@coreplane/switchboard 0.0.0 → 1.18.0

package/dist/assets/deploy/cloudflare-resident/wrangler.template.jsonc

@@ -0,0 +1,120 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "{{script}}",
+  "main": "worker.ts",
+  "compatibility_date": "2026-08-01",
+  // @cloudflare/sandbox@next needs Node builtins (same as the SDK's own examples).
+  "compatibility_flags": ["nodejs_compat"],
+  // The installation's Cloudflare account (deploy/profile.json `account`) — every Worker deploys to it.
+  "account_id": "{{account}}",
+  // Reachable only with the RESIDENT_ADMIN_TOKEN / RESIDENT_OPERATOR_TOKEN
+  // bearer secrets (plus an unauthenticated GET /healthz wake ping). Custom
+  // domain on the installation's zone so the bot config has a stable URL.
+  "workers_dev": false,
+  "routes": [{ "pattern": "{{hostname}}", "custom_domain": true }],
+  "observability": { "enabled": true },
+  "vars": {
+    // The state Worker (deploy/cloudflare-memory/): where scheduled() records
+    // each resident-watchdog firing. Public URL — a var, not a
+    // secret; the bearer is the MEMORY_TOKEN secret (deploy/secrets.manifest.json).
+    // A profile without a memory Worker renders no var: firings go unrecorded.
+    // {{#if urls.stateWorkerUrl}}
+    "STATE_WORKER_URL": "{{urls.stateWorkerUrl}}",
+    // {{/if}}
+    // Presigned snapshot transfers (docs/reference/specs/resident-repos.md item 61):
+    // with these two vars AND the R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY
+    // secrets (deploy/secrets.manifest.json) present, the container moves
+    // archive bytes itself over presigned R2 URLs and the Durable Object stays
+    // out of the data path; any one absent → the SDK's local-bucket mode.
+    // BACKUP_BUCKET_NAME MUST equal the BACKUP_BUCKET
+    // binding's bucket below — the SDK signs URLs for this name, the offboard
+    // sweep deletes through the binding. Public config, not secrets.
+    "CLOUDFLARE_ACCOUNT_ID": "{{account}}",
+    "BACKUP_BUCKET_NAME": "{{script}}-cache"
+  },
+  "containers": [
+    {
+      "class_name": "ResidentDO",
+      // The profile's image mode decides (src/deploy/images.ts): `build` renders
+      // ./Dockerfile, built by wrangler at deploy time; `registry` renders the
+      // release's published image as copied into this account's registry by
+      // `deploy images`. The Dockerfile extends docker.io/cloudflare/sandbox:<version>,
+      // whose tag MUST match the @cloudflare/sandbox version in package.json
+      // EXACTLY (no 'latest' tag exists) — bump both together.
+      "image": "{{image}}",
+      // Custom 4 vCPU / 12 GiB / 20 GB — the platform's custom-type ceiling
+      // (the same shape as standard-4, kept in object form so the sizing test
+      // can read it). This ONE type is every resident's container (one DO per
+      // repo, one container class), so it is sized for the largest onboarded
+      // repo and for 16 threads sharing it. The CPU is the decision now: with
+      // one vCPU every thread's test run and the refresh cycle's own install
+      // shared a single core (the fifty-concurrent-runs plan, D6). Memory
+      // follows the CPU (Cloudflare requires >=3 GiB per vCPU → 12 GiB), and
+      // the disk follows the memory (<=2 GB per GiB → 20 GB). The disk
+      // arithmetic is over measured parts, checked by instanceSizing.test.ts
+      // against this file: the resident of a large monorepo filled the
+      // original 8 GB in 45 min (provision, one thread attached 42 min later,
+      // ENOSPC 6 min after that). Measured inside the resident
+      // (docs/reference/specs/resident-repos.md item 55): image 552 MB + mirror 380
+      // + warm checkout 2772 (history 380, tree 94, pnpm node_modules 2298) +
+      // the reserve the attach admission holds back (snapshot staging + a
+      // 1 GiB floor, 2965) = 6669 MB base; a hardlinked thread tree 555 MB; a
