@harperfast/harper 5.3.0-alpha.1 → 5.3.0-beta.2

package/server/serverHelpers/serverUtilities.ts

@@ -89,9 +89,9 @@ export type OperationFunctionName = ValueOf<typeof terms.OPERATIONS_ENUM>;
  * name — still stripped, since this runs ahead of the validation that now rejects it). `value` /
  * `values` carry .env secrets from set_env_value; `value` / `envelope` carry secrets from
  * set_secret. `token` is the login-purpose token (login) and the CI identity token
- * (exchange_oidc_token), and is also stripped defensively — no operation declares a top-level `token`,
- * but validation allows unknown keys, so a mistyped `harper deploy setup token=…` must not log a live
- * credential. `refresh_token` is the 30-day credential (refresh_operation_token).
+ * (exchange_oidc_token), and is also stripped defensively — no operation declares a top-level
+ * `token`, but validation allows unknown keys, so a mistyped `harper deploy setup token=…` must not
+ * log a live credential. `refresh_token` is the 30-day credential (refresh_operation_token).
  *
  * Redaction runs *before* the handler, so a rejected request logs a still-spendable credential —
  * which is why a new secret-bearing field belongs here rather than left to the default (harper#1527
@@ -111,10 +111,21 @@ export const UNLOGGABLE_OPERATION_FIELDS = [
 	'refresh_token',
 ];
 
+const UNLOGGABLE_FIELDS_BY_OPERATION = new Map<string, ReadonlySet<string>>([
+	['add_ssh_key', new Set(['key'])],
+	['update_ssh_key', new Set(['key'])],
+]);
+
 /** Callers gate this on log level: it allocates, and the operations log is often off. */
 export function redactForOperationLog(body: Record<string, any>): Record<string, any> {
 	const clean = { ...body };
 	for (const field of UNLOGGABLE_OPERATION_FIELDS) delete clean[field];
+	const operationFields = UNLOGGABLE_FIELDS_BY_OPERATION.get(body.operation);
+	if (operationFields) {
+		for (const field of Object.keys(clean)) {
+			if (operationFields.has(field.toLowerCase())) delete clean[field];
+		}
+	}
 	return clean;
 }
 
@@ -235,6 +246,17 @@ server.setMcpQuotaHandler = (handler) => {
 	setMcpQuotaHandler(handler);
 };
 
+// The nested `search_operation` operations dataLayer/export.ts's getRecords can actually run (its
+// VALID_SEARCH_OPERATIONS). Validated at dispatch so an unsupported or missing nested operation is a
+// request-time 400 rather than an async job failure, and so the nested authorization below always
+// resolves a real handler.
+const EXPORT_SEARCH_OPERATIONS = new Set<string>([
+	terms.OPERATIONS_ENUM.SEARCH_BY_VALUE,
+	terms.OPERATIONS_ENUM.SEARCH_BY_HASH,
+	terms.OPERATIONS_ENUM.SEARCH_BY_CONDITIONS,
+	terms.OPERATIONS_ENUM.SQL,
+]);
+
 export function chooseOperation(json: OperationRequestBody, bypassAuth = false) {
 	let getOpResult: OperationFunctionObject;
 	try {
@@ -255,32 +277,112 @@ export function chooseOperation(json: OperationRequestBody, bypassAuth = false)
 
 	const { operation_function, job_operation_function } = getOpResult;
 
