@underpostnet/cyberia 3.3.76 → 3.4.0

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -135,7 +135,7 @@ services:
   # server starts but rejects connections until seeded). Serves REST/WS on 4005
   # and the engine gRPC data service on 50051.
   engine-cyberia-runtime:
-    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.76}
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.4.0}
     container_name: dd-cyberia-engine
     command:
       - /bin/sh
@@ -190,7 +190,7 @@ services:
   # gateway on host port 8081, so one port can route every instance path.
 
   cyberia-server-runtime:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.4.0}
     container_name: dd-cyberia-server
     environment:
       INSTANCE_CODE: amethyst-strata-expansion
@@ -228,7 +228,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-forest:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.4.0}
     container_name: dd-cyberia-server-forest
     environment:
       INSTANCE_CODE: FOREST
@@ -266,7 +266,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-test:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.4.0}
     container_name: dd-cyberia-server-test
     environment:
       INSTANCE_CODE: TEST
@@ -315,7 +315,7 @@ services:
   #   cyberia-server-test   -> cyberia-client-test
 
   cyberia-client-runtime:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.4.0}
     container_name: dd-cyberia-client
     environment:
       CYBERIA_PORT: '8081'
@@ -340,7 +340,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-forest:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.4.0}
     container_name: dd-cyberia-client-forest
     environment:
       CYBERIA_PORT: '8081'
@@ -365,7 +365,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-test:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.4.0}
     container_name: dd-cyberia-client-test
     environment:
       CYBERIA_PORT: '8081'

package/src/server/build/catalog.js

@@ -71,6 +71,7 @@ const loadDeployCatalog = async (deployId) => {
  */
 const loadProductCatalogs = async () => {
   const catalogs = [];
+  if (!fs.existsSync('./src/projects')) return catalogs;
   for (const file of await fs.readdir('./src/projects')) {
     if (file === 'underpost') continue;
     const mod = await import(`../../projects/${file}/catalog-${file}.js`);

package/src/server/build/execution.js

@@ -154,10 +154,23 @@ const HOST_WRITE_BINARIES = new Set([
   'haproxy',
 ]);
 
-// `gh` reaches a remote service and writes to it (`gh secret set`, `gh release create`), so it
-// is a network effect rather than local filesystem work — an unclassified binary would default
-// to `fs` and run under HERMETIC_BUILD.
-const NET_BINARIES = new Set(['curl', 'wget', 'ssh', 'scp', 'sftp', 'rsync', 'nc', 'ping', 'dig', 'nslookup', 'gh']);
+// `gh` and `socket` reach a remote service and write to it (`gh secret set`, `socket scan create`),
+// so they are a network effect rather than local filesystem work — an unclassified binary would
+// default to `fs` and run under HERMETIC_BUILD.
+const NET_BINARIES = new Set([
+  'curl',
+  'wget',
+  'ssh',
+  'scp',
+  'sftp',
+  'rsync',
+  'nc',
+  'ping',
+  'dig',
+  'nslookup',
+  'gh',
+  'socket',
+]);
 
 const CLUSTER_BINARIES = new Set(['kubectl', 'helm']);
 
@@ -200,7 +213,8 @@ const classifySegment = (segment) => {
   // Leading `VAR=value` assignments are not the command.
   let start = 0;
   while (start < bare.length && /^[A-Z_][A-Z0-9_]*=/i.test(bare[start])) start++;
-  const binary = nodePath.basename(bare[start] ?? '');
+  // A quoted binary path (`'/x/.bin/socket' scan`) names the same binary as the bare one.
+  const binary = nodePath.basename(bare[start] ?? '').replace(/^['"]|['"]$/g, '');
   const rest = bare.slice(start);
 
