@underpostnet/cyberia 3.3.77 → 3.4.0

package/src/index.js

@@ -25,6 +25,7 @@ import UnderpostPackage from './cli/package.js';
 import UnderpostRepository from './cli/repository.js';
 import UnderpostRun from './cli/run.js';
 import UnderpostSecret from './cli/secrets.js';
+import UnderpostSocketSecurity from './cli/socketsecurity.js';
 import UnderpostSSH from './cli/ssh.js';
 import UnderpostState from './cli/state.js';
 import UnderpostStatic from './cli/static.js';
@@ -52,7 +53,7 @@ class Underpost {
    * @type {String}
    * @memberof Underpost
    */
-  static version = 'v3.3.77';
+  static version = 'v3.4.0';
 
   /**
    * Required Node.js major version
@@ -384,6 +385,16 @@ class Underpost {
   static get package() {
     return UnderpostPackage.API;
   }
+
+  /**
+   * Socket supply-chain security cli API
+   * @static
+   * @type {UnderpostSocketSecurity.API}
+   * @memberof Underpost
+   */
+  static get socketSecurity() {
+    return UnderpostSocketSecurity.API;
+  }
 }
 
 if (!process.version || !process.version.startsWith(`${Underpost.majorNodejsVersion}.`))
@@ -422,6 +433,7 @@ export {
   UnderpostRepository,
   UnderpostRun,
   UnderpostSecret,
+  UnderpostSocketSecurity,
   UnderpostSSH,
   UnderpostState,
   UnderpostDns,

package/src/runtime/engine-cyberia/Dockerfile

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.77
+ARG UNDERPOST_VERSION=3.4.0
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/Dockerfile.dev

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.77
+ARG UNDERPOST_VERSION=3.4.0
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/Dockerfile.test

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.77
+ARG UNDERPOST_VERSION=3.4.0
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/compose.env

@@ -24,6 +24,7 @@ IPFS_CLUSTER_IMAGE=ipfs/ipfs-cluster:latest
 # The engine-cyberia image ships only the underpost CLI; at start it runs the
 # `underpost start --build` bootstrap, which clones ${GITHUB_USERNAME}/engine-cyberia.
 GITHUB_USERNAME=underpostnet
+GITHUB_ORG_NAME=underpost
 GITHUB_TOKEN=change_me_private_repo_token
 
 # --- MongoDB (translation of Secret mongodb-secret) --------------------------

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -135,7 +135,7 @@ services:
   # server starts but rejects connections until seeded). Serves REST/WS on 4005
   # and the engine gRPC data service on 50051.
   engine-cyberia-runtime:
-    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.77}
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.4.0}
     container_name: dd-cyberia-engine
     command:
       - /bin/sh
@@ -190,7 +190,7 @@ services:
   # gateway on host port 8081, so one port can route every instance path.
 
   cyberia-server-runtime:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.4.0}
     container_name: dd-cyberia-server
     environment:
       INSTANCE_CODE: amethyst-strata-expansion
@@ -228,7 +228,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-forest:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.4.0}
     container_name: dd-cyberia-server-forest
     environment:
       INSTANCE_CODE: FOREST
@@ -266,7 +266,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-test:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.4.0}
     container_name: dd-cyberia-server-test
     environment:
       INSTANCE_CODE: TEST
@@ -315,7 +315,7 @@ services:
   #   cyberia-server-test   -> cyberia-client-test
 
   cyberia-client-runtime:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.4.0}
     container_name: dd-cyberia-client
     environment:
       CYBERIA_PORT: '8081'
@@ -340,7 +340,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-forest:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.4.0}
     container_name: dd-cyberia-client-forest
     environment:
       CYBERIA_PORT: '8081'
@@ -365,7 +365,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-test:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.4.0}
     container_name: dd-cyberia-client-test
     environment:
       CYBERIA_PORT: '8081'

package/src/server/build/catalog.js

@@ -71,6 +71,7 @@ const loadDeployCatalog = async (deployId) => {
  */
 const loadProductCatalogs = async () => {
   const catalogs = [];
+  if (!fs.existsSync('./src/projects')) return catalogs;
   for (const file of await fs.readdir('./src/projects')) {
     if (file === 'underpost') continue;
     const mod = await import(`../../projects/${file}/catalog-${file}.js`);

package/src/server/build/execution.js

@@ -154,10 +154,23 @@ const HOST_WRITE_BINARIES = new Set([
   'haproxy',
 ]);
 