+      // thread whose lockfile differs 2853 MB; 20 000 MB mounts as ~18 858 MB
+      // usable → 16 hardlinked + 1 installing trees (or 12 + 2) fit; the
+      // pool's 16 + 2 does not fit even this ceiling, so the disk stays a
+      // BUDGET (residentDiskBudget.ts): the next tree past it is refused
+      // `disk-pressure` and runs cold, never ENOSPC. The pnpm store holds no
+      // second copy of the deps (measured).
+      //
+      // Cost: vCPU bills on ACTIVE use only; memory and disk bill on the
+      // provisioned size while awake, and a resident is effectively always-on
+      // (10-min refresh alarm < 20m sleepAfter) — about $83/mo provisioned per
+      // resident (memory ~$79 + disk ~$4) vs ~$55 at 8 GiB / 16 GB, plus vCPU
+      // when the cores are busy (up to ~$210/mo with all four pinned, which
+      // under load they are meant to be). History: standard-1 (½ vCPU / 4 GiB
+      // / 8 GB) → 1 vCPU (a resident pinned at 100% of ½ vCPU, memory fine) →
+      // 8 GiB for the 16 GB of disk it unlocks → 4 vCPU / 12 GiB / 20 GB for
+      // 16 concurrent seats. That monorepo's console build asks for a 16 GB
+      // node heap, so if `build` ever becomes a real command this is still
+      // not the ceiling. Custom-type constraints: whole vCPUs 1-4, >=3 GiB per
+      // vCPU, <=2 GB disk per GiB, at most 12 GiB / 20 GB. (The thread-sandbox
+      // Worker is the predefined standard-4 — the same 4 vCPU / 12 GiB / 20 GB,
+      // reached from the other side: one cold thread must be able to typecheck
+      // a large monorepo alone — and it is awake only for one run.)
+      "instance_type": { "vcpu": 4, "memory_mib": 12288, "disk_mb": 20000 },
+      // Platform ceiling only. The enforced cap is RESIDENT_CAP (6) in
+      // worker.ts — deliberately below this so an onboard is always refused
+      // atomically by the registry, never by a platform scheduling failure.
+      "max_instances": 10
+    }
+  ],
+  "durable_objects": {
+    "bindings": [
+      // One ResidentDO (Sandbox subclass = container) per onboarded resource;
+      // the DO name IS the resource id ("repo:<slug>").
+      { "name": "RESIDENT", "class_name": "ResidentDO" },
+      // Singleton registry: onboarded set + command table + cap enforcement.
+      { "name": "REGISTRY", "class_name": "ResidentRegistryDO" }
+    ]
+  },
+  "migrations": [{ "tag": "v1", "new_sqlite_classes": ["ResidentDO", "ResidentRegistryDO"] }],
+  // Resident cache + snapshots. The binding name BACKUP_BUCKET is load-bearing:
+  // metadata reads and the offboard sweep go through it, and the SDK's
+  // local-bucket mode (createBackup({ localBucket: true })) moves the archive
+  // bytes through it too — via the Durable Object, which is what put a 128 MB
+  // isolate in the data path of a 1.16 GB restore (item 61). Production
+  // mode is presigned: the CLOUDFLARE_ACCOUNT_ID / BACKUP_BUCKET_NAME vars
+  // above plus the R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY secrets let the
+  // container move the bytes itself; with any of the four absent the Worker
+  // falls back to local mode and says so on /healthz. The bucket is named after
+  // this Worker's script (`<script>-cache`), so two installations on one
+  // account never share one — and BACKUP_BUCKET_NAME must say the same name.
+  "r2_buckets": [{ "binding": "BACKUP_BUCKET", "bucket_name": "{{script}}-cache" }],
+  // Watchdog cadence: every 10 minutes, strictly BELOW the container
+  // sleep window (SLEEP_AFTER = "20m" in worker.ts) so a healthy resident is
+  // re-warmed before the platform can ever sleep it. Invariant: watchdog/alarm
+  // cadence < sleepAfter — bump the two together. This list must equal the
+  // `resident` entries of the schedule registry (src/core/schedules.ts) — a
+  // unit test enforces it; change the registry first.
+  "triggers": { "crons": ["*/10 * * * *"] }
+}

