@coreplane/switchboard 1.266.0 → 1.266.1

package/dist/assets/deploy/cloudflare/worker.ts

@@ -1,5 +1,6 @@
 import { depotCiAuthorization, handleDepotCi } from "./depotCi.ts";
 import { DEPOT_CI_AUTHORIZATION_PATH, DEPOT_CI_PATH } from "../../src/core/depotCi.ts";
+import { githubDoorEdgeRoute } from "../../src/channels/githubDoorPaths.ts";
 // Cloudflare Containers shim: runs the unchanged Switchboard image as a single
 // always-on container instance — the shape of any long-lived server on
 // Cloudflare Containers (singleton DO, cron keep-alive;
@@ -88,6 +89,7 @@ export interface Env {
   DEPOT_API_TOKEN?: string; // Worker-only organization credential: NEVER forwarded to any container
   DEPOT_CI_BRIDGE_TOKEN?: string; // bot → Worker, narrow repo-bound CI operations only
   PUBLIC_BASE_URL?: string; // live-view: base for /runs/<id>?t=… links on the status card
+  PUBLIC_GIT_BASE_URL?: string; // GitHub run-bearer door on a separate custom domain without dashboard Access
   ACCESS_TEAM_DOMAIN?: string; // live-view SSO gate: Cloudflare Access team domain (JWKS + iss)
   ACCESS_AUD?: string; // live-view SSO gate: Cloudflare Access application AUD tag
   DASHBOARD_TOKEN?: string; // dashboard auth `token` strategy: the bearer (the default env name; config may name another)
@@ -130,6 +132,7 @@ const FORWARDED_OPTIONAL = [
   "GITHUB_APP_PRIVATE_KEY",
   "DEPOT_CI_BRIDGE_TOKEN",
   "PUBLIC_BASE_URL",
+  "PUBLIC_GIT_BASE_URL",
   "ACCESS_TEAM_DOMAIN",
   "ACCESS_AUD",
   "DASHBOARD_TOKEN",
@@ -462,7 +465,10 @@ const withLength = (res: Response): Response => withKnownLength(res, (size) => n
 
 export default {
   async fetch(request: Request, env: Env): Promise<Response> {
-    const pathname = new URL(request.url).pathname;
+    const requestUrl = new URL(request.url);
+    const pathname = requestUrl.pathname;
+    if (githubDoorEdgeRoute(requestUrl, request.method, env.PUBLIC_GIT_BASE_URL) === "refuse")
+      return new Response("not found", { status: 404 });
     // Permits can only be consumed through the Worker's fixed container
     // binding. The public edge must never proxy this callback path.
     if (pathname === DEPOT_CI_AUTHORIZATION_PATH) return new Response("not found", { status: 404 });

package/dist/assets/deploy/cloudflare/wrangler.template.jsonc

@@ -13,7 +13,10 @@
   // Cloudflare Access (SSO), and Access can only front a real zone domain —
   // leaving the workers.dev URL up would expose an un-SSO'd copy of /runs.
   "workers_dev": false,
-  "routes": [{ "pattern": "{{hostname}}", "custom_domain": true }],
+  "routes": [
+    { "pattern": "{{hostname}}", "custom_domain": true },
+    { "pattern": "git.{{hostname}}", "custom_domain": true }
+  ],
   // Non-secret, deploy-constant config for the container. PUBLIC_BASE_URL: the
   // live-view link base — the dispatcher (in the container) reads
   // process.env.PUBLIC_BASE_URL to put the /runs/<id>?t=… link on the status
@@ -27,6 +30,7 @@
   // every dashboard request is denied.
   "vars": {
     "PUBLIC_BASE_URL": "{{urls.publicBaseUrl}}",
+    "PUBLIC_GIT_BASE_URL": "https://git.{{hostname}}",
     // {{#if access}}
     "ACCESS_TEAM_DOMAIN": "{{access.teamDomain}}",
     "ACCESS_AUD": "{{access.aud}}",

