fhirsmith 0.9.7 → 0.10.1

package/CHANGELOG.md

@@ -6,6 +6,48 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [v0.10.1] - 2026-06-27
+
+### Fixed
+
+- Terminology: the version-less value set lookup now resolves to the latest version when several versions of the same value set are present (e.g. VSAC date versions), instead of an arbitrary one determined by database row order
+- Rendering: fixed value set links in `renderLinkComma` (read the resolver's `description`/`link` fields and fall back to the raw URI)
+
+### Tx Conformance Statement
+
+FHIRsmith passed all 2503 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed, tests v1.9.1, runner v6.9.11)
+
+## [v0.10.0] - 2026-06-27
+
+### Added
+
+- Publisher: track the IG Publisher version used for each task, and show it on the tasks list and task detail pages
+- Packages: new `POST /packages/update-package` endpoint to force-refresh specific packages in the registry, bypassing the feed crawler's de-duplication (used to push out a corrected package after a bad publish)
+- Publisher: automatically update SUSHI to the latest release before each draft build and publication run, installed into a FHIRsmith-owned prefix so it needs no root privileges
+
+### Changed
+
+- Rebuilt how caching works (see the tools IG for documentation)
+- Renamed the compare worker/operation
+
+### Fixed
+
+- Publisher: the publication run now verifies that the package about to be published is a real publication build (not a draft) before committing it to the web tree, so a failed publication build can no longer silently ship a `notForPublication` draft package
+- Packages: the crawler now rejects any package flagged `notForPublication` at ingest, instead of only checking the feed entry
+- Registry: better handling of versions on manual queries against the external registry
+- Fixed handling of the cache-control header
+- Corrections to generated test cases
+
+### Security
+
+- SSRF protection: outbound fetches in the packages and registry crawlers now reject any host that resolves to a non-public address (private, loopback, link-local including cloud-metadata, CGNAT, unique-local, etc.). Enforced at connection time, so it also covers redirect targets and DNS rebinding, and prevents leaking registry API keys to a redirected host
+- Path-injection hardening: local-file feed reads in the packages crawler are confined to explicitly-allowed directories; the `update-package` endpoint only accepts http(s) URLs
+- Dependency updates (npm audit)
+
+### Tx Conformance Statement
+
+FHIRsmith passed all 2503 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed, tests v1.9.1, runner v6.9.11)
+
 ## [v0.9.7] - 2026-06-12
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fhirsmith",
-  "version": "0.9.7",
+  "version": "0.10.1",
   "txVersion": "1.9.1",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",

package/packages/package-crawler.js

@@ -9,8 +9,27 @@ const {XMLParser} = require('fast-xml-parser');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
+const dns = require('dns');
+const http = require('http');
+const https = require('https');
+const ipaddr = require('ipaddr.js');
 const {debugLog} = require("../tx/operation-context");
 
+// True if an IP literal is anything other than a normal public (unicast) address:
+// loopback, private, link-local (incl. 169.254.169.254 cloud metadata), unique-local,
+// CGNAT, multicast, reserved, etc. IPv4-mapped IPv6 addresses are unwrapped first.
+function isNonPublicAddress(ip) {
+  try {
+    let addr = ipaddr.parse(ip);
+    if (addr.kind() === 'ipv6' && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    return addr.range() !== 'unicast';
+  } catch (e) {
+    return true; // unparseable - treat as unsafe
+  }
+}
+
 class PackageCrawler {
   log;
   packages = new Set();
@@ -139,10 +158,96 @@ class PackageCrawler {
     return url.replace(/^http:/, 'https:');
   }
 
