@xuda.io/account_module 1.2.2298 → 1.2.2299

package/index.mjs

@@ -2,7 +2,8 @@ import path from 'path';
 import fs from 'fs';
 import crypto from 'node:crypto';
 import _ from 'lodash';
-import { execFile } from 'child_process';
+import { execFile, spawn } from 'child_process';
+import os from 'os';
 import { promisify } from 'util';
 import { createRequire } from 'module';
 import { parsePhoneNumber } from 'libphonenumber-js';
@@ -2529,17 +2530,61 @@ const _ops_validate_modules = (modules) => {
   return { list, unknown: list.filter((m) => !universe.includes(m)) };
 };
 
-// Spawn utils/hotfix_prod.mjs against explicit WG hosts. execFile rejects on a
-// non-zero exit (hotfix_prod exits 1 if ANY host failed), which we translate to
-// ok:false rather than throwing, keeping stdout for the summary either way.
-const _ops_run_hotfix = async ({ hosts, modules, dry_run, timeout_ms }) => {
-  const args = [_HOTFIX_TOOL(), '--hosts', hosts.map((h) => h.ssh).join(','), ...(modules || []), ...(dry_run ? ['--dry-run'] : [])];
+// Run `node <args>` DETACHED, with its own process group and its own log file (not
+// our stdio pipes). This account proc is the deploy orchestrator, and pm2 WATCHES
+// common/ + cpi/account_module, so a stray file change restarts it. A rollout spawned
+// as a normal child would then be torn down mid-flight, leaving boxes half-patched.
+// detached:true = the child leads its own session and survives a signal aimed at our
+// process group; the log file = a broken parent pipe cannot SIGPIPE it. We still await
+// its exit for the summary; if we get bounced mid-run the child finishes on its own,
+// and a re-run is a safe no-op (hotfix_prod skips already-current modules). Never
+// rejects: failures come back as { ok:false, exit, stderr }. stdout+stderr are merged
+// into the log, so a fatal error stays visible in the tail the UI shows.
+const _ops_run_node_detached = ({ args, timeout_ms, env }) => {
+  const logfile = path.join(os.tmpdir(), `xuda_ops_${Date.now()}_${Math.random().toString(36).slice(2, 8)}.log`);
+  let fd;
   try {
-    const { stdout, stderr } = await _execFileP('node', args, { maxBuffer: 32 * 1024 * 1024, timeout: timeout_ms || 300000, env: { ...process.env } });
-    return { ok: true, exit: 0, stdout: String(stdout || ''), stderr: String(stderr || '') };
+    fd = fs.openSync(logfile, 'a');
   } catch (e) {
-    return { ok: false, exit: e && typeof e.code === 'number' ? e.code : 1, stdout: String((e && e.stdout) || ''), stderr: String((e && (e.stderr || e.message)) || e) };
-  }
+    return Promise.resolve({ ok: false, exit: 1, stdout: '', stderr: 'could not open run log: ' + e.message });
+  }
+  return new Promise((resolve) => {
+    let done = false;
+    let timer = null;
+    const settle = ({ exit, stderr }) => {
+      if (done) return;
+      done = true;
+      if (timer) clearTimeout(timer);
+      try { fs.closeSync(fd); } catch (e) {}
+      let stdout = '';
+      try { stdout = fs.readFileSync(logfile, 'utf8'); } catch (e) {}
+      try { fs.unlinkSync(logfile); } catch (e) {}
+      resolve({ ok: exit === 0, exit, stdout, stderr: stderr || '' });
+    };
+    let child;
+    try {
+      child = spawn('node', args, { detached: true, stdio: ['ignore', fd, fd], env: env || { ...process.env } });
+    } catch (e) {
+      settle({ exit: 1, stderr: 'spawn failed: ' + e.message });
+      return;
+    }
+    timer = setTimeout(() => {
+      try { process.kill(-child.pid, 'SIGKILL'); } catch (e) {}
+      settle({ exit: 124, stderr: `timed out after ${Math.round((timeout_ms || 300000) / 1000)}s` });
+    }, timeout_ms || 300000);
+    child.on('error', (e) => settle({ exit: 1, stderr: e.message }));
+    child.on('exit', (code, signal) => settle({ exit: code == null ? 1 : code, stderr: signal ? 'killed by ' + signal : '' }));
+    child.unref();
+  });
+};
+
+// Spawn utils/hotfix_prod.mjs against explicit WG hosts, DETACHED (see above), so a
+// pm2 file-watch restart of this orchestrator cannot kill an in-flight rollout.
+// hotfix_prod exits 1 if ANY host failed; that becomes ok:false, keeping stdout for
+// the summary either way.
+const _ops_run_hotfix = ({ hosts, modules, dry_run, timeout_ms }) => {
+  const args = [_HOTFIX_TOOL(), '--hosts', hosts.map((h) => h.ssh).join(','), ...(modules || []), ...(dry_run ? ['--dry-run'] : [])];
+  return _ops_run_node_detached({ args, timeout_ms });
 };
 