-// `gh` reaches a remote service and writes to it (`gh secret set`, `gh release create`), so it
-// is a network effect rather than local filesystem work — an unclassified binary would default
-// to `fs` and run under HERMETIC_BUILD.
-const NET_BINARIES = new Set(['curl', 'wget', 'ssh', 'scp', 'sftp', 'rsync', 'nc', 'ping', 'dig', 'nslookup', 'gh']);
+// `gh` and `socket` reach a remote service and write to it (`gh secret set`, `socket scan create`),
+// so they are a network effect rather than local filesystem work — an unclassified binary would
+// default to `fs` and run under HERMETIC_BUILD.
+const NET_BINARIES = new Set([
+  'curl',
+  'wget',
+  'ssh',
+  'scp',
+  'sftp',
+  'rsync',
+  'nc',
+  'ping',
+  'dig',
+  'nslookup',
+  'gh',
+  'socket',
+]);
 
 const CLUSTER_BINARIES = new Set(['kubectl', 'helm']);
 
@@ -200,7 +213,8 @@ const classifySegment = (segment) => {
   // Leading `VAR=value` assignments are not the command.
   let start = 0;
   while (start < bare.length && /^[A-Z_][A-Z0-9_]*=/i.test(bare[start])) start++;
-  const binary = nodePath.basename(bare[start] ?? '');
+  // A quoted binary path (`'/x/.bin/socket' scan`) names the same binary as the bare one.
+  const binary = nodePath.basename(bare[start] ?? '').replace(/^['"]|['"]$/g, '');
   const rest = bare.slice(start);
 
   if (CLUSTER_BINARIES.has(binary)) {

package/src/server/build/package.js

@@ -6,12 +6,13 @@
  */
 
 import fs from 'fs-extra';
+import { builtinModules } from 'node:module';
 import os from 'node:os';
 import nodePath from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loggerFactory } from '../ops/logger.js';
 import { shellArgumentFactory, shellExec } from '../runtime/process.js';
-import { loadDeployCatalog } from './catalog.js';
+import { loadDeployCatalog, loadProductCatalogs } from './catalog.js';
 
 const logger = loggerFactory(import.meta);
 const ENGINE_PACKAGE_PATH = fileURLToPath(new URL('../../../', import.meta.url));
@@ -19,6 +20,31 @@ const STAGED_CLI_PACKAGE = 'underpost-cli.tgz';
 const DEPLOY_CONF_ROOT = './engine-private/conf';
 const DEPLOY_MANIFEST_INDENT = 4;
 
+/**
+ * Modules a production install executes: the CLI, the servers, the client build, and the
+ * browser bundles the build compiles. What they import statically has to resolve from
+ * `dependencies`, because the runtime images install the package with `--omit=dev`.
+ * @constant {string[]}
+ * @memberof PackageBuilder
+ */
+const RUNTIME_ENTRY_POINTS = [
+  'bin/index.js',
+  'src/server.js',
+  'src/api.js',
+  'src/proxy.js',
+  'src/client.build.js',
+  'src/client/*.index.js',
+  'src/client/sw/*.js',
+  // Loaded by name from a deploy's configuration, so no static import reaches them.
+  'src/api/*/*.js',
+  'src/ws/*/*.js',
+  'src/grpc/*/*.js',
+  'src/projects/*/*.js',
+];
+const BUILTINS = new Set(builtinModules);
+// A dynamic import whose argument is not a string literal; esbuild would expand it into a glob.
+const NON_LITERAL_IMPORT = /\bimport\((?!\s*(['"])[^'"\n]*\1\s*\))/g;
+
 /**
  * Packs an npm package into a build context under a stable file name.
  *
@@ -195,17 +221,23 @@ const buildProductPackageJson = ({
  * @param {object} params.packageJson - The repository's manifest.
  * @param {object} [params.catalog] - That product's catalog.
  * @param {string} [params.underpostVersion] - Engine CLI version to pin; the manifest's own otherwise.
+ * @param {string} [params.underpostPackageName] - The engine package the tarball depends on; `underpost` otherwise.
  * @returns {object} The manifest to publish.
  * @memberof PackageBuilder
  */
-const publishedProductPackageJson = ({ packageJson, catalog = {}, underpostVersion = '' } = {}) => {
+const publishedProductPackageJson = ({
+  packageJson,
+  catalog = {},
+  underpostVersion = '',
+  underpostPackageName = 'underpost',
+} = {}) => {
   if (!packageJson || typeof packageJson !== 'object')
     throw new TypeError('publishedProductPackageJson requires packageJson');
 
