@coreplane/switchboard 1.226.1 → 1.228.0

package/dist/assets/deploy/cloudflare-resident/worker.ts

@@ -85,6 +85,23 @@ import { selectBindingsToPurge } from "../../src/execution/bindingPurge.js";
 import { busyAfterKillReason, planForceDetach } from "../../src/execution/residentDetach.js";
 import { parseReadonly, planReadonlyAttach } from "../../src/execution/residentReadonly.js";
 import { decideWorktree, parseReuse, type WorktreeFacts } from "../../src/execution/residentReuse.js";
+import {
+  boundByFor,
+  parseOwnPr,
+  parsePushed,
+  parseRefByDefault,
+  rebindPlan,
+  rebindRefused,
+  rebindVerdict,
+  rememberOwnBranches,
+  type BoundBy,
+  type OwnBranch,
+  type OwnPr,
+  type PushedBranch,
+  type Rebound,
+  type RebindRefused,
+  type RebindTreeFacts,
+} from "../../src/execution/residentRebind.js";
 import {
   depCacheScript,
   mutableCachePaths,
@@ -966,10 +983,28 @@ interface ResidentRecord {
 
 /** Per-thread binding: persisted in the resident DO keyed by
  *  threadKey; survives restarts and eviction. `user`/`evicted` describe the
- *  current allocation; `ref` is sticky for the thread's whole life. */
+ *  current allocation; `ref` is sticky for the thread's whole life, with one
+ *  exception — the branch the thread's own run opened a pull request on
+ *  (`rebound`, docs/reference/specs/resident-repos.md item 16). */
 interface ThreadBinding {
   threadKey: string;
   ref: string;
+  /** How `ref` was chosen when the binding was made: the repo default for want
+   *  of a named branch (item 30), or a branch someone named. Absent on a
+   *  binding made before the field: read as `default` iff `ref` is the default
+   *  branch. Only a `default` binding may ever move. */
+  boundBy?: BoundBy;
+  /** The one move a binding may make (item 16): from the default it was bound
+   *  to, onto the branch the thread's own run opened a pull request on. Set,
+   *  the binding never moves again. */
+  rebound?: Rebound;
+  /** The branches the thread's own runs pushed and the pull requests they
+   *  head, as each run's release handed them over (`/detach` `pushed`, item
+   *  16a) — written before any eviction decision, so the fact outlives the
+   *  tree: a clean tree is released the moment a run ends, and this is what
+   *  lets the follow-up's attach move onto the branch and recreate the tree
+   *  there. Newest last; the oldest fall off past `OWN_BRANCHES_MAX`. */
+  ownBranches?: OwnBranch[];
   /** Allocated OS user (worker2..worker17); "" once evicted (pool released). */
   user: string;
   worktreePath: string;
@@ -1047,8 +1082,36 @@ interface AttachOk {
   /** Every command this attach ran, as offsets from its start (docs/reference/specs/
    *  tracing.md item 19): the bot grafts them under its attach span. */
   trace: ResidentStep[];
+  /** This attach moved the binding onto the branch the thread's own run opened
+   *  a pull request on (item 16): from where, to where, which PR. */
+  rebound?: Rebound;
+  /** The caller asked for that move and the binding stood: the branch, the PR
+   *  and why — so the bot can say where the follow-up runs and why. */
+  rebindRefused?: RebindRefused;
+}
+
+/** Why the caller's `refHint` is what it is (item 16), beside the hint itself:
+ *  `ownPr` — the pull request the thread's own run opened, whose head branch
+ *  the hint is (the one reason a binding may move; never a PR a person named);
+ *  `refByDefault` — the caller bound the resident's own default branch because
+ *  its message named none (item 30), recorded on a new binding as `boundBy`. */
+interface RefHintReason {
+  ownPr: OwnPr | null;
+  refByDefault: boolean;
 }
 