+  // Roots under which local-file feed reads are permitted. Reading local files supports
+  // locally-configured feeds (e.g. for testing); allowed roots come from
+  // config.localFeedDirs, plus the directory of a local master feed url. Anything else
+  // is rejected so a third-party feed can't point a read at an arbitrary server file.
+  allowedLocalRoots() {
+    const roots = [];
+    const cfg = this.config && this.config.localFeedDirs;
+    if (Array.isArray(cfg)) {
+      roots.push(...cfg);
+    } else if (typeof cfg === 'string' && cfg.length > 0) {
+      roots.push(cfg);
+    }
+    if (this.config && typeof this.config.masterUrl === 'string' && this.config.masterUrl.startsWith('/')) {
+      roots.push(path.dirname(this.config.masterUrl));
+    }
+    return roots.map((r) => path.resolve(r));
+  }
+
+  // A DNS lookup wrapper that rejects any host resolving to a non-public address.
+  // Enforced at connection time (so it also covers redirect targets and defeats
+  // DNS-rebinding), this is the SSRF guard for all outbound http(s) fetches.
+  // Set config.allowPrivateAddresses = true to disable (e.g. for local test registries).
+  ssrfLookup() {
+    const allowPrivate = !!(this.config && this.config.allowPrivateAddresses);
+    return (hostname, options, callback) => {
+      if (typeof options === 'function') {
+        callback = options;
+        options = {};
+      }
+      const wantAll = !!(options && options.all);
+      dns.lookup(hostname, Object.assign({}, options, { all: true }), (err, addresses) => {
+        if (err) {
+          callback(err);
+          return;
+        }
+        if (!allowPrivate) {
+          for (const a of addresses) {
+            if (isNonPublicAddress(a.address)) {
+              callback(new Error('Blocked request to non-public address ' + a.address + ' (host ' + hostname + ')'));
+              return;
+            }
+          }
+        }
+        if (wantAll) {
+          callback(null, addresses);
+        } else {
+          callback(null, addresses[0].address, addresses[0].family);
+        }
+      });
+    };
+  }
+
+  // http/https agents that route every connection through the SSRF lookup. Cached so
+  // connections can be pooled across requests.
+  guardedAgents() {
+    if (!this._guardedAgents) {
+      const lookup = this.ssrfLookup();
+      class GuardedHttpAgent extends http.Agent {
+        createConnection(options, cb) {
+          return super.createConnection(Object.assign({}, options, { lookup }), cb);
+        }
+      }
+      class GuardedHttpsAgent extends https.Agent {
+        createConnection(options, cb) {
+          return super.createConnection(Object.assign({}, options, { lookup }), cb);
+        }
+      }
+      this._guardedAgents = {
+        httpAgent: new GuardedHttpAgent({ keepAlive: true }),
+        httpsAgent: new GuardedHttpsAgent({ keepAlive: true })
+      };
+    }
+    return this._guardedAgents;
+  }
+
+  // Resolve a local feed path and confine it to an allowed root (path-injection guard).
+  resolveLocalReadPath(url) {
+    const resolved = path.resolve(url);
+    const roots = this.allowedLocalRoots();
+    const allowed = roots.some((root) => resolved === root || resolved.startsWith(root + path.sep));
+    if (!allowed) {
+      throw new Error('Refusing to read local file outside the allowed feed directories: ' + url);
+    }
+    return resolved;
+  }
+
   async fetchJson(url) {
     try {
       if (url.startsWith("/")) {
-        const content = await fs.promises.readFile(url, "utf8");
+        const content = await fs.promises.readFile(this.resolveLocalReadPath(url), "utf8");
         return JSON.parse(content);
       } else {
         const response = await axios.get(url, {
@@ -150,7 +255,9 @@ class PackageCrawler {
           signal: this.abortController?.signal,
           headers: {
             'User-Agent': 'FHIR Package Crawler/1.0'
-          }
+          },
+          httpAgent: this.guardedAgents().httpAgent,
+          httpsAgent: this.guardedAgents().httpsAgent
         });
         return response.data;
       }
@@ -166,7 +273,7 @@ class PackageCrawler {
   async fetchXml(url) {
     try {
       if (url.startsWith("/")) {
-        const content = await fs.promises.readFile(url, 'utf8');
+        const content = await fs.promises.readFile(this.resolveLocalReadPath(url), 'utf8');
         const parser = new XMLParser({
           ignoreAttributes: false,
           attributeNamePrefix: '@_',
@@ -180,7 +287,9 @@ class PackageCrawler {
           signal: this.abortController?.signal,
           headers: {
             'User-Agent': 'FHIR Package Crawler/1.0'
-          }
+          },
+          httpAgent: this.guardedAgents().httpAgent,
+          httpsAgent: this.guardedAgents().httpsAgent
         });
 
