to `<projectPath>/Dockerfile` and
-     *   `<projectPath>/deployment.yaml`.
+     * The target is named by `--deploy-id` and `--instance-id`, like every other instance runner.
+     * Where the artifacts land is not an argument: an instance's project directory is derived from
+     * the conf entry itself (see {@link instanceProjectPathFactory}), so the caller cannot pair an
+     * instance with someone else's checkout. Artifacts are written to
+     * `<project>/manifests/deployments/<instance>-<env>/`, and in production the pair is also
+     * copied to `<project>/Dockerfile` and `<project>/deployment.yaml`.
+     *
+     * @param {string} path - Unused; the target comes from `--deploy-id` and `--instance-id`.
      * @param {UnderpostRunDefaultOptions} options - The default underpost runner options for customizing workflow
      * @memberof UnderpostRun
      */
     'instance-build-manifest': async (path, options = DEFAULT_OPTION) => {
       const env = options.dev ? 'development' : 'production';
-      let [deployId, id, projectPath] = path.split(',');
-      const rootPath = projectPath ? projectPath : '.';
+      const deployId = options.deployId;
+      const id = options.instanceId;
+      if (!deployId || !id) {
+        logger.error('[instance-build-manifest] --deploy-id and --instance-id are required');
+        return;
+      }
 
       const confInstances = loadConfInstances(deployId);
       // Targeting a template id builds every world in the family. The fan-out
@@ -2297,20 +2307,23 @@ EOF
       }
       if (!options.instanceOnly && (selected.length > 1 || selected[0].id !== id)) {
         for (const instance of selected)
-          await UnderpostRun.RUNNERS['instance-build-manifest'](
-            [deployId, instance.id, projectPath].filter((v) => v !== undefined).join(','),
-            { ...options, instanceOnly: true },
-          );
+          await UnderpostRun.RUNNERS['instance-build-manifest']('', {
+            ...options,
+            instanceId: instance.id,
+            instanceOnly: true,
+          });
         return;
       }
 
+      const instance = selected[0];
+      // The conf names the project: its repository, else its runtime, else its id. A world and the
+      // checkout it publishes to cannot disagree, because only one of them is stated.
+      const rootPath = instanceProjectPathFactory(instance);
       const envManifestPath = `${rootPath}/manifests/deployments/${id}-${env}`;
       const outputPath = `${envManifestPath}/deployment.yaml`;
       const dockerfileManifestPath = `${envManifestPath}/Dockerfile`;
 
       fs.mkdirpSync(envManifestPath);
-
-      const instance = selected[0];
       const isDefaultInstance = instance.id === instance.templateId || !instance.templateId;
       const instanceEnvBuilder = await loadProjectInstanceEnvBuilder(deployId);
 
@@ -2357,14 +2370,15 @@ EOF
       const _fromPort = instancePortFactory({ instance, env });
       const _toPort = instancePortFactory({ instance, env, container: true });
 
-      // Build image from projectPath Dockerfile and load into cluster when --build is set.
-      if (options.build && projectPath) {
+      // Build the image from the project's own Dockerfile and load it into the cluster when
+      // --build is set.
+      if (options.build) {
         const isKind = !options.kubeadm && !options.k3s;
         Underpost.image.build({
-          path: projectPath,
+          path: rootPath,
           imageName: _image,
           podmanSave: true,
-          imageOutPath: projectPath,
+          imageOutPath: rootPath,
           kind: isKind,
           kubeadm: !!options.kubeadm,
           k3s: !!options.k3s,
@@ -2484,12 +2498,11 @@ EOF
       // a rewrite never points at a document that cannot exist. The check is a
       // read: placing the document into the gateway volume is `deploy
       // --sync-static`'s job at apply time, and a build must not mutate the host.
-      // `projectPath` is passed through because this runner is given one
-      // explicitly; the sync derives the same root from the instance itself.
-      const statusPageEntries = instanceStatusPageEntriesFactory({
-        instances: [instance],
-        projectPath: rootPath,
-      }).filter((entry) => fs.existsSync(entry.sourcePath));
+      // No project override: this runner and the sync now derive the root from the same instance
+      // by the same rule, so passing one here could only make them disagree.
+      const statusPageEntries = instanceStatusPageEntriesFactory({ instances: [instance] }).filter((entry) =>
+        fs.existsSync(entry.sourcePath),
+      );
 