   const version = `${underpostVersion || packageJson.version || ''}`.replace(/^v/, '');
   if (!version) throw new TypeError('publishedProductPackageJson requires a version to pin the engine CLI at');
 
-  const dependencies = { underpost: `^${version}`, ...(catalog.packageDependencies ?? {}) };
+  const dependencies = { [underpostPackageName]: `^${version}`, ...(catalog.packageDependencies ?? {}) };
   const devDependencies = productDevDependenciesFactory({
     engineDependencies: packageJson.dependencies,
     engineDevDependencies: packageJson.devDependencies,
@@ -485,22 +517,153 @@ const installDeployDependencies = async (deployId, catalog) => {
   return specs;
 };
 
+/**
+ * The package a bare import specifier names; empty for relative, absolute and builtin ones.
+ * @param {string} specifier - Import specifier.
+ * @returns {string} Package name.
+ * @memberof PackageBuilder
+ */
+const importPackageNameFactory = (specifier = '') => {
+  if (/^(\.|\/|node:|data:|[a-z]+:\/\/)/.test(specifier)) return '';
+  const segments = specifier.split('/');
+  const name = specifier.startsWith('@') ? segments.slice(0, 2).join('/') : segments[0];
+  return BUILTINS.has(name) ? '' : name;
+};
+
+/**
+ * Walks the import graph from the runtime entry points and collects the packages it reaches.
+ * esbuild parses every module, so an import-shaped line inside a string or a comment is not an
+ * import. A dynamic `import('name')` is recorded as lazy: it loads on one code path only, so it
+ * does not bind a production install the way a static import does. Non-code assets stay out of
+ * the graph, and a non-literal dynamic import is not expanded: esbuild fails on a glob with no
+ * match, and the modules such imports load are entry points already.
+ * @param {object} [params]
+ * @param {string} [params.root] - Package root.
+ * @param {string[]} [params.entryPoints] - Entry point paths or glob patterns, relative to root.
+ * @returns {Promise<{files: string[], packages: Record<string, string[]>, lazyPackages: Record<string, string[]>}>} Importers by package, relative to root.
+ * @memberof PackageBuilder
+ */
+const runtimeImportGraphFactory = async ({ root = ENGINE_PACKAGE_PATH, entryPoints = RUNTIME_ENTRY_POINTS } = {}) => {
+  const esbuild = await import('esbuild');
+  const { metafile } = await esbuild.build({
+    absWorkingDir: nodePath.resolve(root),
+    entryPoints: entryPoints.flatMap((pattern) => fs.globSync(pattern, { cwd: root })),
+    bundle: true,
+    write: false,
+    metafile: true,
+    logLevel: 'silent',
+    platform: 'node',
+    format: 'esm',
+    packages: 'external',
+    outdir: nodePath.join(os.tmpdir(), 'underpost-runtime-graph'),
+    plugins: [
+      {
+        name: 'literal-dynamic-imports',
+        setup(build) {
+          build.onLoad({ filter: /\.[cm]?js$/ }, (args) => ({
+            contents: fs.readFileSync(args.path, 'utf8').replace(NON_LITERAL_IMPORT, 'import(__dynamic__||'),
+            loader: 'js',
+          }));
+        },
+      },
+      {
+        name: 'code-only',
+        setup(build) {
+          build.onResolve({ filter: /\.[^./\\]+$/ }, (args) =>
+            /\.(?:[cm]?js|json)$/.test(args.path) ? undefined : { path: args.path, external: true },
+          );
+        },
+      },
+    ],
+  });
+  const packages = {};
+  const lazyPackages = {};
+  for (const [file, input] of Object.entries(metafile.inputs))
+    for (const { path, kind, external } of input.imports) {
+      const name = external ? importPackageNameFactory(path) : '';
+      if (!name) continue;
+      const importers = ((kind === 'dynamic-import' ? lazyPackages : packages)[name] ??= []);
+      if (!importers.includes(file)) importers.push(file);
