Release 1.0.4 responsiveness fixes - #85

#!/bin/bash
set -euo pipefail

node --test test/read-state.mjs
npm run architecture:report
npm run ci

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- package manifests ---'
git ls-files | grep -E '(^|/)(package\.json|package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml)$' || true

printf '%s\n' '--- package scripts and node dependency declarations ---'
node - <<'JS'
const fs = require('fs');
const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
console.log(JSON.stringify({
  packageManager: p.packageManager,
  scripts: p.scripts,
  dependencies: p.dependencies,
  devDependencies: p.devDependencies
}, null, 2));
JS

printf '%s\n' '--- TypeScript configuration references ---'
rg -n --glob 'tsconfig*.json' --glob '!node_modules' '"types"|"typeRoots"|"moduleResolution"|"extends"' .

printf '%s\n' '--- relevant tracked files ---'
git ls-files 'test/read-state.mjs' 'scripts/run-test-suite.mjs' 'package.json' 'package-lock.json' 'tsconfig*.json'

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- lockfile entries for Node types ---'
rg -n -C 2 '"node_modules/@types/node"|"`@types/node`"' package-lock.json

printf '%s\n' '--- installed dependency state ---'
if [ -d node_modules ]; then
  echo 'node_modules: present'
  if [ -d node_modules/@types/node ]; then
    echo '`@types/node`: present'
  else
    echo '`@types/node`: absent'
  fi
else
  echo 'node_modules: absent'
fi

#!/bin/bash
set -eu
printf '%s\n' '--- installer context ---'
sed -n '130,175p' site/public/install-oci-runtime.sh
printf '%s\n' '--- regression test context ---'
sed -n '300,345p' test/site.mjs
printf '%s\n' '--- changelog context ---'
sed -n '15,32p' CHANGELOG.md
printf '%s\n' '--- related sudoers/mail references ---'
rg -n --glob '!node_modules' 'mail_no_(user|perms|badpass)|sudoers|TEMP_ROOT/sudoers|denied' site/public/install-oci-runtime.sh test/site.mjs CHANGELOG.md

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re

installer = Path("site/public/install-oci-runtime.sh").read_text()
test = Path("test/site.mjs").read_text()
changelog = Path("CHANGELOG.md").read_text()

rule = re.search(
    r"printf 'Defaults:%s ([^\\n]+)\\n%s ALL=\\(root\\) NOPASSWD: %s \\*\\n'",
    installer,
)
assert rule, "generated sudoers rule not found"
defaults, principal, command = rule.group(1), "%s ALL=(root)", "*"
print("generated Defaults options:", defaults)
print("has !mail_no_user:", "!mail_no_user" in defaults)
print("has !mail_no_perms:", "!mail_no_perms" in defaults)
print("service-user rule grants only helper path with arbitrary arguments:", "NOPASSWD: %s *" in installer)
print("test asserts !mail_no_perms:", "!mail_no_perms" in test)
print("test exercises denied-command path:", bool(re.search(r"denied|not allowed|sudo.*(?:false|cat|sh|id)", test, re.I)))
print("changelog claim present:", "Denied service-user `sudo` calls no longer start mail delivery processes" in changelog)
PY
if command -v man >/dev/null 2>&1; then
  man sudoers 2>/dev/null | col -b 2>/dev/null | grep -A8 -B3 -E 'mail_no_(perms|user)' || true
else
  echo "local sudoers man page unavailable"
fi

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re

installer = Path("site/public/install-oci-runtime.sh").read_text()
test = Path("test/site.mjs").read_text()
changelog = Path("CHANGELOG.md").read_text()

defaults_line = next(
    line for line in installer.splitlines()
    if "Defaults:%s" in line and "mail_badpass" in line
)
assert "!mail_no_user" in defaults_line
print("defaults line:", defaults_line.strip())
print("has !mail_no_user:", "!mail_no_user" in defaults_line)
print("has !mail_no_perms:", "!mail_no_perms" in defaults_line)

rule_lines = installer.splitlines()
rule_index = next(i for i, line in enumerate(rule_lines) if "ALL=(root)" in line)
rule = "\n".join(rule_lines[rule_index:rule_index + 1])
print("service-user rule:", rule.strip())
print("explicit helper-only command rule:", "NOPASSWD:" in rule and "HELPER_PATH" in rule)

assert "!mail_no_perms" not in test
print("test asserts !mail_no_perms:", "!mail_no_perms" in test)
denied_patterns = re.compile(
    r"(denied|not allowed|permission denied|mail_no_perms|sudo.*(?:false|cat|sh|id))",
    re.I,
)
print("test contains denied-command coverage:", bool(denied_patterns.search(test)))
print(
    "changelog claim present:",
    "Denied service-user `sudo` calls no longer start mail delivery processes" in changelog,
)
PY