+/** The body every bot always sent: a hint with no reason attached. */
+const NO_REF_HINT_REASON: RefHintReason = { ownPr: null, refByDefault: false };
+
+/** What the rebind decided under the mutex (item 16): nothing to move (the
+ *  row is already on the branch), a named refusal, or the move — written on
+ *  the row, whether a checkout in the live tree or a ref the attach will
+ *  recreate the tree at. */
+type RebindOutcome =
+  | { kind: "none"; binding: ThreadBinding }
+  | { kind: "refuse"; refused: RebindRefused }
+  | { kind: "rebound"; moved: ThreadBinding; rebound: Rebound };
+
 /** Result of one /op test/build execution. `ok` is the command's
  *  verdict — a failing test run is a RESULT with ok:false, never an error. */
 interface OpRunOk {
@@ -4286,6 +4349,8 @@ export class ResidentDO extends Sandbox<Env> {
     threadKey: string,
     ref: string,
     worktreePath: string,
+    /** How a NEW binding's ref was chosen (item 16); an existing binding keeps its own record. */
+    boundBy: BoundBy,
   ): Promise<{ binding: ThreadBinding; wrote: boolean } | ThreadErr> {
     const key = threadBindingKey(threadKey);
     const existing = await this.ctx.storage.get<ThreadBinding>(key);
@@ -4306,6 +4371,16 @@ export class ResidentDO extends Sandbox<Env> {
       boundAt: existing?.boundAt ?? now,
       lastAttachAt: now,
       evicted: false,
+      // An evicted binding's own history: how its ref was chosen (absent on
+      // one made before the field — never overwritten by this attach's flag)
+      // and the one move it may have made.
+      ...(existing
+        ? {
+            ...(existing.boundBy !== undefined ? { boundBy: existing.boundBy } : {}),
+            ...(existing.rebound !== undefined ? { rebound: existing.rebound } : {}),
+            ...(existing.ownBranches !== undefined ? { ownBranches: existing.ownBranches } : {}),
+          }
+        : { boundBy }),
     };
     await this.ctx.storage.put(key, binding);
     return { binding, wrote: true };
@@ -4326,13 +4401,14 @@ export class ResidentDO extends Sandbox<Env> {
     reuse = false,
     record?: ResidentRecord,
     traceparent?: string,
+    reason: RefHintReason = NO_REF_HINT_REASON,
   ): Promise<AttachOk | ThreadErr> {
     // One step trace per attach (docs/reference/specs/tracing.md item 19): every command
     // the attach runs lands on it, and the answer carries it.
     const t0 = systemClock();
     const trace = createStepTrace(t0);
     const res = await this.stepTrace.run(trace, () =>
-      this.attachThreadTraced(threadKey, refHint, readonly, wantSha, reuse, record, t0),
+      this.attachThreadTraced(threadKey, refHint, readonly, wantSha, reuse, record, t0, reason),
     );
     // The same steps as the resident's own `resident.attach` root (item 22).
     emitStepRoot("resident.attach", t0, trace.steps(), traceparent, "error" in res ? refusalOutcome(res) : "ok");
@@ -4348,6 +4424,7 @@ export class ResidentDO extends Sandbox<Env> {
     reuse: boolean,
     record: ResidentRecord | undefined,
     t0: number,
+    reason: RefHintReason,
   ): Promise<AttachOk | ThreadErr> {
     try {
       await this.ensureHydrated();
@@ -4365,7 +4442,17 @@ export class ResidentDO extends Sandbox<Env> {
       // container under it (and isIdle never parks the cycle mid-attach).
       this.attachesInFlight++;
       try {
-        return await this.attachThreadBody(threadKey, refHint, readonly, wantSha, reuse, resourceId, t0, record);
+        return await this.attachThreadBody(
+          threadKey,
+          refHint,
+          readonly,
+          wantSha,
+          reuse,
+          resourceId,
+          t0,
+          record,
+          reason,
+        );
       } finally {
         this.attachesInFlight--;
       }
@@ -4399,7 +4486,8 @@ export class ResidentDO extends Sandbox<Env> {
     reuse: boolean,
     resourceId: string,
     t0: number,
-    recordFromRoute?: ResidentRecord,
+    recordFromRoute: ResidentRecord | undefined,
+    reason: RefHintReason,
   ): Promise<AttachOk | ThreadErr> {
     try {
       await this.refreshIfStale(resourceId);
@@ -4419,8 +4507,22 @@ export class ResidentDO extends Sandbox<Env> {
     const record = recordFromRoute ?? (await this.registry().getRecord(resource));
     if (!record || !facts) return { error: "not-serviceable: registry record or repo facts missing", status: 503 };
 
