@frockbot/cloudflare 0.0.0 → 0.7.291

package/src/native-sessions.ts

@@ -0,0 +1,121 @@
+import {
+  isProtocolValue,
+  type ClientHello,
+} from "@frockbot/core/protocol-schemas";
+
+export interface NativeSessionRecord {
+  schemaVersion: 1;
+  userId: string;
+  sessionId: string;
+  hello: ClientHello;
+  expiresAt: number;
+  revoked: boolean;
+}
+
+export interface NativeSessionStorage {
+  get<T>(key: string): T | undefined;
+  put(key: string, value: unknown): void;
+}
+
+export type NativeSessionOperation = {
+  schemaVersion: 1;
+  userId: string;
+  action: "check-issue" | "issue" | "read" | "revoke";
+  sessionId: string;
+  hello: ClientHello;
+  expiresAt: number;
+};
+
+export function decodeNativeSessionOperation(
+  value: unknown,
+): NativeSessionOperation {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid native session");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join() !==
+      "action,expiresAt,hello,schemaVersion,sessionId,userId" ||
+    v.schemaVersion !== 1 ||
+    !isProtocolValue("Identifier", v.userId) ||
+    !isProtocolValue("Identifier", v.sessionId) ||
+    !isProtocolValue("ClientHello", v.hello) ||
+    (v.action !== "check-issue" &&
+      v.action !== "issue" &&
+      v.action !== "read" &&
+      v.action !== "revoke") ||
+    typeof v.expiresAt !== "number" ||
+    !Number.isSafeInteger(v.expiresAt)
+  )
+    throw new Error("Invalid native session");
+  return {
+    schemaVersion: 1,
+    userId: v.userId,
+    sessionId: v.sessionId,
+    hello: v.hello,
+    action: v.action,
+    expiresAt: v.expiresAt,
+  };
+}
+
+// Called only inside the User DO's synchronous transaction. Bounded, versioned
+// records survive eviction; expiry tombstones cannot be evicted by new logins.
+export function nativeSessionOperation(
+  storage: NativeSessionStorage,
+  input: unknown,
+  now: number,
+): NativeSessionRecord | null {
+  const op = decodeNativeSessionOperation(input);
+  const key = "native:sessions:v1";
+  const stored = storage.get<unknown>(key);
+  if (stored !== undefined && !Array.isArray(stored))
+    throw new Error("Invalid stored native sessions");
+  const records = (stored ?? []) as unknown[];
+  const current: NativeSessionRecord[] = records
+    .map((value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Invalid stored native session");
+      const { revoked, ...fields } = value as Record<string, unknown>;
+      if (typeof revoked !== "boolean")
+        throw new Error("Invalid stored native session");
+      const decoded = decodeNativeSessionOperation({
+        ...fields,
+        action: "read",
+      });
+      const { action: _action, ...record } = decoded;
+      return { ...record, revoked };
+    })
+    .filter((record) => record.expiresAt > now);
+  let record = current.find((item) => item.sessionId === op.sessionId);
+  if (op.action === "issue" || op.action === "check-issue") {
+    if (record)
+      throw new Error("This sign-in has already been used. Sign in again.");
+    // Active ones only. A revoked session is a device that has signed out,
+    // and counting it kept the slot for the rest of its seven days: sign in
+    // and out enough times on one phone and the app told you to sign out on
+    // another device, which could not have helped.
+    if (current.filter((item) => !item.revoked).length >= 32)
+      throw new Error("Too many active sign-ins. Sign out on another device.");
+    if (op.expiresAt <= now || op.expiresAt > now + 7 * 86400_000)
+      throw new Error("Invalid native session expiry");
+    if (op.action === "check-issue") return null;
+    record = {
+      schemaVersion: 1,
+      userId: op.userId,
+      sessionId: op.sessionId,
+      hello: op.hello,
+      expiresAt: op.expiresAt,
+      revoked: false,
+    };
+    current.push(record);
+  } else if (record) {
+    if (
+      record.userId !== op.userId ||
+      record.expiresAt !== op.expiresAt ||
+      JSON.stringify(record.hello) !== JSON.stringify(op.hello)
+    )
+      return null;
+    if (op.action === "revoke") record.revoked = true;
+  }
+  if (op.action !== "read") storage.put(key, current);
+  return record && !record.revoked ? record : null;
+}