-	// Here there is a SQL statement in either the operation or the searchOperation (from jobs like export_local).  Need to check the perms
-	// on all affected tables/attributes.
+	const isSqlOperation = json.operation === terms.OPERATIONS_ENUM.SQL;
+	// `verifyPerms` derives the tables it checks from the object it is handed, so the caller-supplied
+	// `search_operation` may only stand in as the permission subject for the operations that actually
+	// run it (dataLayer/export.ts is its only consumer). For anything else it would check the nested
+	// tables while the handler runs against the top-level ones.
+	const nestedSearch =
+		json.operation === terms.OPERATIONS_ENUM.EXPORT_LOCAL || json.operation === terms.OPERATIONS_ENUM.EXPORT_TO_S3
+			? json.search_operation
+			: undefined;
+	if (nestedSearch !== undefined) {
+		// It becomes the permission subject below, and a primitive would throw on the principal
+		// assignment — a 400 rather than a wrapped 500.
+		if (nestedSearch === null || typeof nestedSearch !== 'object' || Array.isArray(nestedSearch)) {
+			throw handleHDBError(
+				new Error(),
+				`'search_operation' must be an object`,
+				hdbErrors.HTTP_STATUS_CODES.BAD_REQUEST,
+				undefined,
+				undefined,
+				true
+			);
+		}
+		// The object check alone lets `{}` and unsupported operations through — they would then fail
+		// asynchronously in the export worker (or dereference `search_operation.operation`). Require a
+		// supported operation at request time; the nested authorization below relies on it resolving.
+		if (typeof nestedSearch.operation !== 'string' || !EXPORT_SEARCH_OPERATIONS.has(nestedSearch.operation)) {
+			throw handleHDBError(
+				new Error(),
+				`'search_operation.operation' must be one of: ${[...EXPORT_SEARCH_OPERATIONS].join(', ')}`,
+				hdbErrors.HTTP_STATUS_CODES.BAD_REQUEST,
+				undefined,
+				undefined,
+				true
+			);
+		}
+		// Dispatch state, never client input: the export worker re-reads `parsed_sql_object` off this
+		// same object (evaluateSQL), and it carries `permissions_checked`, so a body-supplied one would
+		// execute an AST no check ever saw. Deleting it rather than replacing it with the authorized
+		// parse is deliberate — the worker then re-parses and re-runs the check itself.
+		delete nestedSearch.parsed_sql_object;
+	}
+	// The AST check below covers only the statement's tables, never the caller's right to invoke the
+	// job operation, so it is additive to verifyPerms rather than an alternative to it.
+	const hasNestedSqlSearch = nestedSearch?.operation === terms.OPERATIONS_ENUM.SQL;
+
 	try {
-		if (json.operation === 'sql' || (json.search_operation && json.search_operation.operation === 'sql')) {
+		if (isSqlOperation || hasNestedSqlSearch) {
 			const sql = require('../../sqlTranslator/index');
-			const sqlStatement = json.operation === 'sql' ? json.sql : json.search_operation.sql;
+			const sqlStatement = isSqlOperation ? json.sql : nestedSearch.sql;
 			// Before this dispatch's own parse is assigned, so a body-supplied object cannot survive it.
 			stripSuppliedParsedSqlObject(json);
 			const parsedSqlObject = sql.convertSQLToAST(sqlStatement);
-			json.parsed_sql_object = parsedSqlObject;
+			if (hasNestedSqlSearch && parsedSqlObject.variant !== terms.VALID_SQL_OPS_ENUM.SELECT) {
+				throw handleHDBError(
+					new Error(),
+					`'search_operation.sql' must be a SELECT statement`,
+					hdbErrors.HTTP_STATUS_CODES.BAD_REQUEST,
+					undefined,
+					undefined,
+					true
+				);
+			}
+			// Only the direct-SQL path consumes `json.parsed_sql_object` (evaluateSQL). A nested export
+			// re-parses off `search_operation` — whose `parsed_sql_object` was deleted above — so setting
+			// it here for a job would be inert.
+			if (isSqlOperation) {
+				json.parsed_sql_object = parsedSqlObject;
+			}
 			if (!bypassAuth) {
-				// The SQL path never reaches verifyPerms, so the role `operations` allowlist must be
-				// enforced here — otherwise an allowlisted role reaches unlisted operations via `sql`.
-				// json.operation is already the API name ('sql', or the outer job op like 'export_local').
-				const allowlistDenial = opAuth.verifyOperationsAllowlist(json, json.operation);
-				if (allowlistDenial) {
-					operationLog.error(`${HTTP_STATUS_CODES.FORBIDDEN} from operation ${json.operation}`);
-					operationLog.warn(`User '${json.hdb_user?.username}' is not permitted to ${json.operation}`);
-					throw handleHDBError(
-						new Error(),
-						allowlistDenial,
-						hdbErrors.HTTP_STATUS_CODES.FORBIDDEN,
-						undefined,
-						undefined,
-						true
-					);
+				if (hasNestedSqlSearch) {
+					// A nested-SQL export's outer op (export_local/export_to_s3) is `requires_su`, which the
+					// AST table check below does not enforce. Authorize invoking it through verifyPerms
+					// exactly as the non-SQL job path does — otherwise SQL is a way around the requires_su
+					// gate that path enforces. The nested table reads are then covered additively by the AST
+					// check. verifyPerms also runs the allowlist (gate 1) and the export token scope.
+					const functionToCheck = job_operation_function === undefined ? operation_function : job_operation_function;
+					const outerDenial = opAuth.verifyPerms(json, functionToCheck, { apiOperation: json.operation });
+					if (outerDenial) {
+						operationLog.error(`${HTTP_STATUS_CODES.FORBIDDEN} from operation ${json.operation}`);
+						operationLog.warn(`User '${json.hdb_user?.username}' is not permitted to ${json.operation}`);
+						throw handleHDBError(
+							new Error(),
+							outerDenial,
+							hdbErrors.HTTP_STATUS_CODES.FORBIDDEN,
+							undefined,
+							false,
+							true
+						);
+					}
+				} else {
+					// Direct SQL: the invoked operation IS `sql`, so the role `operations` allowlist is the
+					// operation-invocation check — otherwise an allowlisted role reaches unlisted operations
+					// via `sql`. json.operation is already the API name.
+					const allowlistDenial = opAuth.verifyOperationsAllowlist(json, json.operation);
+					if (allowlistDenial) {
+						operationLog.error(`${HTTP_STATUS_CODES.FORBIDDEN} from operation ${json.operation}`);
+						operationLog.warn(`User '${json.hdb_user?.username}' is not permitted to ${json.operation}`);
+						throw handleHDBError(
+							new Error(),
+							allowlistDenial,
+							hdbErrors.HTTP_STATUS_CODES.FORBIDDEN,
+							undefined,
+							undefined,
+							true
+						);
+					}
 				}
 				// `json.operation` explicitly — the operation this dispatch already resolved, not a
 				// field read back off the request body.
@@ -309,10 +411,9 @@ export function chooseOperation(json: OperationRequestBody, bypassAuth = false)
 			json.operation !== terms.OPERATIONS_ENUM.EXCHANGE_OIDC_TOKEN
 		) {
 			const functionToCheck = job_operation_function === undefined ? operation_function : job_operation_function;
-			const operation_json = json.search_operation ? json.search_operation : json;
-			if (!operation_json.hdb_user) {
-				operation_json.hdb_user = json.hdb_user;
-			}
+			const operation_json = nestedSearch ?? json;
+			// Authentication is the only source of the principal; a nested one is overwritten, not honored.
+			operation_json.hdb_user = json.hdb_user;
 
