@coreplane/switchboard 1.265.1 → 1.266.1

package/dist/assets/.env.example

@@ -33,3 +33,9 @@ E2B_API_KEY=e2b_...
 # GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
 # (b) Fallback: a fine-grained PAT scoped to only the repos the bot may touch.
 # GH_TOKEN=github_pat_...
+
+# Depot CI bridge (optional; bot only). Depot's organization token must NOT be
+# in this file or any container: provision DEPOT_API_TOKEN only on the Worker.
+# Provision a separate internal bearer on that Worker; it forwards this one to
+# the bot. PUBLIC_BASE_URL must be the Worker's HTTPS origin. No Depot CLI needed.
+# DEPOT_CI_BRIDGE_TOKEN=...

package/dist/assets/deploy/cloudflare/depotCi.ts

@@ -0,0 +1,246 @@
+// Depot's organization token belongs to this Worker alone. The bot sends a
+// repo-bound, typed operation; this adapter resolves ownership before spending
+// that credential on logs or a mutation. Nothing here executes repository code.
+import { z } from "zod";
+import { MINUTE_MS } from "../../src/core/budgets.ts";
+import {
+  DEPOT_CI_AUTHORIZATION_PATH,
+  DEPOT_CI_MAX_BYTES,
+  DEPOT_ERRORS,
+  depotCiGrantSchema,
+  depotCiTicketSchema,
+  depotId,
+  depotJson,
+} from "../../src/core/depotCi.ts";
+import { redactSecrets, stripAnsi } from "../../src/core/redact.ts";
+import { sameToken } from "./artifactsCopy.ts";
+import { INTERNAL } from "./shared.ts";
+
+const attemptSchema = z.object({ attemptId: depotId, attempt: z.number().int().positive(), status: z.string() });
+const workflowSchema = z.object({
+  orgId: depotId,
+  runId: depotId,
+  repo: z.string(),
+  workflowId: depotId,
+  headSha: z.string().default(""),
+  sha: z.string().default(""),
+  workflowStatus: z.string(),
+  workflowName: z.string().default(""),
+  workflowPath: z.string().default(""),
+  workflowErrorMessage: z.string().default(""),
+  jobs: z
+    .array(
+      z.object({
+        jobId: depotId,
+        jobKey: z.string(),
+        jobDisplayName: z.string().default(""),
+        status: z.string(),
+        attempts: z.array(attemptSchema).default([]),
+      }),
+    )
+    .default([]),
+});
+const logsSchema = z.object({
+  lines: z.array(z.object({ body: z.string(), stepName: z.string().default("") })).default([]),
+  nextPageToken: z.string().max(8192).default(""),
+});
+const retrySchema = z.object({
+  workflowId: depotId,
+  jobIds: z.array(depotId),
+  jobCount: z.number().int().nonnegative(),
+});
+/** The callback has no caller-controlled origin or path. Worker wiring supplies
+ * the singleton container binding, NOT an Internet fetch or a redirect. */
+export async function depotCiAuthorization(
+  ticket: string,
+  signal: AbortSignal,
+  botFetch: (request: Request) => Promise<Response>,
+): Promise<unknown> {
+  const res = await botFetch(
+    new Request(`${INTERNAL}${DEPOT_CI_AUTHORIZATION_PATH}`, {
+      method: "POST",
+      redirect: "error",
+      signal,
+      headers: { authorization: `Bearer ${ticket}` },
+    }),
+  );
+  if (res.status !== 200) {
+    await res.body?.cancel();
+    return undefined;
+  }
+  return depotJson(res, 16 * 1024);
+}
+const json = (status: number, body: unknown) =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+
+export async function handleDepotCi(
+  request: Request,
+  deps: {
+    depotToken?: string;
+    bridgeToken?: string;
+    authorize?: (ticket: string, signal: AbortSignal) => Promise<unknown>;
+    fetch: typeof fetch;
+  },
+): Promise<Response> {
