Deploy a623efc to Docker Space

Source: MisonL/gpt-image-playground-customer@a623efcc28ea071e4a51a2753173829a0ee01002

public/hf-space-deploy-marker.json

@@ -1,5 +1,6 @@
 {
   "schema_version": 1,
-  "local_sha": "9bbfa7b63748719962755d5bcd75a62ce2415c5a",
-  "created_at": "2026-06-20T13:57:39.833Z"
+  "local_sha": "a623efcc28ea071e4a51a2753173829a0ee01002",
+  "created_at": "2026-06-21T06:16:41.993Z",
+  "deploy_id": "83a9c54d-c4df-43fc-8045-97fe4feadb16"
 }

scripts/deploy-hf-space.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -141,15 +142,34 @@ export function findRemoteDeletePaths(localFiles, remoteFiles) {
     return [...remoteFiles].filter((filename) => !localFiles.has(filename)).sort();
 }
 
-export function buildDeployMarker(localSha, createdAt = new Date()) {
+export function buildDeployMarker(localSha, createdAt = new Date(), deployId = randomUUID()) {
     if (!/^[0-9a-f]{40}$/.test(String(localSha || ''))) throw new Error('localSha must be a full git commit SHA.');
+    if (typeof deployId !== 'string' || !deployId.trim() || /[\r\n]/.test(deployId)) {
+        throw new Error('deployId must be a non-empty single-line string.');
+    }
     return {
         schema_version: 1,
         local_sha: localSha,
-        created_at: createdAt.toISOString()
+        created_at: createdAt.toISOString(),
+        deploy_id: deployId
     };
 }
 
+export function assertDeployMarkerMatches(marker, expectedMarker) {
+    if (!marker || typeof marker !== 'object') throw new Error('deploy marker response was not an object.');
+    if (marker?.schema_version !== expectedMarker.schema_version) throw new Error('deploy marker schema_version mismatch.');
+    if (marker.local_sha !== expectedMarker.local_sha) {
+        throw new Error(`deploy marker local_sha mismatch: expected ${expectedMarker.local_sha}, received ${marker.local_sha || 'missing'}.`);
+    }
+    if (marker.created_at !== expectedMarker.created_at) {
+        throw new Error(`deploy marker created_at mismatch: expected ${expectedMarker.created_at}, received ${marker.created_at || 'missing'}.`);
+    }
+    if (marker.deploy_id !== expectedMarker.deploy_id) {
+        throw new Error(`deploy marker deploy_id mismatch: expected ${expectedMarker.deploy_id}, received ${marker.deploy_id || 'missing'}.`);
+    }
+    return marker;
+}
+
 export function buildDeployMarkerRouteSource(marker) {
     const markerJson = JSON.stringify(marker);
     return `import { NextResponse } from 'next/server';
@@ -184,10 +204,10 @@ function readLocalGitFilesWithDeployMarker() {
     return files;
 }
 
-function uploadSourceTree(sourceDir, localSha) {
-    writeDeployMarker(sourceDir, buildDeployMarker(localSha));
+function uploadSourceTree(sourceDir, deployMarker) {
+    writeDeployMarker(sourceDir, deployMarker);
     const deletePaths = findRemoteDeletePaths(readLocalGitFilesWithDeployMarker(), readRemoteFilePaths());
-    const output = runText('hf', buildUploadArgs({ sourceDir, localSha, repoSlug: readRepositorySlug(), deletePaths }));
+    const output = runText('hf', buildUploadArgs({ sourceDir, localSha: deployMarker.local_sha, repoSlug: readRepositorySlug(), deletePaths }));
     return extractUploadCommitSha(output);
 }
 
@@ -196,26 +216,39 @@ function readSpaceInfo() {
     return parseJsonPayload(output, 'hf spaces info');
 }
 
