Skip to content

Claude/cpu guard script dn d8u #126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gamblecodezcom merged 13 commits into from
Mar 3, 2026
Merged

Claude/cpu guard script dn d8u #126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
c1ad46c
fix: resolve merge conflicts — squash all branch changes onto current…
claude Mar 3, 2026
722c7a0
fix: prevent EADDRINUSE crash-loops and lock Express version
claude Mar 3, 2026
66322f4
feat: add gcz_cpu_guard.sh — passive GCZ stack CPU monitor
claude Mar 3, 2026
7250d44
fix: scope pkill pattern to PROJECT_DIR to avoid killing unrelated no…
claude Mar 3, 2026
18f959f
chore: remove gcz_cpu_guard.sh from repo; whitelist it in rw_cpu_guard
claude Mar 3, 2026
5e9d1fa
fix(security): drop root privileges — run services as runewager user
claude Mar 3, 2026
4fe5dc5
fix: resolve merge conflicts with main — keep security improvements
claude Mar 3, 2026
613da2f
fix: address code review issues in backend.js and prod-run.sh
claude Mar 3, 2026
ab189aa
fix: address remaining code review items (kill escalation, stream gua…
claude Mar 3, 2026
f7f9b6b
fix: resolve merge conflicts — keep stream guards and graceful kill e…
claude Mar 3, 2026
0e300b6
fix: escape PROJECT_DIR in pkill pattern; return 400 on missing rawBody
claude Mar 3, 2026
63bfc3b
fix: add -t flag to fuser so port-clear prestart gets bare PIDs
claude Mar 3, 2026
4f3dd8a
fix: add qa/ to ReadWritePaths — ProtectSystem=strict blocked repo_in…
claude Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions backend.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,11 @@ const logger = {
},
_write(streams, obj) {
const line = JSON.stringify(obj) + '\n';
const writable = streams.filter(Boolean);
const writable = streams.filter((s) => s && !s.destroyed && s.writable);
if (writable.length > 0) {
for (const s of writable) s.write(line);
for (const s of writable) {
try { s.write(line); } catch (e) { console.error(`[backend] stream write error: ${e.message}`); }
}
} else {
console.log(line.trimEnd());
}
Expand Down Expand Up @@ -210,8 +212,9 @@ app.post('/autofix/webhook', async (req, res) => {
const rawBody = req.rawBody;

if (!rawBody || !Buffer.isBuffer(rawBody)) {
logger.error('autofix.webhook', 'Missing rawBody — middleware misconfiguration', { requestId });
return res.status(500).json({ ok: false, error: 'Internal server error', requestId });
// Log as server-side misconfiguration but return 400 so senders don't retry indefinitely.
logger.error('autofix.webhook', 'Missing rawBody — raw-body middleware did not run', { requestId });
return res.status(400).json({ ok: false, error: 'Bad request: missing body', requestId });
}

if (!AUTOFIX_SECRET || !verifySignature(rawBody, sig)) {
Expand Down
13 changes: 10 additions & 3 deletions prod-run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,7 +400,12 @@ ENDPOINT_PORT="${ENDPOINT_PORT:-3001}"
ENDPOINT_LOG_DIR="$LOG_DIR"
ENDPOINT_LOG="$ENDPOINT_LOG_DIR/backend.log"
ENDPOINT_ERR="$ENDPOINT_LOG_DIR/backend-error.log"
touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null || true
if ! touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null; then
warn "Cannot write to $ENDPOINT_LOG_DIR — falling back to /tmp for endpoint logs"
ENDPOINT_LOG="/tmp/runewager-backend.log"
ENDPOINT_ERR="/tmp/runewager-backend-error.log"
touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" || true
Comment on lines +405 to +407

@sourcery-ai sourcery-ai Bot Mar 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: Consider suppressing stderr and/or guarding the fallback touch to avoid noisy failures in /tmp

The fallback touch in /tmp isn’t redirected, so if /tmp is also unwritable (e.g., locked-down envs/chroots), it will start emitting errors to stderr and could behave differently under set -e. To preserve the original quiet, best‑effort behavior, consider something like:

touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null || true

for the fallback as well.

