fix(heal): exclude comment lines from inline-Caddyfile guard + drop trailing split element

[samo-agent]

Root-cause analysis

Two correctness bugs found in buildConfigHealScript after PR #188 merged:

BUG-1 — inline-Caddyfile guard misfires on comment lines

Root cause: The guard detecting whether app.mainHost appears as an inline site block in /etc/caddy/Caddyfile used:

if grep -qF 'samograph.samo.team' /etc/caddy/Caddyfile 2>/dev/null; then

This matches ANY line containing the host — including comment lines. samograph's Caddyfile has a comment mentioning 'samograph.samo.team' (historical note from when the site block lived inline), so the guard was misfiring with inline-caddyfile outcome even though the real vhost is correctly in sites.d with a provenance header.

Fix: Strip comment lines (lines whose first non-whitespace char is #) before the host check:

if grep -v '^[[:space:]]*#' /etc/caddy/Caddyfile 2>/dev/null | grep -qF 'samograph.samo.team'; then

Only a real structural (non-comment) line can now trigger the guard.

BUG-2 — trailing empty element from .split("\n") adds extra blank line in heredoc

Root cause: renderVhost() returns a string ending in "\n" (standard POSIX newline termination). Calling .split("\n") on it produces a trailing empty-string element "", which becomes an extra blank line between } and the heredoc closing delimiter — i.e., }\n\n instead of }\n.

The live file written by the same heredoc also had the extra blank line, so re-runs of heal still matched via cmp. But it is a byte discrepancy versus renderVhost's own output — if any external tool writes the "correct" file (without the double trailing newline), the next heal run would detect spurious drift.

Fix: Strip the trailing newline before splitting at all three call sites:

...regeneratedMainVhost!.replace(/\n$/, "").split("\n"),

Tests

New file: test/heal-correctness-bugs.test.ts — 8 tests.

BUG-1 regression tests (2 cases):

• Comment line containing the mainHost does NOT trigger the guard
• Real inline site block for the mainHost does still trigger the guard

BUG-2 regression tests:

• Confirms renderVhost ends with \n (root cause documentation)
• Heredoc write-to-temp branch has no trailing blank line after }
• Heredoc fresh-write branch has no trailing blank line after }
• Embedded heredoc lines are byte-identical to renderVhost output

TDD discipline: RED commit a07ea5d (failing tests) → GREEN commit 7c6811a (fixes applied).

Full suite result: 2311 pass, 1 expected PG-integration skip (requires PG_TEST_URL), tsc --noEmit clean.

Intentionally NOT changed

• The SAMOHOST_APP_HEAL gate — not touched per brief
• All other heal behaviors — strictly surgical, no scope creep

🤖 Generated with Claude Code