-    const prior = stored.get(threadBindingKey(threadKey)) as ThreadBinding | undefined;
-    const ref = prior?.ref ?? refHint; // the binding's ref wins for the thread's whole life
+    // The binding's ref wins for the thread's whole life, with one exception
+    // (item 16): a thread bound to the repo default for want of a named branch
+    // moves, once and in place, onto the branch its own run opened a pull
+    // request on — when that branch is a local branch of this thread's tree and
+    // the tree is clean. Decided here, before the ref is chosen, so the rest of
+    // the attach (fetch, stale check, deps, credentials) runs on the moved ref.
+    const rebind = await this.rebindToOwnPr(
+      stored.get(threadBindingKey(threadKey)) as ThreadBinding | undefined,
+      reason.ownPr,
+      reuse,
+      facts.defaultRef,
+      slug,
+    );
+    if ("error" in rebind) return rebind;
+    const prior = rebind.binding;
+    const ref = prior?.ref ?? refHint;
     if (!ref) {
       // Name the default branch so the bot can bind to it (loudly) instead of
       // asking the user when the message named no branch; the binding is still
@@ -4437,7 +4539,12 @@ export class ResidentDO extends Sandbox<Env> {
     // and the prior binding's mode — the tested pure helper is the shipped code.
     const mode = planReadonlyAttach({ readonly, prior, slug, mirrorDir: MIRROR_DIR });
 
-    const alloc = await this.allocateThreadUser(threadKey, ref, worktreePath);
+    const alloc = await this.allocateThreadUser(
+      threadKey,
+      ref,
+      worktreePath,
+      boundByFor({ refByDefault: reason.refByDefault, ref, defaultRef: facts.defaultRef }),
+    );
     if ("error" in alloc) return alloc;
     const binding = alloc.binding;
     // "Nothing created" on failure: a FRESH allocation (new binding or a
@@ -4468,12 +4575,212 @@ export class ResidentDO extends Sandbox<Env> {
         binding,
         mode,
         rollback,
+        ...(rebind.rebound !== undefined ? { rebound: rebind.rebound } : {}),
+        ...(rebind.rebindRefused !== undefined ? { rebindRefused: rebind.rebindRefused } : {}),
       });
     } finally {
       this.diskCommittedKiB -= admission.committedKiB;
     }
   }
 