   if (CLUSTER_BINARIES.has(binary)) {

package/src/server/build/package.js

@@ -6,12 +6,13 @@
  */
 
 import fs from 'fs-extra';
+import { builtinModules } from 'node:module';
 import os from 'node:os';
 import nodePath from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loggerFactory } from '../ops/logger.js';
 import { shellArgumentFactory, shellExec } from '../runtime/process.js';
-import { loadDeployCatalog } from './catalog.js';
+import { loadDeployCatalog, loadProductCatalogs } from './catalog.js';
 
 const logger = loggerFactory(import.meta);
 const ENGINE_PACKAGE_PATH = fileURLToPath(new URL('../../../', import.meta.url));
@@ -19,6 +20,31 @@ const STAGED_CLI_PACKAGE = 'underpost-cli.tgz';
 const DEPLOY_CONF_ROOT = './engine-private/conf';
 const DEPLOY_MANIFEST_INDENT = 4;
 
+/**
+ * Modules a production install executes: the CLI, the servers, the client build, and the
+ * browser bundles the build compiles. What they import statically has to resolve from
+ * `dependencies`, because the runtime images install the package with `--omit=dev`.
+ * @constant {string[]}
+ * @memberof PackageBuilder
+ */
+const RUNTIME_ENTRY_POINTS = [
+  'bin/index.js',
+  'src/server.js',
+  'src/api.js',
+  'src/proxy.js',
+  'src/client.build.js',
+  'src/client/*.index.js',
+  'src/client/sw/*.js',
+  // Loaded by name from a deploy's configuration, so no static import reaches them.
+  'src/api/*/*.js',
+  'src/ws/*/*.js',
+  'src/grpc/*/*.js',
+  'src/projects/*/*.js',
+];
+const BUILTINS = new Set(builtinModules);
+// A dynamic import whose argument is not a string literal; esbuild would expand it into a glob.
+const NON_LITERAL_IMPORT = /\bimport\((?!\s*(['"])[^'"\n]*\1\s*\))/g;
+
 /**
  * Packs an npm package into a build context under a stable file name.
  *
@@ -195,17 +221,23 @@ const buildProductPackageJson = ({
  * @param {object} params.packageJson - The repository's manifest.
  * @param {object} [params.catalog] - That product's catalog.
  * @param {string} [params.underpostVersion] - Engine CLI version to pin; the manifest's own otherwise.
+ * @param {string} [params.underpostPackageName] - The engine package the tarball depends on; `underpost` otherwise.
  * @returns {object} The manifest to publish.
  * @memberof PackageBuilder
  */
-const publishedProductPackageJson = ({ packageJson, catalog = {}, underpostVersion = '' } = {}) => {
+const publishedProductPackageJson = ({
+  packageJson,
+  catalog = {},
+  underpostVersion = '',
+  underpostPackageName = 'underpost',
+} = {}) => {
   if (!packageJson || typeof packageJson !== 'object')
     throw new TypeError('publishedProductPackageJson requires packageJson');
 
   const version = `${underpostVersion || packageJson.version || ''}`.replace(/^v/, '');
   if (!version) throw new TypeError('publishedProductPackageJson requires a version to pin the engine CLI at');
 
-  const dependencies = { underpost: `^${version}`, ...(catalog.packageDependencies ?? {}) };
+  const dependencies = { [underpostPackageName]: `^${version}`, ...(catalog.packageDependencies ?? {}) };
   const devDependencies = productDevDependenciesFactory({
     engineDependencies: packageJson.dependencies,
     engineDevDependencies: packageJson.devDependencies,
@@ -485,22 +517,153 @@ const installDeployDependencies = async (deployId, catalog) => {
   return specs;
 };
 
