release 1.18.2: refuse stale mon HTML / box-drawing generator assets

VERSION

@@ -1 +1 @@
-1.18.1
+1.18.2

VERSIONS.md

@@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.18.2** | 2026-07-19 | **Bugfix:** never publish / accept **stale mon HTML assets** — refuse pre-1.15.8 box-drawing sticky JS in site-gen + generated pages; monpages ERROR on public pages still carrying that JS or teed `SyntaxWarning: invalid escape sequence`; purge `site-gen/__pycache__` after suite reset; convert with `PYTHONWARNINGS=error::SyntaxWarning`. |
 | **v1.18.1** | 2026-07-19 | **Bugfix:** (1) mon HTML sticky/err counts honor French badges **ERREUR** / **AVERT** (were plain → 0 errors on FP pages); (2) `stage-lfp` + `INSIDE_PODMAN=1` uses **host-podman** (no empty `INSIDE_SSH` fail); (3) reaffirm filter JS has no box-glyph/`\\-` regex (charCodeAt only — kills SyntaxWarning “geheimsprache” noise). |
 | **v1.18.0** | 2026-07-19 | **Feature:** mattermost — client compatibility matrix: **mobile**, **desktop**, **vendor support** floors (default ≥10.11.0, ERROR) + **web** WARN on EOL; env `MATTERMOST_DESKTOP/SUPPORT_MIN_SERVER`, `MATTERMOST_CLIENT_CHECK`. |
 | **v1.17.0** | 2026-07-19 | **Feature:** mattermost phase — check **server version** (`X-Version-Id`) against **mobile store min** (default **≥10.11.0**); ERROR when too old (newest Android/iOS apps break); env `MATTERMOST_MOBILE_MIN_SERVER` / `MATTERMOST_MOBILE_CHECK=0`. |

check_monitoring_pages.sh

@@ -227,6 +227,25 @@ is_bootstrap_html() {
     && ! grep -qE 'taler-mon:top|id="mon-console"|class="console"' "$f" 2>/dev/null
 }
 
+# Stale mon HTML from pre-1.15.8 generators: box-drawing char-class regex in
+# sticky filter JS (Python SyntaxWarning: invalid escape sequence '\-').
+# Never accept these as "current" public assets (v1.18.2+).
+is_stale_generator_html() {
+  local f="$1"
+  # Old isLowValue() JS (literal box glyphs + \- class)
+  if grep -qE 'if \(/\^\[[╔╗╚╝║═]' "$f" 2>/dev/null; then
+    return 0
+  fi
+  # Converter noise teed into old logs and re-rendered
+  if grep -qiE 'SyntaxWarning: invalid escape sequence' "$f" 2>/dev/null; then
+    return 0
+  fi
+  if grep -qiE 'console_to_html\.py:[0-9]+: SyntaxWarning' "$f" 2>/dev/null; then
+    return 0
+  fi
+  return 1
+}
+
 # True if body looks like our monitoring HTML (not merchant API / WP 404 / bootstrap).
 is_monitoring_html() {
   local f="$1"
@@ -475,6 +494,19 @@ check_one() {
       return 0
     fi
 
+    # Stale generator JS / SyntaxWarning in public body (pre-1.15.8 assets)
+    if is_stale_generator_html "$body"; then
+      if [ "$attempt" -lt "$max_try" ]; then
+        attempt=$((attempt + 1))
+        sleep "$sleep_s" 2>/dev/null || sleep 1
+        continue
+      fi
+      _mon_fail_or_soft "public mon page stale generator" \
+        "$url -> old mon HTML (box-drawing JS regex and/or SyntaxWarning in body) — re-run host-agent on suite ≥v1.15.8 / v1.18.2; do not leave pre-update assets live" || { rm -f "$body"; return 1; }
+      rm -f "$body"
+      return 0
+    fi
+
     if ! is_monitoring_html "$body"; then
       if [ "$attempt" -lt "$max_try" ]; then
         attempt=$((attempt + 1))

host-agent/run-host-report.sh

@@ -353,13 +353,29 @@ htmlify_host() {
   mkdir -p "$HTML_BASE/$host/${HTML_OK_DIR}" "$HTML_BASE/$host/${HTML_ERR_DIR}"
 