+  /** Item 16's one exception to the sticky binding: a thread bound to the repo
+   *  default for want of a named branch moves onto the branch its own run
+   *  opened a pull request on (`ownPr`), once, in place. The decision is the
+   *  pure `rebindPlan` / `rebindVerdict` of src/execution/residentRebind.ts;
+   *  this method measures the tree as the thread user and runs the verdict: a
+   *  `git checkout` inside the existing worktree — same path, same pool user,
+   *  no clone, no `rm -rf`, deps and snapshot lineage untouched — under the
+   *  mirror mutex so no other attach of the thread touches the tree meanwhile.
+   *  The rest of the attach then runs on the moved ref: the mirror fetch for
+   *  the PR head (item 51) and item 17's stale check, which keeps a tree whose
+   *  HEAD is the ref's tip or a descendant of it. The binding records the move
+   *  (`rebound`); the answer carries it, or the named refusal, so the bot can
+   *  say where the follow-up runs and why. A refusal never fails the attach. */
+  private async rebindToOwnPr(
+    prior: ThreadBinding | undefined,
+    ownPr: OwnPr | null,
+    reuse: boolean,
+    defaultRef: string,
+    slug: string,
+  ): Promise<{ binding: ThreadBinding | undefined; rebound?: Rebound; rebindRefused?: RebindRefused } | ThreadErr> {
+    const plan = rebindPlan({ ownPr, reuse, binding: prior, defaultRef });
+    if (plan.kind === "none" || prior === undefined) return { binding: prior };
+    if (plan.kind === "refuse") return { binding: prior, rebindRefused: plan.refused };
+    const key = threadBindingKey(prior.threadKey);
+    // A tree that is gone is recreated at the branch by the attach (item 16):
+    // the mirror must hold the branch first, and a branch pushed since the
+    // last refresh cycle is fetched for — with a token minted here, before
+    // the mutex, like the attach's own recovery fetch. Only when the binding
+    // allows a recreate at all: an evicted tree, or a live one whose runs
+    // pushed the branch (the tree may turn out missing).
+    const fetchToken =
+      (plan.kind === "recreate" || plan.own) && githubAppConfigured(this.env)
+        ? ((await mintRepoScopedToken(this.env, slug).catch(() => null))?.token ?? null)
+        : null;
+    let outcome: RebindOutcome;
+    try {
+      outcome = (
+        await this.withMirrorLock(async (): Promise<RebindOutcome> => {
+          // The binding as it stands NOW, under the mutex — not the snapshot
+          // the plan read before the wait: the move is judged on, and written
+          // over, the row's current fields (its last attach time, its
+          // credential stamp), and a premise that changed while waiting —
+          // another attach already moved the ref — is re-judged, never
+          // overwritten.
+          const current = (await this.ctx.storage.get<ThreadBinding>(key)) ?? prior;
+          const again = rebindPlan({ ownPr, reuse, binding: current, defaultRef });
+          if (again.kind === "none") return { kind: "none", binding: current };
+          if (again.kind === "refuse") return again;
+          if (again.kind === "recreate") return this.recreateAtOwnBranch(current, again, fetchToken);
+          const wt = current.worktreePath;
+          // The facts, as the thread user in the thread's own tree: is the
+          // branch a local branch here (the physical trace of this thread's
+          // run having made it), and are the tracked files clean — judged
+          // only off a status git could read.
+          const tree: RebindTreeFacts = { exists: (await this.run(["test", "-d", `${wt}/.git`])).exitCode === 0 };
+          if (tree.exists) {
+            const branch = await this.threadRun(
+              current.user,
+              wt,
+              `git rev-parse --verify --quiet ${shellQuote(`refs/heads/${again.to}`)}`,
+              DEFAULT_EXEC_TIMEOUT_MS,
+            );
+            tree.branchExists = branch.exitCode === 0;
+            const status = await this.threadRun(
+              current.user,
+              wt,
+              "git status --porcelain -uno",
+              DEFAULT_EXEC_TIMEOUT_MS,
+            );
+            tree.readable = status.exitCode === 0;
+            if (tree.readable) tree.dirty = status.stdout.trim() !== "";
+          }
+          // Judged on the re-read plan: it carries whether the branch is the
+          // thread's own, which the pre-lock plan lacks when it was a recreate.
+          const verdict = rebindVerdict(again, tree);
+          if (verdict.kind === "recreate") return this.recreateAtOwnBranch(current, again, fetchToken);
+          if (verdict.kind !== "rebind") return verdict;
+          const startedAt = systemClock();
+          const checkout = await this.threadRun(
+            current.user,
+            wt,
+            `git checkout --quiet ${shellQuote(again.to)}`,
+            DEFAULT_EXEC_TIMEOUT_MS,
+          );
+          this.stepTrace.getStore()?.record("rebind-checkout", {
+            startedAt,
+            endedAt: systemClock(),
+            exitCode: checkout.exitCode,
+            timedOut: checkout.timedOut,
+          });
+          if (checkout.exitCode !== 0) {
+            const detail =
+              checkout.stderr.trim().split("\n")[0]?.slice(0, 200) || `git checkout exited ${checkout.exitCode}`;
+            return { kind: "refuse", refused: rebindRefused(again, "checkout-failed", detail) };