+/**
+ * The package a bare import specifier names; empty for relative, absolute and builtin ones.
+ * @param {string} specifier - Import specifier.
+ * @returns {string} Package name.
+ * @memberof PackageBuilder
+ */
+const importPackageNameFactory = (specifier = '') => {
+  if (/^(\.|\/|node:|data:|[a-z]+:\/\/)/.test(specifier)) return '';
+  const segments = specifier.split('/');
+  const name = specifier.startsWith('@') ? segments.slice(0, 2).join('/') : segments[0];
+  return BUILTINS.has(name) ? '' : name;
+};
+
+/**
+ * Walks the import graph from the runtime entry points and collects the packages it reaches.
+ * esbuild parses every module, so an import-shaped line inside a string or a comment is not an
+ * import. A dynamic `import('name')` is recorded as lazy: it loads on one code path only, so it
+ * does not bind a production install the way a static import does. Non-code assets stay out of
+ * the graph, and a non-literal dynamic import is not expanded: esbuild fails on a glob with no
+ * match, and the modules such imports load are entry points already.
+ * @param {object} [params]
+ * @param {string} [params.root] - Package root.
+ * @param {string[]} [params.entryPoints] - Entry point paths or glob patterns, relative to root.
+ * @returns {Promise<{files: string[], packages: Record<string, string[]>, lazyPackages: Record<string, string[]>}>} Importers by package, relative to root.
+ * @memberof PackageBuilder
+ */
+const runtimeImportGraphFactory = async ({ root = ENGINE_PACKAGE_PATH, entryPoints = RUNTIME_ENTRY_POINTS } = {}) => {
+  const esbuild = await import('esbuild');
+  const { metafile } = await esbuild.build({
+    absWorkingDir: nodePath.resolve(root),
+    entryPoints: entryPoints.flatMap((pattern) => fs.globSync(pattern, { cwd: root })),
+    bundle: true,
+    write: false,
+    metafile: true,
+    logLevel: 'silent',
+    platform: 'node',
+    format: 'esm',
+    packages: 'external',
+    outdir: nodePath.join(os.tmpdir(), 'underpost-runtime-graph'),
+    plugins: [
+      {
+        name: 'literal-dynamic-imports',
+        setup(build) {
+          build.onLoad({ filter: /\.[cm]?js$/ }, (args) => ({
+            contents: fs.readFileSync(args.path, 'utf8').replace(NON_LITERAL_IMPORT, 'import(__dynamic__||'),
+            loader: 'js',
+          }));
+        },
+      },
+      {
+        name: 'code-only',
+        setup(build) {
+          build.onResolve({ filter: /\.[^./\\]+$/ }, (args) =>
+            /\.(?:[cm]?js|json)$/.test(args.path) ? undefined : { path: args.path, external: true },
+          );
+        },
+      },
+    ],
+  });
+  const packages = {};
+  const lazyPackages = {};
+  for (const [file, input] of Object.entries(metafile.inputs))
+    for (const { path, kind, external } of input.imports) {
+      const name = external ? importPackageNameFactory(path) : '';
+      if (!name) continue;
+      const importers = ((kind === 'dynamic-import' ? lazyPackages : packages)[name] ??= []);
+      if (!importers.includes(file)) importers.push(file);
+    }
+