+  const bearer = /^Bearer\s+(\S+)$/.exec(request.headers.get("authorization") ?? "")?.[1];
+  if (!deps.bridgeToken || !bearer || !sameToken(bearer, deps.bridgeToken))
+    return json(401, { error: "Depot CI bridge bearer refused." });
+  if (request.method !== "POST") return json(405, { error: "Depot CI requires POST." });
+  let raw: unknown;
+  try {
+    raw = await depotJson(new Response(request.body), 16 * 1024);
+  } catch {
+    return json(400, { error: DEPOT_ERRORS.invalid });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return json(400, { error: DEPOT_ERRORS.invalid });
+  const parsed = depotCiTicketSchema.safeParse(raw);
+  if (!parsed.success) return json(400, { error: DEPOT_ERRORS.invalid });
+  const signal = AbortSignal.any([request.signal, AbortSignal.timeout(MINUTE_MS)]);
+  let grant;
+  try {
+    signal.throwIfAborted();
+    grant = depotCiGrantSchema.safeParse(await deps.authorize?.(parsed.data.ticket, signal));
+  } catch {
+    return json(403, { error: DEPOT_ERRORS.unauthorized });
+  }
+  if (!grant.success) return json(403, { error: DEPOT_ERRORS.unauthorized });
+  if (!deps.depotToken) return json(503, { error: DEPOT_ERRORS.unavailable });
+  // Both repo and operation came from a one-use permit the authenticated run's
+  // tool call registered in the bot. Possessing the bridge bearer cannot mint
+  // one, choose another repo, change its head, or replay it.
+  const { repo, operation: op } = grant.data;
+  // Credentials are redacted as exact values too: not every vendor token has a
+  // recognizable prefix. Strip control sequences before either redaction pass.
+  const sanitize = (text: string) =>
+    redactSecrets(
+      stripAnsi(text)
+        .split(deps.depotToken!)
+        .join("[redacted]")
+        .split(deps.bridgeToken!)
+        .join("[redacted]")
+        .split(parsed.data.ticket)
+        .join("[redacted]"),
+    );
+  const safeJson = (value: unknown): unknown => {
+    if (typeof value === "string") return sanitize(value);
+    if (Array.isArray(value)) return value.map(safeJson);
+    if (value && typeof value === "object")
+      return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, safeJson(entry)]));
+    return value;
+  };
+  let mutationStarted = false;
+  let upstreamStatus: number | undefined;
+  const rpc = async (method: "GetWorkflow" | "GetJobAttemptLogs" | "RetryFailedJobs", body: object) => {
+    signal.throwIfAborted();
+    if (method === "RetryFailedJobs") mutationStarted = true;
+    const res = await deps.fetch(`https://api.depot.dev/depot.ci.v1.CIService/${method}`, {
+      method: "POST",
+      redirect: "error",
+      signal,
+      headers: {
+        authorization: `Bearer ${deps.depotToken}`,
+        "content-type": "application/json",
+        "connect-protocol-version": "1",
+      },
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+      upstreamStatus = res.status;
+      await res.body?.cancel();
+      throw new Error("upstream refused");
+    }
+    return depotJson(res);
+  };
+  try {
+    const workflow = workflowSchema.parse(await rpc("GetWorkflow", { workflowId: op.workflowId }));
+    if (workflow.repo.toLowerCase() !== repo.toLowerCase() || workflow.workflowId !== op.workflowId)
+      return json(404, { error: DEPOT_ERRORS.notFound });
+    if (op.operation === "inspect") return json(200, safeJson(workflow));
+    if (op.operation === "retry_failed") {
+      const head = workflow.headSha || workflow.sha;
+      if (