package/src/notification-state-cleanup.ts

@@ -0,0 +1,18 @@
+/** Disposable pre-user projection cleanup. Message history and Bot settings are retained. */
+export async function cleanNotificationTestState(
+  storage: DurableObjectStorage,
+): Promise<void> {
+  const receiptKey = "maintenance:message-notifications:2026-09-09";
+  await storage.transaction(async (tx) => {
+    if (await tx.get(receiptKey)) return;
+    let deleted = 0;
+    for (const prefix of ["shell:unread", "notification:"]) {
+      for (;;) {
+        const keys = [...(await tx.list({ prefix, limit: 128 })).keys()];
+        if (!keys.length) break;
+        deleted += await tx.delete(keys);
+      }
+    }
+    await tx.put(receiptKey, { at: new Date().toISOString(), deleted });
+  });
+}

package/src/ollama-web-search-cleanup.ts

@@ -0,0 +1,69 @@
+// Disposable pre-user cleanup for the retired Ollama web search.
+//
+// Web search is the Web Package's now, on the platform's own key. The Ollama
+// Package's `web-search-max-results` setting capped the search it retired, and
+// its value sits on that Package's installation row in `user-configuration`.
+// Resolution already ignores a value no manifest declares, so this removes a
+// dead value from the row a client reads back rather than repairing a read.
+// The `ollama-cloud-web-search` Capability was never stored: a Package's
+// enabled Capabilities are derived from its definition, so nothing else is
+// left. The receipt makes a second load free.
+
+const USER_CONFIGURATION_KEY = "user-configuration";
+const OLLAMA_PACKAGE_ID = "provider-ollama-cloud";
+const RETIRED_SETTING_ID = "web-search-max-results";
+export const OLLAMA_WEB_SEARCH_CLEANUP_RECEIPT_KEY =
+  "maintenance:ollama-web-search:2026-09-24";
+
+type Stored = Record<string, unknown>;
+
+function record(value: unknown): Stored | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return undefined;
+  return value as Stored;
+}
+
+/** The settings without the retired value, or `undefined` to keep them. */
+export function withoutRetiredWebSearchSettingV1(
+  stored: unknown,
+): Stored | undefined {
+  const settings = record(stored);
+  if (!settings || !Array.isArray(settings.packages)) return undefined;
+  let changed = false;
+  const packages = settings.packages.map((entry) => {
+    const installation = record(entry);
+    const values = record(installation?.values);
+    if (
+      !installation ||
+      !values ||
+      installation.packageId !== OLLAMA_PACKAGE_ID ||
+      !Object.hasOwn(values, RETIRED_SETTING_ID)
+    ) {
+      return entry;
+    }
+    changed = true;
+    const { [RETIRED_SETTING_ID]: _retired, ...kept } = values;
+    const { values: _values, ...rest } = installation;
+    // The settings writer omits an empty bag, so the cleanup does too.
+    return Object.keys(kept).length > 0 ? { ...rest, values: kept } : rest;
+  });
+  return changed ? { ...settings, packages } : undefined;
+}
+
+export async function cleanRetiredOllamaWebSearchV1(
+  storage: DurableObjectStorage,
+  now: Date = new Date(),
+): Promise<void> {
+  if (await storage.get(OLLAMA_WEB_SEARCH_CLEANUP_RECEIPT_KEY)) return;
+  await storage.transaction(async (tx) => {
+    if (await tx.get(OLLAMA_WEB_SEARCH_CLEANUP_RECEIPT_KEY)) return;
+    const cleaned = withoutRetiredWebSearchSettingV1(
+      await tx.get<unknown>(USER_CONFIGURATION_KEY),
+    );
+    if (cleaned) await tx.put(USER_CONFIGURATION_KEY, cleaned);
+    await tx.put(OLLAMA_WEB_SEARCH_CLEANUP_RECEIPT_KEY, {
+      at: now.toISOString(),
+      removed: cleaned !== undefined,
+    });
+  });
+}