         const parser = new XMLParser({
@@ -203,7 +312,7 @@ class PackageCrawler {
   async fetchUrl(url) {
     try {
       if (url.startsWith("/")) {
-        const buffer = await fs.promises.readFile(url);
+        const buffer = await fs.promises.readFile(this.resolveLocalReadPath(url));
         this.totalBytes += buffer.byteLength;
         return buffer;
       } else {
@@ -213,7 +322,9 @@ class PackageCrawler {
           signal: this.abortController?.signal,
           headers: {
             'User-Agent': 'FHIR Package Crawler/1.0'
-          }
+          },
+          httpAgent: this.guardedAgents().httpAgent,
+          httpsAgent: this.guardedAgents().httpsAgent
         });
 
         this.totalBytes += response.data.byteLength;
@@ -558,6 +669,12 @@ class PackageCrawler {
       if (npmPackage.hasJavaScript && !isTemplate && id !== 'hl7.fhir.pubpack') {
         throw new Error(`Package ${idver} rejected: contains JavaScript files but is not a template package`);
       }
+      // The feed gate (item.notForPublication) only sees the RSS entry. A package whose
+      // feed entry is clean can still carry notForPublication inside the tarball - that is
+      // a draft build that must never enter the registry. Reject it here too.
+      if (npmPackage.notForPublication) {
+        throw new Error(`Package ${idver} rejected: tarball is flagged notForPublication (draft build, not suitable for publication)`);
+      }
 
       // Extract URLs from package
       const urls = this.processPackageUrls(npmPackage);

package/packages/packages.js

@@ -592,6 +592,64 @@ class PackagesModule {
     }
   }
 
+  // Re-fetch a single package tarball and replace whatever is stored for it, bypassing
+  // the crawler's GUID dedup and notForPublication feed gate. Used to push out a
+  // corrected package that was already (mis)published.
+  async forceUpdatePackage(link) {
+    // Only allow fetching over http(s). This endpoint must never be usable to read
+    // local server files (path injection) - tarballs are always published web URLs.
+    if (!link || !/^https?:\/\//i.test(link)) {
+      throw new Error('Invalid package link (must be an http(s) URL): ' + link);
+    }
+    if (!this.crawler) {
+      this.crawler = new PackageCrawler(this.config, this.db, this.stats);
+    }
+
+    // The feed uses the versioned package.tgz url as the (permalink) GUID, so reusing
+    // the link as the GUID keeps a later crawl from inserting a duplicate.
+    const guid = link;
+
+    const buffer = await this.crawler.fetchUrl(link);
+    const npm = await this.crawler.extractNpmPackage(buffer, link);
+
+    // Refuse to re-store a still-broken package - that would just re-publish the bug.
+    if (npm.notForPublication) {
+      throw new Error('Refusing to store ' + npm.id + '#' + npm.version + ': fetched tarball is still flagged notForPublication');
+    }
+
+    const idver = npm.id + '#' + npm.version;
+    const replaced = await this.deleteVersionsByGuid(guid);
+
+    const itemLog = { status: '??' };
+    await this.crawler.store(link, link, guid, new Date(), buffer, idver, itemLog);
+
+    pckLog.info('Force-updated ' + idver + ' from ' + link + ' (replaced ' + replaced + ' existing row(s))');
+    return { status: 'updated', id: npm.id, version: npm.version, replaced };
+  }
+
+  // Delete a stored package version and all of its child rows, by GUID.
+  deleteVersionsByGuid(guid) {
+    return new Promise((resolve, reject) => {
+      this.db.all('SELECT PackageVersionKey FROM PackageVersions WHERE GUID = ?', [guid], (err, rows) => {
+        if (err) return reject(err);
+        const keys = (rows || []).map(r => r.PackageVersionKey);
+        if (keys.length === 0) return resolve(0);
+        const ph = keys.map(() => '?').join(',');
+        const stmts = [
+          'DELETE FROM PackageFHIRVersions WHERE PackageVersionKey IN (' + ph + ')',
+          'DELETE FROM PackageDependencies WHERE PackageVersionKey IN (' + ph + ')',
+          'DELETE FROM PackageURLs WHERE PackageVersionKey IN (' + ph + ')',
+          'DELETE FROM PackageVersions WHERE PackageVersionKey IN (' + ph + ')'
+        ];
+        const runNext = (i) => {
+          if (i >= stmts.length) return resolve(keys.length);
+          this.db.run(stmts[i], keys, (e) => e ? reject(e) : runNext(i + 1));
+        };
+        runNext(0);
+      });
+    });
+  }
+
   async initializeDatabase() {
     return new Promise((resolve, reject) => {
       // Use config path if absolute, otherwise resolve relative to data dir
@@ -1223,6 +1281,52 @@ class PackagesModule {
       }
     });
 