+          }
+          const rebound: Rebound = {
+            from: current.ref,
+            to: again.to,
+            pr: again.pr,
+            at: new Date(systemClock()).toISOString(),
+          };
+          const moved: ThreadBinding = { ...current, ref: again.to, rebound };
+          await this.ctx.storage.put(key, moved);
+          return { kind: "rebound", moved, rebound };
+        }, ATTACH_MUTEX_WAIT_MS)
+      ).value;
+    } catch (err) {
+      if (err instanceof MirrorBusyError) {
+        const s = await this.getStatus();
+        return { error: errMsg(err), status: 503, state: s.state, reason: "mirror-busy" };
+      }
+      return { error: `attach-failed: ${errMsg(err)}`, status: 500 };
+    }
+    if (outcome.kind === "none") return { binding: outcome.binding };
+    if (outcome.kind === "refuse") {
+      console.log(
+        `attach ${prior.threadKey}: kept on ${prior.ref} — rebind to ${plan.to} refused (${outcome.refused.reason}: ${outcome.refused.why})`,
+      );
+      return { binding: prior, rebindRefused: outcome.refused };
+    }
+    const { moved, rebound } = outcome;
+    console.log(
+      `attach ${prior.threadKey}: rebound ${rebound.from} → ${rebound.to} (the thread's own pull request #${rebound.pr})`,
+    );
+    return { binding: moved, rebound };
+  }
+
+  /** The move when the thread's tree is gone (item 16): the binding's ref
+   *  becomes the branch its own run pushed, and the attach that follows
+   *  recreates the tree at it — `ensureThreadWorktree` finds no tree and
+   *  clones the branch from the mirror. So the mirror must hold the branch:
+   *  one pushed since the last refresh cycle is fetched for here, under the
+   *  mutex; a branch still missing after the fetch (deleted after a merge, or
+   *  never pushed) is a `branch-absent` refusal and the binding stands — the
+   *  attach then goes on at the ref it had, never `unknown-ref`. Nothing on
+   *  disk is touched: no checkout (there is no tree), no clone (the attach's). */
+  private async recreateAtOwnBranch(
+    current: ThreadBinding,
+    plan: { to: string; pr: number },
+    fetchToken: string | null,
+  ): Promise<RebindOutcome> {
+    let present = await this.refExists(plan.to);
+    if (!present) {
+      // A fetch that fails — GitHub unreachable, no token for a private repo —
+      // is not the attach's failure: the branch is then simply not in the
+      // mirror, and the refusal below names it, so the binding stands and the
+      // run goes on at the ref it had instead of the attach ending 500.
+      try {
+        await this.gitWithCred(
+          fetchToken,
+          ["-C", MIRROR_DIR, "fetch", "--prune", "origin"],
+          "fetch",
+          GIT_NETWORK_TIMEOUT_MS,
+        );
+      } catch (err) {
+        console.log(
+          `attach ${current.threadKey}: the fetch for ${plan.to} failed (${errMsg(err)}) — the rebind is refused, the attach goes on`,
+        );
+      }
+      present = await this.refExists(plan.to);
+    }
+    if (!present) {
+      return {
+        kind: "refuse",
+        refused: rebindRefused(
+          plan,
+          "branch-absent",
+          `the thread's worktree is gone and the mirror does not hold ${JSON.stringify(plan.to)} (deleted after a merge, or never pushed); the tree cannot be recreated at it`,
+        ),
+      };
+    }
+    const rebound: Rebound = {
+      from: current.ref,
+      to: plan.to,
+      pr: plan.pr,
+      at: new Date(systemClock()).toISOString(),
+    };
+    const moved: ThreadBinding = { ...current, ref: plan.to, rebound };
+    await this.ctx.storage.put(threadBindingKey(current.threadKey), moved);
+    return { kind: "rebound", moved, rebound };
+  }
+
+  /** The release's word on what the run pushed (`/detach` `pushed`, item
+   *  16a), remembered on the binding BEFORE the detach decides anything: a
+   *  clean tree is evicted at once, a dirty one kept, an already-evicted
+   *  binding answered as such — and in every case the fact must outlive the
+   *  tree, since it is what a follow-up's rebind onto the thread's own pull
+   *  request branch reads once the tree is gone. No binding → nothing to
+   *  remember on (the detach answers its 404 next). */
+  private async rememberOwnBranches(threadKey: string, pushed: readonly PushedBranch[]): Promise<void> {
+    const binding = await this.ctx.storage.get<ThreadBinding>(threadBindingKey(threadKey));
+    if (!binding) return;
+    await this.ctx.storage.put(threadBindingKey(threadKey), {
+      ...binding,
+      ownBranches: rememberOwnBranches(binding.ownBranches, pushed, new Date(systemClock()).toISOString()),
+    } satisfies ThreadBinding);
+  }
+
   /** The second half of an attach, past disk admission: mint, fetch + clone
    *  under the mirror lock, deps, credentials, the binding write. Split from
    *  `attachThreadBody` only so the admission's commitment is released on every
@@ -4490,8 +4797,12 @@ export class ResidentDO extends Sandbox<Env> {
     binding: ThreadBinding;
     mode: ReturnType<typeof planReadonlyAttach>;
     rollback: () => Promise<void>;
+    /** What `rebindToOwnPr` decided (item 16), for the answer. */
+    rebound?: Rebound;
+    rebindRefused?: RebindRefused;
   }): Promise<AttachOk | ThreadErr> {
     const { threadKey, refHint, wantSha, reuse, slug, t0, facts, record, binding, mode, rollback } = input;
+    const { rebound, rebindRefused } = input;
 