package/src/package-page-shapes-cleanup.ts

@@ -0,0 +1,190 @@
+// Disposable pre-user cleanup for the turn-log shapes the Package page
+// pipeline left behind.
+//
+// The Applet canvas admitted a Package page's tool call as a `directTool`
+// run, and an Applet publish reconciled the Computer with a `publish` sync.
+// Both producers are gone and neither decoder accepts the value, so this
+// rewrites them before anything decodes a run or a Session event.
+//
+// A finished run keeps its transcript and loses the field: it reads as the
+// ordinary Turn it was drawn as. An unfinished one could only resume as a chat
+// Turn replaying its label, so it is removed with the pointers that named it,
+// as the prepared-input cleanup does. A `publish` sync becomes `signal`, the
+// other mid-Turn reason: the event is diagnostic, its counts stay true, and no
+// sequence number moves. The walk is once per Bot; it pages rather than
+// loading the archive into one value.
+
+import {
+  ACTIVE_RUN_KEY,
+  LATEST_EVENTS_KEY,
+  PENDING_AGENT_RUN_PREFIX,
+  PENDING_USER_RUN_PREFIX,
+  REPAIR_DUE_PREFIX,
+  REPAIR_RUN_PREFIX,
+  RUN_INDEX_PREFIX,
+  RUN_PREFIX,
+  SESSION_EVENT_LOG_INDEX_PREFIX,
+  SessionEventLog,
+  type SessionEventLogStorage,
+} from "@frockbot/core/durable";
+
+const RECEIPT = "maintenance:package-page-shapes:2026-09-24";
+const PAGE = 50;
+
+interface CleanupStorage extends SessionEventLogStorage {
+  delete(key: string): Promise<boolean>;
+  transaction<T>(body: (tx: SessionEventLogStorage) => Promise<T>): Promise<T>;
+}
+
+type Stored = Record<string, unknown>;
+
+function record(value: unknown): Stored | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return undefined;
+  return value as Stored;
+}
+
+/** The event without a `publish` sync, or `undefined` to keep it. */
+export function withoutPublishSyncV1(event: Stored): Stored | undefined {
+  return event.type === "computer/sync" && event.reason === "publish"
+    ? { ...event, reason: "signal" }
+    : undefined;
+}
+
+/** The run without Package page shapes, or `undefined` to keep it. */
+function withoutPackagePageShapes(run: Stored): Stored | undefined {
+  let changed = false;
+  const cleaned = { ...run };
+  if (Object.hasOwn(cleaned, "directTool")) {
+    delete cleaned.directTool;
+    changed = true;
+  }
+  if (Array.isArray(cleaned.events)) {
+    cleaned.events = cleaned.events.map((event) => {
+      const stored = record(event);
+      const replaced = stored && withoutPublishSyncV1(stored);
+      if (!replaced) return event;
+      changed = true;
+      return replaced;
+    });
+  }
+  return changed ? cleaned : undefined;
+}
+
+function isTerminal(run: Stored): boolean {
+  return (
+    run.status === "completed" ||
+    run.status === "failed" ||
+    run.status === "cancelled"
+  );
+}
+
+async function page(
+  storage: CleanupStorage,
+  prefix: string,
+  visit: (key: string, value: unknown) => Promise<void>,
+): Promise<void> {
+  let start: string | undefined;
+  for (;;) {
+    const listed = await storage.list({
+      prefix,
+      limit: PAGE,
+      ...(start ? { start } : {}),
+    });
+    if (listed.size === 0) return;
+    let last = "";
+    for (const [key, value] of listed) {
+      last = key;
+      if (start !== undefined && key === start) continue;
+      await visit(key, value);
+    }
+    if (listed.size < PAGE) return;
+    start = `${last}\0`;
+  }
+}
+
+export async function cleanPackagePageShapesV1(
+  storage: CleanupStorage,
+): Promise<void> {
+  if (await storage.get(RECEIPT)) return;
+  let rewrittenRuns = 0;
+  const removed = new Set<string>();
+  await page(storage, RUN_PREFIX, async (key, value) => {
+    const run = record(value);
+    if (!run) return;
+    if (Object.hasOwn(run, "directTool") && !isTerminal(run)) {
+      if (typeof run.runId === "string") removed.add(run.runId);
+      await storage.delete(key);
+      return;
+    }
+    const cleaned = withoutPackagePageShapes(run);
+    if (!cleaned) return;
+    rewrittenRuns += 1;
+    await storage.put(key, cleaned);
+  });
+  if (removed.size > 0) {
+    const active = await storage.get(ACTIVE_RUN_KEY);
+    if (typeof active === "string" && removed.has(active)) {
+      await storage.delete(ACTIVE_RUN_KEY);
+    }
+    for (const prefix of [
+      PENDING_USER_RUN_PREFIX,
+      PENDING_AGENT_RUN_PREFIX,
+      RUN_INDEX_PREFIX,
+      REPAIR_DUE_PREFIX,
+    ]) {
+      await page(storage, prefix, async (key, value) => {
+        if (typeof value === "string" && removed.has(value)) {
+          await storage.delete(key);
+        }
+      });
+    }
+    for (const runId of removed) {
+      await storage.delete(`${REPAIR_RUN_PREFIX}${runId}`);
+    }
+  }
+
+  const sessions: string[] = [];
+  await page(storage, SESSION_EVENT_LOG_INDEX_PREFIX, async (key) => {
+    sessions.push(
+      decodeURIComponent(key.slice(SESSION_EVENT_LOG_INDEX_PREFIX.length)),
+    );
+  });
+  let events = 0;
+  const unreadable: string[] = [];
+  for (const sessionId of sessions) {
+    try {
+      events += await storage.transaction((tx) =>
+        new SessionEventLog(tx).repairStoredEvents(
+          sessionId,
+          withoutPublishSyncV1,
+        ),
+      );
+    } catch {
+      // A throw here would reset the object on every wake. A log this cannot
+      // read was unreadable before it ran, and is left as it was.
+      unreadable.push(sessionId);
+    }
+  }
+  // The pre-paging log, if a Bot still has one, is read the same way.
+  const legacy = await storage.get(LATEST_EVENTS_KEY);
+  if (Array.isArray(legacy)) {
+    let changed = false;
+    const repaired = legacy.map((event) => {
+      const stored = record(event);
+      const replaced = stored && withoutPublishSyncV1(stored);
+      if (!replaced) return event;
+      changed = true;
+      events += 1;
+      return replaced;
+    });
+    if (changed) await storage.put(LATEST_EVENTS_KEY, repaired);
+  }
+  await storage.put(RECEIPT, {
+    schemaVersion: 1,
+    rewrittenRuns,
+    removedRuns: removed.size,
+    events,
+    unreadable,
+  });
+}

