`scripts/canary-install/run-canary-with-cncp.sh`

45 lines
#!/bin/bash
# run-canary-with-cncp.sh — generic wrapper: run a read-only canary, and on a non-zero
# exit (3=ALERT, 2=INCONCLUSIVE) POST its /tmp result summary to CNCP parking-lot.
# promote-canary.sh schedules THIS wrapper (so launchd gets CNCP alerting the bare canary
# lacks). Read-only w.r.t. prod ($0). The canary itself never mutates; this only reads its
# /tmp json + POSTs a CNCP card on alert.
#
# Usage (what the plist runs):
#   bash run-canary-with-cncp.sh <canary-abs-path.mjs> <tmp-json-path> <label> [urgency]
# Example:
#   bash run-canary-with-cncp.sh \
#     "$HOME/Projects/designerwallcoverings/scripts/sitemap-integrity-canary/sitemap-integrity-canary.mjs" \
#     /tmp/sitemap-integrity-canary.json dw-sitemap-integrity P2
set -uo pipefail
CANARY="${1:?need canary script path}"
TMPJSON="${2:?need /tmp json path}"
LABEL="${3:?need label}"
URG="${4:-P2}"
CNCP="http://127.0.0.1:3333/api/parking-lot"

: > "/tmp/${LABEL}.log" 2>/dev/null || true   # truncate-on-start so the wrapper log can't grow unbounded (box never sleeps)
node "$CANARY"; rc=$?

# rc 0 = HEALTHY (no CNCP card — silence on green); 2 = INCONCLUSIVE; 3 = ALERT
if [ "$rc" -ne 0 ]; then
  verdict=$([ "$rc" -eq 3 ] && echo ALERT || echo INCONCLUSIVE)
  # Build the POST body with node JSON.stringify so a quote/newline in the summary can't
  # produce malformed JSON (CNCP {url,note} shape verified live this run). Plain-ASCII, capped.
  BODY=$(TMPJSON="$TMPJSON" LABEL="$LABEL" URG="$URG" VERDICT="$verdict" node -e '
    let d={}; try{ d=require(process.env.TMPJSON);}catch(e){}
    const a=(d.alerts||[]).join(" | ").replace(/[^\x20-\x7E]/g," ").slice(0,400);
    const note=`<!-- URGENCY: ${process.env.URG} --> [canary:${process.env.LABEL}] ${d.verdict||process.env.VERDICT}: ${a||"(no json summary)"}`;
    process.stdout.write(JSON.stringify({url:"file://"+process.env.TMPJSON, note}));
  ' 2>/dev/null)
  if [ -n "$BODY" ]; then
    code=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$CNCP" -H 'Content-Type: application/json' --data-binary "$BODY" 2>/dev/null || echo "000")
    echo "[run-canary-with-cncp] $LABEL rc=$rc → CNCP POST http=$code ($verdict)"
  else
    echo "[run-canary-with-cncp] $LABEL rc=$rc → could not build CNCP body (verdict $verdict); exit code still propagates"
  fi
else
  echo "[run-canary-with-cncp] $LABEL rc=0 HEALTHY → no CNCP card (silence on green)"
fi
exit "$rc"