Skip to content

Claude/cpu guard script dn d8u #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gamblecodezcom merged 15 commits into from
Mar 3, 2026
Merged

Claude/cpu guard script dn d8u #127

Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
c1ad46c
fix: resolve merge conflicts — squash all branch changes onto current…
claude Mar 3, 2026
722c7a0
fix: prevent EADDRINUSE crash-loops and lock Express version
claude Mar 3, 2026
66322f4
feat: add gcz_cpu_guard.sh — passive GCZ stack CPU monitor
claude Mar 3, 2026
7250d44
fix: scope pkill pattern to PROJECT_DIR to avoid killing unrelated no…
claude Mar 3, 2026
18f959f
chore: remove gcz_cpu_guard.sh from repo; whitelist it in rw_cpu_guard
claude Mar 3, 2026
5e9d1fa
fix(security): drop root privileges — run services as runewager user
claude Mar 3, 2026
4fe5dc5
fix: resolve merge conflicts with main — keep security improvements
claude Mar 3, 2026
613da2f
fix: address code review issues in backend.js and prod-run.sh
claude Mar 3, 2026
ab189aa
fix: address remaining code review items (kill escalation, stream gua…
claude Mar 3, 2026
f7f9b6b
fix: resolve merge conflicts — keep stream guards and graceful kill e…
claude Mar 3, 2026
0e300b6
fix: escape PROJECT_DIR in pkill pattern; return 400 on missing rawBody
claude Mar 3, 2026
63bfc3b
fix: add -t flag to fuser so port-clear prestart gets bare PIDs
claude Mar 3, 2026
4f3dd8a
fix: add qa/ to ReadWritePaths — ProtectSystem=strict blocked repo_in…
claude Mar 3, 2026
5375bba
fix(prod-run): robust _esc_dir helper, deduplicate, silence fallback …
claude Mar 3, 2026
639145d
merge: resolve prod-run.sh conflicts from origin/main
claude Mar 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions prod-run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ say() { printf '[%s] %s\n' "$APP_NAME" "$*"; }
warn() { printf '[%s][warn] %s\n' "$APP_NAME" "$*" >&2; }
err() { printf '[%s][error] %s\n' "$APP_NAME" "$*" >&2; }

# Escape a string for safe use as a literal substring in an ERE/BRE regex.
# Escapes every character that is not alphanumeric, underscore, or forward-slash.
esc_regex_str() { printf '%s' "$1" | sed 's/[^[:alnum:]_/]/\\&/g'; }


SERVICE_USER="$APP_NAME"
SERVICE_GROUP="$APP_NAME"
Expand Down Expand Up @@ -318,7 +322,7 @@ KillSignal=SIGTERM
TimeoutStopSec=20
StandardOutput=append:${MAIN_LOG}
StandardError=append:${ERROR_LOG}
ReadWritePaths=${PROJECT_DIR}/logs ${PROJECT_DIR}/data
ReadWritePaths=${PROJECT_DIR}/logs ${PROJECT_DIR}/data ${PROJECT_DIR}/qa
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
Expand Down Expand Up @@ -404,9 +408,11 @@ if ! touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null; then
warn "Cannot write to $ENDPOINT_LOG_DIR — falling back to /tmp for endpoint logs"
ENDPOINT_LOG="/tmp/runewager-backend.log"
ENDPOINT_ERR="/tmp/runewager-backend-error.log"
touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" || true
touch "$ENDPOINT_LOG" "$ENDPOINT_ERR" 2>/dev/null || true
fi

_esc_dir="$(esc_regex_str "$PROJECT_DIR")"

if command -v systemctl >/dev/null 2>&1; then
# Install/refresh the service unit from repo copy
if [[ -f "$ENDPOINT_SERVICE_SRC" ]]; then
Expand All @@ -429,7 +435,6 @@ if command -v systemctl >/dev/null 2>&1; then
say "runewager-endpoint restarted via systemd"
else
warn "systemctl restart runewager-endpoint failed — falling back to nohup"
_esc_dir="$(printf '%s' "$PROJECT_DIR" | sed 's/[.[\*^$()+?{|]/\\&/g')"
pkill -f "node .*${_esc_dir}/backend\.js" 2>/dev/null || true
sleep 1
# Re-check port: another process may have bound it during the failed systemd restart window
Expand All @@ -445,7 +450,6 @@ if command -v systemctl >/dev/null 2>&1; then
fi
else
# No systemd — direct nohup
_esc_dir="$(printf '%s' "$PROJECT_DIR" | sed 's/[.[\*^$()+?{|]/\\&/g')"
pkill -f "node .*${_esc_dir}/backend\.js" 2>/dev/null || true
sleep 1
if is_port_listening "$ENDPOINT_PORT"; then
Expand Down