package/src/plugin-egress.ts

@@ -0,0 +1,31 @@
+// The egress loopback a Plugin worker's `globalOutbound` is bound to.
+//
+// A Plugin's `fetch` never reaches the network directly: `globalOutbound` is
+// this service, minted per User with the hosts the enabled Plugins declared
+// (or open access, if one asked for it and the User approved). Every Plugin
+// in the worker shares a realm, so the policy is the union of what they
+// declared and is described to the User that way (ADR 0026). A refused host
+// is a thrown error, which is what a Plugin's `fetch` sees as a rejection —
+// the same shape the platform gives a worker with no outbound at all.
+import { WorkerEntrypoint } from "cloudflare:workers";
+import {
+  pluginEgressAdmitsV1,
+  type PluginEgressPropsV1,
+} from "@frockbot/app/isolates/capabilities";
+
+export type { PluginEgressPropsV1 };
+
+export class PluginEgress extends WorkerEntrypoint<
+  unknown,
+  PluginEgressPropsV1
+> {
+  override async fetch(request: Request): Promise<Response> {
+    const verdict = pluginEgressAdmitsV1(this.ctx.props, request.url);
+    if (!verdict.admitted) {
+      // Thrown, not answered: a 403 would read as the remote's answer, and a
+      // Plugin has no contract for telling the two apart.
+      throw new Error(verdict.reason);
+    }
+    return fetch(request);
+  }
+}