-async function waitForRunning(spaceCommitSha, localSha) {
+export async function waitForRunning(spaceCommitSha, deployMarker, options = {}) {
+    const attempts = options.attempts || STATUS_POLL_ATTEMPTS;
+    const intervalMs = options.intervalMs ?? STATUS_POLL_INTERVAL_MS;
+    const readInfo = options.readInfo || readSpaceInfo;
+    const verifyMarker = options.verifyMarker || verifyDeployMarker;
+    const sleep = options.sleep || delay;
+    const log = options.log || console.log;
     let lastStage = 'unknown';
     let lastSha = 'unknown';
-    for (let attempt = 1; attempt <= STATUS_POLL_ATTEMPTS; attempt += 1) {
-        const info = readSpaceInfo();
+    let lastMarkerError = 'unknown';
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        const info = readInfo();
         lastStage = info.runtime?.stage || 'unknown';
         lastSha = info.sha || info.runtime?.raw?.sha || 'unknown';
-        console.log(`attempt=${attempt} stage=${lastStage} sha=${lastSha}`);
+        log(`attempt=${attempt} stage=${lastStage} sha=${lastSha}`);
         if (lastStage === 'RUNNING' && lastSha === spaceCommitSha) {
-            return { stage: lastStage, sha: lastSha };
+            try {
+                const marker = await verifyMarker(deployMarker);
+                return { stage: lastStage, sha: lastSha, service_marker_verified: true, marker };
+            } catch (error) {
+                lastMarkerError = error instanceof Error ? error.message : String(error);
+                log(`attempt=${attempt} marker_status=not_ready error=${lastMarkerError}`);
+            }
         }
-        await delay(STATUS_POLL_INTERVAL_MS);
+        await sleep(intervalMs);
     }
-    const marker = await verifyDeployMarker(localSha);
+    const marker = await verifyMarker(deployMarker);
     return {
         stage: lastStage,
         sha: lastSha,
         management_status: 'runtime_stage_not_running',
         service_marker_verified: true,
-        warning: `Space did not reach RUNNING for ${spaceCommitSha}; last stage=${lastStage} sha=${lastSha}`,
+        warning: `Space did not reach RUNNING with a matching service marker for ${spaceCommitSha}; last stage=${lastStage} sha=${lastSha} marker_error=${lastMarkerError}`,
         marker
     };
 }
@@ -224,16 +257,9 @@ async function fetchJson(path) {
     return fetchJsonWithTimeout(new URL(path, HF_SPACE_URL), { timeoutMs: PUBLIC_ENDPOINT_TIMEOUT_MS });
 }
 
-async function verifyDeployMarker(localSha) {
+async function verifyDeployMarker(expectedMarker) {
     const marker = await fetchJson(`${DEPLOY_MARKER_SERVICE_PATH}?t=${Date.now()}`);
-    if (marker?.schema_version !== 1) throw new Error('deploy marker schema_version was not 1.');
-    if (marker.local_sha !== localSha) {
-        throw new Error(`deploy marker local_sha mismatch: expected ${localSha}, received ${marker.local_sha || 'missing'}.`);
-    }
-    if (typeof marker.created_at !== 'string' || !marker.created_at.trim()) {
-        throw new Error('deploy marker created_at was missing.');
-    }
-    return marker;
+    return assertDeployMarkerMatches(marker, expectedMarker);
 }
 
 async function verifyPublicEndpoints() {
@@ -263,10 +289,11 @@ async function deploy() {
     assertCleanGitWorktree();
     runText('hf', ['auth', 'whoami']);
     const localSha = runText('git', ['rev-parse', 'HEAD']);
+    const deployMarker = buildDeployMarker(localSha);
     const sourceDir = prepareSourceTree();
     try {
-        const spaceCommitSha = uploadSourceTree(sourceDir, localSha);
-        const runtime = await waitForRunning(spaceCommitSha, localSha);
+        const spaceCommitSha = uploadSourceTree(sourceDir, deployMarker);
+        const runtime = await waitForRunning(spaceCommitSha, deployMarker);
         const verification = await verifyPublicEndpoints();
         console.log(
             JSON.stringify(

scripts/deploy-hf-space.test.mjs

@@ -3,12 +3,14 @@ import { describe, it } from 'node:test';
 
 import {
     GIT_ARCHIVE_MAX_BUFFER_BYTES,
+    assertDeployMarkerMatches,
     buildDeployMarker,
     buildDeployMarkerRouteSource,
     buildUploadArgs,
     extractUploadCommitSha,
     findRemoteDeletePaths,
-    parseRepositorySlug
+    parseRepositorySlug,
+    waitForRunning
 } from './deploy-hf-space.mjs';
 
 describe('HF Space deploy script', () => {
@@ -129,28 +131,121 @@ describe('HF Space deploy script', () => {
     });
 
     it('builds a non-secret deploy marker for service-side deployment verification', () => {
-        const marker = buildDeployMarker('3333333333333333333333333333333333333333', new Date('2026-06-20T10:00:00.000Z'));
+        const marker = buildDeployMarker(
+            '3333333333333333333333333333333333333333',
+            new Date('2026-06-20T10:00:00.000Z'),
+            'deploy-333'
+        );
 
         assert.deepEqual(marker, {
             schema_version: 1,
             local_sha: '3333333333333333333333333333333333333333',
-            created_at: '2026-06-20T10:00:00.000Z'
+            created_at: '2026-06-20T10:00:00.000Z',
+            deploy_id: 'deploy-333'
         });
         assert.doesNotMatch(JSON.stringify(marker), /key|token|secret|password/i);
     });
 
