Say what changed, hold alerts during expected changes, and shorten the commands #27

2026-10-15T15:09:37-07:00

dejima-agent commented

2026-10-15 15:09:37 -07:00

Summary generated by LLM agent

Three things made a triggered guard hard to act on: the push said only "N file(s) changed", every planned update paged and needed a manual accept, and in a container every command needed cd into the compose directory plus a long prefix, then a second command to get the heartbeat back.

What changed

Alerts say what changed, in the guard's own words. The push names the kind of change and the watched area it falls under, from a fixed list in the guard, never the path: 1 file(s) modified in ~/.ssh/known_hosts, 1 file(s) added in /etc/apt. A known_hosts change gets a one-line explanation, since it is the commonest harmless one (cloning from a new git server). With guard_name set, the alert also says where to run dejima-guard report. report now lists each path as added, modified or removed, above the raw lines.

ignore_paths (space-separated substrings) keeps a change in the report without alerting on it. A critical path cannot be ignored.

dejima-guard expect [30m] opens an expected-changes window, on the guard only. Until it ends, change alerts and unreachable alerts (reboots) are held. Held changes still send the heartbeat; an unreachable devbox does not. At the end, a check started by expect accepts the state and sends a low-priority note saying what it accepted. If that check is lost, the first check after the deadline does it instead. Critical paths and containment still alert, and a window never accepts a critical path. accept closes a window early; expect --cancel closes one without accepting. Windows are capped at 24h.

Shorter commands.

accept runs a check afterwards, so the heartbeat resumes straight away.
New status command shows the baseline, last check, window and last finding.
bin/dejima-guard-docker installs on the container host as dejima-guard and runs docker exec dejima-guard dejima-guard "$@", so it works from any directory.

Supporting changes.

flock on the state directory, since the loop, an operator's accept and a window's waiting check can now overlap.
Both sides of the diff are sorted, so a baseline the guard rewrites compares line for line.
The compose example adds init: true to reap the waiting process.

Tested

bats test/: 140 tests, all passing, 18 of them new. They cover area wording with no devbox-chosen strings in the push, add/modify/remove pairing, ignore and critical-path precedence, held vs alerted cases inside a window, accepting at the deadline (real 1s window), critical paths surviving a window's accept, a window ending unreachable, --cancel, status, and the wrapper's docker exec arguments. shellcheck reports no warnings. Not tested: an actual container build. The image relies on setsid and flock from util-linux, which is Essential in Debian.

**Summary generated by LLM agent** Three things made a triggered guard hard to act on: the push said only "N file(s) changed", every planned update paged and needed a manual `accept`, and in a container every command needed `cd` into the compose directory plus a long prefix, then a second command to get the heartbeat back. ## What changed **Alerts say what changed, in the guard's own words.** The push names the kind of change and the watched area it falls under, from a fixed list in the guard, never the path: `1 file(s) modified in ~/.ssh/known_hosts, 1 file(s) added in /etc/apt`. A known_hosts change gets a one-line explanation, since it is the commonest harmless one (cloning from a new git server). With `guard_name` set, the alert also says where to run `dejima-guard report`. `report` now lists each path as added, modified or removed, above the raw lines. **`ignore_paths`** (space-separated substrings) keeps a change in the report without alerting on it. A critical path cannot be ignored. **`dejima-guard expect [30m]`** opens an expected-changes window, on the guard only. Until it ends, change alerts and unreachable alerts (reboots) are held. Held changes still send the heartbeat; an unreachable devbox does not. At the end, a check started by `expect` accepts the state and sends a low-priority note saying what it accepted. If that check is lost, the first check after the deadline does it instead. Critical paths and containment still alert, and a window never accepts a critical path. `accept` closes a window early; `expect --cancel` closes one without accepting. Windows are capped at 24h. **Shorter commands.** - `accept` runs a check afterwards, so the heartbeat resumes straight away. - New `status` command shows the baseline, last check, window and last finding. - `bin/dejima-guard-docker` installs on the container host as `dejima-guard` and runs `docker exec dejima-guard dejima-guard "$@"`, so it works from any directory. **Supporting changes.** - `flock` on the state directory, since the loop, an operator's `accept` and a window's waiting check can now overlap. - Both sides of the diff are sorted, so a baseline the guard rewrites compares line for line. - The compose example adds `init: true` to reap the waiting process. ## Tested `bats test/`: 140 tests, all passing, 18 of them new. They cover area wording with no devbox-chosen strings in the push, add/modify/remove pairing, ignore and critical-path precedence, held vs alerted cases inside a window, accepting at the deadline (real 1s window), critical paths surviving a window's accept, a window ending unreachable, `--cancel`, `status`, and the wrapper's `docker exec` arguments. shellcheck reports no warnings. Not tested: an actual container build. The image relies on `setsid` and `flock` from util-linux, which is Essential in Debian.

dejima-agent added 1 commit 2026-10-15 15:09:38 -07:00

Say what changed, hold alerts during expected changes, and shorten the commands ed2a843406

Alerts now name the kind of change and the watched area it falls under, from
a fixed list, and report lists each path as added, modified or removed.
ignore_paths keeps a change in the report without alerting on it.

dejima-guard expect opens a window that holds change and unreachable alerts,
then accepts at its end. Critical paths and containment still alert, and a
window never accepts a critical path.

accept now runs a check afterwards so the heartbeat resumes, status
summarises the guard's state, and bin/dejima-guard-docker runs any command in
the container from any directory.

branderson approved these changes 2026-10-15 15:40:49 -07:00

branderson merged commit 9c61a28e86 into main

2026-10-15 15:40:55 -07:00

dejima-agent referenced this pull request

2026-10-15 15:49:53 -07:00

Name /etc/nginx in alerts, and say both reasons known_hosts changes #28

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-guard#27