package/src/plugin-page-route.ts

@@ -0,0 +1,72 @@
+// A Plugin's page, served from the app's own origin (ADR 0036).
+//
+// The page is untrusted HTML, so the app origin is only where its bytes come
+// from, never what they run as. The response's CSP `sandbox` gives the
+// document an opaque origin however it is opened — framed, or pasted into an
+// address bar — so it can read no cookie and no storage of the app, and the
+// policy lets it load and connect to nothing. The frame's own `sandbox`
+// attribute says the same again. The route is anonymous because the frame's
+// request is credentialless: the page is named by the hash of its bytes, and
+// holds nothing of the account.
+import { PLUGIN_PAGE_ROUTE_V1 } from "@frockbot/core/contracts";
+import { sha256HexTextV1 } from "@frockbot/core/crypto";
+import { INSIGHTS_REPORT_ORIGIN, INSIGHTS_SCRIPT_ORIGIN } from "./insights.js";
+
+/*
+ * The zone injects its Insights beacon into HTML it serves; `no-transform`
+ * asks it not to, because the hash names these bytes. The beacon's origins
+ * are named anyway, since that is a request rather than a guarantee, and
+ * naming them opens nothing else.
+ */
+export const PLUGIN_PAGE_CSP_V1 = [
+  "sandbox allow-scripts",
+  "default-src 'none'",
+  `script-src 'unsafe-inline' ${INSIGHTS_SCRIPT_ORIGIN}`,
+  "style-src 'unsafe-inline'",
+  "img-src data:",
+  `connect-src ${INSIGHTS_REPORT_ORIGIN}`,
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'self'",
+].join("; ");
+
+export function isPluginPagePathV1(pathname: string): boolean {
+  return PLUGIN_PAGE_ROUTE_V1.test(pathname);
+}
+
+export async function servePluginPageV1(
+  request: Request,
+  url: URL,
+  load: ((contentHash: string) => Promise<string | undefined>) | undefined,
+): Promise<Response> {
+  if (request.method !== "GET" && request.method !== "HEAD") {
+    return Response.json({ error: "method not allowed" }, { status: 405 });
+  }
+  const contentHash = PLUGIN_PAGE_ROUTE_V1.exec(url.pathname)?.[1];
+  if (!contentHash) {
+    return Response.json({ error: "page was not found" }, { status: 404 });
+  }
+  const etag = `"${contentHash}"`;
+  const headers = {
+    "content-type": "text/html; charset=utf-8",
+    "content-security-policy": PLUGIN_PAGE_CSP_V1,
+    "x-content-type-options": "nosniff",
+    "referrer-policy": "no-referrer",
+    "cache-control": "public, max-age=31536000, immutable, no-transform",
+    etag,
+  };
+  if (request.headers.get("if-none-match") === etag) {
+    return new Response(null, { status: 304, headers });
+  }
+  const html = await load?.(contentHash);
+  if (html === undefined) {
+    return Response.json({ error: "page was not found" }, { status: 404 });
+  }
+  if ((await sha256HexTextV1(html)) !== contentHash) {
+    return Response.json(
+      { error: "page failed verification" },
+      { status: 502 },
+    );
+  }
+  return new Response(request.method === "HEAD" ? null : html, { headers });
+}

