rollbridge 0.1.16 → 0.1.18

package/README.md

@@ -162,10 +162,13 @@ owns cleaning up on-disk release directories.
 releaseRetention: {keep: 5, maxAgeMs: 86400000}
 ```
 
-Set `statePath` to have the daemon persist its state to a file (active/draining
-releases, process pids, counters, recent events). On the next startup it reads
-any leftover file and reports managed processes still alive from a daemon that
-didn't shut down cleanly — advisory orphan detection. After a crash, run
+Set `statePath` to have the daemon persist secret-safe recovery state to a file
+(active/draining releases, process pids, counters, sanitized recent events).
+Commands, environment mappings, child command lines, and captured process output
+are deliberately excluded; those diagnostics remain available through the live
+status/log/event APIs. On the next startup Rollbridge reads any leftover file and
+reports managed processes still alive from a daemon that didn't shut down cleanly
+— advisory orphan detection. After a crash, run
 `rollbridge recover` to list those leftovers and `rollbridge recover --force` to
 stop them before restarting the daemon. A clean `shutdown` removes the file. See
 [`docs/config.md`](docs/config.md#statepath).
@@ -405,7 +408,8 @@ the foreground (for example from a boot-time service manager):
 ```bash
 rollbridge daemon --config /srv/ticket-server/rollbridge.js \
   --release-path /srv/ticket-server/releases/20260813090000/ticket-server \
-  --release-id 20260813090000 --revision abc123
+  --release-id 20260813090000 --revision abc123 \
+  --boot-attestation sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
 ```
 
 The four bootstrap inputs are all-or-nothing and use absolute config/release
@@ -416,6 +420,14 @@ persisted processes from a previous daemon are reported as orphans and are never
 recovered or killed implicitly; their live PID records remain in `statePath` for
 explicit recovery.
 
+External supervisors may add `--boot-attestation` with exactly `sha256:` plus
+64 lowercase hexadecimal characters. After successful activation, `rollbridge
+status` echoes the opaque, non-secret value under `bootstrap.attestation`
+alongside the exact release id/path/revision. Listener-only and detached ensured
+daemons omit `bootstrap`, so a supervisor can distinguish a newly accepted
+foreground owner from a stale daemon without Rollbridge interpreting the token.
+See [`docs/cli.md`](docs/cli.md#daemon) for the complete contract.
+
 Start the daemon only when it is not already running:
 
 ```bash

package/docs/cli.md

@@ -24,7 +24,8 @@ process-policy details.
 
 ```
 rollbridge daemon [--config <path>]
-                  [--release-path <path> --release-id <id> --revision <sha>]
+                  [--release-path <path> --release-id <id> --revision <sha>
+                   [--boot-attestation <sha256:digest>]]
 ```
 
 Runs the supervisor in the foreground: binds the stable proxy port and the
@@ -53,6 +54,13 @@ release. `statePath` entries from a previous daemon remain advisory orphans:
 bootstrap never runs recovery and never signals those processes, and retains
 their live PID records in `statePath` for explicit recovery.
 
+`--boot-attestation` is an optional, non-secret opaque ownership token for an
+external supervisor. Its canonical format is exactly `sha256:` followed by 64
+lowercase hexadecimal characters. It is accepted only with the complete
+known-release bootstrap tuple above and is never accepted by `ensure-daemon`.
+After successful activation, `status` echoes it unchanged in the bootstrap
+identity. Rollbridge does not calculate or interpret the digest.
+
 With no release options, daemon behavior is unchanged: it starts listener-only
 and waits for control-socket deployments.
 
@@ -174,6 +182,24 @@ Memory-supervised processes also report `rssBytes`, `memoryRestarts`,
 its runtime `format`, package `version`, content `digest`, and absolute `path`.
 `ensure-daemon` uses this attestation before reusing a responsive daemon.
 
+A foreground known-release daemon also reports the exact CLI bootstrap identity:
+
+```json
+{
+  "bootstrap": {
+    "releaseId": "20260813090000",
+    "releasePath": "/srv/app/releases/20260813090000/app",
+    "revision": "abc123",
+    "attestation": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+  }
+}
+```
+
+`attestation` is omitted when the optional argument was not supplied. Ordinary
+listener-only daemons and detached daemons created by `ensure-daemon` omit the
+entire `bootstrap` object. External supervisors can therefore distinguish two
+otherwise identical foreground boots by comparing the opaque attestation.
+
 When [`statePath`](config.md#statepath) is configured, status also includes an
 `orphans` array: managed processes from a **previous** daemon that are still
 alive (`id`, `pid`, `releaseId`) — for example after the daemon restarted but its

package/docs/config.md

@@ -90,10 +90,13 @@ release records; the deploy tool still owns on-disk release directories.
 