   if [ -n "$SITE_GEN" ] && [ -f "$SITE_GEN/console_to_html.py" ]; then
-    # PYTHONWARNINGS: never let SyntaxWarning leak into the suite log (tee).
-    # stderr → agent log file only, not the mon console stream.
+    # Never convert with a pre-1.15.8 generator (old assets → SyntaxWarning + bad sticky JS).
+    if grep -qE 'if \(/\^\[[╔╗╚╝║═]' "$SITE_GEN/console_to_html.py" 2>/dev/null; then
+      echo "ERROR: refuse stale site-gen $SITE_GEN/console_to_html.py (box-drawing JS regex)" >&2
+      return 1 2>/dev/null || exit 1
+    fi
+    # SyntaxWarning = generator regression: fail convert (do not publish old-style pages).
+    # Other stderr still goes to agent log file only, not the mon console stream.
     _mon_html_py() {
-      PYTHONWARNINGS=ignore::SyntaxWarning \
-        python3 "$SITE_GEN/console_to_html.py" "$@" 2>>"${LOG_DIR:-/tmp}/console_to_html.err"
+      local _out="" _i
+      for _i in "$@"; do
+        if [ "$_i" = "--out" ]; then _out=1; continue; fi
+        if [ "$_out" = "1" ]; then _out="$_i"; break; fi
+      done
+      PYTHONWARNINGS=error::SyntaxWarning \
+        python3 "$SITE_GEN/console_to_html.py" "$@" 2>>"${LOG_DIR:-/tmp}/console_to_html.err" || return 1
+      # Never leave pre-1.15.8 sticky JS in a just-written page (stale log text is filtered in converter).
+      if [ -n "$_out" ] && [ -f "$_out" ] && grep -qE 'if \(/\^\[[╔╗╚╝║═]' "$_out" 2>/dev/null; then
+        echo "ERROR: generated mon HTML still has stale box-drawing JS: $_out" >&2
+        return 1
+      fi
+      return 0
     }
-    _mon_html_py \
+    if ! _mon_html_py \
       --lang "${TALER_MON_LANG:-en}" \
       --log "$LOG" \
       --out "$mon_err" \
@@ -373,37 +389,49 @@ htmlify_host() {
       --page-label "$PAGE_LABEL" \
       --path-err "$HTML_URL_ERR" \
       --link-other "$HTML_URL_OK"
+    then
+      echo "ERROR: mon HTML convert failed (err page) for $host — refuse publish of stale/broken assets" >&2
+      return 1 2>/dev/null || exit 1
+    fi
     if [ "$ec" -eq 0 ]; then
-      _mon_html_py \
-      --lang "${TALER_MON_LANG:-en}" \
+      if ! _mon_html_py \
+        --lang "${TALER_MON_LANG:-en}" \
         --log "$LOG" \
         --out "$mon" \
         --hostname "$host" \
         --mode ok \
         --commit "${COMMIT:-}" \
         --commit-url "${COMMIT_URL:-}" \
-      --suite-version "${SUITE_VERSION:-unknown}" \
-      --suite-version-url "${SUITE_VERSION_URL:-}" \
+        --suite-version "${SUITE_VERSION:-unknown}" \
+        --suite-version-url "${SUITE_VERSION_URL:-}" \
         --suite-path "$SUITE_PATH" \
         --page-label "$PAGE_LABEL" \
         --path-err "$HTML_URL_ERR" \
         --link-other ""
+      then
+        echo "ERROR: mon HTML convert failed (ok page) for $host" >&2
+        return 1 2>/dev/null || exit 1
+      fi
       rm -rf "$HTML_BASE/$host/${HTML_ERR_DIR}"
       echo "html $host → ${HTML_URL_OK} only (clean · ${COMMIT_SHORT:-?})"
     else
-      _mon_html_py \
-      --lang "${TALER_MON_LANG:-en}" \
+      if ! _mon_html_py \
+        --lang "${TALER_MON_LANG:-en}" \
         --log "$LOG" \
         --out "$mon" \
         --hostname "$host" \
         --mode redirect \
         --commit "${COMMIT:-}" \
         --commit-url "${COMMIT_URL:-}" \
-      --suite-version "${SUITE_VERSION:-unknown}" \
-      --suite-version-url "${SUITE_VERSION_URL:-}" \
+        --suite-version "${SUITE_VERSION:-unknown}" \
+        --suite-version-url "${SUITE_VERSION_URL:-}" \
         --suite-path "$SUITE_PATH" \
         --page-label "$PAGE_LABEL" \
         --path-err "$HTML_URL_ERR"
+      then
+        echo "ERROR: mon HTML convert failed (redirect page) for $host" >&2
+        return 1 2>/dev/null || exit 1
+      fi
       echo "html $host → ${HTML_URL_OK} stub + ${HTML_URL_ERR} (ec=$ec · ${COMMIT_SHORT:-?})"
     fi
   else

host-agent/update-suite.sh

@@ -142,4 +142,12 @@ fi
 
 ln -sfn "$SUITE_DIR" "$HOME/taler-monitoring" 2>/dev/null || true
 chmod +x taler-monitoring.sh check_*.sh host-agent/*.sh site-gen/*.sh site-gen/*.py 2>/dev/null || true
+# Drop bytecode so a stale site-gen never wins over the tree we just reset to.
+rm -rf "$SUITE_DIR/site-gen/__pycache__" 2>/dev/null || true
+# Refuse known-bad pre-1.15.8 generator (box-drawing JS regex → SyntaxWarning noise)
+if [ -f "$SUITE_DIR/site-gen/console_to_html.py" ] \
+  && grep -qE 'if \(/\^\[[╔╗╚╝║═]' "$SUITE_DIR/site-gen/console_to_html.py" 2>/dev/null; then
+  _upd_die "site-gen/console_to_html.py still has pre-1.15.8 box-drawing JS regex — refuse stale generator"
+  return 1 2>/dev/null || exit 1
+fi
 return 0 2>/dev/null || true