     // Command-level token mint — before the lock so mint latency
     // never holds the mutex, and failure never blocks the attach.
@@ -4664,6 +4975,8 @@ export class ResidentDO extends Sandbox<Env> {
       mutexWaitMs: locked.waitedMs,
       attachMs: systemClock() - t0,
       trace: this.currentSteps(),
+      ...(rebound !== undefined ? { rebound } : {}),
+      ...(rebindRefused !== undefined ? { rebindRefused } : {}),
     };
   }
 
@@ -5701,7 +6014,10 @@ export class ResidentDO extends Sandbox<Env> {
   async detachThread(
     threadKey: string,
     force: boolean,
+    /** What the ending run pushed (item 16a): remembered on the binding first, whatever the detach then decides. */
+    pushed: readonly PushedBranch[] = [],
   ): Promise<{ released: boolean; reason?: string; user?: string } | ThreadErr> {
+    if (pushed.length > 0) await this.rememberOwnBranches(threadKey, pushed);
     const binding = await this.ctx.storage.get<ThreadBinding>(threadBindingKey(threadKey));
     if (!binding) return { error: `no-binding: ${threadKey} has never attached to this resident`, status: 404 };
     if (binding.evicted || !binding.user) return { released: false, reason: "already-evicted" };
@@ -7540,13 +7856,34 @@ async function handleAttach(env: Env, body: Record<string, unknown>, traceparent
   if ("error" in want) return json({ error: want.error }, 400);
   const reuse = parseReuse(body.reuse);
   if ("error" in reuse) return json({ error: reuse.error }, 400);
+  // Why the hint is what it is (item 16): the thread's own pull request and
+  // its head branch — the branch checked against the one ref pattern like
+  // every ref, before it can become a git argument — and the bound-by-default flag.
+  const parsedOwnPr = parseOwnPr(body.ownPr);
+  if ("error" in parsedOwnPr) return json({ error: parsedOwnPr.error }, 400);
+  if (parsedOwnPr.ownPr !== null) {
+    const ownRef = parseRef(parsedOwnPr.ownPr.ref, "ownPr.ref");
+    if ("error" in ownRef) return json({ error: ownRef.error }, 400);
+  }
+  const refByDefault = parseRefByDefault(body.refByDefault);
+  if ("error" in refByDefault) return json({ error: refByDefault.error }, 400);
+  const reason: RefHintReason = { ownPr: parsedOwnPr.ownPr, refByDefault: refByDefault.refByDefault };
   // Post-validation, the answer streams like /exec (item 59): heartbeat
   // whitespace then ONE JSON document over HTTP 200, so an attach that waits
   // on a deps install (minutes) cannot lose the connection the way a plain
   // response does (`fetch failed` a few minutes in). A refusal
   // carries its `status` in the body; `ResidentExecutor.attach` reads it there.
   return streamHeartbeatJson(
-    ctx.stub.attachThread(ctx.threadKey, refHint, readonly.readonly, want.sha, reuse.reuse, ctx.record, traceparent),
+    ctx.stub.attachThread(
+      ctx.threadKey,
+      refHint,
+      readonly.readonly,
+      want.sha,
+      reuse.reuse,
+      ctx.record,
+      traceparent,
+      reason,
+    ),
     (result) => result,
     (err) => ({ error: errMsg(err), status: 500 }),
   );
@@ -7555,7 +7892,15 @@ async function handleAttach(env: Env, body: Record<string, unknown>, traceparent
 async function handleDetach(env: Env, body: Record<string, unknown>): Promise<Response> {
   const ctx = await resolveThreadRoute(env, body);
   if (ctx instanceof Response) return ctx;
-  const result = await ctx.stub.detachThread(ctx.threadKey, body.force === true);
+  // What the run pushed (item 16a), each ref through the one ref pattern
+  // before it can be stored or become a git argument.
+  const pushed = parsePushed(body.pushed);
+  if ("error" in pushed) return json({ error: pushed.error }, 400);
+  for (const entry of pushed.pushed) {
+    const ref = parseRef(entry.ref, "pushed[].ref");
+    if ("error" in ref) return json({ error: ref.error }, 400);
+  }
+  const result = await ctx.stub.detachThread(ctx.threadKey, body.force === true, pushed.pushed);
   if ("error" in result) return threadErrResponse(result);
   return json(result);
 }