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -23,6 +23,7 @@ import {
   applyRetention,
   clampRetentionPolicy,
   isRunRecord,
+  isRecoveryEvidenceScope,
   isRunSession,
   isRunVisibilityFilter,
   normalizeStored,
@@ -4163,6 +4164,12 @@ export class RunHistoryDO extends DurableObject<Env> {
    * walked until the page fills; the kept set is the newest prefix of the
    * in-cutoff order, so the walk stops at the first row outside it.
    *
+   * Recovery evidence additionally streams every retained summary through the
+   * record parser before trusting identity filters: valid JSON can still be
+   * unreadable evidence whose missing identity would hide a competing child.
+   * This does not load the retained summaries into memory together or change
+   * the relevant-row cap; ordinary list queries keep the fast path above.
+   *
    * `visibleTo` — the caller's authorization predicate (authorization.md item
    * 6) — is compiled into the same WHERE clause (`visibilitySql`): its leaves
    * become `channel_id IN (…)`, `channel_visibility IN (…)`, `user_id = ?`,
@@ -4170,7 +4177,9 @@ export class RunHistoryDO extends DurableObject<Env> {
    * indexed filter on the page query, never a post-filter. `none` answers an
    * empty page without a query.
    */
-  async list(q: RunListOptions): Promise<{ items: RunListItem[]; nextBefore?: { finishedAt: number; id: string } }> {
+  async list(
+    q: RunListOptions,
+  ): Promise<{ items: RunListItem[]; nextBefore?: { finishedAt: number; id: string }; evidenceComplete?: boolean }> {
     const now = systemClock();
     const limit = clampListLimit(q.limit);
     if (q.visibleTo?.kind === "none") return { items: [] };
@@ -4204,6 +4213,29 @@ export class RunHistoryDO extends DurableObject<Env> {
       where.push(`parent_run_id = ?`);
       params.push(q.parentRunId);
     }
+    if (q.recoveryEvidence !== undefined) {
+      // Identity comparisons cannot prove an unreadable record is unrelated.
+      // Use the same parser as the result loop, not a weaker SQL shape check.
+      for (const row of this.sql.exec<Pick<RunRow, "run_id" | "summary_json">>(
+        `SELECT run_id, summary_json FROM runs WHERE finished_at >= ? ORDER BY finished_at DESC, run_id DESC`,
+        cutoff,
+      )) {
+        if (kept !== null && !kept.has(row.run_id)) break; // only the retained newest-first prefix
+        if (!parseSummary(row)) return { items: [], evidenceComplete: false };
+      }
+      const scope = q.recoveryEvidence;
+      const unitKey = `${scope.instanceId}:${scope.unit}`;
+      const prefix = `${unitKey}/`;
+      // Literal prefix, not LIKE: instance ids can contain SQL wildcard chars.
+      // Bare unit keys remain candidates, never proof of absence.
+      where.push(`(CASE WHEN json_valid(summary_json) THEN (
+        json_extract(summary_json, '$.parentInstanceId') = ? OR
+        json_extract(summary_json, '$.idempotencyKey') = ? OR
+        substr(json_extract(summary_json, '$.idempotencyKey'), 1, ?) = ? OR
+        thread_key IN (${scope.threadKeys.map(() => "?").join(",")})
+      ) ELSE 1 END)`);
+      params.push(scope.instanceId, unitKey, prefix.length, prefix, ...scope.threadKeys);
+    }
     if (q.pr !== undefined) {
       // `namesPullRequest` in SQL: the row's repository and the number it names.
       where.push(`repo = ?`, `pr_number = ?`);
@@ -4216,13 +4248,18 @@ export class RunHistoryDO extends DurableObject<Env> {
     // the walk stops early at the first evicted row) — never a full table load.
     const rows = this.sql.exec<RunRow>(`${select} LIMIT ?`, ...params, limit).toArray();
     const items: RunListItem[] = [];
+    let malformed = false;
     for (const row of rows) {
       if (items.length >= limit) break;
       if (kept !== null && !kept.has(row.run_id)) break; // kept is a newest-first prefix: nothing older is kept either
       const summary = parseSummary(row);
       if (summary) items.push({ ...summary, bytes: row.bytes });
+      else malformed = true;
     }
-    const out: { items: RunListItem[]; nextBefore?: { finishedAt: number; id: string } } = { items };
+    const out: { items: RunListItem[]; nextBefore?: { finishedAt: number; id: string }; evidenceComplete?: boolean } = {
+      items,
+    };
+    if (q.recoveryEvidence !== undefined) out.evidenceComplete = !malformed && rows.length < limit;
     if (items.length === limit) {
       const last = items[items.length - 1];
       out.nextBefore = { finishedAt: last.finishedAt, id: last.id };
@@ -4322,7 +4359,7 @@ function identityOfSummary(raw: string): { userName?: string; parentRunId?: stri
   }
 }
 
