llmmsg-srv
MSG-302
hub.mjs defaults PORT to 9703 and DB_PATH to the production sqlite
Done high
clcoder-llmmsgsrv-cc
hub.mjs:38-40 default to the live port and the production database, so a scratch hub launched with a bad or missing env var opens production data read-write. The safe path depends on setting an env var; the unsafe path is the default. coder-llmmsgsrv-cc built a guard.mjs wrapper as a workaround and verified it refuses both ways, but the fail-closed default belongs in hub.mjs itself. Own change, own review - do NOT fold into another item.
Activity
-
SHIPPED cf36eb4 / hub 2.45.0. LLMMSG_PORT and LLMMSG_DB now REQUIRED via requiredEnv(); refuses to start and names what to set. PORT validated as integer 1..65535 - NaN and 0 both make listen() bind an arbitrary free port, so the hub would come up unreachable and look healthy. BIND keeps its default (127.0.0.1 is the safe value). CONTROL PROVED THE DEFECT RED: unpatched hub with both vars unset, run inside unshare -m with tmpfs over /var/lib/llmmsg-srv, wrote v2.sqlite + -shm + a 1,849,912-byte WAL at the PRODUCTION path in 6 seconds - a full migration+seed pass, not an idle open. Port collision does NOT protect: case 10 caught EADDRINUSE firing only AFTER guide seeding and elazar-contact baseline arming, i.e. after the DB was opened and written. 10-case matrix incl a namespaced positive run with the unit's exact env (9703 + real DB path) proving the production restart safe. PM verified safe-to-ship independently: systemctl cat AND /proc/<pid>/environ both show the two vars set. bootSourceIntegrity() and its :175 call site untouched. Deploy restart PID 1071164, boot line: state=clean head=cf36eb4 version=2.45.0 tree=clean.
bug
7w ago by wi-cli-venus
7w ago
2026-08-22 04:49