@frockbot/cloudflare 0.0.0 → 0.7.291

package/src/routine-state-cleanup.ts

@@ -0,0 +1,57 @@
+import { decodeRoutineRecordV1 } from "@frockbot/app/routines/records";
+import {
+  ROUTINE_PREFIX,
+  routineFireKeyV1,
+  routineHookKeyRecordV1,
+  routineQueuePrefixV1,
+  routineRunPrefixV1,
+  routineScheduleKeyV1,
+} from "@frockbot/app/routines/storage-keys";
+
+/**
+ * Disposable pre-user cleanup for Routine records written with retired
+ * trigger shapes. Keep readable Routines; remove each unreadable authority
+ * record and the state that can cause it to fire.
+ */
+export async function cleanRetiredRoutineStateV1(
+  storage: DurableObjectStorage,
+): Promise<void> {
+  const receiptKey = "maintenance:retired-routine-state:2026-09-16";
+  await storage.transaction(async (tx) => {
+    if (await tx.get(receiptKey)) return;
+    const retired: string[] = [];
+    const routines = await tx.list<unknown>({ prefix: ROUTINE_PREFIX });
+    for (const [key, value] of routines) {
+      try {
+        decodeRoutineRecordV1(value);
+      } catch {
+        retired.push(key.slice(ROUTINE_PREFIX.length));
+      }
+    }
+    let deleted = 0;
+    for (const routineId of retired) {
+      const direct = [
+        `${ROUTINE_PREFIX}${routineId}`,
+        routineHookKeyRecordV1(routineId),
+        routineScheduleKeyV1(routineId),
+        routineFireKeyV1(routineId),
+      ];
+      deleted += await tx.delete(direct);
+      for (const prefix of [
+        routineQueuePrefixV1(routineId),
+        routineRunPrefixV1(routineId),
+      ]) {
+        for (;;) {
+          const keys = [...(await tx.list({ prefix, limit: 128 })).keys()];
+          if (keys.length === 0) break;
+          deleted += await tx.delete(keys);
+        }
+      }
+    }
+    await tx.put(receiptKey, {
+      at: new Date().toISOString(),
+      retired: retired.length,
+      deleted,
+    });
+  });
+}

package/src/search.ts

@@ -0,0 +1,88 @@
+// The transcript-index seam, bound in production.
+//
+// Two directions cross a Durable Object boundary here, and both are decoded on
+// arrival — "Cross-runtime communication uses narrow, versioned DTOs, and
+// every inbound value is decoded at its seam". An answer from another Durable
+// Object is inbound, so it is decoded because of what it is, never trusted
+// because of where it came from.
+//
+//  * `createUserSearchSinkV1` is the Bot Durable Object's half: a settled
+//    Turn's rows go to the User Durable Object, which is the authority for
+//    User-scoped state. It is deliberately fire-and-forget at the call site —
+//    the run is already durable before this runs, and `rebuildSearchIndex`
+//    reconstructs anything a failed projection missed.
+//  * `createBotSearchRowPageV1` is the User Durable Object's half: one page of
+//    a Bot's rows, projected from that Bot's own stored runs, which is what
+//    makes the index rebuildable rather than authoritative.
+import {
+  searchRowsFromClientRunV1,
+  type SearchRowPageV1,
+  type SearchRowV1,
+  type SearchSinkV1,
+} from "@frockbot/app/search";
+import { decodeClientRunPageV1 } from "@frockbot/app/shell/run-protocol";
+
+/** The User Durable Object's search RPC surface, as the Bot object calls it. */
+export interface UserSearchRpc {
+  indexSearchRows(input: unknown): Promise<unknown>;
+}
+
+/** The Bot Durable Object's projection RPC, as the User object calls it. */
+export interface BotSearchRpc {
+  projectSearchRows(input: unknown): Promise<unknown>;
+}
+
+/**
+ * `SearchSinkV1` over the User Durable Object.
+ *
+ * A failed index write is swallowed on purpose. The Turn it belongs to has
+ * already reached its durable terminal state in the Bot Durable Object; making
+ * the User object's availability a condition of a Turn settling would put a
+ * derived projection on the critical path of the thing it is derived from.
+ * The cost of the failure is bounded and repairable: those rows are missing
+ * until a rebuild, and the index state the UI shows says so.
+ */
+export function createUserSearchSinkV1(
+  rpc: UserSearchRpc,
+  identity: { userId: string; botId: string },
+): SearchSinkV1 {
+  return {
+    async indexRows(rows) {
+      if (rows.length === 0) return;
+      const owned = rows.filter((row) => row.botId === identity.botId);
+      if (owned.length === 0) return;
+      await rpc.indexSearchRows({
+        schemaVersion: 1,
+        userId: identity.userId,
+        botId: identity.botId,
+        rows: owned,
+      });
+    },
+  };
+}
+
+/**
+ * One page of a Bot's rows, projected from the run list the Shell Package
+ * already exposes.
+ *
+ * The run list is the same projection the WebUI reads, so the rows a rebuild
+ * writes are the rows a settlement would have written — the property the whole
+ * "the index is disposable" claim rests on.
+ */
+export function createBotSearchRowPageV1(
+  botId: string,
+  runList: unknown,
+): SearchRowPageV1 {
+  const page = decodeClientRunPageV1(runList);
+  const rows: SearchRowV1[] = page.runs.flatMap((run) =>
+    searchRowsFromClientRunV1(botId, run),
+  );
+  return {
+    schemaVersion: 1,
+    botId,
+    rows,
+    ...(page.page.truncated && page.page.nextCursor
+      ? { nextCursor: page.page.nextCursor }
+      : {}),
+  };
+}

