@underpostnet/cyberia 3.3.77 → 3.4.0

package/scripts/test-monitor.sh

@@ -24,7 +24,7 @@ MODE=runtime                                  # runtime | instance
 ENV=development                               # development | production
 DEPLOY_ID=dd-test                             # deploy id (instance mode: parent of conf.instances.json)
 INSTANCE_IDS=                                 # instance mode: csv of ids (default: all in conf.instances.json)
-IMAGE=underpost/wp:v3.3.77                    # runtime mode image (instance mode reads image from conf)
+IMAGE=underpost/wp:v3.4.0                    # runtime mode image (instance mode reads image from conf)
 VERSIONS=green                                # csv of blue/green versions
 REPLICAS=1                                    # replicas per deployment
 NAMESPACE=default                             # k8s namespace

package/src/api/file/file.router.js

@@ -4,7 +4,7 @@ import { FileController } from './file.controller.js';
 
 class FileRouter {
   /**
-   * authenticated writes, admin-only deletes.
+   * authenticated writes, admin-only deletes and full listing.
    * @param {import('../types.js').RouterOptions} options
    * @returns {import('express').Router}
    */
@@ -13,6 +13,12 @@ class FileRouter {
     router.post(`/:id`, options.authMiddleware, async (req, res) => await FileController.post(req, res, options));
     router.post(`/`, options.authMiddleware, async (req, res) => await FileController.post(req, res, options));
     router.get(`/blob/:id`, async (req, res) => await FileController.get(req, res, options));
+    router.get(
+      `/all`,
+      options.authMiddleware,
+      adminGuard,
+      async (req, res) => await FileController.get(req, res, options),
+    );
     router.get(`/:id`, async (req, res) => await FileController.get(req, res, options));
     router.get(`/`, async (req, res) => await FileController.get(req, res, options));
     router.delete(

package/src/cli/baremetal.js

@@ -3389,7 +3389,7 @@ fi
         throw new Error('Invalid token format');
       }
 
-      logger.info('Maas api token generated', { consumer_key, consumer_secret, token_key, token_secret });
+      logger.info('Maas api token generated', { consumer_key, token_key });
       return { consumer_key, consumer_secret, token_key, token_secret };
     },
 

package/src/cli/docker-compose.js

@@ -192,7 +192,7 @@ services:
 MONGO_IMAGE=mongo:latest
 VALKEY_IMAGE=valkey/valkey:latest
 APP_IMAGE=underpost/underpost-engine
-APP_TAG=v3.3.77
+APP_TAG=v3.4.0
 PROXY_IMAGE=nginx:stable-alpine
 PROMETHEUS_IMAGE=prom/prometheus:latest
 GRAFANA_IMAGE=grafana/grafana:latest

package/src/cli/index.js

@@ -7,6 +7,7 @@ import { commitData } from '../client/components/core/CommonJs.js';
 import { registerDomainCommand } from './domains.js';
 import { TEST_TIERS, testSuiteNames } from '../server/build/testing.js';
 import { EXECUTION_PROFILES, profileFromOptionsFactory, setExecutionProfile } from '../server/build/execution.js';
+import { SEVERITIES } from '../server/security/socketsecurity.js';
 
 import Underpost from '../index.js';
 
@@ -1403,6 +1404,41 @@ program
   )
   .action(Underpost.package.callback);
 
+program
+  .command('socketsecurity')
+  .option(
+    '--audit',
+    "Audits the checkout (default). Dependency security: segregation, npm audit, the Socket patch scan and, with SOCKET_CLI_API_TOKEN set, the Socket full scan of the dependency manifests. Source code risk: with SOCKET_CLI_API_TOKEN set, the alerts Socket's registry analysis raises on this project's own published package, as refactoring tasks. Writes the JSON and Markdown reports.",
+  )
+  .option(
+    '--reach',
+    'Runs the full application reachability analysis over the local working tree with the Socket scan (tier 1 evidence); no pushed commit is needed.',
+  )
+  .option(
+    '--ci',
+    'Audits, then exits non-zero when the Socket scan violates the organization policy or a finding remains at --fail-on.',
+  )
+  .option('--fail-on <severity>', `Severity --ci fails at. One of: ${SEVERITIES.join(', ')}. Defaults to high.`)
+  .option(
+    '--fix',
+    'Runs the remediation pass before the audit: npm audit fix, every available Socket patch, socket fix without major upgrades, socket patch apply.',
+  )
+  .option('--major', 'With --fix: lets socket fix apply major upgrades.')
+  .option('--patch-scan', 'Lists the Socket patches available for the installed packages.')
+  .option(
+    '--patch-get <identifier>',
+    'Downloads one patch (UUID, CVE, GHSA or PURL) into .socket/manifest.json and applies it.',
+  )
+  .option('--patch-apply', 'Applies the patch manifest; the prepare hook. A host without the Socket CLI skips it.')
+  .option('--patch-setup', 'Installs the prepare hook in package.json.')
+  .option('--out <dir>', 'Report directory (default: security-reports).')
+  .option('--dry-run', 'Previews --patch-setup; verifies --patch-apply without writing.')
+  .description(
+    'Security audit through Socket.dev: dependency security (advisories, supply chain alerts, reachability, ' +
+      "security patches in .socket/manifest.json) and source code risk (alerts on this project's own code).",
+  )
+  .action(Underpost.socketSecurity.callback);
+
 program
   .command('release')
   .argument('[version]', 'The new version string to set (e.g., "3.1.4"). Defaults to current version.')