+    // Force-refresh specific packages, bypassing the feed. The crawler only fetches a
+    // package once (it dedupes on the feed GUID) and skips anything flagged
+    // notForPublication, so there is normally no way to make it re-pick-up a package
+    // that was published incorrectly and later corrected. This endpoint re-fetches the
+    // tarball(s) directly and replaces whatever is stored.
+    //
+    //   POST /update-package   { "links": ["http://hl7.org/fhir/uv/ips/2.0.1/package.tgz", ...] }
+    //
+    // The link is the versioned package.tgz url, which is exactly the GUID the feed uses,
+    // so the replacement keeps the same GUID and a later crawl won't create a duplicate.
+    // If config.updateToken is set, the request must carry it in the x-update-token header.
+    this.router.post('/update-package', async (req, res) => {
+      const start = Date.now();
+      try {
+        if (this.config.updateToken && req.headers['x-update-token'] !== this.config.updateToken) {
+          res.status(403).json({ error: 'forbidden: missing or invalid x-update-token' });
+          return;
+        }
+        let links = req.body && (req.body.links || req.body.packages || (req.body.url ? [req.body.url] : (req.body.link ? [req.body.link] : null)));
+        if (typeof links === 'string') links = [links];
+        if (!Array.isArray(links) || links.length === 0) {
+          res.status(400).json({ error: 'Provide a JSON body like {"links": ["<package.tgz url>", ...]}' });
+          return;
+        }
+        const results = [];
+        for (const link of links) {
+          try {
+            results.push(Object.assign({ link }, await this.forceUpdatePackage(link)));
+          } catch (e) {
+            pckLog.error('Force update failed for ' + link + ': ' + e.message);
+            results.push({ link, status: 'error', error: e.message });
+          }
+        }
+        const failed = results.filter(r => r.status === 'error').length;
+        res.status(failed === results.length ? 500 : 200).json({
+          message: 'Processed ' + results.length + ' package(s), ' + failed + ' failed',
+          results
+        });
+      } catch (error) {
+        pckLog.error('update-package endpoint failed:', error);
+        res.status(500).json({ error: 'update-package failed', message: error.message });
+      } finally {
+        this.stats.countRequest('update-package', Date.now() - start);
+      }
+    });
+
     // Crawler statistics endpoint (existing)
     this.router.get('/stats', async (req, res) => {
       const start = Date.now();

package/publisher/publisher.js

@@ -200,6 +200,17 @@ class PublisherModule {
         });
       });
     }
+    if (!columnNames.includes('publisher_version')) {
+      await new Promise((resolve, reject) => {
+        this.db.run('ALTER TABLE tasks ADD COLUMN publisher_version TEXT', (err) => {
+          if (err) reject(err);
+          else {
+            this.logger.info('Migration: added publisher_version column to tasks table');
+            resolve();
+          }
+        });
+      });
+    }
     const websiteColumns = await new Promise((resolve, reject) => {
       this.db.all("PRAGMA table_info(websites)", (err, rows) => {
         if (err) reject(err);
@@ -542,6 +553,11 @@ class PublisherModule {
     // Step 3: Clone GitHub repository
     await this.cloneRepository(task, draftDir);
 
+    // Step 3b: Update SUSHI to the latest release. The IG Publisher runs SUSHI with
+    // --require-latest, so a SUSHI that has fallen behind npm's latest makes the build
+    // fail. Refreshing it here keeps draft builds working.
+    await this.ensureLatestSushi(task.id);
+
     // Step 4: Run IG publisher
     await this.runIGPublisher(publisherJar, draftDir, logFile, task.id);
 
@@ -578,6 +594,16 @@ class PublisherModule {
         throw new Error('Could not find publisher.jar in latest release');
       }
 
+      // Record which IG Publisher version this task is using. The same jar is reused
+      // for the publication run, so this is the version that produced the output.
+      const publisherVersion = releaseResponse.data.tag_name || releaseResponse.data.name || 'unknown';
+      try {
+        await this.updateTaskFields(taskId, { publisher_version: publisherVersion });
+      } catch (e) {
+        this.logger.warn('Failed to record publisher_version for task ' + taskId + ': ' + e.message);
+      }
+      await this.logTaskMessage(taskId, 'info', 'Using IG Publisher version ' + publisherVersion);
+
       await this.logTaskMessage(taskId, 'info', 'Downloading from: ' + downloadUrl);
 