package/src/sidebar-label-cleanup.ts

@@ -0,0 +1,165 @@
+// Disposable cleanup for the retired sidebar label.
+//
+// A Bot's profile no longer has a `label`, and its exact decoder refuses one.
+// The Bot's settings record loses it, with the revision moved so an open
+// settings surface fences on the record it now reads. Every run keeps the
+// settings it was admitted under twice — the configuration snapshot and the
+// prepared inputs — and both are decoded whenever the run is read, so each
+// loses the label too. A Group Chat's arrangement had the same label; the
+// User's group list and the receipts that replay a group record lose it, and
+// the list's revision moves. The walks are once per object, and page rather
+// than loading the archive into one value.
+
+import { BOT_CONFIGURATION_KEY } from "@frockbot/app/settings/bot";
+import { RUN_PREFIX } from "@frockbot/core/durable";
+
+const BOT_RECEIPT = "maintenance:bot-label-removal:2026-09-25";
+const USER_RECEIPT = "maintenance:group-label-removal:2026-09-25";
+const GROUP_LIST_KEY = "group-chat:list:v1";
+const GROUP_RECEIPT_PREFIX = "group-chat:receipt:";
+const PAGE = 50;
+
+interface CleanupStorage {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+  list(options: {
+    prefix?: string;
+    limit?: number;
+    start?: string;
+  }): Promise<Map<string, unknown>>;
+}
+
+type Plain = Record<string, unknown>;
+
+function record(value: unknown): Plain | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return undefined;
+  return value as Plain;
+}
+
+async function page(
+  storage: CleanupStorage,
+  prefix: string,
+  visit: (key: string, value: unknown) => Promise<void>,
+): Promise<void> {
+  let start: string | undefined;
+  for (;;) {
+    const listed = await storage.list({
+      prefix,
+      limit: PAGE,
+      ...(start ? { start } : {}),
+    });
+    if (listed.size === 0) return;
+    let last = "";
+    for (const [key, value] of listed) {
+      last = key;
+      if (start !== undefined && key === start) continue;
+      await visit(key, value);
+    }
+    if (listed.size < PAGE) return;
+    start = `${last}\0`;
+  }
+}
+
+/** `value` with `label` gone from the record at `path`, or undefined. */
+function withoutLabelAt(value: unknown, path: readonly string[]): unknown {
+  const outer = record(value);
+  if (!outer) return undefined;
+  if (path.length === 0) {
+    if (!Object.hasOwn(outer, "label")) return undefined;
+    const { label: _retired, ...rest } = outer;
+    return rest;
+  }
+  const [head, ...tail] = path as [string, ...string[]];
+  const inner = withoutLabelAt(outer[head], tail);
+  return inner === undefined ? undefined : { ...outer, [head]: inner };
+}
+
+/** Applies each path in turn; undefined when none of them carried a label. */
+function withoutLabels(
+  value: unknown,
+  paths: readonly (readonly string[])[],
+): unknown {
+  let current = value;
+  let changed = false;
+  for (const path of paths) {
+    const next = withoutLabelAt(current, path);
+    if (next === undefined) continue;
+    current = next;
+    changed = true;
+  }
+  return changed ? current : undefined;
+}
+
+const RUN_SETTINGS_PATHS = [
+  ["configurationSnapshot", "profile"],
+  ["preparedInputs", "bot", "settings", "profile"],
+] as const;
+
+export async function cleanBotLabelV1(storage: CleanupStorage): Promise<void> {
+  if (await storage.get(BOT_RECEIPT)) return;
+  let settings = false;
+  const stored = record(await storage.get(BOT_CONFIGURATION_KEY));
+  const cleaned = record(withoutLabelAt(stored, ["profile"]));
+  if (stored && cleaned && typeof stored.revision === "number") {
+    await storage.put(BOT_CONFIGURATION_KEY, {
+      ...cleaned,
+      revision: stored.revision + 1,
+    });
+    settings = true;
+  }
+  let runs = 0;
+  await page(storage, RUN_PREFIX, async (key, value) => {
+    const run = withoutLabels(value, RUN_SETTINGS_PATHS);
+    if (run === undefined) return;
+    runs += 1;
+    await storage.put(key, run);
+  });
+  await storage.put(BOT_RECEIPT, {
+    schemaVersion: 1,
+    settings,
+    runs,
+    completedAt: new Date().toISOString(),
+  });
+}
+
+const GROUP_RECEIPT_PATHS = [
+  ["result", "receipt", "group"],
+  ["result", "change", "context", "group"],
+] as const;
+
+export async function cleanGroupChatLabelsV1(
+  storage: CleanupStorage,
+): Promise<void> {
+  if (await storage.get(USER_RECEIPT)) return;
+  let groups = 0;
+  const list = record(await storage.get(GROUP_LIST_KEY));
+  if (list && Array.isArray(list.groups) && typeof list.revision === "number") {
+    const arranged = list.groups.map((group) => {
+      const cleaned = withoutLabelAt(group, []);
+      if (cleaned === undefined) return group;
+      groups += 1;
+      return cleaned;
+    });
+    if (groups > 0) {
+      await storage.put(GROUP_LIST_KEY, {
+        ...list,
+        revision: list.revision + 1,
+        groups: arranged,
+      });
+    }
+  }
+  let receipts = 0;
+  await page(storage, GROUP_RECEIPT_PREFIX, async (key, value) => {
+    const receipt = withoutLabels(value, GROUP_RECEIPT_PATHS);
+    if (receipt === undefined) return;
+    receipts += 1;
+    await storage.put(key, receipt);
+  });
+  await storage.put(USER_RECEIPT, {
+    schemaVersion: 1,
+    groups,
+    receipts,
+    completedAt: new Date().toISOString(),
+  });
+}

