unoverse 0.1.132 → 0.1.133

package/operator/lib/deploy.sh

@@ -59,9 +59,51 @@ const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
 const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
 const read = () => { try { return fs.readFileSync(ledgerPath, "utf8").split("\n").map(s => s.trim()).filter(Boolean); } catch { return []; } };
 
+/**
+ * A MACHINE IS A SET OF ADDRESSES, NOT ONE.
+ *
+ * This asked "what is my IP?" once and registered the answer, deleting whatever it had
+ * registered before. That is correct for one stable address and actively harmful without
+ * one: a connection that leaves through a different egress than the probe did arrives
+ * from an address nobody trusted. Observed live 2026-08-10 on a laptop whose ISP
+ * alternates two addresses roughly evenly — six probes returned three of each. Each run
+ * registered whichever it drew and REMOVED the other, so running the command again
+ * (exactly what a locked-out developer does) deleted the rule that was working, and the
+ * database stayed unreachable through both.
+ *
+ * So probe several times and register the DISTINCT SET. Replacement is unchanged: the
+ * previous set still goes, so rules never pile up. One address for a normal machine, two
+ * for a flapping one, and the developer never has to know which they are.
+ */
+/**
+ * EACH PROBE MUST BE ITS OWN CONNECTION, or the loop is theatre. `fetch` keeps the
+ * connection alive, so six calls to one host ride ONE socket and one egress, and the
+ * probe reports a single address on the very machine that has two. Measured: six
+ * keep-alive probes returned the same address six times, while six separate `curl`
+ * processes returned three of each. `Connection: close` retires the socket, and rotating
+ * the endpoint keeps a single provider's own routing from deciding the answer.
+ */
+const ENDPOINTS = ["https://api.ipify.org", "https://icanhazip.com", "https://ifconfig.me/ip"];
+const PROBES = 9;
+const egress = async () => {
+  const seen = new Set();
+  for (let i = 0; i < PROBES; i++) {
+    try {
+      const res = await fetch(ENDPOINTS[i % ENDPOINTS.length], {
+        headers: { connection: "close" },
+        signal: AbortSignal.timeout(5000),
+      });
+      const v = (await res.text()).trim();
+      if (/^\d+\.\d+\.\d+\.\d+$/.test(v)) seen.add(v);
+    } catch {}
+  }
+  return [...seen];
+};
+
 (async () => {
-  const ip = (await (await fetch("https://api.ipify.org", { signal: AbortSignal.timeout(5000) })).text()).trim();
-  if (!/^\d+\.\d+\.\d+\.\d+$/.test(ip)) return;
+  const ips = await egress();
+  if (!ips.length) return;
+  const isOurs = (v) => ips.includes(v);
 
   const list = await (await api("/databases")).json();
   const db = (list.databases || []).find((d) => d.name === cluster);
@@ -71,26 +113,28 @@ const read = () => { try { return fs.readFileSync(ledgerPath, "utf8").split("\n"
   let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
 
   const ours = read();                                   // only these may be removed
-  const stale = ours.filter((v) => v !== ip);
-  const had = rules.some((r) => r.type === "ip_addr" && r.value === ip);
+  const stale = ours.filter((v) => !isOurs(v));
+  const missing = ips.filter((v) => !rules.some((r) => r.type === "ip_addr" && r.value === v));
+  const label = ips.join(", ");
   // SAY SO EVEN WHEN NOTHING CHANGES. Returning silently made the command look like it had
   // failed: the developer typed it because they could not connect, and got a blank line.
-  if (had && stale.length === 0) {
-    fs.writeFileSync(ledgerPath, ip + "\n");
-    console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) can already reach ${cluster} \x1b[2m(nothing changed)\x1b[0m`);
+  if (!missing.length && !stale.length) {
+    fs.writeFileSync(ledgerPath, ips.join("\n") + "\n");
+    console.log(`  \x1b[32m✓\x1b[0m This machine (${label}) can already reach ${cluster} \x1b[2m(nothing changed)\x1b[0m`);
     return;
   }
 
   rules = rules.filter((r) => !(r.type === "ip_addr" && stale.includes(r.value)));
-  if (!had) rules.push({ type: "ip_addr", value: ip });
+  for (const v of missing) rules.push({ type: "ip_addr", value: v });
 
   const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
   if (!res.ok) {
-    console.log(`  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add ${ip} by hand`);
+    console.log(`  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — add ${label} by hand`);
     return;
   }
-  fs.writeFileSync(ledgerPath, ip + "\n");
-  console.log(`  \x1b[32m✓\x1b[0m This machine (${ip}) may reach ${cluster} \x1b[2m(${rules.length} trusted sources, only ours changed)\x1b[0m`);
+  fs.writeFileSync(ledgerPath, ips.join("\n") + "\n");
+  const changed = ips.length > 1 ? `${ips.length} addresses for this machine` : "only ours changed";
+  console.log(`  \x1b[32m✓\x1b[0m This machine (${label}) may reach ${cluster} \x1b[2m(${rules.length} trusted sources, ${changed})\x1b[0m`);
 })().catch(() => {});
 NODE
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.132",
+  "version": "0.1.133",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",