+  for (const name of Object.keys(lazyPackages)) if (packages[name]) delete lazyPackages[name];
+  const sorted = (registry) =>
+    Object.fromEntries(
+      Object.entries(registry)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([name, importers]) => [name, importers.sort()]),
+    );
+  return {
+    files: Object.keys(metafile.inputs).sort(),
+    packages: sorted(packages),
+    lazyPackages: sorted(lazyPackages),
+  };
+};
+
+/**
+ * Checks a manifest against the runtime import graph: every package the graph reaches
+ * statically must be declared in `dependencies`, or be pinned by a product catalog for the
+ * deploys that load its modules. A package reached only lazily is reported, not counted as a
+ * violation.
+ * @param {object} [params]
+ * @param {string} [params.root] - Package root.
+ * @param {object} [params.packageJson] - Manifest to check; read from root otherwise.
+ * @param {object[]} [params.catalogs] - Product catalogs; every one in the tree otherwise.
+ * @returns {Promise<{dependencies: number, devDependencies: number, runtime: string[], lazy: string[], misplaced: Array<{name: string, declaredIn: string, importers: string[]}>}>} Audit result.
+ * @memberof PackageBuilder
+ */
+const auditRuntimeDependencies = async ({
+  root = ENGINE_PACKAGE_PATH,
+  packageJson = readManifest(nodePath.join(root, 'package.json')),
+  catalogs,
+} = {}) => {
+  const { packages, lazyPackages } = await runtimeImportGraphFactory({ root });
+  const dependencies = packageJson.dependencies ?? {};
+  const devDependencies = packageJson.devDependencies ?? {};
+  const catalogDependencies = Object.assign(
+    {},
+    ...(catalogs ?? (await loadProductCatalogs())).map((catalog) => catalog.packageDependencies ?? {}),
+  );
+  const declaredIn = (name) =>
+    dependencies[name]
+      ? 'dependencies'
+      : catalogDependencies[name]
+        ? 'catalog'
+        : devDependencies[name]
+          ? 'devDependencies'
+          : 'none';
+  const misplaced = Object.entries(packages)
+    .map(([name, importers]) => ({ name, declaredIn: declaredIn(name), importers }))
+    .filter(({ declaredIn: origin }) => origin !== 'dependencies' && origin !== 'catalog');
+  return {
+    dependencies: Object.keys(dependencies).length,
+    devDependencies: Object.keys(devDependencies).length,
+    runtime: Object.keys(packages),
+    lazy: Object.keys(lazyPackages).map((name) => `${name} (${declaredIn(name)})`),
+    misplaced,
+  };
+};
+
 export {
   DEPLOY_CONF_ROOT,
   DEPLOY_MANIFEST_INDENT,
+  RUNTIME_ENTRY_POINTS,
   STAGED_CLI_PACKAGE,
+  auditRuntimeDependencies,
   buildDeployPackageJson,
   buildProductPackageJson,
   deployDependencySpecsFactory,
   deployPackageNameFactory,
   deployPackagePathFactory,
   deployStartScriptFactory,
+  importPackageNameFactory,
   installDeployDependencies,
   packageRepositoryFactory,
   productDevDependenciesFactory,
   productPackageOptionsFactory,
   publishedProductPackageJson,
   renamePackage,
+  runtimeImportGraphFactory,
   setPackageRepository,
   stageCliPackage,
   stagePackageArchive,