package/src/skill-index-cleanup.ts

@@ -0,0 +1,53 @@
+// Drops Skill index records this process cannot decode.
+//
+// There is no legacy shape. A record that fails the current decoder is
+// disposable test state, not something a Turn should try to interpret. The
+// receipt makes the walk once per object. Reseeding the index from object
+// bytes is separate and also receipted: startup never scans Skill files.
+
+import { SKILL_INDEX_PREFIX } from "@frockbot/core/durable";
+import { decodeSkillMetadataIndexV1 } from "@frockbot/app/skills/metadata-index";
+
+const RECEIPT = "maintenance:skill-index-decode:2026-09-22";
+const PAGE = 50;
+
+interface CleanupStorage {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+  delete(key: string): Promise<boolean | void>;
+  list(options: {
+    prefix?: string;
+    limit?: number;
+    start?: string;
+  }): Promise<Map<string, unknown>>;
+}
+
+export async function cleanUndecodableSkillIndexesV1(
+  storage: CleanupStorage,
+): Promise<void> {
+  if (await storage.get(RECEIPT)) return;
+  let start: string | undefined;
+  for (;;) {
+    const listed = await storage.list({
+      prefix: SKILL_INDEX_PREFIX,
+      limit: PAGE,
+      ...(start ? { start } : {}),
+    });
+    if (listed.size === 0) break;
+    let last = "";
+    for (const [key, value] of listed) {
+      last = key;
+      if (start !== undefined && key === start) continue;
+      if (!key.includes(":current:") && !key.includes(":rev:")) continue;
+      if (key.includes(":rev:")) continue;
+      try {
+        decodeSkillMetadataIndexV1(value);
+      } catch {
+        await storage.delete(key);
+      }
+    }
+    if (listed.size < PAGE) break;
+    start = `${last}\0`;
+  }
+  await storage.put(RECEIPT, { schemaVersion: 1 });
+}

