unoverse 0.1.131 → 0.1.133

package/operator/lib/deploy.sh

@@ -41,8 +41,12 @@
 # exists because the opposite mistake is what wiped this exact cluster's firewall once
 # already: an authoritative write that assumed the whole list was ours to own.
 _operator_db_access() {
-  local cloud="$1" dir="$ROOT/infra/$cloud" cluster
-  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  # `$2` is the cluster, when the CALLER already knows it. The monorepo has no ground to
+  # read one from — it develops against a cluster named only in .env — so re-deriving it
+  # from terraform.tfvars here meant this returned 0 and did nothing in the one place the
+  # developer actually types `npm run dev`.
+  local cloud="$1" dir="$ROOT/infra/$cloud" cluster="${2:-}"
+  [ -n "$cluster" ] || cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
   [ -n "$cluster" ] || return 0
   [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
   mkdir -p "$ROOT/.unoverse"
@@ -55,9 +59,51 @@ const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
 const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
 const read = () => { try { return fs.readFileSync(ledgerPath, "utf8").split("\n").map(s => s.trim()).filter(Boolean); } catch { return []; } };
 
+/**
+ * A MACHINE IS A SET OF ADDRESSES, NOT ONE.
+ *
+ * This asked "what is my IP?" once and registered the answer, deleting whatever it had
+ * registered before. That is correct for one stable address and actively harmful without
+ * one: a connection that leaves through a different egress than the probe did arrives
+ * from an address nobody trusted. Observed live 2026-08-10 on a laptop whose ISP
+ * alternates two addresses roughly evenly — six probes returned three of each. Each run
+ * registered whichever it drew and REMOVED the other, so running the command again
+ * (exactly what a locked-out developer does) deleted the rule that was working, and the
+ * database stayed unreachable through both.
+ *
+ * So probe several times and register the DISTINCT SET. Replacement is unchanged: the
+ * previous set still goes, so rules never pile up. One address for a normal machine, two
+ * for a flapping one, and the developer never has to know which they are.
+ */
+/**
+ * EACH PROBE MUST BE ITS OWN CONNECTION, or the loop is theatre. `fetch` keeps the
+ * connection alive, so six calls to one host ride ONE socket and one egress, and the
+ * probe reports a single address on the very machine that has two. Measured: six
+ * keep-alive probes returned the same address six times, while six separate `curl`
+ * processes returned three of each. `Connection: close` retires the socket, and rotating
+ * the endpoint keeps a single provider's own routing from deciding the answer.
+ */
+const ENDPOINTS = ["https://api.ipify.org", "https://icanhazip.com", "https://ifconfig.me/ip"];
+const PROBES = 9;
+const egress = async () => {
+  const seen = new Set();
+  for (let i = 0; i < PROBES; i++) {
+    try {
+      const res = await fetch(ENDPOINTS[i % ENDPOINTS.length], {
+        headers: { connection: "close" },
+        signal: AbortSignal.timeout(5000),
+      });
+      const v = (await res.text()).trim();
+      if (/^\d+\.\d+\.\d+\.\d+$/.test(v)) seen.add(v);
+    } catch {}
+  }
+  return [...seen];
+};
+
 (async () => {
-  const ip = (await (await fetch("https://api.ipify.org", { signal: AbortSignal.timeout(5000) })).text()).trim();
-  if (!/^\d+\.\d+\.\d+\.\d+$/.test(ip)) return;
+  const ips = await egress();
+  if (!ips.length) return;
+  const isOurs = (v) => ips.includes(v);
 
   const list = await (await api("/databases")).json();
   const db = (list.databases || []).find((d) => d.name === cluster);
@@ -67,26 +113,28 @@ const read = () => { try { return fs.readFileSync(ledgerPath, "utf8").split("\n"
   let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
 