package/src/server/build/testing.js

@@ -128,8 +128,9 @@ const TEST_TIERS = [
       'src/server/ops/systemd.js',
       'src/server/security/container-storage.js',
       'src/server/security/selinux.js',
+      'src/server/security/socketsecurity.js',
     ],
-    description: 'SELinux policy, systemd units and the SOPS secret store.',
+    description: 'SELinux policy, systemd units, the SOPS secret store and the Socket supply-chain audit.',
   },
   {
     name: 'infra:2-network',

package/src/server/network/underpost-gateway.js

@@ -957,6 +957,104 @@ const placeInstanceStaticAssets = ({ instances, options, label }) => {
   return assertStaticAssets({ records, hostRoot, label });
 };
 
+/**
+ * @method parseRawHttpResponse
+ * @description Splits a raw HTTP/1.x response into its status code and body. The body
+ * is everything after the first blank line, byte for byte, so it can be hashed against
+ * the document on disk.
+ * @param {string} raw - Response as read off the socket.
+ * @returns {{status: string, body: string}} Status code (empty when no status line) and body.
+ * @memberof UnderpostGateway
+ */
+const parseRawHttpResponse = (raw = '') => {
+  const status = /^HTTP\/[0-9.]+\s+([0-9]{3})/.exec(raw)?.[1] || '';
+  if (!status) return { status: '', body: '' };
+  const separator = raw.search(/\r?\n\r?\n/);
+  if (separator < 0) return { status, body: '' };
+  return { status, body: raw.slice(separator).replace(/^\r?\n\r?\n/, '') };
+};
+
+/**
+ * @method gatewayPodFetch
+ * @description One request against the gateway from inside its own pod, returning the
+ * status and the body even when the status is an error.
+ *
+ * Written on the socket with `nc` rather than fetched with `wget`: the image ships
+ * busybox, whose `wget` discards the body of any non-2xx response and exits — so a
+ * fallback document, which is by definition delivered with an upstream-failure status,
+ * could never be read through it. The probe that did so failed every attempt on a
+ * correct edge and looked like a hang. HTTP/1.0 keeps the reply unchunked, so the body
+ * is the document verbatim. Where `nc` is absent the `wget` pair still yields the status.
+ * @param {object} params
+ * @param {string} params.namespace - Namespace the gateway runs in.
+ * @param {string} params.host - Host header to present.
+ * @param {string} [params.path] - Request path.
+ * @returns {{status: string, body: string}} What the gateway answered.
+ * @memberof UnderpostGateway
+ */
+const gatewayPodFetch = ({ namespace, host, path = '/' }) => {
+  const exec = (script) =>
+    `${
+      shellExec(`kubectl exec -n ${namespace} deploy/${UNDERPOST_GATEWAY.name} -- sh -c "${script}"`, {
+        stdout: true,
+        silent: true,
+        silentOnError: true,
+        disableLog: true,
+      }) ?? ''
+    }`;
+  const request = path || '/';
+  const raw = exec(
+    `printf 'GET ${request} HTTP/1.0\\r\\nHost: ${host}\\r\\n\\r\\n' | nc -w 10 127.0.0.1 ${UNDERPOST_GATEWAY.port} 2>/dev/null || true`,
+  );
+  const parsed = parseRawHttpResponse(raw);
+  if (parsed.status) return parsed;
+  const url = `http://127.0.0.1${request}`;
+  const headers = exec(`wget -S -O /dev/null -T 10 --header 'Host: ${host}' ${url} 2>&1 || true`);
+  const status = [...headers.matchAll(/HTTP\/[0-9.]+\s+([0-9]{3})/g)].pop()?.[1] || '';
+  const body = exec(`wget -q -O - -T 10 --header 'Host: ${host}' ${url} 2>/dev/null || true`);
+  return { status, body };
+};
+
+/**
+ * @method gatewayFetch
+ * @description One request against the gateway, returning the status and the body
+ * even when the status is an error — the shape every fallback probe asserts on.
+ *
+ * Sent from this host with `curl` to the gateway Service first: the sync runs on the
+ * node that holds the gateway's volume, so the ClusterIP is reachable, and curl keeps