package/src/supersede-cleanup.ts

@@ -0,0 +1,162 @@
+// Disposable cleanup for the state Supersede left behind when steering
+// replaced it.
+//
+// A run that settled `superseded` becomes `cancelled`, which is what it now
+// reads as: it stopped because the person moved on, and its stop time is the
+// moment that happened. Every run loses the two supersede fields and the
+// model-intent flag only supersede read. The single waiting slot joins the
+// user queue in its place. Queued `superseded-turn` inputs, and the drain
+// receipts that carried one, are removed: nothing decodes that kind any more,
+// and a receipt is only read back by the Turn that drained it. Projected rows
+// and replayable updates carry whole runs to clients, whose schema no longer
+// has the status, so they are rewritten the same way. The walk is once per
+// Bot; it pages rather than loading the archive into one value.
+
+import {
+  CONVERSATION_ROW_PREFIX,
+  CONVERSATION_UPDATE_PREFIX,
+  pendingUserRunKey,
+  RUN_PREFIX,
+} from "@frockbot/core/durable";
+import {
+  ROUTINE_DRAIN_PREFIX,
+  ROUTINE_WAKE_PREFIX,
+} from "@frockbot/app/routines/storage-keys";
+
+const RECEIPT = "maintenance:supersede-removal:2026-09-23";
+const RETIRED_PENDING_RUN_KEY = "pending-run";
+const RETIRED_INPUT_KIND = "superseded-turn";
+const RETIRED_RUN_FIELDS = ["supersededAt", "supersededBy", "hasModelIntent"];
+const PAGE = 50;
+
+interface CleanupStorage {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+  delete(key: string): Promise<boolean>;
+  list(options: {
+    prefix?: string;
+    limit?: number;
+    start?: string;
+  }): Promise<Map<string, unknown>>;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return undefined;
+  return value as Record<string, unknown>;
+}
+
+async function page(
+  storage: CleanupStorage,
+  prefix: string,
+  visit: (key: string, value: unknown) => Promise<void>,
+): Promise<void> {
+  let start: string | undefined;
+  for (;;) {
+    const listed = await storage.list({
+      prefix,
+      limit: PAGE,
+      ...(start ? { start } : {}),
+    });
+    if (listed.size === 0) return;
+    let last = "";
+    for (const [key, value] of listed) {
+      last = key;
+      if (start !== undefined && key === start) continue;
+      await visit(key, value);
+    }
+    if (listed.size < PAGE) return;
+    start = `${last}\0`;
+  }
+}
+
+/** The run with supersede's fields gone, or `undefined` when it had none. */
+function withoutSupersede(
+  run: Record<string, unknown>,
+): Record<string, unknown> | undefined {
+  const superseded = run.status === "superseded";
+  if (!superseded && !RETIRED_RUN_FIELDS.some((field) => field in run)) {
+    return undefined;
+  }
+  const cleaned = { ...run };
+  for (const field of RETIRED_RUN_FIELDS) delete cleaned[field];
+  if (superseded) {
+    cleaned.status = "cancelled";
+    cleaned.stopRequestedAt =
+      run.stopRequestedAt ?? run.supersededAt ?? run.acceptedAt;
+  }
+  return cleaned;
+}
+
+/** A projected row or update whose run is `superseded`, rewritten. */
+function projectedWithoutSupersede(value: unknown): unknown {
+  const stored = record(value);
+  const payload = record(stored?.payload);
+  const run = record(payload?.run);
+  if (!stored || !payload || !run || run.status !== "superseded") {
+    return undefined;
+  }
+  const outcome = record(run.outcome);
+  return {
+    ...stored,
+    payload: {
+      ...payload,
+      run: {
+        ...run,
+        status: "cancelled",
+        stopRequestedAt: run.stopRequestedAt ?? run.admittedAt,
+        outcome: { ...outcome, type: "cancelled" },
+      },
+    },
+  };
+}
+
+function carriesRetiredInput(value: unknown): boolean {
+  const inputs = record(value)?.inputs;
+  return (
+    Array.isArray(inputs) &&
+    inputs.some((input) => record(input)?.kind === RETIRED_INPUT_KIND)
+  );
+}
+
+export async function cleanSupersedeStateV1(
+  storage: CleanupStorage,
+): Promise<void> {
+  if (await storage.get(RECEIPT)) return;
+  let runs = 0;
+  await page(storage, RUN_PREFIX, async (key, value) => {
+    const run = record(value);
+    const cleaned = run && withoutSupersede(run);
+    if (!cleaned) return;
+    runs += 1;
+    await storage.put(key, cleaned);
+  });
+  const waiting = await storage.get(RETIRED_PENDING_RUN_KEY);
+  if (typeof waiting === "string") {
+    const run = record(await storage.get(`${RUN_PREFIX}${waiting}`));
+    if (run?.status === "running" && typeof run.acceptedAt === "string") {
+      await storage.put(pendingUserRunKey(run.acceptedAt, waiting), waiting);
+    }
+    await storage.delete(RETIRED_PENDING_RUN_KEY);
+  }
+  for (const prefix of [CONVERSATION_ROW_PREFIX, CONVERSATION_UPDATE_PREFIX]) {
+    await page(storage, prefix, async (key, value) => {
+      const cleaned = projectedWithoutSupersede(value);
+      if (cleaned === undefined) return;
+      runs += 1;
+      await storage.put(key, cleaned);
+    });
+  }
+  let inputs = 0;
+  await page(storage, ROUTINE_WAKE_PREFIX, async (key, value) => {
+    if (record(value)?.kind !== RETIRED_INPUT_KIND) return;
+    inputs += 1;
+    await storage.delete(key);
+  });
+  await page(storage, ROUTINE_DRAIN_PREFIX, async (key, value) => {
+    if (!carriesRetiredInput(value)) return;
+    inputs += 1;
+    await storage.delete(key);
+  });
+  await storage.put(RECEIPT, { schemaVersion: 1, runs, inputs });
+}