 // Pull hotfix_prod's human summary block + a tail for the UI.
@@ -7455,8 +7500,10 @@ setTimeout(async () => {
 // 10% monthly Stripe coupon, saves a NUMBERED draft issue to xuda_newsletter, and
 // emails a sample to ops (info@xuda.ai) + a superuser notification for review.
 // Nothing goes to subscribers until a superuser hits Publish in the dashboard
-// (newsletter_publish), which blasts to every preferences.newsletter_opt_in
-// account with a per-recipient unsubscribe link + List-Unsubscribe header.
+// (newsletter_publish), which blasts to every account that has NOT opted out
+// (preferences.newsletter_opt_in !== false, so a missing flag counts as opted
+// in), minus the xuda.network seed personas, with a per-recipient unsubscribe
+// link + List-Unsubscribe header. See _newsletter_blast for why both rules exist.
 // Opt-out flips the same flag the router /newsletter/unsubscribe route reads.
 // ============================================================================
 const NEWSLETTER_DB = 'xuda_newsletter';
@@ -8089,8 +8136,25 @@ const _newsletter_blast = async (issue, by_uid) => {
   const [pool, ppool] = await Promise.all([_nl_fashion_pool(), _nl_partner_pool()]);
   let sent = 0, failed = 0, total = 0;
   try {
-    const rret = await db_module.find_couch_query('xuda_accounts', { selector: { docType: 'account', stat: 3, 'preferences.newsletter_opt_in': true }, limit: 100000 }, true);
-    const recipients = rret.docs || [];
+    // Opt-in is OPT-OUT by design: the three signup surfaces stamp
+    // preferences.newsletter_opt_in=true, but every account created before the
+    // newsletter shipped has NO such field. Selecting on `=== true` therefore
+    // matched 1 of 456 accounts on master and the audience was silently empty
+    // (issue #4 reported "1 sent"). Treat a MISSING flag as opted in, and only
+    // an explicit false as opted out.
+    //
+    // EXCLUDE the xuda.network personas. They are seed accounts on
+    // @ambassadors.xuda.network / @mentors.xuda.network, domains with no mail
+    // service, so mailing them is 420 guaranteed hard bounces in one blast,
+    // which the bounce handler turns into 420 suspensions plus real damage to
+    // the sending reputation. `source` starts with xuda_network_ on every one of
+    // them and agrees with the address on all 420, so it is the reliable marker.
+    // Filtering here rather than in the Mango selector: it is a few hundred docs,
+    // and $ne against a MISSING field is exactly the semantic that caused this bug.
+    const rret = await db_module.find_couch_query('xuda_accounts', { selector: { docType: 'account', stat: 3 }, limit: 100000 }, true);
+    const recipients = (rret.docs || []).filter(
+      (a) => !String(a.source || '').startsWith('xuda_network_') && a.preferences?.newsletter_opt_in !== false,
+    );
     total = recipients.length;
     for (const acct of recipients) {
       const email = acct.account_info && acct.account_info.email;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.2298",
+  "version": "1.2.2299",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {