serve.zone/onebox
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 82 Wiki Activity

82 Releases 305 Tags

RSS Feed
  • v32.5.0 33912999a6
    Compare

    Onebox v32.5.0
    Release / build-and-release (push) Successful in 25m4s
    Details
    Stable

    jkunz released this 2026-09-23 18:45:52 +00:00 | 169 commits to main since this release

    2026-09-23 - 32.5.0

    Features

    • Move a completed Corestore engine conversion to this release's pinned Corestore image with migration corestore-engine --replace-completed-target-image <digest> --migration-id <id> --expected-prior-image <digest> --expected-target-container <id>, run offline like the other conversion modes. Before anything changes, Onebox requires the phase complete, the exact conversion id, current target image and container, every Onebox service stopped with its runtime at zero and no running platform consumer of Corestore. It pulls the candidate by digest and admits only a newer release of the same Corestore major by the images' OCI release labels, so a downgrade, a same-version re-release and a major change are refused. It records the running prior owner's readiness, a digest of its value-free resource inventory and, as priorConsumerServiceIds, the Corestore service ids of the Onebox platform services that inventory names as consumers, for which Onebox keeps no binding of its own, then journals the attempt in a separate corestore-engine-completed-target record. The prior target is retained stopped under its recovery name and an exact candidate opens the same staged volume, which is never exported again. The conversion journal names the candidate only after it answered readiness, served the prior inventory and became the running owner, and it records the same completed handoff an active-target replacement appends, so the unchanged 32.4 journal reader still accepts it. Any failure before that commit stops and keeps the candidate as onebox-migration-engine-target-retired-<id>-<attempt>, restores and re-proves the prior target, and leaves the journal unchanged. An interrupted attempt or restore resumes with the same arguments without repeating a finished step. Startup refuses a pending attempt with the exact command that resumes it, a record that disagrees with the journal by the rule it breaks, pointing to --status without a resume command even while its last attempt is pending, and a running retired candidate. A failure after the journal commit never restores: the attempt stays pending, and the command exits non-zero with the cause and that resume command, which carries the attempt's own prior image and container rather than the candidate --status then reports as the target; a command built from the status is refused with the same resume command. That rerun keeps the attempt's writer fence: it first proves that every Onebox service is stopped with its Swarm runtime at zero, that no consumer the attempt recorded runs, that the journal names the candidate, that the attempt is owner-selected, that its prior target is stopped under its recovery name and that no retired candidate runs, refuses by name otherwise, and then starts the exact candidate if it was stopped; it never restarts a running candidate, starts the prior target or creates a container. Once the candidate answers, a running consumer its inventory names that the admission did not record is refused by name as well, and the attempt stays pending until the consumer is stopped. --status lists every attempt and states completedTargetState as none, settled, pending, committed or diverged, and it shows a record that disagrees with the journal instead of refusing it: completedTargetDivergence names the broken rule and shows the record's attempt, step and handoff index beside the journal's target and handoff history. Never roll back the Onebox binary while an attempt is pending, because 32.4 does not read the completed-target record; finish the attempt first and replace the binary only while completedTargetState is none or settled. The change adds no startup data migration; the data version stays 0.20.0. This release keeps Corestore 32.2.3 pinned, so a conversion that completed on 32.2.3 has nothing newer to move to until a release pins a newer Corestore.
    • Bundle @serve.zone/appstore 32.1.1 (from 32.0.1). Its cloudly template 1.2.0 moves Cloudly to 32.9.0 with the 1.1.10 runtime contract unchanged, requires Onebox 32.4.0, migrates the Cloudly data to 0.20.0 at startup and needs a full restore to roll back. The App Store upgrade test now prepares the 1.1.10 to 1.2.0 upgrade of an install that runs a Cloudly image set outside the template, as central does.

    Fixes

    • Name a failed Corestore engine journal, completed-target record or platform-owner write during an active or completed target replacement with its own error instead of reporting a concurrent change. The write is still accepted when its exact postcondition holds after a lost response; when it does not, the error states write failed with the write's message and keeps the write error as its cause, also when the postcondition cannot be read either.
    • Report a failed offline migration corestore-platform or migration corestore-engine command by its own error when Onebox's offline maintenance then fails to shut down. The shutdown failure is attached as the command error's cause, named Onebox offline maintenance did not shut down after the command failed and kept beside any cause the error already had, instead of replacing it, and a successful command whose shutdown fails now fails as Onebox offline maintenance did not shut down after the command completed.
    • Print the cause chain of a failed CLI command. After the error message, each attached cause follows on its own line under caused by:, and the members of a combined failure under -, so an attached shutdown or teardown failure reaches the operator. The chain stops after eight levels and never repeats an error, and it prints messages only, never stack traces. A command that runs in the daemon prints the daemon's error message once.
    • Never quote secret-bearing input that fails to parse. Each of these inputs is named by what it is when it is not valid JSON: App Store secret env stdin as App Store secret env stdin is not valid JSON instead of App Store secret env stdin must be one JSON object, a decrypted credential as Decrypted credential is not valid JSON, a persisted hosted-app OIDC signing key as Persisted hosted-app OIDC signing key is not valid JSON, the managed dcrouter config as Managed dcrouter config is not valid JSON, a Corestore control API response, including the provision and credential-material responses, as Corestore control API <method> <path> response is not valid JSON, and backup content as Backup service configuration is not valid JSON, Backup platform-resource metadata is not valid JSON, Valkey backup export is not valid JSON, Corestore database backup receipt is not valid JSON or S3 bundle manifest is not valid JSON. An App Store migration script whose output is not valid JSON is logged as Migration script output is not valid JSON with the output's byte length, instead of with the first 200 characters of the output, which carry the service's environment values. A managed dcrouter config that cannot be read is reported as Managed dcrouter config cannot be read: <error> instead of as invalid JSON. The daemon logs a malformed control request line by its size only, as Invalid Onebox control request: the <n>-byte request line is not valid JSON, and the CLI reports a malformed daemon response line the same way, as Invalid Onebox control response: the <n>-byte response line is not valid JSON. None keeps the parser's error, not even as a cause, because its message quotes the text it could not read.

    Maintenance

    • Raise the build, test and release tooling to its current line: @git.zone/tsbuild 4.6.0, @git.zone/tsbundle 2.14.0 (bundles now compile with the project's own tsconfig.json), @git.zone/tstest 6.2.0, @git.zone/tsrun 3.0.0 and @types/node 26.6.1; pnpm stays 12.4.2 because newer releases are inside the seven-day release-age window. tsrun 3 gives the development entry cli.ts.js Node's standard process.argv, so node ./cli.ts.js <command> reaches the CLI with all of its arguments; under tsrun 2 the CLI's process.argv.slice(2) lost the first two. The binary's Deno runtime lock is unchanged. The Node development tree now resolves @push.rocks/smartserve 6.3.1, which tstest 6.2.0 brings in, as the peer of @api.global/typedsocket and @serve.zone/api, where the binary keeps 6.2.4.
    • Remove the Docker manager's runAutoRemovingMaintenanceContainer and cleanupDiagnosticContainerAttempt and the expectJsonOutput option of runMaintenanceContainer, which have had no caller since the Secrets v2 cutover engine was deleted.
    Downloads