       // Download the file
@@ -603,6 +629,62 @@ class PublisherModule {
     }
   }
 
+  // Directory holding FHIRsmith's own copy of SUSHI. Installing here (rather than -g)
+  // needs no root: on the server the global npm prefix (/usr) is root-owned.
+  sushiDir() {
+    return folders.filePath('publisher', 'sushi');
+  }
+
+  // Environment for spawning the IG Publisher so it finds our managed SUSHI on PATH.
+  // The publisher resolves the `sushi` command from PATH, so prepending our bin dir
+  // makes it use the version we just installed.
+  publisherEnv() {
+    const binDir = path.join(this.sushiDir(), 'bin');
+    return Object.assign({}, process.env, {
+      PATH: binDir + path.delimiter + (process.env.PATH || '')
+    });
+  }
+
+  // Update FHIRsmith's managed SUSHI to the latest npm release before a run. The IG
+  // Publisher invokes SUSHI with --require-latest, so a SUSHI that has fallen behind
+  // npm's latest makes the build abort. We install into a FHIRsmith-owned prefix
+  // (sushiDir) to avoid needing root for a global install, and the publisher picks it
+  // up via publisherEnv(). Best-effort: a failure is logged but not fatal - the
+  // corrected runBuild check in the IG Publisher now turns a stale SUSHI into a loud
+  // publication failure rather than a silently-published draft.
+  async ensureLatestSushi(taskId) {
+    const { spawn } = require('child_process');
+    const dir = this.sushiDir();
+    fs.mkdirSync(dir, { recursive: true });
+    await this.logTaskMessage(taskId, 'info', 'Ensuring SUSHI is up to date in ' + dir + ' ...');
+    await new Promise((resolve) => {
+      // -g with --prefix makes npm treat `dir` as the global prefix, so the binary
+      // lands at dir/bin/sushi (a FHIRsmith-owned, writable location).
+      const npm = spawn('npm', ['install', '-g', 'fsh-sushi@latest', '--prefix', dir], { stdio: ['ignore', 'pipe', 'pipe'] });
+      let err = '';
+      npm.stdout.on('data', () => { /* ignore */ });
+      npm.stderr.on('data', (d) => { err += d.toString(); });
+      npm.on('error', async (e) => {
+        await this.logTaskMessage(taskId, 'warn', 'Could not run npm to update SUSHI: ' + e.message);
+        resolve();
+      });
+      npm.on('close', async (code) => {
+        if (code === 0) {
+          let version = '';
+          try {
+            version = require('child_process').execSync('sushi --version', { env: this.publisherEnv(), encoding: 'utf8' }).trim();
+          } catch (e) {
+            version = '(version check failed)';
+          }
+          await this.logTaskMessage(taskId, 'info', 'SUSHI is up to date: ' + version);
+        } else {
+          await this.logTaskMessage(taskId, 'warn', 'SUSHI update exited with code ' + code + (err ? ': ' + err.trim().slice(-400) : ''));
+        }
+        resolve();
+      });
+    });
+  }
+
   async cloneRepository(task, draftDir) {
     const { spawn } = require('child_process');
     const gitUrl = 'https://github.com/' + task.github_org + '/' + task.github_repo + '.git';
@@ -658,7 +740,8 @@ class PublisherModule {
         '.'
       ], {
         cwd: draftDir,
-        stdio: ['pipe', 'pipe', 'pipe']
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: this.publisherEnv()
       });
 
       // Create log file stream
@@ -684,7 +767,7 @@ class PublisherModule {
         const elapsedMs = Date.now() - buildStart;
         const sinceDataMs = Date.now() - lastDataAt;
         let logKb = 0;
-        try { logKb = Math.round(fs.statSync(logFile).size / 1024); } catch (_) {}
+        try { logKb = Math.round(fs.statSync(logFile).size / 1024); } catch (_) { /* log file not created yet */ }
         const elapsedMin = Math.floor(elapsedMs / 60000);
         const elapsedSec = Math.floor(elapsedMs / 1000) % 60;
         const idleSec = Math.floor(sinceDataMs / 1000);
@@ -760,6 +843,91 @@ class PublisherModule {
     await this.logTaskMessage(task.id, 'info', 'Build output verified: package-id=' + qaData['package-id'] + ', version=' + qaData['ig-ver']);
   }
 