 ## `statePath`
 
-When set, the daemon persists a state snapshot — the active and draining
-releases, each managed process's metadata (including pid), restart counters, and
-recent events — to this file (atomically, on changes and every few seconds). On a
-clean `shutdown` the file is removed.
+When set, the daemon persists a secret-safe state snapshot — the active and
+draining releases, each managed process's recovery metadata (including pid),
+restart counters, and recent structured events — to this file (atomically, on
+changes and every few seconds). Process commands, working directories,
+environment mappings, child command lines, and retained stdout/stderr are never
+persisted. They remain available from the live `status`, `logs`, and `events`
+APIs while the daemon is running. On a clean `shutdown` the file is removed.
 
 On the **next startup**, the daemon reads any leftover file and reports managed
 processes whose pids are still alive — likely orphans from a daemon that crashed

package/docs/logging.md

@@ -36,6 +36,12 @@ events. It is distinct from the two in-memory views:
 - `rollbridge events` — the recent structured daemon event history (the most
   recent 1000 events), the same events written to the log file.
 
+When `statePath` is configured, its recovery snapshot is intentionally not a
+log archive: process commands, environment mappings, child command lines, and
+captured stdout/stderr are excluded. Use the live APIs above or the configured
+daemon log for those diagnostics, and protect that log according to the
+sensitivity of application output.
+
 Both are cleared when the daemon restarts; the log file persists.
 
 ## Rotation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/cli.js

@@ -35,12 +35,13 @@ export async function runCli(argv) {
     .option("--release-path <path>", "Bootstrap release path (requires --config, --release-id, and --revision)")
     .option("--release-id <id>", "Bootstrap release id (requires --config, --release-path, and --revision)")
     .option("--revision <sha>", "Bootstrap revision (requires --config, --release-path, and --release-id)")
+    .option("--boot-attestation <digest>", "Opaque bootstrap ownership attestation (requires the complete bootstrap release tuple)")
     .action(async (options) => {
       const bootstrap = await validateDaemonBootstrapOptions(options)
       const configPath = await resolveConfigPath(options.config)
       const config = await loadConfig(configPath)
       const runtime = await loadDaemonRuntimeIdentity(process.env.ROLLBRIDGE_DAEMON_RUNTIME_MANIFEST)
-      const daemon = new RollbridgeDaemon({config, configPath, runtime})
+      const daemon = new RollbridgeDaemon({bootstrap, config, configPath, runtime})
 
       await daemon.start({exposeControl: !bootstrap})
 
@@ -720,13 +721,17 @@ async function validateConfigFile(configPath) {
 /**
  * Validates the daemon's optional all-or-nothing bootstrap release interface before
  * config loading or listener startup.
- * @param {{config?: string, releaseId?: string, releasePath?: string, revision?: string}} options - Daemon CLI options.
- * @returns {Promise<{releaseId: string, releasePath: string, revision: string} | undefined>} Validated bootstrap metadata.
+ * @param {{bootAttestation?: string, config?: string, releaseId?: string, releasePath?: string, revision?: string}} options - Daemon CLI options.
+ * @returns {Promise<{attestation?: string, releaseId: string, releasePath: string, revision: string} | undefined>} Validated bootstrap metadata.
  */
 async function validateDaemonBootstrapOptions(options) {
   const bootstrapValues = [options.releasePath, options.releaseId, options.revision]
   const bootstrapRequested = bootstrapValues.some((value) => value !== undefined)
 
+  if (options.bootAttestation !== undefined && !bootstrapRequested) {
+    throw new Error("Daemon --boot-attestation is accepted only with --config, --release-path, --release-id, and --revision.")
+  }
+
   if (!bootstrapRequested) return undefined
 
   if (!options.config || bootstrapValues.some((value) => value === undefined)) {
@@ -744,6 +749,7 @@ async function validateDaemonBootstrapOptions(options) {
 
   if (!safeIdentifier.test(releaseId)) throw new Error("Daemon bootstrap --release-id must be a non-empty safe identifier containing only letters, numbers, dots, underscores, and hyphens.")
   if (!safeIdentifier.test(revision)) throw new Error("Daemon bootstrap --revision must be a non-empty safe identifier containing only letters, numbers, dots, underscores, and hyphens.")
+  if (options.bootAttestation !== undefined && !/^sha256:[a-f0-9]{64}$/.test(options.bootAttestation)) throw new Error("Daemon bootstrap --boot-attestation must use the canonical sha256:<64 lowercase hex> format.")
 
   let releaseStat
 
@@ -757,7 +763,7 @@ async function validateDaemonBootstrapOptions(options) {
 
   if (!releaseStat.isDirectory()) throw new Error("Daemon bootstrap --release-path must name a directory.")
 