package/dist/assets/deploy/cloudflare-sandbox/Dockerfile

@@ -13,19 +13,21 @@
 FROM --platform=linux/amd64 docker.io/library/node:24.21.0-slim AS node
 
 # The tag MUST match the @cloudflare/sandbox version in package.json exactly
-# (no 'latest' tag exists) — bump both together.
-FROM docker.io/cloudflare/sandbox:0.12.9
+# (no 'latest' tag exists on the @next line) — bump both together. The same
+# base as the resident image: its container server is compiled with a Bun
+# whose directory watcher no longer dies on an entry removed under it, which
+# ended the 0.12.9 line's server mid-command (docs/reference/specs/execution.md
+# item 21).
+FROM docker.io/cloudflare/sandbox:0.13.0-next.751.1
 USER root
-# The SDK's container server kills any command after COMMAND_TIMEOUT_MS. On
-# 0.12.x the default is unlimited (unset → no limit; 0.3.x defaulted to 30s),
-# a per-exec `timeout` option wins over it, and a kill by it lands as a normal
-# result with a synthetic exit code (143/137), not a rejection. worker.ts
-# passes no per-call timeout, so this env var is the container-level lever.
-# Pure BACKSTOP: the real per-command limit is coreutils `timeout` in
-# worker.ts (280s default, raisable per call via the bash tool's timeoutMs up
-# to the 20-min ceiling BASH_TIMEOUT_MAX_MS), which yields a genuine exit 124
-# through the normal result path. This sits 40s above the 20-min ceiling so it
-# never wins the race. Bump alongside BASH_TIMEOUT_MAX_MS
+# The SDK's container server kills any command after COMMAND_TIMEOUT_MS
+# (unset → no limit). Pure BACKSTOP behind two closer ones: the real
+# per-command limit is coreutils `timeout` in worker.ts (280s default,
+# raisable per call via the bash tool's timeoutMs up to the 20-min ceiling
+# BASH_TIMEOUT_MAX_MS), which yields a genuine exit 124 through the normal
+# result path, and worker.ts launches each process with the SDK's own
+# per-process `timeout` a margin above that. This sits 40s above the 20-min
+# ceiling so it never wins the race. Bump alongside BASH_TIMEOUT_MAX_MS
 # (src/execution/bashTimeout.ts); changing it requires a container rebuild +
 # redeploy.
 ENV COMMAND_TIMEOUT_MS=1240000
@@ -53,8 +55,8 @@ RUN apt-get update \
 # execs the real client. src/deploy/sandboxDocker.test.ts holds its shape.
 COPY --chmod=0755 docker-wrapper.sh /usr/local/bin/docker
 
-# Node 24, not the base's. The published 0.12.9 base ships Node 22.23.2
-# (copied from node:22-slim: the binary at /usr/local/bin/node, npm and
+# Node 24, not the base's. The 0.13.0-next base ships Node 22.23.2 like the
+# 0.12.9 one (copied from node:22-slim: the binary at /usr/local/bin/node, npm and
 # corepack under /usr/local/lib/node_modules, npm/npx symlinked into it), while
 # this repository builds and tests on Node 24 (.nvmrc, CI) and its published
 # CLI requires `>=24`. A run that exercised the suite inside this image read a
@@ -173,3 +175,12 @@ RUN npm install -g @earendil-works/pi-coding-agent@0.85.1 \
   && npm cache clean --force \
   && pi --version | grep -qx '0.85.1' \
   && pi --help | grep -q -- '--mode <mode>'
+
+# The container outlives a crash of the SDK's container server (the
+# supervisor's header says why). The base image's ENTRYPOINT is tini running
+# the server, so one uncaught exception there ended the container; here tini
+# stays PID 1 — it reaps orphans and forwards the platform's signals — and
+# runs the supervisor, which starts the server again when it exits.
+# src/deploy/sandboxRuntimeSupervisor.test.ts holds this pair of lines.
+COPY --chmod=0755 runtime-supervisor.sh /usr/local/bin/sandbox-runtime-supervisor
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/sandbox-runtime-supervisor"]