Suggested change
ENDPOINT_LOG="/tmp/runewager-backend.log"
ENDPOINT_ERR="/tmp/runewager-backend-error.log"
touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" || true
ENDPOINT_LOG="/tmp/runewager-backend.log"
ENDPOINT_ERR="/tmp/runewager-backend-error.log"
touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null || true

fi

if command -v systemctl >/dev/null 2>&1; then
# Install/refresh the service unit from repo copy
Expand All @@ -424,7 +429,8 @@ if command -v systemctl >/dev/null 2>&1; then
say "runewager-endpoint restarted via systemd"
else
warn "systemctl restart runewager-endpoint failed — falling back to nohup"
pkill -f "node .*${PROJECT_DIR}/backend\.js" 2>/dev/null || true
_esc_dir="$(printf '%s' "$PROJECT_DIR" | sed 's/[.[\*^$()+?{|]/\\&/g')"
pkill -f "node .*${_esc_dir}/backend\.js" 2>/dev/null || true
sleep 1
# Re-check port: another process may have bound it during the failed systemd restart window
if is_port_listening "$ENDPOINT_PORT"; then
Expand All @@ -439,7 +445,8 @@ if command -v systemctl >/dev/null 2>&1; then
fi
else
# No systemd — direct nohup
pkill -f "node .*${PROJECT_DIR}/backend\.js" 2>/dev/null || true
_esc_dir="$(printf '%s' "$PROJECT_DIR" | sed 's/[.[\*^$()+?{|]/\\&/g')"
pkill -f "node .*${_esc_dir}/backend\.js" 2>/dev/null || true
sleep 1
if is_port_listening "$ENDPOINT_PORT"; then
free_port_if_conflicted "$ENDPOINT_PORT" "" || true
Expand Down
3 changes: 2 additions & 1 deletion runewager-endpoint.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ Type=simple
WorkingDirectory=/var/www/html/Runewager
# Clear any stale process holding port 3001 before each start to prevent EADDRINUSE crash-loops.
# The '+' prefix runs this step as root so it can kill processes owned by any user.
ExecStartPre=+/bin/sh -c 'port=${ENDPOINT_PORT:-3001}; pid=$(lsof -t -i:"$port" 2>/dev/null || fuser "$port"/tcp 2>/dev/null || true); [ -n "$pid" ] && echo "[endpoint-prestart] killing stale PID $pid on port $port" && kill -9 $pid && sleep 1 || true'
# Graceful escalation: SIGTERM → 3s wait → SIGKILL (only if still alive).
ExecStartPre=+/bin/sh -c 'port=${ENDPOINT_PORT:-3001}; pid=$(lsof -t -i:"$port" 2>/dev/null || fuser -t "$port"/tcp 2>/dev/null || true); [ -z "$pid" ] && exit 0; echo "[endpoint-prestart] SIGTERM PID $pid on port $port"; kill -TERM "$pid" 2>/dev/null || true; sleep 3; kill -0 "$pid" 2>/dev/null && { echo "[endpoint-prestart] escalating to SIGKILL"; kill -KILL "$pid" 2>/dev/null || true; sleep 1; } || true'
ExecStart=/usr/bin/node /var/www/html/Runewager/backend.js
User=root
Group=root
Expand Down
2 changes: 1 addition & 1 deletion runewager.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ TimeoutStopSec=30
# Logging: append mode — survives log rotation without restart
StandardOutput=append:/var/www/html/Runewager/logs/runewager.log
StandardError=append:/var/www/html/Runewager/logs/runewager-error.log
ReadWritePaths=/var/www/html/Runewager/logs /var/www/html/Runewager/data
ReadWritePaths=/var/www/html/Runewager/logs /var/www/html/Runewager/data /var/www/html/Runewager/qa
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
Expand Down