-  return {releaseId, releasePath: /** @type {string} */ (options.releasePath), revision}
+  return {attestation: options.bootAttestation, releaseId, releasePath: /** @type {string} */ (options.releasePath), revision}
 }
 
 /**

package/src/daemon.js

@@ -17,19 +17,22 @@ const STATE_PERSIST_INTERVAL_MS = 5000
 /**
  * @typedef {import("./json.js").JsonValue} JsonValue
  * @typedef {{releaseId?: string, releasePath: string, revision?: string}} DeployArgs
+ * @typedef {{attestation?: string, releaseId: string, releasePath: string, revision: string}} BootstrapIdentity
  * @typedef {{id: string, process: import("./managed-process.js").ManagedProcessStatus}} ProcessStatus
- * @typedef {{activeReleaseId: string | null, application: string, control: import("./config.js").ControlConfig, daemonRuntime: import("./daemon-runtime.js").DaemonRuntimeIdentity | undefined, orphans: {id: string, pid: number, releaseId: string | null}[], proxy: {host: string, port: number | undefined, upstreamHost: string}, releases: import("./release-group.js").ReleaseStatus[], services: ProcessStatus[], singletons: ProcessStatus[]}} DaemonStatus
+ * @typedef {{activeReleaseId: string | null, application: string, bootstrap: BootstrapIdentity | undefined, control: import("./config.js").ControlConfig, daemonRuntime: import("./daemon-runtime.js").DaemonRuntimeIdentity | undefined, orphans: {id: string, pid: number, releaseId: string | null}[], proxy: {host: string, port: number | undefined, upstreamHost: string}, releases: import("./release-group.js").ReleaseStatus[], services: ProcessStatus[], singletons: ProcessStatus[]}} DaemonStatus
  */
 
 export default class RollbridgeDaemon {
   /**
    * @param {object} args - Options.
+   * @param {BootstrapIdentity} [args.bootstrap] - Immutable known-release foreground bootstrap identity.
    * @param {import("./config.js").RollbridgeConfig} args.config - Rollbridge config.
    * @param {string} [args.configPath] - Config file path to reload before deploys.
    * @param {(message: string, data?: Record<string, JsonValue>) => void} [args.logger] - Logger.
    * @param {import("./daemon-runtime.js").DaemonRuntimeIdentity} [args.runtime] - Immutable daemon runtime identity.
    */
-  constructor({config, configPath, logger, runtime}) {
+  constructor({bootstrap, config, configPath, logger, runtime}) {
+    this.bootstrap = bootstrap ? {...bootstrap} : undefined
     this.config = config
     this.configPath = configPath
     this.runtime = runtime
@@ -721,8 +724,9 @@ export default class RollbridgeDaemon {
     if (!this.statePath || this.stopping) return
 
     const statePath = this.statePath
-    const status = this.status()
-    const snapshot = {...status, events: this.eventLog.recent(), persistedAt: new Date().toISOString()}
+    const status = /** @type {Record<string, JsonValue>} */ (secretSafeStateValue(this.status()))
+    const events = secretSafeStateValue(this.eventLog.recent())
+    const snapshot = {...status, events, persistedAt: new Date().toISOString()}
 
     // Serialize writes (and track the tail) so shutdown can wait for an in-flight write before
     // clearing the file — otherwise a write started before shutdown could recreate it afterward.
@@ -819,6 +823,7 @@ export default class RollbridgeDaemon {
     return {
       activeReleaseId: this.activeRelease ? this.activeRelease.releaseId : null,
       application: this.config.application,
+      bootstrap: this.bootstrap ? {...this.bootstrap} : undefined,
       control: {...this.config.control},
       daemonRuntime: this.runtime ? {...this.runtime} : undefined,
       orphans: [...this.orphans],
@@ -851,6 +856,30 @@ function stringOrUndefined(value) {
   return value
 }
 