       // httproute.yaml — this instance's own routes, including the status routes
       // that reach the static utility instead of this workload. No Gateway is
@@ -3066,7 +3079,7 @@ EOF`);
         const hostListenResult = etcHostFactory(hosts);
         logger.info(hostListenResult.renderHosts);
       }
-      const version = 'v3.3.73';
+      const version = 'v3.3.77';
       const instanceOptionsFactory = (deployId, instanceId) => ({
         ...options,
         ...clusterContextFactory(clusterType),
@@ -3505,10 +3518,17 @@ EOF`);
           logger.info('[gateway-status] Backend probe (same Host and path, bypassing Envoy)', { backendProbes });
           // Only the rule the browser actually hit is comparable, so judge on
           // the root rule rather than on every rule of the route.
+          // The gateway answer carries the `server` header (`502 (nginx)`), the
+          // direct one is the bare code: compared as strings, every relayed status
+          // read as a routing fault, and the data plane log was dumped on a healthy
+          // edge whose only problem was an absent workload.
+          const statusCode = (answer) => /^([0-9]{3})/.exec(`${answer ?? ''}`)?.[1];
           const rootProbes = backendProbes.filter((entry) => entry.request.endsWith('/'));
-          const appFault = rootProbes.filter((entry) => `${entry.direct}` === `${entry.gateway}`);
+          const appFault = rootProbes.filter(
+            (entry) => statusCode(entry.direct) && statusCode(entry.direct) === statusCode(entry.gateway),
+          );
           const gatewayFault = rootProbes.filter(
-            (entry) => /^[0-9]{3}$/.test(entry.direct) && `${entry.direct}` !== `${entry.gateway}`,
+            (entry) => statusCode(entry.direct) && statusCode(entry.direct) !== statusCode(entry.gateway),
           );
           if (gatewayFault.length > 0) {
             logger.warn(
@@ -3850,9 +3870,9 @@ EOF`);
       );
       switch (serviceId) {
         case 'mongo-express-service': {
-          shellExec(`kubectl delete svc mongo-express-service -n ${options.namespace} --ignore-not-found`);
-          shellExec(`kubectl delete deployment mongo-express -n ${options.namespace} --ignore-not-found`);
-          shellExec(`kubectl apply -f manifests/deployment/mongo-express/deployment.yaml -n ${options.namespace}`);
+          // One deploy path for the client, shared with `cluster --mongo-express`: the secret,
+          // the auth-mode overlay selection and the readiness wait live there.
+          await MongoExpress.deploy({ namespace: options.namespace, options });
           podToMonitor = 'mongo-express';
           break;
         }
@@ -4398,186 +4418,47 @@ EOF`;
 