package/src/plugin-panels-cleanup.ts

@@ -0,0 +1,101 @@
+// Disposable pre-user cleanup for ADR 0034: Applets are deleted.
+//
+// There are no Users yet. Directory entries, Composition `applets[]`, the
+// account feature flag, cleanup to-dos and the Bot's focused-Applet pointer
+// are dropped rather than migrated. A receipt makes a second load free. The
+// key strings are restated here so this file does not import the Applet
+// product it is deleting.
+import { COMPOSITION_GENERATION_PREFIX } from "@frockbot/core/durable";
+
+export const PLUGIN_PANELS_USER_CLEANUP_RECEIPT_KEY =
+  "maintenance:plugin-panels:2026-09-21";
+export const PLUGIN_PANELS_BOT_CLEANUP_RECEIPT_KEY =
+  "maintenance:plugin-panels:2026-09-21";
+
+const USER_FEATURES_KEY = "user:features:v1";
+const APPLET_DIRECTORY_ENTRY_PREFIX = "applets:entry:";
+const APPLET_DIRECTORY_REVISION_KEY = "applets:directory-revision";
+const APPLET_CLEANUP_PREFIX = "applets:cleanup:";
+const APPLET_FOCUSED_KEY = "applets:focused";
+
+export async function cleanUserAppletsV1(
+  storage: DurableObjectStorage,
+  now: Date = new Date(),
+): Promise<void> {
+  if (await storage.get(PLUGIN_PANELS_USER_CLEANUP_RECEIPT_KEY)) return;
+  const at = now.toISOString();
+  let removedEntries = 0;
+  let removedCleanups = 0;
+  let strippedGenerations = 0;
+  let strippedFeatures = false;
+  let removedRevision = false;
+
+  await storage.transaction(async (tx) => {
+    if (await tx.get(PLUGIN_PANELS_USER_CLEANUP_RECEIPT_KEY)) return;
+    const entryKeys = [
+      ...(await tx.list({ prefix: APPLET_DIRECTORY_ENTRY_PREFIX })).keys(),
+    ];
+    if (entryKeys.length > 0) {
+      removedEntries = await tx.delete(entryKeys);
+    }
+    const cleanupKeys = [
+      ...(await tx.list({ prefix: APPLET_CLEANUP_PREFIX })).keys(),
+    ];
+    if (cleanupKeys.length > 0) {
+      removedCleanups = await tx.delete(cleanupKeys);
+    }
+    if ((await tx.get(APPLET_DIRECTORY_REVISION_KEY)) !== undefined) {
+      await tx.delete(APPLET_DIRECTORY_REVISION_KEY);
+      removedRevision = true;
+    }
+    for (const [key, value] of await tx.list<unknown>({
+      prefix: COMPOSITION_GENERATION_PREFIX,
+    })) {
+      if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+      if (!Object.hasOwn(value, "applets")) continue;
+      const { applets: _dropped, ...rest } = value as Record<string, unknown>;
+      await tx.put(key, rest);
+      strippedGenerations += 1;
+    }
+    const features = await tx.get<unknown>(USER_FEATURES_KEY);
+    if (
+      features &&
+      typeof features === "object" &&
+      !Array.isArray(features) &&
+      Object.hasOwn(features, "applets")
+    ) {
+      const { applets: _dropped, ...rest } = features as Record<
+        string,
+        unknown
+      >;
+      await tx.put(USER_FEATURES_KEY, rest);
+      strippedFeatures = true;
+    }
+    await tx.put(PLUGIN_PANELS_USER_CLEANUP_RECEIPT_KEY, {
+      schemaVersion: 1,
+      at,
+      removedEntries,
+      removedCleanups,
+      strippedGenerations,
+      strippedFeatures,
+      removedRevision,
+    });
+  });
+}
+
+export async function cleanBotAppletsV1(
+  storage: DurableObjectStorage,
+  now: Date = new Date(),
+): Promise<void> {
+  if (await storage.get(PLUGIN_PANELS_BOT_CLEANUP_RECEIPT_KEY)) return;
+  await storage.transaction(async (tx) => {
+    if (await tx.get(PLUGIN_PANELS_BOT_CLEANUP_RECEIPT_KEY)) return;
+    const hadFocus = (await tx.get(APPLET_FOCUSED_KEY)) !== undefined;
+    if (hadFocus) await tx.delete(APPLET_FOCUSED_KEY);
+    await tx.put(PLUGIN_PANELS_BOT_CLEANUP_RECEIPT_KEY, {
+      schemaVersion: 1,
+      at: now.toISOString(),
+      clearedFocus: hadFocus,
+    });
+  });
+}