package/dist/assets/deploy/cloudflare-sandbox/Dockerfile

@@ -0,0 +1,67 @@
+# Sandbox container image: the @cloudflare/sandbox base plus git + gh, so the
+# coding/review agents work out of the box.
+# The tag MUST match the @cloudflare/sandbox version in package.json exactly
+# (no 'latest' tag exists) — bump both together.
+FROM docker.io/cloudflare/sandbox:0.12.9
+USER root
+# The SDK's container server kills any command after COMMAND_TIMEOUT_MS. On
+# 0.12.x the default is unlimited (unset → no limit; 0.3.x defaulted to 30s),
+# a per-exec `timeout` option wins over it, and a kill by it lands as a normal
+# result with a synthetic exit code (143/137), not a rejection. worker.ts
+# passes no per-call timeout, so this env var is the container-level lever.
+# Pure BACKSTOP: the real per-command limit is coreutils `timeout` in
+# worker.ts (280s default, raisable per call via the bash tool's timeoutMs up
+# to the 20-min ceiling BASH_TIMEOUT_MAX_MS), which yields a genuine exit 124
+# through the normal result path. This sits 40s above the 20-min ceiling so it
+# never wins the race. Bump alongside BASH_TIMEOUT_MAX_MS
+# (src/execution/bashTimeout.ts); changing it requires a container rebuild +
+# redeploy.
+ENV COMMAND_TIMEOUT_MS=1240000
+# docker.io + iptables: a Docker engine for runs whose tests need containers
+# (act's default job mode, testcontainers, compose, image builds). Nothing
+# starts the daemon at boot — the wrapper below does, on the first `docker`
+# call. The sandbox is already root with full capabilities inside its own
+# microVM, so a container a run starts shares that run's blast radius and
+# nothing more; no privileged flag or capability is added anywhere.
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends git curl ca-certificates docker.io iptables \
+  && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+       -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+       > /etc/apt/sources.list.d/github-cli.list \
+  && apt-get update && apt-get install -y --no-install-recommends gh \
+  && rm -rf /var/lib/apt/lists/* \
+  && git config --system credential.helper '!gh auth git-credential' \
+  && git config --system user.name "switchboard-bot" \
+  && git config --system user.email "switchboard-bot@users.noreply.github.com"
+
+# `docker` resolves to this wrapper (/usr/local/bin precedes /usr/bin on PATH):
+# it starts dockerd in its own session on first use — a plain background
+# process would die with the exec's process group — waits for the engine, then
+# execs the real client. src/deploy/sandboxDocker.test.ts holds its shape.
+COPY --chmod=0755 docker-wrapper.sh /usr/local/bin/docker
+
+# Node comes from the base: the published 0.12.9 image ships Node 22.23 (copied
+# from node:22-slim, with npm; no NodeSource deb), so the retarget-and-upgrade
+# layer the 0.3.x image needed is gone. This repo pins `engines: node
+# >=22` (undici@8 needs Node 22's `webidl.util.markAsUncloneable`), and a
+# review run that falls back off the resident onto a fresh sandbox must load
+# the full vitest suite; the assertion fails the build if a base bump ever
+# lands below 22. (The resident image gets Node 24 from its 0.13.0-next base.)
+RUN node --version | grep -Eq '^v(2[2-9]|[3-9][0-9])\.'
+
+# pnpm: the base image ships Node + npm (corepack is under
+# /usr/local/lib/node_modules but not on PATH) and not pnpm, so coding runs in pnpm repos hit
+# `pnpm: command not found` on install/build. Installed globally with npm, the
+# same way the resident image does it, so this version is here before any run
+# needs it. It is not necessarily the version that RUNS: pnpm ≥10 honours a
+# repo's own `packageManager` field and fetches it, so a pnpm repo that pins
+# one still needs the registry on its first install.
+#
+# EXACT version, enforced by src/deploy/imagePins.test.ts, same pin and same
+# reason as the resident image (deploy/cloudflare-resident/Dockerfile): with
+# `@latest` here the pnpm major moved on a rebuild, and pnpm 11 stopped
+# reading `package.json`'s `pnpm` field. pnpm still honours a repo's own
+# `packageManager`, so this is the floor for repos that name none.
+RUN npm install -g pnpm@10.34.5 \
+  && pnpm --version | grep -qx '10\.34\.5'