     /**
      * @method push-bundle
-     * @description Builds the client zip for the specified deployment, splits it into parts, and uploads to file storage.
-     *   Steps: set env, build+split zip, upload only the zip parts belonging to the deploy-id's hosts (from conf.server.json).
-     *   Only files matching `<host>-<route>.zip.part*` or `<host>-<route>.zip` for each non-skipped route are uploaded.
-     * @param {string} path - Optional `fsPath.splitOption` string.
-     *   Examples: `build` (default split 8), `build.16` (split 16 MB), `build.none-split` (no split flag).
+     * @description Builds the deployment's client bundles and uploads them to file storage.
+     *   Steps: set env, build and split the zips, then upload each resolved route's artifacts
+     *   under the deployment's `storage.bundle.json`. Routes the client build skips — redirects,
+     *   rebuild-disabled routes, and `singleReplica` routes that carry their own deploy id —
+     *   produce no bundle and are not pushed.
+     * @param {string} path - Optional comma-separated host filter (e.g. 'a.com' or 'a.com,b.com').
+     *   Empty selects every host in `engine-private/conf/<deployId>/conf.server.json`.
      * @param {UnderpostRunDefaultOptions} options - The default underpost runner options for customizing workflow.
-     * @param {string} [options.deployId] - Override deploy ID.
+     * @param {string} [options.deployId] - Deploy ID for storage lookup (defaults to 'dd-default').
+     * @param {string} [options.split] - Zip part size in MB, or 'none' to upload one zip. Defaults to 8.
      * @param {boolean} [options.dev] - Use development environment; defaults to production.
      * @memberof UnderpostRun
      */
-    'push-bundle': (path = '', options = DEFAULT_OPTION) => {
-      const baseCommand = cli('underpost', { local: true });
-      const env = options.dev ? 'development' : 'production';
-      const deployId = options.deployId || 'dd-default';
-      const pathParts = (path || '').split('.');
-      const fsPath = (pathParts[0] || '').trim() || 'build';
-      const splitOption = (pathParts[1] || '').trim();
-
-      let splitFlag = '--split 8';
-      if (splitOption) {
-        if (splitOption === 'none-split') {
-          splitFlag = '';
-        } else {
-          const splitMb = Number(splitOption);
-          if (Number.isFinite(splitMb) && splitMb > 0) {
-            splitFlag = `--split ${splitMb}`;
-          } else {
-            logger.warn('push-bundle: invalid split option, using default split 8', {
-              path,
-              splitOption,
-            });
-          }
-        }
-      }
-
-      const confServerPath = `./engine-private/conf/${deployId}/conf.server.json`;
-      const confServer = fs.existsSync(confServerPath)
-        ? loadReplicas(deployId, loadConfServerJson(confServerPath))
-        : {};
-      const storageFilePath = `engine-private/conf/${deployId}/storage.bundle.json`;
-
-      shellExec(`${baseCommand} env ${deployId} ${env}`);
-      shellExec(`${baseCommand} client ${deployId} --env ${env} --build-zip${splitFlag ? ` ${splitFlag}` : ''}`);
-
-      const pushBundleFiles = (host, routePath) => {
-        const buildId = `${host}-${routePath.replaceAll('/', '')}`;
-        const buildDir = `./${fsPath}`;
-        if (!fs.existsSync(buildDir)) return;
-        const partFiles = fs
-          .readdirSync(buildDir)
-          .filter(
-            (name) =>
-              name.startsWith(`${buildId}.zip.part`) ||
-              name.startsWith(`${buildId}.zip-part`) ||
-              name === `${buildId}.zip`,
-          )
-          .map((name) => `${fsPath}/${name}`);
-        if (partFiles.length === 0) {
-          logger.warn(`push-bundle: no bundle files found for '${host}${routePath}'`, { buildId });
-          return;
-        }
-        for (const partFile of partFiles) {
-          shellExec(
-            `${baseCommand} fs ${partFile} --deploy-id ${deployId} --storage-file-path ${storageFilePath} --force`,
-          );
-        }
-      };
-
-      for (const host of Object.keys(confServer)) {
-        for (const routePath of Object.keys(confServer[host])) {
-          const routeConf = confServer[host][routePath] || {};
-          if (routeConf.redirect || routeConf.disabledRebuild) continue;
-          if (routeConf.singleReplica) {
-            if (routeConf.replicas) {
-              for (const replica of routeConf.replicas) {
-                pushBundleFiles(host, replica);
-              }
-            }
-            continue;
-          }
-          pushBundleFiles(host, routePath);
-        }
-      }
-    },
+    'push-bundle': (path = '', options = DEFAULT_OPTION) =>
+      pushClientBundle({
+        deployId: options.deployId || 'dd-default',
+        hosts: clientBundleHostFilter(path),
+        split: options.split,
+        dev: options.dev,
+      }),
 