package/src/cli/kubectl.js

@@ -7,7 +7,7 @@
  */
 
 import { loggerFactory, redactSensitiveText } from '../server/ops/logger.js';
-import { shellExec, sleepSync } from '../server/runtime/process.js';
+import { shellArgumentFactory, shellExec, sleepSync } from '../server/runtime/process.js';
 import { timer } from '../client/components/core/CommonJs.js';
 import Underpost from '../index.js';
 
@@ -275,7 +275,8 @@ class UnderpostKubectl {
     },
 
     /**
-     * Runs a shell command inside a pod container via `kubectl exec`.
+     * Runs a shell command inside a pod container via `kubectl exec`. The command is quoted as one
+     * argument, so the pod's shell parses it and the host shell never expands it.
      * @param {object} params
      * @param {string} params.podName - Target pod name.
      * @param {string} params.namespace - Pod namespace.
@@ -287,7 +288,7 @@ class UnderpostKubectl {
      * @memberof UnderpostKubectl
      */
     exec({ podName, namespace, command, retries = DEFAULT_POD_RETRIES, timeoutSeconds = 0 }) {
-      const kubectlCmd = `sudo kubectl exec -n ${namespace} -i ${podName} -- sh -c "${command}"`;
+      const kubectlCmd = `sudo kubectl exec -n ${shellArgumentFactory(namespace)} -i ${shellArgumentFactory(podName)} -- sh -c ${shellArgumentFactory(command)}`;
       return Underpost.kubectl.run(kubectlCmd, {
         context: `exec in pod ${podName}`,
         retries,

package/src/cli/release.js

@@ -503,6 +503,8 @@ class UnderpostRelease {
       shellExec(`sudo rm -rf ./engine-private/conf/dd-default`);
       shellExec(`node bin cron --kubeadm --setup-start --git`); // --apply
       shellExec(`node bin cmt --changelog-build`);
+      shellExec(`npm run security`);
+      shellExec(`sudo rm -rf ./conf.dd*.js`);
       return { from: version, to: newVersion, files: report.map((r) => r.file), dryRun: false };
     },
 

package/src/cli/repository.js

@@ -950,7 +950,12 @@ Prevent build private config repo.`,
       confRawPaths[1] = `${JSON.stringify(DefaultConf)};`;
       const targetConfPath = `./conf${defaultConf ? '' : `.${deployId}`}.js`;
       fs.writeFileSync(targetConfPath, confRawPaths.join(sepRender), 'utf8');
-      shellExec(`prettier --write ${targetConfPath}`);
+      // A host tool, not a dependency: without it the manifest stays valid, only unformatted.
+      if (
+        `${shellExec('command -v prettier', { silent: true, silentOnError: true, stdout: true, disableLog: true }) ?? ''}`.trim()
+      )
+        shellExec(`prettier --write ${shellArgumentFactory(targetConfPath)}`);
+      else logger.warn('prettier is not on PATH; conf manifest left unformatted', { targetConfPath });
     },
 
     /**
@@ -1985,7 +1990,7 @@ Prevent build private config repo.`,
             `export GITHUB_TOKEN='${githubToken.replace(/'/g, "'\\''")}'`,
             `export GITHUB_USERNAME='${githubUsername.replace(/'/g, "'\\''")}'`,
             `git config --global --add safe.directory '${siteRoot}' 2>/dev/null || true`,
-            `cd '${siteRoot}' && git add -A && git commit -m 'backup $(date -u +%Y-%m-%dT%H:%M:%SZ)' || true`,
+            `cd '${siteRoot}' && git add -A && git commit -m "backup $(date -u +%Y-%m-%dT%H:%M:%SZ)" || true`,
             `cd '${siteRoot}' && underpost push . ${githubUsername}/${repoName}`,
             `cd /home/dd/engine && node bin host clean --force`,
           ].join(' && ');

package/src/cli/run.js

@@ -3079,7 +3079,7 @@ EOF`);
         const hostListenResult = etcHostFactory(hosts);
         logger.info(hostListenResult.renderHosts);
       }
-      const version = 'v3.3.77';
+      const version = 'v3.4.0';
       const instanceOptionsFactory = (deployId, instanceId) => ({
         ...options,
         ...clusterContextFactory(clusterType),