+const SECRET_BEARING_STATE_KEYS = new Set(["children", "command", "cwd", "env", "environment", "logs", "output"])
+
+/**
+ * Removes process definitions and captured output from a value before it reaches statePath.
+ * The live status/events APIs retain those diagnostics in memory; persistent state is only a
+ * secret-safe recovery aid and must not become a second process log or configuration store.
+ * @param {JsonValue} value - JSON value to sanitize.
+ * @returns {JsonValue} A secret-safe copy.
+ */
+function secretSafeStateValue(value) {
+  if (Array.isArray(value)) return value.map((entry) => secretSafeStateValue(entry))
+  if (!value || typeof value !== "object") return value
+
+  /** @type {Record<string, JsonValue>} */
+  const safe = {}
+
+  for (const [key, entry] of Object.entries(value)) {
+    if (SECRET_BEARING_STATE_KEYS.has(key)) continue
+    safe[key] = secretSafeStateValue(entry)
+  }
+
+  return safe
+}
+
 /**
  * @param {JsonValue} value - Value.
  * @param {string} key - Key.

package/test/daemon-bootstrap.test.js

@@ -14,20 +14,34 @@ import {isProcessAlive, liveProcesses, readState, writeState} from "../src/state
 const currentDir = path.dirname(fileURLToPath(import.meta.url))
 const binPath = path.join(currentDir, "..", "bin", "rollbridge")
 const dummyAppPath = path.join(currentDir, "fixtures", "dummy-app.js")
+const firstAttestation = `sha256:${"a".repeat(64)}`
+const secondAttestation = `sha256:${"b".repeat(64)}`
 
 test("daemon bootstrap requires complete, safe, absolute inputs before binding listeners", async (t) => {
   const cases = [
     {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1"], message: /must be provided together/},
     {args: ["--config", "relative/config.js", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "abc123"], message: /--config must be an absolute path/},
     {args: ["--config", "CONFIG", "--release-path", "relative/release", "--release-id", "v1", "--revision", "abc123"], message: /--release-path must be an absolute path/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE_UNNORMALIZED", "--release-id", "v1", "--revision", "abc123"], message: /--release-path must be normalized/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE_MISSING", "--release-id", "v1", "--revision", "abc123"], message: /--release-path is not accessible/},
     {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "unsafe id", "--revision", "abc123"], message: /--release-id/},
-    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "unsafe revision"], message: /--revision/}
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "unsafe revision"], message: /--revision/},
+    {args: ["--config", "CONFIG", "--boot-attestation", firstAttestation], message: /accepted only with/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "abc123", "--boot-attestation", `sha256:${"A".repeat(64)}`], message: /--boot-attestation/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "abc123", "--boot-attestation", `sha512:${"a".repeat(64)}`], message: /--boot-attestation/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "abc123", "--boot-attestation", `sha256:${"a".repeat(63)}`], message: /--boot-attestation/}
   ]
 
   for (const testCase of cases) {
     await t.test(testCase.message.source, async () => {
       const fixture = await createFixture()
-      const args = testCase.args.map((arg) => arg === "CONFIG" ? fixture.configPath : arg === "RELEASE" ? fixture.root : arg)
+      const args = testCase.args.map((arg) => {
+        if (arg === "CONFIG") return fixture.configPath
+        if (arg === "RELEASE") return fixture.root
+        if (arg === "RELEASE_UNNORMALIZED") return `${fixture.root}/child/..`
+        if (arg === "RELEASE_MISSING") return path.join(fixture.root, "missing")
+        return arg
+      })
 
       try {
         const result = await runDaemon(args)
@@ -35,6 +49,7 @@ test("daemon bootstrap requires complete, safe, absolute inputs before binding l
         assert.notEqual(result.code, 0)
         assert.match(result.stderr, testCase.message)
         await assert.rejects(() => fs.stat(fixture.socketPath), {code: "ENOENT"})
+        await assert.rejects(() => fs.stat(fixture.startedPath), {code: "ENOENT"})
       } finally {
         await fs.rm(fixture.root, {force: true, recursive: true})
       }
@@ -44,7 +59,7 @@ test("daemon bootstrap requires complete, safe, absolute inputs before binding l
 
 test("daemon bootstrap activates the exact release through the foreground daemon", async () => {
   const fixture = await createFixture()
-  const child = spawnDaemon(fixture, {releaseId: "release-42", revision: "abc123"})
+  const child = spawnDaemon(fixture, {attestation: firstAttestation, releaseId: "release-42", revision: "abc123"})
 