     /**
      * @method pull-bundle
-     * @description Downloads split zip parts from file storage, merges and extracts them, and moves the result into the public directory.
-     *   Steps: set env, download parts (omit-unzip), merge zip, unzip, remove zip + parts, move to public/<host>[/path].
-     *   Iterates over every non-singleReplica, non-redirect, non-disabledRebuild route in conf.server.json
-     *   so that multi-path deployments are handled correctly.
-     * @param {string} path - Optional comma-separated host name(s) to restrict processing (e.g. 'underpost.net' or 'a.com,b.com').
-     *   If omitted, all hosts from `engine-private/conf/<deployId>/conf.server.json` are used.
+     * @description Downloads the deployment's client bundles from file storage and installs them
+     *   into the served public directory.
+     *   Steps: set env, download the parts, merge and extract each resolved route's zip, then
+     *   replace `public/<host>[<route>]` with the extracted tree. Route selection matches
+     *   push-bundle, so the two directions always address the same set of bundles.
+     * @param {string} path - Optional comma-separated host filter (e.g. 'a.com' or 'a.com,b.com').
+     *   Empty selects every host in `engine-private/conf/<deployId>/conf.server.json`.
      * @param {UnderpostRunDefaultOptions} options - The default underpost runner options for customizing workflow.
      * @param {string} [options.deployId] - Deploy ID for storage lookup (defaults to 'dd-default').
      * @param {boolean} [options.dev] - Use development environment; defaults to production.
      * @memberof UnderpostRun
      */
-    'pull-bundle': (path = '', options = DEFAULT_OPTION) => {
-      const baseCommand = cli('underpost', { local: true });
-      const env = options.dev ? 'development' : 'production';
-      const deployId = options.deployId || 'dd-default';
-      const confServerPath = `./engine-private/conf/${deployId}/conf.server.json`;
-      const confServer = fs.existsSync(confServerPath)
-        ? loadReplicas(deployId, loadConfServerJson(confServerPath))
-        : {};
-      const hostsArg = path
-        ? path
-            .split(',')
-            .map((h) => h.trim())
-            .filter(Boolean)
-        : Object.keys(confServer);
-
-      if (hostsArg.length === 0) {
-        logger.error('pull-bundle: no hosts resolved', { deployId, path, confServerPath });
-        return;
-      }
-
-      shellExec(`${baseCommand} env ${deployId} ${env}`);
-      if (!fs.existsSync('./build')) fs.mkdirSync('./build', { recursive: true });
-      shellExec(
-        `${baseCommand} fs build --recursive --deploy-id ${deployId} --storage-file-path engine-private/conf/${deployId}/storage.bundle.json --pull --omit-unzip`,
-      );
-
-      const pullBundleRoute = (host, routePath) => {
-        const buildId = `${host}-${routePath.replaceAll('/', '')}`;
-        const zipPath = `build/${buildId}.zip`;
-        const buildDir = './build';
-        const hasZip = fs.existsSync(zipPath);
-        const hasParts =
-          fs.existsSync(buildDir) &&
-          fs
-            .readdirSync(buildDir)
-            .some((name) => name.startsWith(`${buildId}.zip.part`) || name.startsWith(`${buildId}.zip-part`));
-
-        if (!hasZip && !hasParts) {
-          logger.warn(`Bundle not found for '${host}${routePath}'. Skipping.`, { zipPath, deployId });
-          return;
-        }
-
-        if (hasParts) shellExec(`${baseCommand} client --merge-zip ${zipPath}`);
-        shellExec(`${baseCommand} client --unzip ${zipPath}`);
-        shellExec(`sudo rm -rf ${zipPath}`);
-
-        if (fs.existsSync(buildDir)) {
-          fs.readdirSync(buildDir)
-            .filter((name) => name.startsWith(`${buildId}.zip.part`) || name.startsWith(`${buildId}.zip-part`))
-            .forEach((partFile) => shellExec(`sudo rm -rf ${buildDir}/${partFile}`));
-        }
-
-        const extractedDir = `build/${buildId.replace(/-$/, '')}`;
-        if (!fs.existsSync(extractedDir)) {
-          logger.warn(`Extracted build dir not found: ${extractedDir}. Skipping move for '${host}${routePath}'.`);
-          return;
-        }
-
-        const publicDestPath = routePath === '/' ? `public/${host}` : `public/${host}${routePath}`;
-        if (fs.existsSync(publicDestPath)) shellExec(`sudo rm -rf ${publicDestPath}`);
-        if (routePath !== '/') shellExec(`sudo mkdir -p public/${host}`);
-        fs.copySync(`${extractedDir}`, `${publicDestPath}`);
-      };
-
-      for (const host of hostsArg) {
-        const routePaths = confServer[host] ? Object.keys(confServer[host]) : ['/'];
-
-        for (const routePath of routePaths) {
-          const routeConf = confServer[host] ? confServer[host][routePath] || {} : {};
-          if (routeConf.redirect || routeConf.disabledRebuild) continue;
-          if (routeConf.singleReplica) {
-            if (routeConf.replicas) {
-              for (const replica of routeConf.replicas) {
-                pullBundleRoute(host, replica);
-              }
-            }
-            continue;
-          }
-          pullBundleRoute(host, routePath);
-        }
-      }
-    },
+    'pull-bundle': async (path = '', options = DEFAULT_OPTION) =>
+      await pullClientBundle({
+        deployId: options.deployId || 'dd-default',
+        hosts: clientBundleHostFilter(path),
+        dev: options.dev,
+      }),
 
