rollbridge 0.1.16 → 0.1.17

package/README.md

@@ -162,10 +162,13 @@ owns cleaning up on-disk release directories.
 releaseRetention: {keep: 5, maxAgeMs: 86400000}
 ```
 
-Set `statePath` to have the daemon persist its state to a file (active/draining
-releases, process pids, counters, recent events). On the next startup it reads
-any leftover file and reports managed processes still alive from a daemon that
-didn't shut down cleanly — advisory orphan detection. After a crash, run
+Set `statePath` to have the daemon persist secret-safe recovery state to a file
+(active/draining releases, process pids, counters, sanitized recent events).
+Commands, environment mappings, child command lines, and captured process output
+are deliberately excluded; those diagnostics remain available through the live
+status/log/event APIs. On the next startup Rollbridge reads any leftover file and
+reports managed processes still alive from a daemon that didn't shut down cleanly
+— advisory orphan detection. After a crash, run
 `rollbridge recover` to list those leftovers and `rollbridge recover --force` to
 stop them before restarting the daemon. A clean `shutdown` removes the file. See
 [`docs/config.md`](docs/config.md#statepath).

package/docs/config.md

@@ -90,10 +90,13 @@ release records; the deploy tool still owns on-disk release directories.
 
 ## `statePath`
 
-When set, the daemon persists a state snapshot — the active and draining
-releases, each managed process's metadata (including pid), restart counters, and
-recent events — to this file (atomically, on changes and every few seconds). On a
-clean `shutdown` the file is removed.
+When set, the daemon persists a secret-safe state snapshot — the active and
+draining releases, each managed process's recovery metadata (including pid),
+restart counters, and recent structured events — to this file (atomically, on
+changes and every few seconds). Process commands, working directories,
+environment mappings, child command lines, and retained stdout/stderr are never
+persisted. They remain available from the live `status`, `logs`, and `events`
+APIs while the daemon is running. On a clean `shutdown` the file is removed.
 
 On the **next startup**, the daemon reads any leftover file and reports managed
 processes whose pids are still alive — likely orphans from a daemon that crashed

package/docs/logging.md

@@ -36,6 +36,12 @@ events. It is distinct from the two in-memory views:
 - `rollbridge events` — the recent structured daemon event history (the most
   recent 1000 events), the same events written to the log file.
 
+When `statePath` is configured, its recovery snapshot is intentionally not a
+log archive: process commands, environment mappings, child command lines, and
+captured stdout/stderr are excluded. Use the live APIs above or the configured
+daemon log for those diagnostics, and protect that log according to the
+sensitivity of application output.
+
 Both are cleared when the daemon restarts; the log file persists.
 
 ## Rotation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/daemon.js

@@ -721,8 +721,9 @@ export default class RollbridgeDaemon {
     if (!this.statePath || this.stopping) return
 
     const statePath = this.statePath
-    const status = this.status()
-    const snapshot = {...status, events: this.eventLog.recent(), persistedAt: new Date().toISOString()}
+    const status = /** @type {Record<string, JsonValue>} */ (secretSafeStateValue(this.status()))
+    const events = secretSafeStateValue(this.eventLog.recent())
+    const snapshot = {...status, events, persistedAt: new Date().toISOString()}
 
     // Serialize writes (and track the tail) so shutdown can wait for an in-flight write before
     // clearing the file — otherwise a write started before shutdown could recreate it afterward.
@@ -851,6 +852,30 @@ function stringOrUndefined(value) {
   return value
 }
 
+const SECRET_BEARING_STATE_KEYS = new Set(["children", "command", "cwd", "env", "environment", "logs", "output"])
+
+/**
+ * Removes process definitions and captured output from a value before it reaches statePath.
+ * The live status/events APIs retain those diagnostics in memory; persistent state is only a
+ * secret-safe recovery aid and must not become a second process log or configuration store.
+ * @param {JsonValue} value - JSON value to sanitize.
+ * @returns {JsonValue} A secret-safe copy.
+ */
+function secretSafeStateValue(value) {
+  if (Array.isArray(value)) return value.map((entry) => secretSafeStateValue(entry))
+  if (!value || typeof value !== "object") return value
+
+  /** @type {Record<string, JsonValue>} */
+  const safe = {}
+
+  for (const [key, entry] of Object.entries(value)) {
+    if (SECRET_BEARING_STATE_KEYS.has(key)) continue
+    safe[key] = secretSafeStateValue(entry)
+  }
+
+  return safe
+}
+
 /**
  * @param {JsonValue} value - Value.
  * @param {string} key - Key.