#!/bin/bash
set -eu

printf '%s\n' '--- relevant source ---'
sed -n '60,100p' src/server/channel-computers.ts
sed -n '1625,1695p' src/server/channel-computers.ts

printf '%s\n' '--- constant usages ---'
rg -n -C 3 'RECONCILE_EVERY_MS|INITIAL_RECONCILE_MS|HELM_FLEET_INTERVAL_MS|HELM_FLEET_INITIAL_MS|setInterval|setTimeout' src/server/channel-computers.ts

printf '%s\n' '--- related tests ---'
rg -n -C 2 'HELM_FLEET_INTERVAL_MS|HELM_FLEET_INITIAL_MS|reconcil|channel-computers' --glob '*test*' --glob '*spec*' .

#!/bin/bash
set -eu

node - <<'JS'
const delays = [NaN, Infinity, -Infinity, 2_147_483_647, 2_147_483_648, 1e15];
for (const delay of delays) {
  const timeout = setTimeout(() => {}, delay);
  const interval = setInterval(() => {}, delay);
  console.log(JSON.stringify({
    delay,
    timeout: { _idleTimeout: timeout._idleTimeout },
    interval: { _idleTimeout: interval._idleTimeout },
  }));
  clearTimeout(timeout);
  clearInterval(interval);
}
JS

#!/bin/bash
set -eu

printf '%s\n' '--- reconciliation workload ---'
rg -n -B 12 -A 45 'async function reconcileOne|function reconcileOne|reconcileOne\\(' src/server/channel-computers.ts

printf '%s\n' '--- test setup and environment handling ---'
sed -n '1,180p' test/channel-computers.mjs
rg -n -C 3 'process\\.env|import\\(|channel-computers' test/channel-computers.mjs test/channel-computers-isolated-backends.mjs

#!/bin/bash
set -eu

printf '%s\n' '--- reconciliation workload ---'
rg -n -F -B 12 -A 45 'reconcileOne' src/server/channel-computers.ts

printf '%s\n' '--- test setup and environment handling ---'
sed -n '1,180p' test/channel-computers.mjs
rg -n -C 3 'process\.env|import\(|channel-computers' test/channel-computers.mjs test/channel-computers-isolated-backends.mjs

#!/bin/bash
set -e
printf '%s\n' '--- test/site.mjs context ---'
sed -n '300,340p' test/site.mjs
printf '%s\n' '--- sudo mail flag references ---'
rg -n -C 3 'mail_(badpass|no_perms|no_user)|Defaults:%s' --glob '!node_modules' .
printf '%s\n' '--- candidate installer files ---'
git ls-files | rg -i 'installer|oci|sudo|container|site'

#!/bin/bash
set -e
printf '%s\n' '--- installer policy context ---'
sed -n '120,175p' site/public/install-oci-runtime.sh
printf '%s\n' '--- helper command and sudo call sites ---'
rg -n -C 4 'sudo|HELPER_PATH|SERVICE_USER|mail_no_perms|mail_no_user|mail_badpass' \
  site/public/install-oci-runtime.sh scripts/1helm-oci-runtime test
printf '%s\n' '--- sudoers documentation available locally ---'
command -v sudo || true
find /usr/share/man /usr/share/doc -type f 2>/dev/null | rg '/sudoers(\.|$)|sudo' | head -20 || true

#!/bin/bash
set -e
python3 - <<'PY'
from pathlib import Path
import re

installer = Path("site/public/install-oci-runtime.sh").read_text()
test = Path("test/site.mjs").read_text()

policy = re.search(
    r"printf '([^']*)'\\s*\\n'\s*"
    r'\s*"?(?:\$SERVICE_USER|\$HELPER_PATH)', installer
)
line = next(
    line for line in installer.splitlines()
    if "Defaults:%s" in line and "mail_badpass" in line
)
assert "!mail_badpass" in line
assert "!mail_no_user" in line
assert "!mail_no_perms" not in line

expected = r"/Defaults:%s !mail_badpass, !mail_no_perms, !mail_no_user/"
assert "!mail_no_perms" not in test.splitlines()[326]
print("generated policy template:", line.strip())
print("missing denied-permission flag: !mail_no_perms")
print("proposed test pattern is distinct:", expected)
PY