     /**
      * @method kubeadm-wireguard

package/src/cli/test.js

@@ -19,6 +19,7 @@ import { shellExec } from '../server/runtime/process.js';
 import {
   UNDERPOST_TESTING,
   allureManifestsFactory,
+  coverageReportKey,
   resolveTestSelection,
   testJobManifestFactory,
   vitestArgsFactory,
@@ -82,6 +83,9 @@ class UnderpostTest {
           'NODE_ENV=test',
           ...(allureResultsDirectory ? [`${UNDERPOST_TESTING.allureResultsEnvKey}=${allureResultsDirectory}`] : []),
         ];
+        // Only this selection's report starts from nothing: the ones beside it belong to
+        // other selections a deploy on this host may publish.
+        if (coverage) fs.removeSync(`${root}/${UNDERPOST_TESTING.coverageDirectory}/${coverageReportKey(suite)}`);
         shellExec(
           `cd ${root} && ${env.join(' ')} npx vitest ${vitestArgsFactory({ projects, grep, watch, coverage }).join(' ')}`,
         );

package/src/cli/wireguard.js

@@ -95,42 +95,27 @@ const EVENT_SERVICE_UNIT_PATH = '/etc/systemd/system/underpost-event.service';
 
 /**
  * @constant ENGINE_SYNC_STEPS
- * @description What bringing one node's checkout up to date consists of.
+ * @description Sequence of steps to bring a node's checkout up to date.
  *
- * The deploy's package script runs twice, and that is the shape of the whole sequence: every
- * step between them is the node's own CLI, which cannot load from a checkout whose installed
- * packages no longer match its manifest — so the first run repairs the tree it finds, and the
- * second installs the manifest the switch just landed. The first is advisory because a node
- * whose tree predates that script must still reach the switch that gives it one.
+ * The sync runs the node's own CLI, bracketed by two critical installs:
  *
- * The switch moves the node between package scopes, and everything the node runs off that scope
- * has to follow it, or the sync leaves the node running the previous one:
- * - the repository pair is written into the node's host configuration, because that store is the
- *   only place `deploy/lib/host.sh` reads the source a later `prepare_host` pulls from. Without
- *   it that preparation resolves the default pairing and undoes the switch.
- * - the cluster's CronJob manifests are regenerated and republished, because their pod bodies run
- *   the checkout that just changed.
- * - the supervised services are reconciled through their own generators, on the unit file's
- *   existence rather than on the unit being active: one the previous scope's tree left dead is
- *   exactly the one that has to come back, and `is-active` skipped precisely that case.
+ * 1. **Bootstrap Install:** Restores the original `package.json` from git and installs it.
+ *    This ensures the CLI remains runnable with the current code tree before any changes are applied.
+ * 2. **Deploy Install:** Installs the deploy's `package.json` and links the CLI. This happens
+ *    after both the configuration and source code switches have landed.
  *
- * All of those are scoped to the role of the node reached — see {@link NODE_ROLE_STEPS}.
- *
- * A step whose placeholder resolves to nothing is dropped rather than run empty: a monorepo sync
- * belongs to no deploy, a deploy that ships no package script has nothing to run, and a run
- * without a token must not overwrite the node's with a blank.
  * @memberof UnderpostWireguard
  */
 const ENGINE_SYNC_STEPS = [
-  { command: 'bash <deploy-package-script>', halt: false },
+  { command: 'git checkout -- package.json; npm install', halt: false },
   { command: 'node bin host set GITHUB_TOKEN <github-token>' },
-  { command: 'underpost run clean', halt: true },
-  { command: 'underpost cmt --switch-repo <engine> --target-branch <engine-branch>', halt: true },
+  { command: 'node bin run clean', halt: true },
   {
-    command: 'underpost cmt ./engine-private --switch-repo <engine-private> --target-branch <engine-private-branch>',
+    command: 'node bin cmt ./engine-private --switch-repo <engine-private> --target-branch <engine-private-branch>',
     halt: true,
   },
-  { command: 'bash <deploy-package-script>', halt: true },
+  { command: 'node bin cmt --switch-repo <engine> --target-branch <engine-branch>', halt: true },
+  { command: '<package-install-command>', halt: true },
   { command: 'node bin host set ENGINE_SRC_REPO <engine>', halt: true },
   { command: 'node bin host set ENGINE_SRC_PRIVATE_REPO <engine-private>', halt: true },
   { command: '<cron-reconcile-command>', halt: false },
@@ -159,10 +144,9 @@ const deployIdFactory = (deployId) => {
  * being synced actually ships one.
  *
  * Both halves have to hold. A monorepo sync belongs to no deploy, and a deploy that ships no
- * script of its own would leave the node running `bash` against a path that does not exist —
- * which the second, halting occurrence turns into a failed sync rather than a missing install.
- * The check reads this checkout because it is the tree the node lands on once the switch
- * completes, which is the only tree whose contents the step can be resolved against.
+ * script of its own would leave the node running `bash` against a path that does not exist. The
+ * check reads this checkout because it is the tree the node lands on once the switch completes,
+ * which is the only tree whose contents the step can be resolved against.
  * @param {string} engine - Engine source repository the node is switched onto.
  * @returns {string} Path to that deploy's package script, or `''` when there is none to run.
  * @memberof UnderpostWireguard
@@ -173,6 +157,23 @@ const deployPackageScriptFactory = (engine = '') => {
   return path && fs.existsSync(path) ? path : '';
 };
 
