@coreplane/switchboard 1.266.1 → 1.267.1

package/dist/assets/deploy/cloudflare-memory/package.json

@@ -16,7 +16,7 @@
     "secrets": "npm --prefix ../.. run --silent cli -- deploy secrets memory"
   },
   "devDependencies": {
-    "@cloudflare/vitest-pool-workers": "^0.22.0",
+    "@cloudflare/vitest-plugin": "1.2.8",
     "@cloudflare/workers-types": "^5.20260914.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",

package/dist/assets/deploy/cloudflare-memory/tsconfig.json

@@ -7,7 +7,7 @@
     "module": "esnext",
     "moduleResolution": "bundler",
     "lib": ["esnext"],
-    "types": ["@cloudflare/workers-types/experimental", "@cloudflare/vitest-pool-workers/types", "node"],
+    "types": ["@cloudflare/workers-types/experimental", "@cloudflare/vitest-plugin/types", "node"],
     "strict": true,
     "noEmit": true,
     "skipLibCheck": true,

package/dist/assets/deploy/cloudflare-resident/gc.ts

@@ -99,6 +99,7 @@ export type ReclaimWhy =
   | "busy"
   | "run-held"
   | "re-attached"
+  | "cleanup-failed"
   | Extract<RefFate, "gone" | "merged" | "closed">;
 
 /** Evict this binding now? A finished ref (gone/merged/closed) is reclaimed

package/dist/assets/deploy/cloudflare-resident/keyedAsyncLock.ts

@@ -0,0 +1,20 @@
+/** Serialize one key through the entire operation, including rollback. */
+export class KeyedAsyncLock {
+  private readonly tails = new Map<string, Promise<void>>();
+
+  async run<T>(key: string, action: () => Promise<T>): Promise<T> {
+    const prior = this.tails.get(key);
+    let release!: () => void;
+    const current = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    this.tails.set(key, current);
+    if (prior) await prior;
+    try {
+      return await action();
+    } finally {
+      release();
+      if (this.tails.get(key) === current) this.tails.delete(key);
+    }
+  }
+}

package/dist/assets/deploy/cloudflare-resident/legacyCredentials.ts

@@ -41,3 +41,60 @@ remove(sys.argv[2], 'cred')
 export function legacyCredentialScrubCommand(worktreePath: string, stageDir: string): string[] {
   return ["python3", "-c", LEGACY_CREDENTIAL_SCRUB, `${worktreePath}/.git`, stageDir];
 }
+
+/** A free UID must not inherit files left in its old staging directory.
+ * Inspect directory components without following links and report only whether
+ * content exists. The probe never reads or prints a credential or staged file. */
+export const LEGACY_STAGE_CONTENT_SCAN = `import os, sys
+
+flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+fd = os.open('/', flags)
+try:
+    try:
+        for part in sys.argv[1].strip('/').split('/'):
+            if not part:
+                continue
+            child = os.open(part, flags, dir_fd=fd)
+            os.close(fd)
+            fd = child
+    except FileNotFoundError:
+        print('clean')
+    else:
+        print('stale' if os.listdir(fd) else 'clean')
+finally:
+    os.close(fd)
+`;
+
+export function legacyStageContentScanCommand(stageDir: string): string[] {
+  return ["python3", "-c", LEGACY_STAGE_CONTENT_SCAN, stageDir];
+}
+
+/** Eviction may free this UID only after its known staging files are gone.
+ * Unlink through an unfollowed directory descriptor; a linked stage fails. */
+export const LEGACY_STAGE_REUSE_SCRUB = `import os, sys
+
+flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW
+fd = os.open('/', flags)
+try:
+    try:
+        for part in sys.argv[1].strip('/').split('/'):
+            if not part:
+                continue
+            child = os.open(part, flags, dir_fd=fd)
+            os.close(fd)
+            fd = child
+    except FileNotFoundError:
+        pass
+    else:
+        for name in ('cred', 'put'):
+            try:
+                os.unlink(name, dir_fd=fd)
+            except FileNotFoundError:
+                pass
+finally:
+    os.close(fd)
+`;
+
+export function legacyStageReuseScrubCommand(stageDir: string): string[] {
+  return ["python3", "-c", LEGACY_STAGE_REUSE_SCRUB, stageDir];
+}

package/dist/assets/deploy/cloudflare-resident/orphanThreadUsers.ts

@@ -0,0 +1,14 @@
+/** Validate the root-owned scan before a pool UID can be handed to another run.
+ * An older release may have removed a binding without removing its tree. */
+export function hasUnexpectedOwnedThreadDir(output: string, root: string, allowed: readonly string[]): boolean {
+  const pathOk = (path: string) => {
+    if (!path.startsWith(`${root}/`)) return false;
+    const name = path.slice(root.length + 1);
+    return name.length > 0 && /^[A-Za-z0-9._-]+$/.test(name) && name !== "." && name !== "..";
+  };
+  if (allowed.some((path) => !pathOk(path))) return true;
+  if (output === "") return false;
+  if (!output.endsWith("\n")) return true;
+  const paths = output.slice(0, -1).split("\n");
+  return paths.some((path) => !pathOk(path) || !allowed.includes(path));
+}