 			// Pass the top-level operation for the token-scope check: for an export job, operation_json
 			// is the nested search_operation, so json.operation (export_local/export_to_s3) is the op the
@@ -335,6 +436,35 @@ export function chooseOperation(json: OperationRequestBody, bypassAuth = false)
 					true
 				);
 			}
+
+			// The check above authorizes invoking the operation, but for a non-SQL export it returns
+			// before any table check — a requires_su export is granted the moment its `operations`
+			// allowlist lists it (verifyPerms gate 2) — and the job worker then runs `search_operation`
+			// through searchByValue/Hash/Conditions, none of which check permissions. So the nested read
+			// is only enforceable here: authorize it additively against its real search handler and the
+			// authenticated principal (assigned above via operation_json), so a role that may invoke the
+			// export but lacks read on the table is denied. A nested SQL search is covered by the AST
+			// branch above instead.
+			if (nestedSearch) {
+				const nestedFunction = getOperationFunction(nestedSearch).operation_function;
+				const nestedPermsResult = opAuth.verifyPerms(nestedSearch, nestedFunction, {
+					apiOperation: json.operation,
+				});
+				if (nestedPermsResult) {
+					operationLog.error(`${HTTP_STATUS_CODES.FORBIDDEN} from operation ${json.operation}`);
+					operationLog.warn(
+						`User '${operation_json.hdb_user?.username}' is not permitted to ${nestedSearch.operation} within ${json.operation}`
+					);
+					throw handleHDBError(
+						new Error(),
+						nestedPermsResult,
+						hdbErrors.HTTP_STATUS_CODES.FORBIDDEN,
+						undefined,
+						false,
+						true
+					);
+				}
+			}
 		}
 	} catch (err) {
 		throw handleHDBError(err, `There was an error when trying to choose an operation path`, 500);