+  // Read package/package.json out of a .tgz without unpacking the whole archive.
+  inspectPackageTgz(tgzPath) {
+    const { spawn } = require('child_process');
+    return new Promise((resolve, reject) => {
+      const tar = spawn('tar', ['-xzOf', tgzPath, 'package/package.json']);
+      let out = '';
+      let err = '';
+      tar.stdout.on('data', (d) => { out += d.toString(); });
+      tar.stderr.on('data', (d) => { err += d.toString(); });
+      tar.on('error', reject);
+      tar.on('close', (code) => {
+        if (code !== 0) {
+          reject(new Error('Could not read ' + tgzPath + ': ' + (err.trim() || ('tar exit ' + code))));
+        } else {
+          try {
+            resolve(JSON.parse(out));
+          } catch (e) {
+            reject(new Error('Invalid package.json in ' + tgzPath + ': ' + e.message));
+          }
+        }
+      });
+    });
+  }
+
+  // Confirm the package.tgz files that landed in the web tree are publication builds,
+  // not the draft. Throws (failing the task) if a draft package was published.
+  async verifyPublishedPackage(task, website, draftDir) {
+    await this.logTaskMessage(task.id, 'info', 'Verifying published package(s) are publication builds...');
+
+    // The intended publication path comes from the IG's publication-request.json.
+    const prPath = path.join(draftDir, 'publication-request.json');
+    if (!fs.existsSync(prPath)) {
+      await this.logTaskMessage(task.id, 'warn', 'No publication-request.json found at ' + prPath + ' - skipping published-package check');
+      return;
+    }
+    const pr = JSON.parse(fs.readFileSync(prPath, 'utf8'));
+    const pubPath = pr.path;
+
+    // The website base url lets us map a canonical url to a folder in the web tree.
+    const setupPath = path.join(website.local_folder, 'publish-setup.json');
+    if (!pubPath || !fs.existsSync(setupPath)) {
+      await this.logTaskMessage(task.id, 'warn', 'Cannot resolve web path (path or publish-setup.json missing) - skipping published-package check');
+      return;
+    }
+    const setup = JSON.parse(fs.readFileSync(setupPath, 'utf8'));
+    const baseUrl = setup.website && setup.website.url;
+    if (!baseUrl || !pubPath.startsWith(baseUrl)) {
+      await this.logTaskMessage(task.id, 'warn', 'Publication path ' + pubPath + ' is not under website url ' + baseUrl + ' - skipping published-package check');
+      return;
+    }
+
+    const relVer = pubPath.substring(baseUrl.length).replace(/^\/+/, '');
+    const relCur = relVer.replace(/\/[^/]+\/?$/, ''); // strip the version segment for the "current" copy
+    const candidates = [
+      path.join(website.local_folder, relVer, 'package.tgz'),
+      path.join(website.local_folder, relCur, 'package.tgz')
+    ];
+
+    let checked = 0;
+    for (const pkgPath of candidates) {
+      if (!fs.existsSync(pkgPath)) {
+        continue;
+      }
+      checked++;
+      const json = await this.inspectPackageTgz(pkgPath);
+      const problems = [];
+      if (json.notForPublication) {
+        problems.push('notForPublication is set');
+      }
+      if (typeof json.url === 'string' && json.url.startsWith('file:')) {
+        problems.push('url is a local file path (' + json.url + ')');
+      }
+      if (problems.length > 0) {
+        throw new Error('Published package ' + pkgPath + ' is a draft build, not a publication build (' +
+            problems.join('; ') + '). The IG Publisher publication run likely skipped package ' +
+            'regeneration (e.g. a Jekyll/template failure). Not committing.');
+      }
+      await this.logTaskMessage(task.id, 'info', 'Verified publication package: ' + pkgPath);
+    }
+
+    if (checked === 0) {
+      await this.logTaskMessage(task.id, 'warn', 'No published package.tgz found to verify under ' + relVer + ' or ' + relCur);
+    }
+  }
+
   async runPublication(task) {
     const website = await this.getWebsite(task.website_id);
     if (!website) {
@@ -824,6 +992,12 @@ class PublisherModule {
     // Step 3: Pull latest web folder before publishing into it
     await this.runCommand('git', ['pull'], { cwd: website.git_root }, task.id, 'Pulling latest web folder');
 