+        head.toLowerCase() !== op.expectedHead.toLowerCase() ||
+        !["failed", "cancelled"].includes(workflow.workflowStatus)
+      )
+        return json(409, { error: DEPOT_ERRORS.stale });
+      const answer = retrySchema.parse(await rpc("RetryFailedJobs", { workflowId: op.workflowId }));
+      if (answer.workflowId !== op.workflowId || answer.jobCount !== answer.jobIds.length)
+        throw new Error("inconsistent retry response");
+      return json(200, safeJson(answer));
+    }
+    const jobs = workflow.jobs.filter((j) => j.jobId === op.jobId);
+    if (jobs.length !== 1) return json(404, { error: DEPOT_ERRORS.notFound });
+    const attempts = jobs[0].attempts;
+    const latest = Math.max(...attempts.map((a) => a.attempt));
+    const selected = attempts.filter((a) => (op.attemptId ? a.attemptId === op.attemptId : a.attempt === latest));
+    if (selected.length !== 1) return json(404, { error: DEPOT_ERRORS.notFound });
+    const attemptId = selected[0].attemptId;
+    let pageToken: string | undefined;
+    const seen = new Set<string>();
+    const records: string[] = [];
+    let capturedChars = 0;
+    let complete = false;
+    let truncated = false;
+    const lineLimit = op.lines ?? 200;
+    for (let page = 0; page < 20; page++) {
+      const result = logsSchema.parse(
+        await rpc("GetJobAttemptLogs", { attemptId, ...(pageToken ? { pageToken } : {}) }),
+      );
+      // Keep the finite raw capture until all boundaries can be sanitized.
+      // A separate aggregate ceiling bounds Worker memory, not just each page.
+      const chars = result.lines.reduce((sum, line) => sum + line.body.length + 1, 0);
+      if (capturedChars + chars > 2 * DEPOT_CI_MAX_BYTES) break;
+      for (const line of result.lines) records.push(line.body);
+      capturedChars += chars;
+      if (!result.nextPageToken) {
+        complete = true;
+        break;
+      }
+      if (seen.has(result.nextPageToken)) break;
+      seen.add(result.nextPageToken);
+      pageToken = result.nextPageToken;
+    }
+    // Depot records/pages may split a credential. Compare both interpretations
+    // of their separators BEFORE clipping: if removing newlines changes what is
+    // secret, withhold the capture rather than guessing which fragment is safe.
+    // Partial captures are withheld too: a later page could finish a credential
+    // or a PEM block. This fails closed without retaining unbounded raw logs.
+    const rawText = complete ? records.join("\n") : "";
+    const sanitized = sanitize(rawText);
+    const withheld = !complete
+      ? "incomplete capture"
+      : sanitized.replace(/\n/g, "") !== sanitize(rawText.replace(/\n/g, ""))
+        ? "credential spans log records"
+        : undefined;
+    let text = "";
+    if (!withheld) {
+      const lines = sanitized.split("\n");
+      truncated = lines.length > lineLimit;
+      text = lines.slice(-lineLimit).join("\n");
+      if (text.length > 50_000) {
+        text = text.slice(-50_000);
+        truncated = true;
+      }
+    }
+    return json(200, {
+      workflowId: op.workflowId,
+      jobId: op.jobId,
+      attemptId,
+      complete,
+      truncated: truncated || !!withheld,
+      ...(withheld ? { withheld } : {}),
+      text,
+    });
+  } catch {
+    return json(502, {
+      error: mutationStarted
+        ? DEPOT_ERRORS.unknown
+        : upstreamStatus
+          ? `Depot CI upstream refused (HTTP ${upstreamStatus}).`
+          : DEPOT_ERRORS.failed,
+    });
+  }
+}