   try {
     await waitForLog(child, "control socket listening")
@@ -53,6 +68,12 @@ test("daemon bootstrap activates the exact release through the foreground daemon
 
     assert.equal(activeRelease.releasePath, fixture.root)
     assert.equal(activeRelease.revision, "abc123")
+    assert.deepEqual(status.bootstrap, {
+      attestation: firstAttestation,
+      releaseId: "release-42",
+      releasePath: fixture.root,
+      revision: "abc123"
+    })
     assert.ok(status.proxy && typeof status.proxy === "object" && !Array.isArray(status.proxy) && typeof status.proxy.port === "number")
     assert.equal((await fetch(`http://127.0.0.1:${status.proxy.port}/release`).then((response) => response.text())).trim(), "release-42")
 
@@ -101,6 +122,7 @@ test("plain daemon startup remains listener-only with no active release", async
 
     assert.equal(status.activeReleaseId, null)
     assert.deepEqual(status.releases, [])
+    assert.equal(status.bootstrap, undefined)
 
     child.kill("SIGTERM")
     assert.equal((await once(child, "exit"))[0], 0)
@@ -110,6 +132,47 @@ test("plain daemon startup remains listener-only with no active release", async
   }
 })
 
+test("ensure-daemon rejects boot attestation instead of inheriting foreground identity", async () => {
+  const fixture = await createFixture()
+
+  try {
+    const result = await runRollbridge(["ensure-daemon", "--config", fixture.configPath, "--boot-attestation", firstAttestation])
+
+    assert.notEqual(result.code, 0)
+    assert.match(result.stderr, /unknown option '--boot-attestation'/)
+    await assert.rejects(() => fs.stat(fixture.socketPath), {code: "ENOENT"})
+    await assert.rejects(() => fs.stat(fixture.startedPath), {code: "ENOENT"})
+  } finally {
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("otherwise identical foreground boots remain distinguishable by attestation", async () => {
+  const fixture = await createFixture()
+
+  try {
+    const attestations = []
+
+    for (const attestation of [firstAttestation, secondAttestation]) {
+      const child = spawnDaemon(fixture, {attestation, releaseId: "same-release", revision: "same-revision"})
+
+      await waitForLog(child, "control socket listening")
+      const status = await sendControlCommand({command: {command: "status"}, path: fixture.socketPath})
+
+      assert.equal(status.activeReleaseId, "same-release")
+      assert.ok(status.bootstrap && typeof status.bootstrap === "object" && !Array.isArray(status.bootstrap))
+      attestations.push(status.bootstrap.attestation)
+
+      child.kill("SIGTERM")
+      assert.equal((await once(child, "exit"))[0], 0)
+    }
+
+    assert.deepEqual(attestations, [firstAttestation, secondAttestation])
+  } finally {
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
 test("SIGTERM during bootstrap activation follows the daemon shutdown path", async () => {
   const fixture = await createFixture({healthPath: "/never-ready", healthTimeoutMs: 60000})
   const started = waitForFile(fixture.startedPath)
@@ -344,11 +407,15 @@ async function waitForFile(filePath) {
 
 /**
  * @param {{configPath: string, root: string}} fixture - Fixture paths.
- * @param {{releaseId: string, revision: string}} release - Bootstrap metadata.
+ * @param {{attestation?: string, releaseId: string, revision: string}} release - Bootstrap metadata.
  * @returns {import("node:child_process").ChildProcessWithoutNullStreams} Spawned daemon.
  */
 function spawnDaemon(fixture, release) {
-  return spawn(process.execPath, [binPath, "daemon", "--config", fixture.configPath, "--release-path", fixture.root, "--release-id", release.releaseId, "--revision", release.revision], {stdio: ["pipe", "pipe", "pipe"]})
+  const args = [binPath, "daemon", "--config", fixture.configPath, "--release-path", fixture.root, "--release-id", release.releaseId, "--revision", release.revision]
+
+  if (release.attestation) args.push("--boot-attestation", release.attestation)
+
+  return spawn(process.execPath, args, {stdio: ["pipe", "pipe", "pipe"]})
 }
 