+ * the body of an error response. Only when that yields no status line does it fall back
+ * to {@link UnderpostGateway.gatewayPodFetch}, which needs nothing on the host at all.
+ * @param {object} params
+ * @param {string} params.namespace - Namespace the gateway runs in.
+ * @param {string} params.host - Host header to present.
+ * @param {string} [params.path] - Request path.
+ * @returns {{status: string, body: string, via: string}} What the gateway answered, and which way.
+ * @memberof UnderpostGateway
+ */
+const gatewayFetch = ({ namespace, host, path = '/' }) => {
+  const clusterIp = `${
+    shellExec(`kubectl get svc ${UNDERPOST_GATEWAY.serviceName} -n ${namespace} -o jsonpath='{.spec.clusterIP}'`, {
+      stdout: true,
+      silent: true,
+      silentOnError: true,
+      disableLog: true,
+    }) ?? ''
+  }`.trim();
+  if (/^[0-9a-f.:]+$/i.test(clusterIp)) {
+    const raw = `${
+      shellExec(
+        `curl -sS -i --noproxy '*' --max-time 10 -H 'Host: ${host}' http://${clusterIp}:${UNDERPOST_GATEWAY.port}${
+          path || '/'
+        } 2>/dev/null || true`,
+        { stdout: true, silent: true, silentOnError: true, disableLog: true },
+      ) ?? ''
+    }`;
+    const parsed = parseRawHttpResponse(raw);
+    if (parsed.status) return { ...parsed, via: 'host' };
+  }
+  return { ...gatewayPodFetch({ namespace, host, path }), via: 'pod' };
+};
+
 /**
  * @method gatewayFallbackProbeRunner
  * @description Proves the edge answers each configured fallback with the exact
@@ -1018,26 +1116,24 @@ const gatewayFallbackProbeRunner = async ({ checks, options, label, gatewayStatu
           silent: true,
           silentOnError: true,
         }).trim();
-      } else {
-        const request = `http://127.0.0.1${check.path || '/'}`;
-        body = shellExec(
-          `kubectl exec -n ${namespace} deploy/${UNDERPOST_GATEWAY.name} -- sh -c ` +
-            `"wget -q -O - -T 10 --header 'Host: ${check.host}' ${request} 2>/dev/null || true"`,
-          { stdout: true, silent: true, silentOnError: true },
-        );
-        const headers = shellExec(
-          `kubectl exec -n ${namespace} deploy/${UNDERPOST_GATEWAY.name} -- sh -c ` +
-            `"wget -S -O /dev/null -T 10 --header 'Host: ${check.host}' ${request} 2>&1 || true"`,
-          { stdout: true, silent: true, silentOnError: true },
-        );
-        status = [...headers.matchAll(/HTTP\/[0-9.]+\s+([0-9]{3})/g)].pop()?.[1] || '';
-      }
+      } else ({ status, body } = gatewayFetch({ namespace, host: check.host, path: check.path }));
       actualHash = crypto
         .createHash('sha256')
         .update(body || '')
         .digest('hex');
       passed = /^50[234]$/.test(status) && !!expectedHash && actualHash === expectedHash;
       if (passed) break;
+      // The first miss is reported as it happens: a probe that polls for minutes with
+      // nothing on the console reads as a hang, and what it saw is the whole diagnosis.
+      if (attempts === 1)
+        logger.warn(`[${label}] Fallback probe not yet satisfied; polling`, {
+          host: check.host,
+          path: check.path || '/',
+          status: status || '(none)',
+          bodyBytes: Buffer.byteLength(body || ''),
+          bodyMatchesConfiguredAsset: actualHash === expectedHash,
+          expectedAsset: expectedHash ? check.assetPath : '(missing on disk)',
+        });
       if (attempts < 30) await timer(2000);
     }
     const result = {
@@ -1059,6 +1155,8 @@ export {
   UNDERPOST_GATEWAY,
   assertStaticAssets,
   gatewayFallbackProbeRunner,
+  gatewayFetch,
+  gatewayPodFetch,
   gatewayStaticAssetExists,
   hostInstanceRegistryPathFactory,
   hostServerConfFactory,
@@ -1071,6 +1169,7 @@ export {
   kubernetesUpstreamFactory,
   underpostGatewayManifestsFactory,
   nginxConfFactory,
+  parseRawHttpResponse,
   seedDefaultStatusPage,
   staticLocationFactory,
   staticPathSegmentFactory,