+    // Step 3b: Update SUSHI to the latest release before the publication run. This is the
+    // step that previously failed silently: the publication build runs SUSHI with
+    // --require-latest, and a draft approved days earlier may now face a newer SUSHI on
+    // npm. Refresh it so the publication build doesn't abort on a version mismatch.
+    await this.ensureLatestSushi(task.id);
+
     // Step 4: Run the IG publisher in go-publish mode
     await this.runPublisherGoPublish(task.id, publisherJar, draftDir, website.local_folder,
         registryDir, historyDir, templatesDir, zipsDir, publishLogFile);
@@ -836,6 +1010,12 @@ class PublisherModule {
     }
     await this.logTaskMessage(task.id, 'info', 'Publication run verified: ' + pubLogName + ' found');
 
+    // Step 5b: Verify the published package is actually a publication build.
+    // If the IG Publisher's publication run skipped package regeneration (e.g. a Jekyll
+    // or template failure), the draft package - flagged notForPublication with a file://
+    // url - can survive into the web tree. Catch that here, before anything is committed.
+    await this.verifyPublishedPackage(task, website, draftDir);
+
     // Step 6: Commit and push the web folder
     await this.logTaskMessage(task.id, 'info', 'Committing changes to web folder...');
     const gitUrl = 'https://github.com/' + task.github_org + '/' + task.github_repo + '.git';
@@ -892,7 +1072,8 @@ class PublisherModule {
 
     return new Promise((resolve, reject) => {
       const java = spawn('java', args, {
-        stdio: ['pipe', 'pipe', 'pipe']
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: this.publisherEnv()
       });
 
       const logStream = fs.createWriteStream(logFile);
@@ -916,7 +1097,7 @@ class PublisherModule {
         const elapsedMs = Date.now() - buildStart;
         const sinceDataMs = Date.now() - lastDataAt;
         let logKb = 0;
-        try { logKb = Math.round(fs.statSync(logFile).size / 1024); } catch (_) {}
+        try { logKb = Math.round(fs.statSync(logFile).size / 1024); } catch (_) { /* log file not created yet */ }
         const elapsedMin = Math.floor(elapsedMs / 60000);
         const elapsedSec = Math.floor(elapsedMs / 1000) % 60;
         const idleSec = Math.floor(sinceDataMs / 1000);
@@ -1217,7 +1398,7 @@ class PublisherModule {
         } else {
           content += '<div class="table-responsive">';
           content += '<table class="table table-striped">';
-          content += '<thead><tr><th>ID</th><th>Package</th><th>Version</th><th>Website</th><th>Status</th><th>Queued</th><th>User</th><th>Actions</th></tr></thead>';
+          content += '<thead><tr><th>ID</th><th>Package</th><th>Version</th><th>Website</th><th>Status</th><th>IG Publisher</th><th>Queued</th><th>User</th><th>Actions</th></tr></thead>';
           content += '<tbody>';
 
           for (const task of tasks) {
@@ -1238,6 +1419,7 @@ class PublisherModule {
             content += '<td>' + task.version + '</td>';
             content += '<td>' + task.website_name + '</td>';
             content += '<td><span class="badge bg-' + this.getStatusColor(task.status) + '">' + task.status + '</span></td>';
+            content += '<td>' + (task.publisher_version ? '<code>' + escape(task.publisher_version) + '</code>' : '<span class="text-muted">—</span>') + '</td>';
             content += '<td>' + new Date(task.queued_at).toLocaleString() + '</td>';
             content += '<td>' + task.user_name + '</td>';
             content += '<td class="task-actions">';
@@ -1542,6 +1724,10 @@ class PublisherModule {
           content += '<p><strong>Status:</strong> <span class="badge bg-' + this.getStatusColor(task.status) + '">' + task.status + '</span></p>';
           content += '<p><strong>GitHub:</strong> ' + task.github_org + '/' + task.github_repo + ' (' + task.git_branch + ')</p>';
 
+          if (task.publisher_version) {
+            content += '<p><strong>IG Publisher:</strong> <code>' + escape(task.publisher_version) + '</code></p>';
+          }
+
           if (task.local_folder) {
             content += '<p><strong>Local Folder:</strong> <code>' + task.local_folder + '</code></p>';
           }