package/dist/assets/deploy/cloudflare-sandbox/docker-wrapper.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# docker(1) for the cold sandbox: starts the engine on first use, then hands
+# over to the real client. Installed as /usr/local/bin/docker, ahead of
+# /usr/bin/docker on PATH, so a run's `docker …` needs no setup step.
+#
+# Why lazy: the image ships dockerd but nothing starts it — the container has
+# no init; the SDK's server only runs the commands it is sent.
+# Why setsid: every /exec runs under `timeout -k 10 … bash -c`, whose process
+# group is reaped when the command returns. A daemon started with `nohup … &`
+# dies with it; one in its own session survives to the next command.
+set -u
+REAL=/usr/bin/docker
+LOG=/var/log/dockerd.log
+
+daemon_ready() { "$REAL" info >/dev/null 2>&1; }
+
+if [ ! -S /var/run/docker.sock ] || ! daemon_ready; then
+  # Containers reach the network through the default bridge, which needs the
+  # kernel to forward between it and the outside interface.
+  sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || echo 1 >/proc/sys/net/ipv4/ip_forward
+  # Two concurrent first calls both start a daemon; the second exits on the
+  # pid lock and both wait below for the one that won.
+  setsid -f dockerd >"$LOG" 2>&1
+  # The bridge and the socket take a few seconds on a fresh microVM. 40 s is
+  # generous, and a broken engine is reported with its log instead of hanging.
+  waited=0
+  until daemon_ready; do
+    waited=$((waited + 1))
+    if [ "$waited" -ge 40 ]; then
+      echo "docker: the engine did not come up within 40 s — see $LOG" >&2
+      exit 1
+    fi
+    sleep 1
+  done
+fi
+
+exec "$REAL" "$@"

package/dist/assets/deploy/cloudflare-sandbox/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "switchboard-sandbox-worker",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "check:image": "docker build --quiet .",
+    "deploy": "node ../bin/build-stamp.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "verify": "npm --prefix ../.. run --silent deploy:gen && npm run typecheck",
+    "dev": "wrangler dev",
+    "typegen": "wrangler types",
+    "tail": "wrangler tail",
+    "secrets": "npm --prefix ../.. run --silent cli -- deploy secrets sandbox"
+  },
+  "dependencies": {
+    "@cloudflare/sandbox": "0.12.9"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^5.20260904.1",
+    "typescript": "^5.9.3",
+    "wrangler": "^4.129.0"
+  }
+}

package/dist/assets/deploy/cloudflare-sandbox/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  // Scoped config so `npx tsc --noEmit` here actually checks worker.ts —
+  // without it, tsc silently falls back to the repo-root tsconfig, which
+  // excludes this directory entirely.
+  "compilerOptions": {
+    "target": "esnext",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "lib": ["esnext"],
+    "types": ["@cloudflare/workers-types"],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    // worker.ts imports its own package.json for the @cloudflare/sandbox pin
+    // (the version onStart compares the container against); wrangler bundles
+    // the JSON import, tsc needs this to type it.
+    "resolveJsonModule": true
+  },
+  "include": ["worker.ts"]
+}