+    }
+
+  for (const name of Object.keys(lazyPackages)) if (packages[name]) delete lazyPackages[name];
+  const sorted = (registry) =>
+    Object.fromEntries(
+      Object.entries(registry)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([name, importers]) => [name, importers.sort()]),
+    );
+  return {
+    files: Object.keys(metafile.inputs).sort(),
+    packages: sorted(packages),
+    lazyPackages: sorted(lazyPackages),
+  };
+};
+
+/**
+ * Checks a manifest against the runtime import graph: every package the graph reaches
+ * statically must be declared in `dependencies`, or be pinned by a product catalog for the
+ * deploys that load its modules. A package reached only lazily is reported, not counted as a
+ * violation.
+ * @param {object} [params]
+ * @param {string} [params.root] - Package root.
+ * @param {object} [params.packageJson] - Manifest to check; read from root otherwise.
+ * @param {object[]} [params.catalogs] - Product catalogs; every one in the tree otherwise.
+ * @returns {Promise<{dependencies: number, devDependencies: number, runtime: string[], lazy: string[], misplaced: Array<{name: string, declaredIn: string, importers: string[]}>}>} Audit result.
+ * @memberof PackageBuilder
+ */
+const auditRuntimeDependencies = async ({
+  root = ENGINE_PACKAGE_PATH,
+  packageJson = readManifest(nodePath.join(root, 'package.json')),
+  catalogs,
+} = {}) => {
+  const { packages, lazyPackages } = await runtimeImportGraphFactory({ root });
+  const dependencies = packageJson.dependencies ?? {};
+  const devDependencies = packageJson.devDependencies ?? {};
+  const catalogDependencies = Object.assign(
+    {},
+    ...(catalogs ?? (await loadProductCatalogs())).map((catalog) => catalog.packageDependencies ?? {}),
+  );
+  const declaredIn = (name) =>
+    dependencies[name]
+      ? 'dependencies'
+      : catalogDependencies[name]
+        ? 'catalog'
+        : devDependencies[name]
+          ? 'devDependencies'
+          : 'none';
+  const misplaced = Object.entries(packages)
+    .map(([name, importers]) => ({ name, declaredIn: declaredIn(name), importers }))
+    .filter(({ declaredIn: origin }) => origin !== 'dependencies' && origin !== 'catalog');
+  return {
+    dependencies: Object.keys(dependencies).length,
+    devDependencies: Object.keys(devDependencies).length,
+    runtime: Object.keys(packages),
+    lazy: Object.keys(lazyPackages).map((name) => `${name} (${declaredIn(name)})`),
+    misplaced,
+  };
+};
+
 export {
   DEPLOY_CONF_ROOT,
   DEPLOY_MANIFEST_INDENT,
+  RUNTIME_ENTRY_POINTS,
   STAGED_CLI_PACKAGE,
+  auditRuntimeDependencies,
   buildDeployPackageJson,
   buildProductPackageJson,
   deployDependencySpecsFactory,
   deployPackageNameFactory,
   deployPackagePathFactory,
   deployStartScriptFactory,
+  importPackageNameFactory,
   installDeployDependencies,
   packageRepositoryFactory,
   productDevDependenciesFactory,
   productPackageOptionsFactory,
   publishedProductPackageJson,
   renamePackage,
+  runtimeImportGraphFactory,
   setPackageRepository,
   stageCliPackage,
   stagePackageArchive,

package/src/server/build/testing.js

@@ -128,8 +128,9 @@ const TEST_TIERS = [
       'src/server/ops/systemd.js',
       'src/server/security/container-storage.js',
       'src/server/security/selinux.js',
+      'src/server/security/socketsecurity.js',
     ],
-    description: 'SELinux policy, systemd units and the SOPS secret store.',
+    description: 'SELinux policy, systemd units, the SOPS secret store and the Socket supply-chain audit.',
   },
   {
     name: 'infra:2-network',

package/src/server/runtime/conf.js

@@ -3126,6 +3126,24 @@ const pruneTemplateWorkTree = (toPath, preservedEntries = []) => {
   }
 };
 