package/dist/assets/deploy/cloudflare/worker.ts

@@ -1,3 +1,6 @@
+import { depotCiAuthorization, handleDepotCi } from "./depotCi.ts";
+import { DEPOT_CI_AUTHORIZATION_PATH, DEPOT_CI_PATH } from "../../src/core/depotCi.ts";
+import { githubDoorEdgeRoute } from "../../src/channels/githubDoorPaths.ts";
 // Cloudflare Containers shim: runs the unchanged Switchboard image as a single
 // always-on container instance — the shape of any long-lived server on
 // Cloudflare Containers (singleton DO, cron keep-alive;
@@ -83,7 +86,10 @@ export interface Env {
   GITHUB_APP_ID?: string;
   GITHUB_APP_INSTALLATION_ID?: string;
   GITHUB_APP_PRIVATE_KEY?: string;
+  DEPOT_API_TOKEN?: string; // Worker-only organization credential: NEVER forwarded to any container
+  DEPOT_CI_BRIDGE_TOKEN?: string; // bot → Worker, narrow repo-bound CI operations only
   PUBLIC_BASE_URL?: string; // live-view: base for /runs/<id>?t=… links on the status card
+  PUBLIC_GIT_BASE_URL?: string; // GitHub run-bearer door on a separate custom domain without dashboard Access
   ACCESS_TEAM_DOMAIN?: string; // live-view SSO gate: Cloudflare Access team domain (JWKS + iss)
   ACCESS_AUD?: string; // live-view SSO gate: Cloudflare Access application AUD tag
   DASHBOARD_TOKEN?: string; // dashboard auth `token` strategy: the bearer (the default env name; config may name another)
@@ -124,7 +130,9 @@ const FORWARDED_OPTIONAL = [
   "GITHUB_APP_ID",
   "GITHUB_APP_INSTALLATION_ID",
   "GITHUB_APP_PRIVATE_KEY",
+  "DEPOT_CI_BRIDGE_TOKEN",
   "PUBLIC_BASE_URL",
+  "PUBLIC_GIT_BASE_URL",
   "ACCESS_TEAM_DOMAIN",
   "ACCESS_AUD",
   "DASHBOARD_TOKEN",
@@ -457,7 +465,21 @@ const withLength = (res: Response): Response => withKnownLength(res, (size) => n
 
 export default {
   async fetch(request: Request, env: Env): Promise<Response> {
-    const pathname = new URL(request.url).pathname;
+    const requestUrl = new URL(request.url);
+    const pathname = requestUrl.pathname;
+    if (githubDoorEdgeRoute(requestUrl, request.method, env.PUBLIC_GIT_BASE_URL) === "refuse")
+      return new Response("not found", { status: 404 });
+    // Permits can only be consumed through the Worker's fixed container
+    // binding. The public edge must never proxy this callback path.
+    if (pathname === DEPOT_CI_AUTHORIZATION_PATH) return new Response("not found", { status: 404 });
+    if (pathname === DEPOT_CI_PATH)
+      return handleDepotCi(request, {
+        depotToken: env.DEPOT_API_TOKEN,
+        bridgeToken: env.DEPOT_CI_BRIDGE_TOKEN,
+        authorize: (ticket, signal) =>
+          depotCiAuthorization(ticket, signal, (req) => getContainer(env.SWITCHBOARD, INSTANCE).fetch(req)),
+        fetch: (input, init) => fetch(input, init),
+      });
     // Only deliberately published copies are public. The existing run reader
     // and the bucket stay private; the write endpoint checks its own bearer.
     if (pathname.startsWith("/pr-images/")) return withLength(await handlePrImage(request, env.ARTIFACTS));

package/dist/assets/deploy/cloudflare/wrangler.template.jsonc

@@ -13,7 +13,10 @@
   // Cloudflare Access (SSO), and Access can only front a real zone domain —
   // leaving the workers.dev URL up would expose an un-SSO'd copy of /runs.
   "workers_dev": false,
-  "routes": [{ "pattern": "{{hostname}}", "custom_domain": true }],
+  "routes": [
+    { "pattern": "{{hostname}}", "custom_domain": true },
+    { "pattern": "git.{{hostname}}", "custom_domain": true }
+  ],
   // Non-secret, deploy-constant config for the container. PUBLIC_BASE_URL: the
   // live-view link base — the dispatcher (in the container) reads
   // process.env.PUBLIC_BASE_URL to put the /runs/<id>?t=… link on the status
@@ -27,6 +30,7 @@
   // every dashboard request is denied.
   "vars": {
     "PUBLIC_BASE_URL": "{{urls.publicBaseUrl}}",
+    "PUBLIC_GIT_BASE_URL": "https://git.{{hostname}}",
     // {{#if access}}
     "ACCESS_TEAM_DOMAIN": "{{access.teamDomain}}",
     "ACCESS_AUD": "{{access.aud}}",

