fix(cli): stop install-service writing a unit that dies on upgrade and reboot - #172
Merged
Merged
Conversation
…d reboot Two independent defects left `threatcrushd.service` permanently unstartable on a real host — found at 6315 failed starts against a path last valid at 0.2.1. `resolveBinPath()` returned `process.argv[1]`, which under a pnpm global install is the version-stamped `.pnpm/@profullstack+threatcrush@X.Y.Z/...` directory. The next upgrade moves that directory, so ExecStart points at nothing and `Restart=on-failure` turns it into an endless loop. Rewrite it to the stable symlink pnpm keeps at the store root, and only when that symlink really exists. The unit also listed `/var/run/threatcrush` under ReadWritePaths. `/var/run` is a symlink to the `/run` tmpfs, so the directory `ensureSystemDirs()` created at install time was gone after the next reboot, and a missing ReadWritePaths entry fails the unit 226/NAMESPACE on every start. Use `RuntimeDirectory=` so systemd creates it per start, and stop pre-creating it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NXz7vRz6C7vaGSwMgWZfD
ThreatCrush Security Scan12 finding(s) HIGH/CRITICAL: 1 | MEDIUM: 6 | LOW: 5
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two independent defects left
threatcrushd.servicepermanently unstartable on a real host (bittorrented-droplet), found at 6315 failed starts against a path last valid at 0.2.1.1. ExecStart pinned to a version-stamped path
resolveBinPath()returnedprocess.argv[1], which under a pnpm global install is…/.pnpm/@profullstack+threatcrush@X.Y.Z/node_modules/…. The next upgrade moves that directory, ExecStart points at nothing, andRestart=on-failureturns it into an endless loop.Now rewritten to the stable symlink pnpm maintains at the store root, and only when that symlink actually exists — npm's global layout is already version-free and is left untouched.
2. A tmpfs path under ReadWritePaths
The unit listed
/var/run/threatcrush./var/runis a symlink to the/runtmpfs, so the directoryensureSystemDirs()created at install time was gone after the next reboot — and a missingReadWritePathsentry fails the unit226/NAMESPACEon every start.Replaced with
RuntimeDirectory=threatcrush, which systemd creates per start and cleans up;ensureSystemDirs()no longer pre-creates it.Verification
pnpm test— 62 passed (6 files), up from 57. New tests cover the path rewrite (pnpm, npm, and missing-target cases) and assert the unit declaresRuntimeDirectory=and lists no tmpfs path.pnpm buildclean.systemd-analyze verifyon the rendered template reports no directive errors.Note
This does not retroactively repair already-installed units. The affected host was fixed by hand; re-running
sudo threatcrush install-serviceis what picks this up elsewhere.🤖 Generated with Claude Code
https://claude.ai/code/session_018NXz7vRz6C7vaGSwMgWZfD