package/src/server/runtime/conf.js

@@ -3001,14 +3001,41 @@ const syncPrivateConf = (deployId, extraPaths = []) => {
 };
 
 /**
- * Moves a deploy's public template sources into the engine working tree ahead of
- * the build copy step. Idempotent and safe to rerun: each move is guarded by
- * `existsSync`, so already-moved or absent sources are skipped rather than throwing.
- * The `[src, dest]` pairs come from the deploy's product catalog (passed in), so
- * this module stays product-agnostic.
+ * Mirrors a deploy's public template sources from the engine working tree to the source
+ * repo they came from. The engine ignores every one of these paths, so an edit made there
+ * never reaches a diff; the source repo is where it is reviewed and committed. Each path
+ * the engine holds is replaced wholesale there (removed, then copied) so the source repo's
+ * `git status` reads as exactly the engine tree's state, deletions included. The engine
+ * copies stay in place: this is a copy, not a move. A path the engine tree does not hold
+ * is left untouched in the source repo rather than deleted.
+ *
+ * @method syncDeployIdSourcesBack
+ * @param {Array<[string, string]>} [sourceMoves=[]] - Public `[src, dest]` pairs.
+ * @returns {string[]} The source paths that were mirrored.
+ * @memberof ServerConfBuilder
+ */
+const syncDeployIdSourcesBack = (sourceMoves = []) => {
+  const mirrored = [];
+  for (const [src, dest] of sourceMoves) {
+    if (!fs.existsSync(dest)) continue;
+    fs.removeSync(src);
+    fs.copySync(dest, src);
+    mirrored.push(src);
+  }
+  return mirrored;
+};
+
+/**
+ * Brings a deploy's public template sources into line ahead of the build copy step. The
+ * engine working tree is the working copy and the source repo its git view, so a path the
+ * engine already holds is mirrored out to the repo ({@link syncDeployIdSourcesBack}) and
+ * only a path the engine lacks is copied in. Nothing is moved: the repo's working tree
+ * keeps every file, so a build never leaves it reading as wholesale deletions, and an
+ * engine-side edit is never overwritten by the repo's copy. Safe to rerun: each step is
+ * guarded by `existsSync`.
  *
  * @method syncDeployIdSources
- * @param {Array<[string, string]>} [sourceMoves=[]] - Public `[src, dest]` move pairs.
+ * @param {Array<[string, string]>} [sourceMoves=[]] - Public `[src, dest]` pairs.
  * @returns {boolean} `true` when any sources were declared, else `false`.
  * @memberof ServerConfBuilder
  */
@@ -3016,7 +3043,8 @@ const syncDeployIdSources = (sourceMoves = []) => {
   if (!sourceMoves.length) return false;
   for (const dir of ['src/api', 'src/client/components', 'src/client/public', 'src/client/services'])
     fs.mkdirSync(dir, { recursive: true });
-  for (const [src, dest] of sourceMoves) if (fs.existsSync(src)) fs.moveSync(src, dest, { overwrite: true });
+  syncDeployIdSourcesBack(sourceMoves);
+  for (const [src, dest] of sourceMoves) if (!fs.existsSync(dest) && fs.existsSync(src)) fs.copySync(src, dest);
   return true;
 };
 
@@ -3098,6 +3126,24 @@ const pruneTemplateWorkTree = (toPath, preservedEntries = []) => {
   }
 };
 
+/**
+ * Marker in the engine `.gitignore` where the engine-only prototype rules start.
+ * @constant {string}
+ * @memberof ServerConfBuilder
+ */
+const GITIGNORE_PROTOTYPE_BOUNDARY = '# Ignore ERP / CRM custom prototypes src';
+
+/**
+ * The `.gitignore` a generated repository carries: the engine rules before the prototype
+ * boundary. Without it, `git add .` after an install commits `node_modules`.
+ * @method templateGitignoreFactory
+ * @param {string} [source='.gitignore'] - Engine `.gitignore` path.
+ * @returns {string} File content.
+ * @memberof ServerConfBuilder
+ */
+const templateGitignoreFactory = (source = '.gitignore') =>
+  fs.readFileSync(source, 'utf8').split(GITIGNORE_PROTOTYPE_BOUNDARY)[0];
+
 /**
  * Rebuilds the standalone `pwa-microservices-template` from scratch out of the current
  * engine source tree.
@@ -3155,6 +3201,8 @@ const buildTemplate = async ({ srcPath = './', toPath = '../pwa-microservices-te
 
   fs.copySync(`./.vscode`, `${toPath}/.vscode`);
   fs.copySync(`./src/client/public/default`, `${toPath}/src/client/public/default`);
+  // The walker filter above drops every `.git*` entry, `.gitignore` included.
+  fs.writeFileSync(`${toPath}/.gitignore`, templateGitignoreFactory(`${srcPath}/.gitignore`), 'utf8');
 