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -23,6 +23,7 @@ import {
   applyRetention,
   clampRetentionPolicy,
   isRunRecord,
+  isRecoveryEvidenceScope,
   isRunSession,
   isRunVisibilityFilter,
   normalizeStored,
@@ -4163,6 +4164,12 @@ export class RunHistoryDO extends DurableObject<Env> {
    * walked until the page fills; the kept set is the newest prefix of the
    * in-cutoff order, so the walk stops at the first row outside it.
    *
+   * Recovery evidence additionally streams every retained summary through the
+   * record parser before trusting identity filters: valid JSON can still be
+   * unreadable evidence whose missing identity would hide a competing child.
+   * This does not load the retained summaries into memory together or change
+   * the relevant-row cap; ordinary list queries keep the fast path above.
+   *
    * `visibleTo` — the caller's authorization predicate (authorization.md item
    * 6) — is compiled into the same WHERE clause (`visibilitySql`): its leaves
    * become `channel_id IN (…)`, `channel_visibility IN (…)`, `user_id = ?`,
@@ -4170,7 +4177,9 @@ export class RunHistoryDO extends DurableObject<Env> {
    * indexed filter on the page query, never a post-filter. `none` answers an
    * empty page without a query.
    */
-  async list(q: RunListOptions): Promise<{ items: RunListItem[]; nextBefore?: { finishedAt: number; id: string } }> {
+  async list(
+    q: RunListOptions,
+  ): Promise<{ items: RunListItem[]; nextBefore?: { finishedAt: number; id: string }; evidenceComplete?: boolean }> {
     const now = systemClock();
     const limit = clampListLimit(q.limit);
     if (q.visibleTo?.kind === "none") return { items: [] };
@@ -4204,6 +4213,29 @@ export class RunHistoryDO extends DurableObject<Env> {
       where.push(`parent_run_id = ?`);
       params.push(q.parentRunId);
     }
+    if (q.recoveryEvidence !== undefined) {
+      // Identity comparisons cannot prove an unreadable record is unrelated.
+      // Use the same parser as the result loop, not a weaker SQL shape check.
+      for (const row of this.sql.exec<Pick<RunRow, "run_id" | "summary_json">>(
+        `SELECT run_id, summary_json FROM runs WHERE finished_at >= ? ORDER BY finished_at DESC, run_id DESC`,
+        cutoff,
+      )) {
+        if (kept !== null && !kept.has(row.run_id)) break; // only the retained newest-first prefix
+        if (!parseSummary(row)) return { items: [], evidenceComplete: false };
+      }
+      const scope = q.recoveryEvidence;
+      const unitKey = `${scope.instanceId}:${scope.unit}`;
+      const prefix = `${unitKey}/`;
+      // Literal prefix, not LIKE: instance ids can contain SQL wildcard chars.
+      // Bare unit keys remain candidates, never proof of absence.
+      where.push(`(CASE WHEN json_valid(summary_json) THEN (
+        json_extract(summary_json, '$.parentInstanceId') = ? OR
+        json_extract(summary_json, '$.idempotencyKey') = ? OR
+        substr(json_extract(summary_json, '$.idempotencyKey'), 1, ?) = ? OR
+        thread_key IN (${scope.threadKeys.map(() => "?").join(",")})
+      ) ELSE 1 END)`);
+      params.push(scope.instanceId, unitKey, prefix.length, prefix, ...scope.threadKeys);
+    }
     if (q.pr !== undefined) {
       // `namesPullRequest` in SQL: the row's repository and the number it names.
       where.push(`repo = ?`, `pr_number = ?`);
@@ -4216,13 +4248,18 @@ export class RunHistoryDO extends DurableObject<Env> {
     // the walk stops early at the first evicted row) — never a full table load.
     const rows = this.sql.exec<RunRow>(`${select} LIMIT ?`, ...params, limit).toArray();
     const items: RunListItem[] = [];
+    let malformed = false;
     for (const row of rows) {
       if (items.length >= limit) break;
       if (kept !== null && !kept.has(row.run_id)) break; // kept is a newest-first prefix: nothing older is kept either
       const summary = parseSummary(row);
       if (summary) items.push({ ...summary, bytes: row.bytes });
+      else malformed = true;
     }
-    const out: { items: RunListItem[]; nextBefore?: { finishedAt: number; id: string } } = { items };
+    const out: { items: RunListItem[]; nextBefore?: { finishedAt: number; id: string }; evidenceComplete?: boolean } = {
+      items,
+    };
+    if (q.recoveryEvidence !== undefined) out.evidenceComplete = !malformed && rows.length < limit;
     if (items.length === limit) {
       const last = items[items.length - 1];
       out.nextBefore = { finishedAt: last.finishedAt, id: last.id };
@@ -4322,7 +4359,7 @@ function identityOfSummary(raw: string): { userName?: string; parentRunId?: stri
   }
 }
 