package/dist/assets/deploy/cloudflare-sandbox/package.json

@@ -16,7 +16,7 @@
     "secrets": "npm --prefix ../.. run --silent cli -- deploy secrets sandbox"
   },
   "dependencies": {
-    "@cloudflare/sandbox": "0.12.9"
+    "@cloudflare/sandbox": "0.13.0-next.751.1"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260904.1",

package/dist/assets/deploy/cloudflare-sandbox/runtime-supervisor.sh

@@ -0,0 +1,68 @@
+#!/bin/sh
+# The cold sandbox's process supervisor, run by tini (PID 1): keeps the
+# container alive across a crash of the SDK's container server
+# (/container-server/sandbox). That server calls process.exit(1) on any
+# uncaught exception, and the base image runs it as tini's one child — so one
+# uncaught error ended the whole container: /workspace gone, a detached pi
+# with it, every later /exec a failure until the platform noticed. Started
+# here as a child instead, the server's exit is a restart a second later; the
+# disk, the detached processes and the Durable Object's view of a running
+# container all survive, and the next command starts a fresh process on the
+# new server (docs/reference/specs/execution.md item 21).
+#
+# A stop from the platform is SIGTERM, which tini forwards here: forwarded to the server, and
+# nothing starts again — a stop that lands during the pause between two
+# starts, or before the new pid is known, still ends here — and the server's
+# own exit status becomes this script's. A terminal's INT is forwarded as
+# TERM too: a child started with `&` by a non-interactive shell ignores INT
+# (POSIX), so INT itself would stop nothing. A server that cannot stay up —
+# QUICK_EXIT_LIMIT exits in a row, each within QUICK_EXIT_SECS of starting —
+# ends the container with the last status instead of looping forever.
+# src/deploy/sandboxRuntimeSupervisor.test.ts holds the shape and drives it.
+set -u
+RUNTIME=${SANDBOX_RUNTIME:-/container-server/sandbox}
+QUICK_EXIT_SECS=10
+QUICK_EXIT_LIMIT=5
+pid=
+stopping=
+quick=0
+code=0
+
+on_signal() {
+  stopping=1
+  if [ -n "$pid" ]; then kill -TERM "$pid" 2>/dev/null; fi
+}
+trap on_signal TERM INT
+
+while :; do
+  started=$(date +%s)
+  "$RUNTIME" "$@" &
+  pid=$!
+  # A stop that landed between the start and this line found no pid to
+  # forward to; the server it missed gets it here.
+  if [ -n "$stopping" ]; then kill -TERM "$pid" 2>/dev/null; fi
+  wait "$pid"
+  code=$?
+  # A trapped signal ends `wait` early (status > 128) while the server still
+  # runs; wait again until it is really gone, so the status is its own.
+  while kill -0 "$pid" 2>/dev/null; do
+    wait "$pid"
+    code=$?
+  done
+  pid=
+  if [ -n "$stopping" ]; then exit "$code"; fi
+  if [ $(( $(date +%s) - started )) -lt "$QUICK_EXIT_SECS" ]; then
+    quick=$((quick + 1))
+  else
+    quick=0
+  fi
+  if [ "$quick" -ge "$QUICK_EXIT_LIMIT" ]; then
+    echo "sandbox-runtime-supervisor: the runtime exited with status $code, $quick times in a row within ${QUICK_EXIT_SECS}s of starting; giving up" >&2
+    exit "$code"
+  fi
+  echo "sandbox-runtime-supervisor: the runtime exited with status $code; starting it again" >&2
+  sleep 1
+  # A stop that landed during the pause: the last status is the answer, and
+  # nothing starts again.
+  if [ -n "$stopping" ]; then exit "$code"; fi
+done