-function parseSummary(row: RunRow): Omit<RunRecord, "events"> | null {
+function parseSummary(row: Pick<RunRow, "summary_json">): Omit<RunRecord, "events"> | null {
   try {
     const parsed: unknown = JSON.parse(row.summary_json);
     return isRunRecord({ ...(parsed as object), events: [] })
@@ -4492,6 +4529,14 @@ function parseRunList(body: unknown): Validated<{ storeKey: string; query: RunLi
       return invalid("pr must be { repo: owner/name, number: a positive integer }");
     query.pr = { repo: pr.repo, number: pr.number };
   }
+  if (b.recoveryEvidence !== undefined) {
+    if (!isRecoveryEvidenceScope(b.recoveryEvidence))
+      return invalid("recoveryEvidence must name an instance, unit and original threads");
+    // No paged or narrowed response can attest complete recovery evidence.
+    if (Object.keys(query).some((field) => field !== "limit") || b.visibleTo !== undefined)
+      return invalid("recoveryEvidence cannot be combined with list filters or cursors");
+    query.recoveryEvidence = b.recoveryEvidence;
+  }
   if (b.visibleTo !== undefined) {
     // A malformed filter is a 400, never "all": the bot degrades to live rows
     // rather than the DO widening what an actor may see.

package/dist/assets/deploy/cloudflare-resident/legacyCredentials.ts

@@ -0,0 +1,43 @@
+/** Root-side cleanup for credentials left by an earlier resident release.
+ * Open every directory component without following symlinks, then unlink
+ * only the named file relative to its pinned directory descriptor. A model
+ * owns the old tree and stage directory, so a pathname-based root `rm` can
+ * otherwise traverse a replacement symlink outside that tree. */
+export const LEGACY_CREDENTIAL_SCRUB = `import os, sys
+
+flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+
+def open_dir(path):
+    fd = os.open('/', flags)
+    try:
+        for part in path.strip('/').split('/'):
+            if not part:
+                continue
+            child = os.open(part, flags, dir_fd=fd)
+            os.close(fd)
+            fd = child
+        return fd
+    except BaseException:
+        os.close(fd)
+        raise
+
+def remove(parent, name):
+    try:
+        fd = open_dir(parent)
+    except FileNotFoundError:
+        return
+    try:
+        try:
+            os.unlink(name, dir_fd=fd)
+        except FileNotFoundError:
+            pass
+    finally:
+        os.close(fd)
+
+remove(sys.argv[1], 'github-credentials')
+remove(sys.argv[2], 'cred')
+`;
+
+export function legacyCredentialScrubCommand(worktreePath: string, stageDir: string): string[] {
+  return ["python3", "-c", LEGACY_CREDENTIAL_SCRUB, `${worktreePath}/.git`, stageDir];
+}