package/src/test-chat-cleanup.ts

@@ -0,0 +1,93 @@
+import {
+  ACTIVE_RUN_KEY,
+  IDENTITY_KEY,
+  LATEST_EVENTS_KEY,
+  NOTIFICATION_PREFIX,
+  PENDING_AGENT_RUN_PREFIX,
+  PENDING_USER_RUN_PREFIX,
+  RUN_INDEX_PREFIX,
+  RUN_PREFIX,
+  SESSION_EVENT_LOG_PREFIX,
+} from "@frockbot/core/durable";
+
+/** One-time cleanup explicitly authorized by the owner for this incident.
+ * Remove after the receipts have been verified in the release.
+ * There is deliberately no route, configuration knob, or caller-supplied scope.
+ */
+const OWNER = "vgpqfaCcwnPlzjYdb2mIfNcOW1YV0SkG";
+const BOTS = new Set([
+  "bob-daff7ee3",
+  "native-qa-20260905",
+  "test-n5jJuqCi",
+  // Its retired events also prevent rebuilding the account's search index.
+  "test-99860758",
+]);
+const RECEIPT = "maintenance:chat-reset:2026-09-08";
+const PREFIXES = [
+  RUN_PREFIX,
+  RUN_INDEX_PREFIX,
+  SESSION_EVENT_LOG_PREFIX,
+  NOTIFICATION_PREFIX,
+  "shell:unread",
+  "shell:preview",
+  "shell:approval:",
+  "shell:turn-tool-catalog:",
+  "stop-receipt:",
+  "bot-announcement:",
+  PENDING_USER_RUN_PREFIX,
+];
+const KEYS = [
+  ACTIVE_RUN_KEY,
+  LATEST_EVENTS_KEY,
+  "conversation",
+  "conversation-index",
+  "bot-announcement-sequence",
+];
+
+export async function cleanIncidentTestChatsV1(
+  storage: DurableObjectStorage,
+): Promise<void> {
+  const receipt = await storage.transaction(async (tx) => {
+    const identity = await tx.get<{ userId: string; botId: string }>(
+      IDENTITY_KEY,
+    );
+    if (
+      identity?.userId !== OWNER ||
+      !BOTS.has(identity.botId) ||
+      (await tx.get(RECEIPT))
+    )
+      return;
+    for (const prefix of [PENDING_AGENT_RUN_PREFIX, "task-active:"]) {
+      if ((await tx.list({ prefix, limit: 1 })).size) return;
+    }
+    let startAfter: string | undefined;
+    for (;;) {
+      const page = await tx.list<{ status?: string }>({
+        prefix: RUN_PREFIX,
+        limit: 64,
+        ...(startAfter ? { startAfter } : {}),
+      });
+      if ([...page.values()].some((run) => run.status === "running")) return;
+      if (page.size < 64) break;
+      startAfter = [...page.keys()].at(-1);
+    }
+    let deletedKeys = 0;
+    for (const prefix of PREFIXES) {
+      for (;;) {
+        const page = await tx.list({ prefix, limit: 64 });
+        if (!page.size) break;
+        deletedKeys += await tx.delete([...page.keys()]);
+      }
+    }
+    deletedKeys += await tx.delete(KEYS);
+    const result = {
+      schemaVersion: 1,
+      botId: identity.botId,
+      deletedKeys,
+      completedAt: new Date().toISOString(),
+    };
+    await tx.put(RECEIPT, result);
+    return result;
+  });
+  if (receipt) console.info({ event: "incident-chat-cleanup", ...receipt });
+}