-function parseSummary(row: RunRow): Omit<RunRecord, "events"> | null {
+function parseSummary(row: Pick<RunRow, "summary_json">): Omit<RunRecord, "events"> | null {
   try {
     const parsed: unknown = JSON.parse(row.summary_json);
     return isRunRecord({ ...(parsed as object), events: [] })
@@ -4492,6 +4529,14 @@ function parseRunList(body: unknown): Validated<{ storeKey: string; query: RunLi
       return invalid("pr must be { repo: owner/name, number: a positive integer }");
     query.pr = { repo: pr.repo, number: pr.number };
   }
+  if (b.recoveryEvidence !== undefined) {
+    if (!isRecoveryEvidenceScope(b.recoveryEvidence))
+      return invalid("recoveryEvidence must name an instance, unit and original threads");
+    // No paged or narrowed response can attest complete recovery evidence.
+    if (Object.keys(query).some((field) => field !== "limit") || b.visibleTo !== undefined)
+      return invalid("recoveryEvidence cannot be combined with list filters or cursors");
+    query.recoveryEvidence = b.recoveryEvidence;
+  }
   if (b.visibleTo !== undefined) {
     // A malformed filter is a 400, never "all": the bot degrades to live rows
     // rather than the DO widening what an actor may see.

package/dist/assets/deploy/cloudflare-resident/legacyCredentials.ts

@@ -0,0 +1,43 @@
+/** Root-side cleanup for credentials left by an earlier resident release.
+ * Open every directory component without following symlinks, then unlink
+ * only the named file relative to its pinned directory descriptor. A model
+ * owns the old tree and stage directory, so a pathname-based root `rm` can
+ * otherwise traverse a replacement symlink outside that tree. */
+export const LEGACY_CREDENTIAL_SCRUB = `import os, sys
+
+flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+
+def open_dir(path):
+    fd = os.open('/', flags)
+    try:
+        for part in path.strip('/').split('/'):
+            if not part:
+                continue
+            child = os.open(part, flags, dir_fd=fd)
+            os.close(fd)
+            fd = child
+        return fd
+    except BaseException:
+        os.close(fd)
+        raise
+
+def remove(parent, name):
+    try:
+        fd = open_dir(parent)
+    except FileNotFoundError:
+        return
+    try:
+        try:
+            os.unlink(name, dir_fd=fd)
+        except FileNotFoundError:
+            pass
+    finally:
+        os.close(fd)
+
+remove(sys.argv[1], 'github-credentials')
+remove(sys.argv[2], 'cred')
+`;
+
+export function legacyCredentialScrubCommand(worktreePath: string, stageDir: string): string[] {
+  return ["python3", "-c", LEGACY_CREDENTIAL_SCRUB, `${worktreePath}/.git`, stageDir];
+}