 /**
@@ -356,7 +423,15 @@ function spawnDaemon(fixture, release) {
  * @returns {Promise<{code: number | null, output: string, stderr: string}>} Completed process result.
  */
 async function runDaemon(args) {
-  const child = spawn(process.execPath, [binPath, "daemon", ...args], {stdio: ["ignore", "pipe", "pipe"]})
+  return await runRollbridge(["daemon", ...args])
+}
+
+/**
+ * @param {string[]} args - Rollbridge command and arguments.
+ * @returns {Promise<{code: number | null, output: string, stderr: string}>} Completed process result.
+ */
+async function runRollbridge(args) {
+  const child = spawn(process.execPath, [binPath, ...args], {stdio: ["ignore", "pipe", "pipe"]})
   let output = ""
   let stderr = ""
 

package/test/managed-process.test.js

@@ -544,6 +544,10 @@ test("does not auto-restart when the restart policy is disabled (maxRestarts: 0)
 
 test("stops auto-restarting once maxRestarts within the window is reached", async () => {
   const managed = buildCrasher({backoffFactor: 1, maxDelayMs: 0, maxRestarts: 2, windowMs: 60000})
+  /** @type {{data: Record<string, import("../src/json.js").JsonValue>, message: string}[]} */
+  const events = []
+
+  managed.logger = (message, data = {}) => { events.push({data, message}) }
 
   try {
     await managed.start()
@@ -554,6 +558,11 @@ test("stops auto-restarting once maxRestarts within the window is reached", asyn
 
     assert.equal(managed.status().restarts, 2)
     assert.equal(managed.status().state, "failed")
+    assert.deepEqual(events.find((event) => event.message === "restart limit reached")?.data, {
+      id: "crasher",
+      maxRestarts: 2,
+      windowMs: 60000
+    })
   } finally {
     await managed.stop()
   }

package/test/rollbridge.test.js

@@ -8,11 +8,11 @@ import net from "node:net"
 import os from "node:os"
 import path from "node:path"
 import test from "node:test"
-import {fileURLToPath} from "node:url"
+import {fileURLToPath, pathToFileURL} from "node:url"
 import RollbridgeDaemon from "../src/daemon.js"
 import {normalizeConfig} from "../src/config.js"
 import {sendControlCommand} from "../src/control-client.js"
-import {readState, writeState} from "../src/state-store.js"
+import {liveProcesses, readState, writeState} from "../src/state-store.js"
 import {runCli} from "../src/cli.js"
 
 const currentDir = path.dirname(fileURLToPath(import.meta.url))
@@ -635,6 +635,37 @@ test("persists daemon state to statePath and removes it on a clean shutdown", as
   assert.equal(stateAfterShutdown, undefined, "state file removed on clean shutdown")
 })
 
+test("persisted daemon state excludes process commands, environment values, and output", async () => {
+  const secret = "state-secret-value"
+  const fixture = await createFixture({persistState: true})
+  const web = fixture.config.processes.find((processConfig) => processConfig.id === "web")
+
+  assert.ok(web)
+  web.env.ROLLBRIDGE_TEST_SECRET = secret
+  web.command = `${JSON.stringify(process.execPath)} -e ${JSON.stringify(`console.log(process.env.ROLLBRIDGE_TEST_SECRET); import(${JSON.stringify(pathToFileURL(dummyAppPath).href)})`)}`
+
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    await waitFor(() => Boolean(daemon.activeRelease?.getProcess("web")?.status().logs.some((entry) => entry.line === secret)))
+
+    daemon.persistState()
+    await waitFor(async () => (await fs.readFile(fixture.statePath, "utf8")).includes('"activeReleaseId": "v1"'))
+
+    const persisted = await fs.readFile(fixture.statePath, "utf8")
+
+    assert.doesNotMatch(persisted, /state-secret-value/)
+    assert.doesNotMatch(persisted, /ROLLBRIDGE_TEST_SECRET/)
+    assert.doesNotMatch(persisted, /"command"/)
+    assert.doesNotMatch(persisted, /"logs"/)
+    assert.deepEqual(liveProcesses(JSON.parse(persisted), () => true).map(({id, releaseId}) => ({id, releaseId})), [{id: "web", releaseId: "v1"}])
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
 test("a clean shutdown clears the state file even when a persist write is in flight", async () => {
   const fixture = await createFixture({persistState: true})
   const daemon = await startDaemon(fixture.config)
@@ -1130,6 +1161,7 @@ test("deploy can ensure the daemon before sending the release command", async ()
     const proxy = /** @type {{port: number}} */ (status.proxy)
 
     assert.equal(status.activeReleaseId, "ensured-v1")
+    assert.equal(status.bootstrap, undefined)
     assert.match(await fs.readFile(pidPath, "utf8"), /\d+/)
     assert.equal(await fetchTextFromPort(proxy.port, "/release"), "ensured-v1")
   } finally {