@coreplane/switchboard 1.267.0 → 1.267.2

package/dist/assets/src/execution/residentPoolSpends.ts

@@ -0,0 +1,96 @@
+/** Durable UID ownership within one VM generation. Missing or malformed
+ * records are unknown generations, never an empty pool. */
+export interface SpentPoolUser {
+  user: string;
+  owner: string;
+}
+
+export function parseSpentPoolUsers(value: unknown, pool: readonly string[]): ReadonlyMap<string, string> | null {
+  if (
+    !Array.isArray(value) ||
+    !value.every(
+      (row): row is SpentPoolUser =>
+        row !== null &&
+        typeof row === "object" &&
+        "user" in row &&
+        "owner" in row &&
+        typeof row.user === "string" &&
+        typeof row.owner === "string" &&
+        /^(thread|op):\S+$/.test(row.owner),
+    )
+  )
+    return null;
+  const spent = new Map(value.map(({ user, owner }) => [user, owner]));
+  if (spent.size !== value.length || [...spent.keys()].some((user) => !pool.includes(user))) return null;
+  return spent;
+}
+
+/** A new owner must get an unused UID; only the exact recorded owner may
+ * reclaim its UID. Both paths record ownership before untrusted work. */
+export function spendPoolUser(
+  value: unknown,
+  pool: readonly string[],
+  user: string,
+  owner: string,
+): SpentPoolUser[] | null {
+  const spent = parseSpentPoolUsers(value, pool);
+  if (!spent || !pool.includes(user) || !/^(thread|op):\S+$/.test(owner)) return null;
+  const prior = spent.get(user);
+  if (prior && prior !== owner) return null;
+  const rows = [...spent].map(([user, owner]) => ({ user, owner }));
+  return prior ? rows : [...rows, { user, owner }];
+}
+
+/** A UID-scoped command must have exactly one live owner. An old duplicate
+ * binding never gains authority merely because its UID is spent. */
+export function mayRunAsPoolUser(
+  value: unknown,
+  pool: readonly string[],
+  user: string,
+  liveThreadKeys: readonly string[],
+  activeOpOwner: string | undefined,
+  expectedOwner?: string,
+): boolean {
+  const recorded = parseSpentPoolUsers(value, pool)?.get(user);
+  if (!recorded || (expectedOwner !== undefined && recorded !== expectedOwner)) return false;
+  if (activeOpOwner !== undefined) return liveThreadKeys.length === 0 && recorded === activeOpOwner;
+  return liveThreadKeys.length === 1 && recorded === `thread:${liveThreadKeys[0]}`;
+}
+
+/** One row per UID is rebuilt from primary bindings when a DO starts. A
+ * malformed or missing row cannot authorize a shell, even if the spend ledger
+ * names the caller. Keep every live claimant so duplicates remain visible. */
+export function parsePoolBindings(value: unknown): string[] | null {
+  if (!Array.isArray(value) || !value.every((key): key is string => typeof key === "string" && key.length > 0))
+    return null;
+  if (new Set(value).size !== value.length) return null;
+  return value;
+}
+
+export function claimPoolBinding(value: unknown, threadKey: string): string[] | null {
+  const current = parsePoolBindings(value);
+  if (!current || !threadKey || current.includes(threadKey)) return null;
+  return [...current, threadKey];
+}
+
+export function releasePoolBinding(value: unknown, threadKey: string): string[] | null {
+  const current = parsePoolBindings(value);
+  if (!current || !threadKey || !current.includes(threadKey)) return null;
+  return current.filter((key) => key !== threadKey);
+}
+
+export function rebuildPoolBindingIndex(
+  bindings: Iterable<{ threadKey: string; user: string; evicted?: boolean }>,
+  pool: readonly string[],
+): Map<string, string[]> | null {
+  const byUser = new Map(pool.map((user) => [user, [] as string[]]));
+  for (const binding of bindings) {
+    if (binding?.evicted === true) continue;
+    if (!binding || typeof binding.threadKey !== "string" || !binding.threadKey) return null;
+    if (!binding.user) continue;
+    const keys = byUser.get(binding.user);
+    if (!keys || keys.includes(binding.threadKey)) return null;
+    keys.push(binding.threadKey);
+  }
+  return byUser;
+}

package/dist/assets/src/execution/residentRecreateAdmission.ts

@@ -0,0 +1,41 @@
+/** An operator recreate closes new admission before its idle read and keeps a
+ * durable refusal across the container destroy. A new DO isolate may reclaim
+ * the mark only by re-running the operator's checked recreate. */
+export class ResidentRecreateAdmission {
+  private claiming = false;
+
+  constructor(
+    private readonly store: {
+      mark(): Promise<void>;
+      clear(): Promise<void>;
+      held(): Promise<boolean>;
+    },
+  ) {}
+
+  get pending(): boolean {
+    return this.claiming;
+  }
+
+  async blocked(): Promise<boolean> {
+    return this.claiming || (await this.store.held());
+  }
+
+  async run<T>(action: () => Promise<T>): Promise<{ busy: true } | { busy: false; value: T }> {
+    if (this.claiming) return { busy: true };
+    this.claiming = true; // no await before a concurrent admission sees this
+    let marked = false;
+    try {
+      await this.store.mark();
+      marked = true;
+      return { busy: false, value: await action() };
+    } finally {
+      try {
+        // A failed mark may already have persisted. Leave it fail-closed for
+        // an explicit checked retry rather than guessing that it did not.
+        if (marked) await this.store.clear();
+      } finally {
+        this.claiming = false;
+      }
+    }
+  }
+}

package/dist/assets/src/execution/residentSteps.ts

@@ -29,6 +29,7 @@ export const RESIDENT_STEP_LABELS = {
   git: "a git command",
   "git-setup": "configuring git",
   "stage-perms": "securing the credential stage",
+  "stage-write-cleanup": "removing a failed staged write",
   install: "installing dependencies",
   build: "building",
   test: "running the tests",