+/**
+ * @method packageInstallCommandFactory
+ * @description How a node installs against the source a switch just landed.
+ *
+ * A deploy's own script is preferred because it installs that deploy's manifest and links the
+ * CLI. Where there is none — a monorepo sync, or a deploy that ships no script — the checkout's
+ * own manifest is installed instead, so the step is never dropped: every sync replaces the
+ * source, and source the installed packages predate is what breaks the next command.
+ * @param {string} engine - Engine source repository the node is switched onto.
+ * @returns {string} The install command for that source.
+ * @memberof UnderpostWireguard
+ */
+const packageInstallCommandFactory = (engine = '') => {
+  const packageScript = deployPackageScriptFactory(engine);
+  return packageScript ? `bash ${packageScript}` : 'npm install';
+};
+
 /**
  * @method deployListFactory
  * @description The deploys whose hostnames a run publishes.
@@ -2666,7 +2667,7 @@ class UnderpostWireguard {
         '<engine-private>': enginePrivate,
         '<engine-branch>': Underpost.repo.getDefaultBranch(engine),
         '<engine>': engine,
-        '<deploy-package-script>': deployPackageScriptFactory(engine),
+        '<package-install-command>': packageInstallCommandFactory(engine),
         ...nodeRoleStepsFactory(options.nodeRole),
         '<github-token>': process.env.GITHUB_TOKEN || '',
       };

package/src/client/components/core/Badge.js

@@ -7,7 +7,6 @@ class Badge {
   static async instance(options = { id: '', type: 'circle-red', classList: '', text: '', style: '' }) {
     if (!options.id) options.id = getId(Badge.Tokens, 'badge-');
     else options.id = 'badge-' + options.id;
-    if (options && options.style && !options.style.color) options.style.color = 'white';
     if (!options.classList) options.classList = '';
     const { id, type } = options;
     Badge.Tokens[id] = { ...options };

package/src/client/components/core/CssCore.js

@@ -53,23 +53,30 @@ const CssCommonCore = async () => {
       .btn-label-content {
         top: 15px;
       }
+      /* Badge: one dark chip in every theme, so its lettering is always white — a caller
+         only sets a color when it also sets the background (see Badge.instance style). */
       .badge {
         min-width: 20px;
         height: 20px;
         border-radius: 3px;
         background: #3b434b;
+        color: white;
         position: relative;
         font-size: 12px;
         font-family: arial;
       }
       .badge-text {
-        /* color: white; */
         padding: 3px 6px 0px 6px;
       }
       .badge-notification-circle-red {
         background: #bd0c0c;
         border-radius: 50%;
       }
+      /* Unread dot over a menu button icon; the label reads left-to-right in both menu modes. */
+      .badge-notification-menu {
+        top: -33px;
+        left: 24px;
+      }
       .top-box-profile-container {
         top: 0px;
         right: 0px;