+    it('builds a unique deploy marker id when none is provided', () => {
+        const first = buildDeployMarker('3333333333333333333333333333333333333333', new Date('2026-06-20T10:00:00.000Z'));
+        const second = buildDeployMarker('3333333333333333333333333333333333333333', new Date('2026-06-20T10:00:00.000Z'));
+
+        assert.match(first.deploy_id, /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+        assert.notEqual(first.deploy_id, second.deploy_id);
+    });
+
     it('rejects short deploy marker commit shas before upload', () => {
         assert.throws(() => buildDeployMarker('3333333'), /full git commit SHA/);
     });
 
+    it('rejects unsafe deploy marker ids before upload', () => {
+        assert.throws(
+            () =>
+                buildDeployMarker(
+                    '3333333333333333333333333333333333333333',
+                    new Date('2026-06-20T10:00:00.000Z'),
+                    'deploy\n333'
+                ),
+            /deployId must be/
+        );
+    });
+
+    it('rejects stale deploy markers from an older same-commit deployment', () => {
+        const expected = buildDeployMarker(
+            '3333333333333333333333333333333333333333',
+            new Date('2026-06-20T10:00:00.000Z'),
+            'deploy-current'
+        );
+        const stale = buildDeployMarker(
+            '3333333333333333333333333333333333333333',
+            new Date('2026-06-20T09:00:00.000Z'),
+            'deploy-stale'
+        );
+
+        assert.throws(() => assertDeployMarkerMatches(stale, expected), /created_at mismatch/);
+        assert.deepEqual(assertDeployMarkerMatches(expected, expected), expected);
+    });
+
+    it('rejects deploy markers with a stale deploy id even when the source commit and timestamp match', () => {
+        const expected = buildDeployMarker(
+            '3333333333333333333333333333333333333333',
+            new Date('2026-06-20T10:00:00.000Z'),
+            'deploy-current'
+        );
+        const stale = {
+            ...expected,
+            deploy_id: 'deploy-stale'
+        };
+
+        assert.throws(() => assertDeployMarkerMatches(stale, expected), /deploy_id mismatch/);
+    });
+
+    it('waits for the public service marker after management reports the new Space commit running', async () => {
+        const marker = buildDeployMarker(
+            '5555555555555555555555555555555555555555',
+            new Date('2026-06-20T12:00:00.000Z'),
+            'deploy-555'
+        );
+        let verifyCount = 0;
+
+        const runtime = await waitForRunning('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', marker, {
+            attempts: 2,
+            intervalMs: 0,
+            readInfo: () => ({
+                runtime: { stage: 'RUNNING' },
+                sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+            }),
+            verifyMarker: async () => {
+                verifyCount += 1;
+                if (verifyCount === 1) throw new Error('deploy marker deploy_id mismatch');
+                return marker;
+            },
+            sleep: async () => {},
+            log: () => {}
+        });
+
+        assert.equal(verifyCount, 2);
+        assert.deepEqual(runtime, {
+            stage: 'RUNNING',
+            sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            service_marker_verified: true,
+            marker
+        });
+    });
+
     it('builds a no-store API route for service-side deploy marker verification', () => {
-        const marker = buildDeployMarker('4444444444444444444444444444444444444444', new Date('2026-06-20T11:00:00.000Z'));
+        const marker = buildDeployMarker(
+            '4444444444444444444444444444444444444444',
+            new Date('2026-06-20T11:00:00.000Z'),
+            'deploy-444'
+        );
         const source = buildDeployMarkerRouteSource(marker);
 
         assert.match(source, /NextResponse\.json/);
         assert.match(source, /Cache-Control/);
         assert.match(source, /no-store/);
         assert.match(source, /4444444444444444444444444444444444444444/);
+        assert.match(source, /deploy-444/);
         assert.doesNotMatch(source, /key|token|secret|password/i);
     });
 

src/app/api/deploy-marker/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from 'next/server';
 
-const deployMarker = {"schema_version":1,"local_sha":"9bbfa7b63748719962755d5bcd75a62ce2415c5a","created_at":"2026-06-20T13:57:39.833Z"} as const;
+const deployMarker = {"schema_version":1,"local_sha":"a623efcc28ea071e4a51a2753173829a0ee01002","created_at":"2026-06-21T06:16:41.993Z","deploy_id":"83a9c54d-c4df-43fc-8045-97fe4feadb16"} as const;
 
 export const dynamic = 'force-dynamic';