Skip to content

update: run post-upgrade setup from the installed CLI, prune after (0.1.87) - #132

Merged
sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
riotcoder/update-setup-from-installed
Nov 2, 2026
Merged

sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
riotcoder/update-setup-from-installed

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor

Fourth fix from the live rollout on bonita. This one took the daemon down for about 70 s.

What happened. At 15:19Z, bonita's hourly infernet update ran from the npm-global copy (0.1.84; the 14:52 npm-path install had repointed the wrapper at it).

  1. The 0.1.86 installer kept the node on git: source went to 0.1.86 and the wrapper was rewritten to source.
  2. update then removed the npm copy, before setup.
  3. It then ran setup in-process from that now-deleted copy. Setup rewrote infernet.service to node <npm copy>/index.js and failed with Cannot find module.
  4. The daemon crash-looped until I rewrote the unit with ~/.local/bin/infernet service install. It came back on 0.1.86 at 15:20:25Z and served jobs again right away.

Fix.

  • When the wrapper runs a different CLI than the current process, update hands post-upgrade setup to that installed CLI (<wrapper> setup --yes --confirm --skip-pull).
  • Stray copies are removed only after setup has rewritten the unit.
  • CLI_DIR is now a realpath, so the comparison holds through symlinked prefixes (mise's 24 -> 24.18.1).

A test covers setupRunsFrom. pnpm vitest run: 967 passed. apps/cli/package.json -> 0.1.87.

🤖 Generated with Claude Code

….1.87)

During the 0.1.86 rollout bonita's hourly `infernet update` ran from the
npm-global copy. The installer (correctly) kept the node on git, then
update removed the npm copy and ran setup in-process from that removed
copy, which rewrote infernet.service to point at it: the daemon
crash-looped for ~70 s until the unit was rewritten by hand.

Now update hands setup to the CLI the wrapper runs when that is not this
process, and removes stray copies only after setup. CLI_DIR is a real
path so the comparison holds through symlinked prefixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

40 finding(s)

HIGH/CRITICAL: 6 | MEDIUM: 14 | LOW: 20

Severity Rule Location
HIGH js-electron-node-integration apps/desktop/electron/main.js:27
HIGH secret-generic-api-key apps/web/app/getting-started/page.js:136
HIGH secret-generic-api-key docs/book/01-introduction/getting-started.md:40
HIGH secret-database-url docs/MIGRATIONS.md:56
HIGH secret-database-url ipips/ipip-0013.md:187
HIGH sensitive-file-committed sample.env:1
MEDIUM secret-hex-token apps/mobile/src/context/AuthContext.js:170
MEDIUM secret-hex-token apps/mobile/src/context/AuthContext.js:239
MEDIUM secret-hex-token apps/web/app/docs/page.js:293
MEDIUM js-unescaped-html-sink apps/web/app/layout.js:148
MEDIUM js-open-redirect apps/web/app/order/order-view.js:43
MEDIUM js-unescaped-html-sink apps/web/components/pit-footer.js:30
MEDIUM js-indirect-code-sink apps/web/lib/operator-vault.js:33
MEDIUM js-indirect-code-sink apps/web/lib/operator-vault.js:34
MEDIUM js-indirect-code-sink apps/web/lib/operator-vault.js:38
MEDIUM sh-remote-script-execution install.sh:583
MEDIUM sh-remote-script-execution install.sh:721
MEDIUM sh-remote-script-execution install.sh:971
MEDIUM sh-predictable-temp-path install.sh:1306
MEDIUM redos-nested-quantifier packages/gpu/src/interconnect.js:177
LOW secret-generic-credential docs/book/04-building-apps/index.md:33
LOW secret-generic-credential tests/auth-parse-body.test.js:43
LOW secret-generic-credential tests/auth-parse-body.test.js:46
LOW secret-generic-credential tests/auth-parse-body.test.js:64
LOW secret-generic-credential tests/auth-parse-body.test.js:70
LOW secret-generic-credential tests/auth-parse-body.test.js:73
LOW secret-hex-token tests/cli-peers.test.js:51
LOW secret-jwt tests/cpr-canary.test.js:26
LOW secret-hex-token tests/cpr-receipts.test.js:179
LOW secret-hex-token tests/cpr-receipts.test.js:182
LOW secret-generic-api-key tests/deploy-providers-foundation.test.js:220
LOW secret-private-key tests/liquid-agent.test.js:88
LOW secret-hex-token tests/node-commands-auth.test.js:68
LOW secret-hex-token tests/node-commands-auth.test.js:69
LOW secret-generic-api-key tests/operator-vault.test.js:62
LOW secret-generic-credential tests/profile-signup.test.js:53
LOW secret-generic-credential tests/profile-signup.test.js:65
LOW secret-generic-credential tests/profile-signup.test.js:90
LOW secret-generic-credential tests/reservation-orders.test.js:152
LOW secret-generic-credential tests/reservations.test.js:263

Snippets are redacted; ThreatCrush never prints matched credential material.

for (const k of ['port', 'address', 'no-advertise']) {
if (args.has(k)) setupArgs.set(k, args.get(k) ?? true);
}
code = await setup(setupArgs, ctx);
@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit d44f123 into master Nov 2, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant