@coreplane/switchboard 1.239.0 → 1.241.0

package/dist/assets/src/core/stateWorkerRef.ts

@@ -0,0 +1,41 @@
+// The one state Worker (deploy/cloudflare-memory/), as the config names it: any
+// `*.worker` block may carry its base URL and the env var holding its bearer,
+// and a capability that keeps a cache there (a delivery snapshot, a costs
+// snapshot) reads whichever block names it — a cache earns no block of its own.
+//
+// Node-free on purpose: the snapshot stores that import this are shared with
+// the Worker by relative path.
+
+/** A `{ baseUrl, tokenEnv? }` reference to the state Worker, as every `*.worker` config block spells it. */
+export interface StateWorkerRef {
+  baseUrl: string;
+  /** Env var holding the bearer; default MEMORY_TOKEN. */
+  tokenEnv?: string;
+}
+
+/** The config blocks that may name the state Worker — one Worker, referenced from each capability that uses it. */
+export interface StateWorkerBlocks {
+  runtimeOverrides?: { worker?: StateWorkerRef };
+  runHistory?: { worker?: StateWorkerRef };
+  schedules?: { worker?: StateWorkerRef };
+  memory?: { worker?: StateWorkerRef };
+}
+
+/** The env var holding the state Worker's bearer when a block names none. */
+export const DEFAULT_STATE_WORKER_TOKEN_ENV = "MEMORY_TOKEN";
+
+/** The slice of the process's `Secrets` a store builder reads (src/secrets.ts; named
+ *  structurally so the builders stay free of the bot's Node-only imports for the Worker). */
+export interface SecretReader {
+  named(name: string): { reveal(): string } | undefined;
+}
+
+/** The first `*.worker` block that names the state Worker, in the order the blocks are listed above. */
+export function stateWorkerOf(config: StateWorkerBlocks): StateWorkerRef | undefined {
+  return [config.runtimeOverrides, config.runHistory, config.schedules, config.memory].find(
+    (block) => block?.worker?.baseUrl,
+  )?.worker;
+}
+
+/** The names a `*.worker` block may carry the state Worker under, for a warning that says where to put one. */
+export const STATE_WORKER_BLOCK_NAMES = "runHistory.worker, runtimeOverrides.worker, schedules.worker or memory.worker";

package/dist/assets/src/core/trace/attrs.ts

@@ -8,7 +8,7 @@
  *  field. */
 
 export type Backend = "local" | "resident" | "sandbox" | "e2b";
-export type Channel = "slack" | "http" | "mcp" | "cli";
+export type Channel = "slack" | "http" | "mcp" | "cli" | "web";
 
 /** Every attribute key any span may carry, with its value domain. */
 export interface AttrDomain {

package/dist/assets/src/execution/bindingPurge.ts

@@ -14,8 +14,8 @@ export interface PurgeableBinding {
 export type PurgeDecision = { ok: true; purge: string[]; keptLive: string[] } | { ok: false; error: string };
 
 /** Thread-key namespaces real channels mint (docs/reference/specs/http-ingress.md item 1,
- *  slack, mcp, the CLI). A purge is for synthetic keys only. */
-const PRODUCTION_NAMESPACES = new Set(["slack", "http", "mcp", "cli"]);
+ *  slack, mcp, the CLI, the web chat). A purge is for synthetic keys only. */
+const PRODUCTION_NAMESPACES = new Set(["slack", "http", "mcp", "cli", "web"]);
 
 /** A prefix must be a whole namespace (`load:`) or longer (`load:r1:`), never
  *  empty, never a bare partial namespace, never a production namespace. */

package/dist/assets/src/execution/residentAutoRebuild.ts

@@ -0,0 +1,73 @@
+// A resident `down` on a reason only a rebuild can escape is rebuilt on that
+// transition, under a budget (docs/reference/specs/resident-repos.md item 36).
+// Pure: the Worker's `goDown` and the watchdog's backstop both call
+// `autoRebuildDecision` over the history row they persist
+// (`resident:autoRebuilds`, ISO instants of the auto-rebuilds this resident
+// has had), so the transition and the backstop cannot disagree.
+
+/** The `down` reasons a rebuild is the only exit from: a down resident runs no
+ *  cycle, and these say the snapshot (or the container that would restore it)
+ *  cannot be used — never a provision failure, which would loop against the
+ *  same broken build. `runtime-unreachable` is item 64's last rung: a recreated
+ *  container that did not answer either. */
+export const REHYDRATION_FAILURE_RE = /^(r2-restore-failed|snapshot-stamp-mismatch|no-snapshot|runtime-unreachable)/;
+
+/** How many auto-rebuilds one resident gets inside one window. A rebuild is a
+ *  clone, an install and a build (minutes to half an hour) that holds the cap
+ *  slot and writes a fresh snapshot; a resident that comes back `warm` and
+ *  goes `down` again on the same class of reason is flapping on something a
+ *  rebuild does not fix, and the third time it stays down where a person can
+ *  see it. */
+export const AUTO_REBUILD_BUDGET = 2;
+export const AUTO_REBUILD_WINDOW_MS = 24 * 60 * 60_000;
+
+/** The stamp a spent budget leaves on the reason — the one mark the decision
+ *  reads back so the watchdog's passes never judge the same down twice. */
+const SPENT_MARK = " — auto-rebuild budget spent (";
+
+export type AutoRebuildDecision =
+  /** Rebuild now; `history` is what to persist (pruned, this instant appended); `reason` is the rebuild's. */
+  | { action: "rebuild"; history: string[]; reason: string }
+  /** Stay down; `reason` is the down reason stamped with the budget; `history` is pruned. */
+  | { action: "budget-spent"; history: string[]; reason: string }
+  | { action: "not-eligible"; why: "reason" | "already-spent" };
+
+/** A `down` reason the transition (or the watchdog) may rebuild from: a
+ *  rehydration failure that no spent budget has stamped yet. */
+export function isAutoRebuildEligible(reason: string): boolean {
+  return REHYDRATION_FAILURE_RE.test(reason) && !reason.includes(SPENT_MARK);
+}
+
+/** Judge one `down`. `history` are the ISO instants of this resident's past
+ *  auto-rebuilds; entries outside the window (or unparseable) are dropped
+ *  before counting and before writing back. */
+export function autoRebuildDecision(input: {
+  reason: string;
+  history: readonly string[];
+  now: number;
+}): AutoRebuildDecision {
+  if (!REHYDRATION_FAILURE_RE.test(input.reason)) return { action: "not-eligible", why: "reason" };
+  if (input.reason.includes(SPENT_MARK)) return { action: "not-eligible", why: "already-spent" };
+  const windowStart = input.now - AUTO_REBUILD_WINDOW_MS;
+  const kept = input.history
+    .map((iso) => ({ iso, at: Date.parse(iso) }))
+    .filter((e) => Number.isFinite(e.at) && e.at > windowStart)
+    .sort((a, b) => a.at - b.at);
+  const hours = Math.round(AUTO_REBUILD_WINDOW_MS / 3_600_000);
+  if (kept.length >= AUTO_REBUILD_BUDGET) {
+    // No reopen instant on the stamp: a stamped row is never judged again and
+    // a down resident runs no cycle, so nothing resumes when the window
+    // passes — only a person's rebuild recovers it, and the stamp says so.
+    return {
+      action: "budget-spent",
+      history: kept.map((e) => e.iso),
+      reason: `${input.reason}${SPENT_MARK}${AUTO_REBUILD_BUDGET} in ${hours} h) — repo rebuild resets it`,
+    };
+  }
+  const history = [...kept.map((e) => e.iso), new Date(input.now).toISOString()];
+  return {
+    action: "rebuild",
+    history,
+    reason: `auto-rebuild (${history.length} of ${AUTO_REBUILD_BUDGET} in ${hours} h): ${input.reason}`,
+  };
+}

package/dist/assets/src/execution/residentRefresh.ts

@@ -180,7 +180,7 @@ export function killStaleBuildProcessesCommand(user: string, dir: string): strin
  *  a tool naming the signal. A bare "killed" is NOT enough — compilers and
  *  OOM messages say it too — and a step the cycle itself timed out is a real
  *  failure however it died. */
-const INTERRUPTION_SIGNATURE = /\bexit 143\b|Session terminated|SIGTERM/;
+const INTERRUPTION_SIGNATURE = /\bexit 143\b|Session terminated|SIGTERM|^restore-interrupted:/;
 
 /** Message wording of the Sandbox SDK's runtime-replacement error family — the
  *  container went away UNDER a live SDK call, so the failure never reaches the
@@ -396,12 +396,34 @@ export function isRuntimeUnreachableReason(reason: string): boolean {
  *  means the stream ran on before the replacement. */
 export function restoreFailureDisposition(
   message: string,
-  facts: { runtimeReplaced?: boolean } = {},
+  facts: { runtimeReplaced?: boolean; runtimeActive?: boolean } = {},
 ): { action: "interrupted"; reason: string } | { action: "down"; reason: string } {
   const timedOut = /\(timed out\)/.test(message);
-  if (!timedOut && (facts.runtimeReplaced === true || RUNTIME_REPLACEMENT_WORDING.test(message))) {
+  if (timedOut) {
+    return {
+      action: "down",
+      reason: `r2-restore-failed: ${message} — container stopped so the transfer cannot land on a rebuild`,
+    };
+  }
+  // The kill signature the instance step's classifier reads
+  // (INTERRUPTION_SIGNATURE): a container roll SIGTERMs the extract, whose
+  // exec comes back a normal `exit 143` result — the SDK's replacement
+  // wording only reaches the execs that follow. Same event, same reading.
+  if (
+    facts.runtimeReplaced === true ||
+    RUNTIME_REPLACEMENT_WORDING.test(message) ||
+    INTERRUPTION_SIGNATURE.test(message)
+  ) {
     return { action: "interrupted", reason: `restore-interrupted: ${message}` };
   }
+  // The Worker's probe after the failure: a runtime that is no longer active
+  // took the disk the extract wrote to with it, whatever the exit code said.
+  if (facts.runtimeActive === false) {
+    return {
+      action: "interrupted",
+      reason: `restore-interrupted: ${message} — the container stopped under the restore`,
+    };
+  }
   return {
     action: "down",
     reason: `r2-restore-failed: ${message} — container stopped so the transfer cannot land on a rebuild`,

package/dist/assets/src/execution/restoreWaiters.ts

@@ -0,0 +1,61 @@
+/** The ledger of held `/await-restore` requests (docs/reference/specs/execution.md
+ *  item 27): each waiter is one resolver held in memory until the resident's
+ *  lifecycle state leaves `restoring`, when `publish` answers every held
+ *  request at once with the state it landed on. Event-driven by construction —
+ *  no polling and no retry timer anywhere: the one publish is the state
+ *  transition itself (`setResidentState`). In-DO memory only: a Durable Object
+ *  restart drops the held RPCs with the waiters, and the bot's own request
+ *  deadline turns that into a named cold fallback, never a hang. */
+export interface RestoreOutcome {
+  /** The lifecycle state the resident landed on when the restore span ended. */
+  state: string;
+  reason: string;
+}
+
+/** One registered waiter: the outcome it will be answered with, and the way
+ *  to withdraw it when the caller learns it need not wait after all. */
+export interface RestoreHold {
+  outcome: Promise<RestoreOutcome>;
+  /** Take the waiter off the ledger; a no-op once a publish answered it. */
+  withdraw(): void;
+}
+
+export class RestoreWaiters {
+  private waiters: Array<(outcome: RestoreOutcome) => void> = [];
+
+  /** How many requests are held right now (the ledger's size, for tests and logs). */
+  get size(): number {
+    return this.waiters.length;
+  }
+
+  /** Register a waiter for the next publish. Register BEFORE reading the
+   *  state you are waiting to leave: a transition that lands between the read
+   *  and the registration would otherwise publish to a ledger this request is
+   *  not on yet, and hold it for a transition that may never come. A caller
+   *  whose read then says the wait is over withdraws. */
+  hold(): RestoreHold {
+    let resolve!: (outcome: RestoreOutcome) => void;
+    const outcome = new Promise<RestoreOutcome>((r) => (resolve = r));
+    this.waiters.push(resolve);
+    return {
+      outcome,
+      withdraw: () => {
+        const at = this.waiters.indexOf(resolve);
+        if (at !== -1) this.waiters.splice(at, 1);
+      },
+    };
+  }
+
+  /** Hold one request until the next publish. */
+  wait(): Promise<RestoreOutcome> {
+    return this.hold().outcome;
+  }
+
+  /** Answer every held request with the state the resident landed on and
+   *  empty the ledger; a publish with nothing held is a no-op. */
+  publish(outcome: RestoreOutcome): void {
+    const held = this.waiters;
+    this.waiters = [];
+    for (const resolve of held) resolve(outcome);
+  }
+}

package/dist/assets/src/mcp/registry.ts

@@ -234,6 +234,13 @@ export interface McpServerView {
   addedByName?: string;
   addedAt?: number;
   promotedFrom?: string;
+  /** `promotedFrom` as a display name, when the lookup answered. */
+  promotedFromName?: string;
+  /** A user row's owner (the id after `user:` in `scopeKey`) as a display name, when the lookup answered. */
+  ownerName?: string;
+  /** A higher tier holds this name, so runs use that entry and this one is idle (`mcpServersFor`'s
+   *  `shadowedBy`, the winning scope key — `org`, or `channel:<id>`); absent when this entry serves. */
+  shadowedBy?: string;
 }
 
 export function serverView(