+/**
+ * Marker in the engine `.gitignore` where the engine-only prototype rules start.
+ * @constant {string}
+ * @memberof ServerConfBuilder
+ */
+const GITIGNORE_PROTOTYPE_BOUNDARY = '# Ignore ERP / CRM custom prototypes src';
+
+/**
+ * The `.gitignore` a generated repository carries: the engine rules before the prototype
+ * boundary. Without it, `git add .` after an install commits `node_modules`.
+ * @method templateGitignoreFactory
+ * @param {string} [source='.gitignore'] - Engine `.gitignore` path.
+ * @returns {string} File content.
+ * @memberof ServerConfBuilder
+ */
+const templateGitignoreFactory = (source = '.gitignore') =>
+  fs.readFileSync(source, 'utf8').split(GITIGNORE_PROTOTYPE_BOUNDARY)[0];
+
 /**
  * Rebuilds the standalone `pwa-microservices-template` from scratch out of the current
  * engine source tree.
@@ -3183,6 +3201,8 @@ const buildTemplate = async ({ srcPath = './', toPath = '../pwa-microservices-te
 
   fs.copySync(`./.vscode`, `${toPath}/.vscode`);
   fs.copySync(`./src/client/public/default`, `${toPath}/src/client/public/default`);
+  // The walker filter above drops every `.git*` entry, `.gitignore` included.
+  fs.writeFileSync(`${toPath}/.gitignore`, templateGitignoreFactory(`${srcPath}/.gitignore`), 'utf8');
 
   // Preserve the template's own README + package.json identity before merging engine metadata.
   for (const checkoutPath of ['README.md', 'package.json']) shellExec(`cd ${toPath} && git checkout ${checkoutPath}`);
@@ -3480,6 +3500,7 @@ export {
   gitOriginRepositoryName,
   ensureTemplateCheckout,
   pruneTemplateWorkTree,
+  templateGitignoreFactory,
   buildTemplate,
   updatePrivateTemplateRepo,
   updatePrivateEngineTestRepo,

package/src/server/runtime/config-scope.js

@@ -60,6 +60,8 @@ const CONFIG_OWNERSHIP = Object.freeze([
   { match: /^(GITHUB_|DEFAULT_SSH_|FORWARD_PROXY_|DEFAULT_DEPLOY_)/, owner: 'host' },
   { match: /^(GF_SECURITY_|CLUSTER_MAILER_)/, owner: 'host' },
   { match: /^UNDERPOST_EVENT_TOKEN$/, owner: 'host' },
+  // The Socket audit runs on hosts and in CI, never in a workload.
+  { match: /^SOCKET_CLI_/, owner: 'host' },
 
   { match: /^(DB_|MARIADB_|VALKEY_)/, owner: 'app' },
   { match: /^(JWT_SECRET|ACCESS_EXPIRE_MINUTES|REFRESH_EXPIRE_MINUTES|PORT|DEPLOY_ID)$/, owner: 'app' },

package/src/server/runtime/process.js

@@ -414,14 +414,15 @@ const getTerminalPid = () => {
 };
 /**
  * Copies text content to the system clipboard using clipboardy.
- * Logs the copied content for confirmation.
+ * Logs only the copied length: the content is often a password or a command carrying one.
  * @memberof Process
  * @param {string} [data='🦄'] - The data to copy. Defaults to '🦄'.
  * @returns {void}
  */
 function pbcopy(data) {
-  clipboard.writeSync(data || '🦄');
-  logger.info(`copied to clipboard`, clipboard.readSync());
+  const content = data || '🦄';
+  clipboard.writeSync(content);
+  logger.info(`copied to clipboard`, { characters: `${content}`.length });
 }
 export {
   installRootFile,