package/test/daemon-bootstrap.test.js

@@ -20,6 +20,8 @@ test("daemon bootstrap requires complete, safe, absolute inputs before binding l
     {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1"], message: /must be provided together/},
     {args: ["--config", "relative/config.js", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "abc123"], message: /--config must be an absolute path/},
     {args: ["--config", "CONFIG", "--release-path", "relative/release", "--release-id", "v1", "--revision", "abc123"], message: /--release-path must be an absolute path/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE_UNNORMALIZED", "--release-id", "v1", "--revision", "abc123"], message: /--release-path must be normalized/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE_MISSING", "--release-id", "v1", "--revision", "abc123"], message: /--release-path is not accessible/},
     {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "unsafe id", "--revision", "abc123"], message: /--release-id/},
     {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "unsafe revision"], message: /--revision/}
   ]
@@ -27,7 +29,13 @@ test("daemon bootstrap requires complete, safe, absolute inputs before binding l
   for (const testCase of cases) {
     await t.test(testCase.message.source, async () => {
       const fixture = await createFixture()
-      const args = testCase.args.map((arg) => arg === "CONFIG" ? fixture.configPath : arg === "RELEASE" ? fixture.root : arg)
+      const args = testCase.args.map((arg) => {
+        if (arg === "CONFIG") return fixture.configPath
+        if (arg === "RELEASE") return fixture.root
+        if (arg === "RELEASE_UNNORMALIZED") return `${fixture.root}/child/..`
+        if (arg === "RELEASE_MISSING") return path.join(fixture.root, "missing")
+        return arg
+      })
 
       try {
         const result = await runDaemon(args)

package/test/managed-process.test.js

@@ -544,6 +544,10 @@ test("does not auto-restart when the restart policy is disabled (maxRestarts: 0)
 
 test("stops auto-restarting once maxRestarts within the window is reached", async () => {
   const managed = buildCrasher({backoffFactor: 1, maxDelayMs: 0, maxRestarts: 2, windowMs: 60000})
+  /** @type {{data: Record<string, import("../src/json.js").JsonValue>, message: string}[]} */
+  const events = []
+
+  managed.logger = (message, data = {}) => { events.push({data, message}) }
 
   try {
     await managed.start()
@@ -554,6 +558,11 @@ test("stops auto-restarting once maxRestarts within the window is reached", asyn
 
     assert.equal(managed.status().restarts, 2)
     assert.equal(managed.status().state, "failed")
+    assert.deepEqual(events.find((event) => event.message === "restart limit reached")?.data, {
+      id: "crasher",
+      maxRestarts: 2,
+      windowMs: 60000
+    })
   } finally {
     await managed.stop()
   }

package/test/rollbridge.test.js

@@ -8,11 +8,11 @@ import net from "node:net"
 import os from "node:os"
 import path from "node:path"
 import test from "node:test"
-import {fileURLToPath} from "node:url"
+import {fileURLToPath, pathToFileURL} from "node:url"
 import RollbridgeDaemon from "../src/daemon.js"
 import {normalizeConfig} from "../src/config.js"
 import {sendControlCommand} from "../src/control-client.js"
-import {readState, writeState} from "../src/state-store.js"
+import {liveProcesses, readState, writeState} from "../src/state-store.js"
 import {runCli} from "../src/cli.js"
 
 const currentDir = path.dirname(fileURLToPath(import.meta.url))
@@ -635,6 +635,37 @@ test("persists daemon state to statePath and removes it on a clean shutdown", as
   assert.equal(stateAfterShutdown, undefined, "state file removed on clean shutdown")
 })
 
+test("persisted daemon state excludes process commands, environment values, and output", async () => {
+  const secret = "state-secret-value"
+  const fixture = await createFixture({persistState: true})
+  const web = fixture.config.processes.find((processConfig) => processConfig.id === "web")
+
+  assert.ok(web)
+  web.env.ROLLBRIDGE_TEST_SECRET = secret
+  web.command = `${JSON.stringify(process.execPath)} -e ${JSON.stringify(`console.log(process.env.ROLLBRIDGE_TEST_SECRET); import(${JSON.stringify(pathToFileURL(dummyAppPath).href)})`)}`
+
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    await waitFor(() => Boolean(daemon.activeRelease?.getProcess("web")?.status().logs.some((entry) => entry.line === secret)))
+
+    daemon.persistState()
+    await waitFor(async () => (await fs.readFile(fixture.statePath, "utf8")).includes('"activeReleaseId": "v1"'))
+
+    const persisted = await fs.readFile(fixture.statePath, "utf8")
+
+    assert.doesNotMatch(persisted, /state-secret-value/)
+    assert.doesNotMatch(persisted, /ROLLBRIDGE_TEST_SECRET/)
+    assert.doesNotMatch(persisted, /"command"/)
+    assert.doesNotMatch(persisted, /"logs"/)
+    assert.deepEqual(liveProcesses(JSON.parse(persisted), () => true).map(({id, releaseId}) => ({id, releaseId})), [{id: "web", releaseId: "v1"}])
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
 test("a clean shutdown clears the state file even when a persist write is in flight", async () => {
   const fixture = await createFixture({persistState: true})
   const daemon = await startDaemon(fixture.config)