package/server/serverHelpers/uwsServer.ts

@@ -24,6 +24,7 @@ import { UwsRequest, UwsRequestBody } from './Request.ts';
 import { Headers } from './Headers.ts';
 import { when } from '../../utility/when.ts';
 import { ClientError } from '../../utility/errors/hdbError.ts';
+import { errorToString } from '../../utility/logging/harper_logger.ts';
 
 // uWS has no npm package; it's installed from a GitHub tag and is platform/ABI-specific.
 // Imported lazily so harper builds/loads on platforms without a uWS binary.
@@ -160,7 +161,9 @@ export async function createUwsServer(options: UwsServerOptions): Promise<{ app:
 					res.cork(() => {
 						res.writeStatus(statusText(status));
 						res.writeHeader('content-type', 'text/plain');
-						res.end(String((error && error.message) || error));
+						// the same renderer as the Node and Bun terminal handlers: the class name is the
+						// error code a client branches on, and it must not depend on the runtime
+						res.end(errorToString(error));
 					});
 				}
 			);

package/server/serverHelpers/webSocketCloseReason.ts

@@ -0,0 +1,25 @@
+// A close frame's payload is at most 125 bytes, two of which are the status code, and `ws` throws a
+// RangeError past that (node_modules/ws/lib/sender.js). Both close sites below are reached from a
+// rejection handler, where such a throw would surface as an unhandled rejection rather than a failed
+// close, so a message Harper does not control — a `server.getUser` override's, for instance — must be
+// bounded before it gets there.
+const MAX_CLOSE_REASON_BYTES = 123;
+
+/** Bounds `text` to what a close frame accepts, truncating on a code-point boundary. */
+export function toCloseReason(text: string | undefined): string {
+	const reason = text ?? '';
+	// a UTF-16 code unit never encodes to fewer than one byte, so an over-long string is over the byte
+	// limit too — testing that first keeps an unbounded message off byteLength's whole-string scan
+	if (reason.length <= MAX_CLOSE_REASON_BYTES && Buffer.byteLength(reason, 'utf8') <= MAX_CLOSE_REASON_BYTES)
+		return reason;
+	let bytes = 0;
+	let end = 0;
+	// iterating the string yields whole code points, so a surrogate pair is never split
+	for (const character of reason) {
+		const size = Buffer.byteLength(character, 'utf8');
+		if (bytes + size > MAX_CLOSE_REASON_BYTES) break;
+		bytes += size;
+		end += character.length;
+	}
+	return reason.slice(0, end);
+}