   // Preserve the template's own README + package.json identity before merging engine metadata.
   for (const checkoutPath of ['README.md', 'package.json']) shellExec(`cd ${toPath} && git checkout ${checkoutPath}`);
@@ -3448,9 +3496,11 @@ export {
   waitForPort,
   syncPrivateConf,
   syncDeployIdSources,
+  syncDeployIdSourcesBack,
   gitOriginRepositoryName,
   ensureTemplateCheckout,
   pruneTemplateWorkTree,
+  templateGitignoreFactory,
   buildTemplate,
   updatePrivateTemplateRepo,
   updatePrivateEngineTestRepo,

package/src/server/runtime/config-scope.js

@@ -60,6 +60,8 @@ const CONFIG_OWNERSHIP = Object.freeze([
   { match: /^(GITHUB_|DEFAULT_SSH_|FORWARD_PROXY_|DEFAULT_DEPLOY_)/, owner: 'host' },
   { match: /^(GF_SECURITY_|CLUSTER_MAILER_)/, owner: 'host' },
   { match: /^UNDERPOST_EVENT_TOKEN$/, owner: 'host' },
+  // The Socket audit runs on hosts and in CI, never in a workload.
+  { match: /^SOCKET_CLI_/, owner: 'host' },
 
   { match: /^(DB_|MARIADB_|VALKEY_)/, owner: 'app' },
   { match: /^(JWT_SECRET|ACCESS_EXPIRE_MINUTES|REFRESH_EXPIRE_MINUTES|PORT|DEPLOY_ID)$/, owner: 'app' },

package/src/server/runtime/process.js

@@ -414,14 +414,15 @@ const getTerminalPid = () => {
 };
 /**
  * Copies text content to the system clipboard using clipboardy.
- * Logs the copied content for confirmation.
+ * Logs only the copied length: the content is often a password or a command carrying one.
  * @memberof Process
  * @param {string} [data='🦄'] - The data to copy. Defaults to '🦄'.
  * @returns {void}
  */
 function pbcopy(data) {
-  clipboard.writeSync(data || '🦄');
-  logger.info(`copied to clipboard`, clipboard.readSync());
+  const content = data || '🦄';
+  clipboard.writeSync(content);
+  logger.info(`copied to clipboard`, { characters: `${content}`.length });
 }
 export {
   installRootFile,

package/src/server/runtime/start.js

@@ -333,10 +333,19 @@ class UnderpostStartUp {
       const result = await awaitDeployMonitor(true);
       if (result === true) {
         // Withdraw every domain's local traces once the deployment is serving. Three calls
-        // rather than one cross-domain sweep: each domain owns what it put on disk.
+        // rather than one cross-domain sweep: each domain owns what it put on disk. Only the
+        // host domain is forced: its `--force` removes the ephemeral `engine-private` clone,
+        // which must not outlive the boot inside a container. For the other two, `--force`
+        // reaches into the cluster (the app Secret, secret purges) and is never wanted here.
         if (env === 'production' && Underpost.state.isInsideContainer())
           for (const domain of [Underpost.secret, Underpost.host, Underpost.app])
-            domain.clean({ env, namespace: 'default', args: {}, dryRun: false, force: false });
+            domain.clean({
+              env,
+              namespace: 'default',
+              args: {},
+              dryRun: false,
+              force: domain === Underpost.host,
+            });
         setTimeout(() => {
           setRuntimeStatus(deployId, env, RUNTIME_STATUS.RUNNING);
           setStartContainerStatus(deployId, env);