   const ours = read();                                   // only these may be removed
-  const stale = ours.filter((v) => v !== ip);
-  const had = rules.some((r) => r.type === "ip_addr" && r.value === ip);
+  const stale = ours.filter((v) => !isOurs(v));
+  const missing = ips.filter((v) => !rules.some((r) => r.type === "ip_addr" && r.value === v));
+  const label = ips.join(", ");
   // SAY SO EVEN WHEN NOTHING CHANGES. Returning silently made the command look like it had
   // failed: the developer typed it because they could not connect, and got a blank line.
-  if (had && stale.length === 0) {
-    fs.writeFileSync(ledgerPath, ip + "\n");
-    console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) can already reach ${cluster} \x1b[2m(nothing changed)\x1b[0m`);
+  if (!missing.length && !stale.length) {
+    fs.writeFileSync(ledgerPath, ips.join("\n") + "\n");
+    console.log(`  \x1b[32m✓\x1b[0m This machine (${label}) can already reach ${cluster} \x1b[2m(nothing changed)\x1b[0m`);
     return;
   }
 
   rules = rules.filter((r) => !(r.type === "ip_addr" && stale.includes(r.value)));
-  if (!had) rules.push({ type: "ip_addr", value: ip });
+  for (const v of missing) rules.push({ type: "ip_addr", value: v });
 
   const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
   if (!res.ok) {
-    console.log(`  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add ${ip} by hand`);
+    console.log(`  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add ${label} by hand`);
     return;
   }
-  fs.writeFileSync(ledgerPath, ip + "\n");
-  console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) may reach ${cluster} \x1b[2m(${rules.length} trusted sources, only ours changed)\x1b[0m`);
+  fs.writeFileSync(ledgerPath, ips.join("\n") + "\n");
+  const changed = ips.length > 1 ? `${ips.length} addresses for this machine` : "only ours changed";
+  console.log(`  \x1b[32m✓\x1b[0m This machine (${label}) may reach ${cluster} \x1b[2m(${rules.length} trusted sources, ${changed})\x1b[0m`);
 })().catch(() => {});
 NODE
 }
@@ -108,16 +156,21 @@ cmd_db_allow() {
   # reachability is a VPC security group, owned by Terraform and changed by `deploy`, not by
   # a developer's laptop asking an API at runtime. Offering `db-allow aws` produced a
   # ground-picker prompt for a cloud that would then have done nothing.
-  SELF_CMD="unoverse db-allow" \
-  GROUNDS_ONLY="digitalocean" \
-  GROUNDS_ONLY_WHY="On AWS the database is reached through its VPC security group, which the ground owns — change it in infra/aws and run ${BOLD}unoverse deploy aws${NC}." \
-  cloud=$(_pick_ground "${1:-}") || {
-    [ -z "${1:-}" ] && [ ! -d "$ROOT/infra" ] && fail "No ground here. There is no database to reach"
-    return 1
-  }
+  # A GROUND IS OPTIONAL HERE. This used to `return 1` the moment the picker found none,
+  # which made the .env fallback below unreachable in the monorepo — the one checkout that
+  # has no ground and the one the fallback was written for. Only ask the picker when there
+  # is something to pick, so an ambiguous two-ground universe still stops, while a
+  # groundless checkout proceeds to look the cluster up where it actually knows it.
+  cloud=""
+  if ls "$ROOT"/infra/*/terraform.tfvars >/dev/null 2>&1; then
+    SELF_CMD="unoverse db-allow" \
+    GROUNDS_ONLY="digitalocean" \
+    GROUNDS_ONLY_WHY="On AWS the database is reached through its VPC security group, which the ground owns — change it in infra/aws and run ${BOLD}unoverse deploy aws${NC}." \
+    cloud=$(_pick_ground "${1:-}") || return 1
+  fi
 
-  local cluster
-  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$ROOT/infra/$cloud/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  local cluster=""
+  [ -n "$cloud" ] && cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$ROOT/infra/$cloud/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
 
   # THE MONOREPO NEEDS THIS TOO, and it has no ground. The platform's own checkout is
   # developed against a managed cluster named only in .env, so a ground-only lookup found
@@ -147,7 +200,9 @@ cmd_db_allow() {
   fi
 
   echo ""
-  _operator_db_access "$cloud"
+  # Hand the cluster over: we already resolved it, from a ground OR from .env, and the
+  # helper cannot re-derive the .env case (there is no tfvars to read).
+  _operator_db_access "$cloud" "$cluster"
   echo ""
   info "Run this again whenever you change network"
   echo ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.131",
+  "version": "0.1.133",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",