package/server/storageReclamation.ts

@@ -1,7 +1,7 @@
 import { readFile, realpath } from 'node:fs/promises';
 import { statfs } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { getWorkerIndex, getWorkerCount } from '../server/threads/manageThreads.js';
+import { ownsStoreMaintenance } from '../server/threads/manageThreads.js';
 import { logger } from '../utility/logging/logger.ts';
 import { CONFIG_PARAMS } from '../utility/hdbTerms.ts';
 import * as envMgr from '../utility/environment/environmentManager.ts';
@@ -106,7 +106,7 @@ export function onStorageReclamation(
 	handler: (priority: number) => Promise<void> | void,
 	skipThreadCheck?: boolean
 ) {
-	if (skipThreadCheck || getWorkerIndex() === getWorkerCount() - 1) {
+	if (skipThreadCheck || ownsStoreMaintenance(path)) {
 		// only run on one thread (last one)
 		if (!path) {
 			throw new Error('Storage reclamation path cannot be empty');

package/server/threads/isolatedApplications.ts

@@ -0,0 +1,157 @@
+/**
+ * Isolated applications: an application whose root-config entry carries `isolated: true` runs in a
+ * worker thread of its own that loads no other application (harper#642, tier 2).
+ *
+ * The invariant every helper here serves: an isolated application is loaded by exactly one thread,
+ * and that thread loads nothing else. The dedicated worker is an ordinary `http` worker by type --
+ * so restarts, overlap rules and shutdown treat it as one -- distinguished only by
+ * `workerData.isolatedApplication`. It binds none of the public ports (the kernel would hand it
+ * connections for every other application) and is reachable only through its own UDS mirror, whose
+ * metadata names the application and its hosts for the fronting proxy to route by.
+ */
+import { isMainThread, workerData } from 'node:worker_threads';
+import { getWorkerIndex } from './manageThreads.js';
+import { getConfigObj, getConfigPath } from '../../config/configUtils.ts';
+import * as env from '../../utility/environment/environmentManager.ts';
+import { CONFIG_PARAMS } from '../../utility/hdbTerms.ts';
+import { isDomainSocketPathTooLong } from '../../utility/domainSocket.ts';
+import { existsSync } from 'node:fs';
+import { basename, join } from 'node:path';
+
+export const DEFAULT_MAX_ISOLATED_APPLICATIONS = 8;
+
+/** The application this thread is dedicated to, if it is a dedicated worker. */
+export function thisThreadsIsolatedApplication(): string | undefined {
+	return (workerData as any)?.isolatedApplication;
+}
+
+export function thisThreadOwnsApplication(
+	appName: string | undefined,
+	owner: string | undefined = thisThreadsIsolatedApplication()
+): boolean {
+	return owner !== undefined && appName === owner;
+}
+
+export function isIsolatedApplication(
+	appName: string,
+	config: Record<string, any> | undefined = getConfigObj()
+): boolean {
+	const entry = config?.[appName];
+	return typeof entry === 'object' && entry !== null && entry.isolated === true;
+}
+
+/** Every application the root config marks isolated, in config order. */
+export function isolatedApplicationNames(config: Record<string, any> | undefined = getConfigObj()): string[] {
+	if (!config) return [];
+	return Object.keys(config).filter((name) => isIsolatedApplication(name, config));
+}
+
+export function presentIsolatedApplicationNames(
+	config: Record<string, any> | undefined = getConfigObj(),
+	componentsRoot: string = getConfigPath(CONFIG_PARAMS.COMPONENTSROOT) as string,
+	installedRoot: string = join(env.get(CONFIG_PARAMS.ROOTPATH), 'components'),
+	runApplicationPath: string | undefined = process.env.RUN_HDB_APP
+): string[] {
+	return isolatedApplicationNames(config).filter(
+		(application) =>
+			existsSync(join(componentsRoot, application)) ||
+			existsSync(join(installedRoot, application)) ||
+			(runApplicationPath && basename(runApplicationPath) === application)
+	);
+}
+
+export function maxIsolatedApplications(): number {
+	const configured = Number(env.get(CONFIG_PARAMS.THREADS_MAXISOLATED));
+	return Number.isInteger(configured) && configured >= 0 ? configured : DEFAULT_MAX_ISOLATED_APPLICATIONS;
+}
+
+/** Why `appName` cannot claim a place in the dedicated-worker budget, if the budget is full. */
+export function isolatedApplicationCapacityRefusal(
+	appName: string,
+	runningApplications: Iterable<string>,
+	max = maxIsolatedApplications()
+): string | undefined {
+	const running = new Set(runningApplications);
+	if (running.has(appName) || running.size < max) return undefined;
+	return `the instance already runs ${max} isolated application(s) (threads.maxIsolated)`;
+}
+
+/**
+ * Whether the calling thread is the one that loads the application `appName` (an application: a
+ * directory under componentsRoot, or a root-config entry with `package`). A dedicated worker loads
+ * only its own application; every other thread -- pool workers and the main thread alike -- loads only
+ * the applications that are not isolated. Decided before any of the application's modules are
+ * imported, so a skipped application has no side effects on the thread that skipped it.
+ */
+export function shouldLoadApplicationHere(
+	appName: string,
+	owner: string | undefined = thisThreadsIsolatedApplication(),
+	config: Record<string, any> | undefined = getConfigObj()
+): boolean {
+	if (owner !== undefined) return appName === owner;
+	return !isIsolatedApplication(appName, config);
+}
+
+/**
+ * Whether this thread starts the uWS listener for one `uwsServeConfigs` entry (see listenOnPorts()).
+ * A dedicated worker starts only its own per-application UDS mirrors -- the entries that carry a
+ * `socketPath` -- and never a global port listener, which the kernel would hand connections for every
+ * other application.
+ */
+export function shouldStartUwsListenerHere(
+	serveConfig: { socketPath?: string },
+	owner: string | undefined = thisThreadsIsolatedApplication()
+): boolean {
+	return owner === undefined || Boolean(serveConfig.socketPath);
+}
+
+/**
+ * Whether a dedicated worker can be reached at all: it binds only UDS mirrors of the secure port, so
+ * without `tls.unixDomainSockets` and a secure port an isolated application would load and answer
+ * nothing, silently. Refused at admission instead. Returns the reason, or undefined when reachable.
+ */
+export function isolatedApplicationsUnreachableReason(platform = process.platform): string | undefined {
+	if (platform === 'win32') return 'Windows does not support per-application UDS mirrors';
+	// the main thread standing in as the only worker (threads.count: 0) has no thread to give
+	if (isMainThread && getWorkerIndex() === 0) return 'threads.count is 0, so there is no worker thread to dedicate';
+	if (!env.get(CONFIG_PARAMS.HTTP_SECUREPORT)) return 'no http.securePort is configured';
+	if (!env.get(CONFIG_PARAMS.TLS_UNIXDOMAINSOCKETS)) return 'tls.unixDomainSockets is not enabled';
+	return undefined;
+}
+
+/** Why `appName` cannot get a dedicated worker on this instance, or undefined when it can. */
+export function isolatedApplicationRefusal(appName: string): string | undefined {
+	const unreachable = isolatedApplicationsUnreachableReason();
+	if (unreachable) return `its worker would be unreachable: ${unreachable}`;
+	const socketPath = join(
+		env.getHdbBasePath(),
+		'sockets',
+		`${applicationSocketName(appName, env.get(CONFIG_PARAMS.HTTP_SECUREPORT))}.sock`
+	);
+	if (isDomainSocketPathTooLong(socketPath)) return `its UDS mirror path ${socketPath} exceeds the platform limit`;
+	return undefined;
+}
+
+/**
+ * The filesystem name of an isolated worker's UDS mirror for `port`: every UTF-8 byte outside
+ * `[A-Za-z0-9._]` becomes a fixed-width `%XX`, which is injective (two application names never share
+ * a socket), and the `app-` prefix keeps it apart from the pool's `<workerIndex>-<port>` names.
+ */
+export function applicationSocketName(appName: string, port: number | string): string {
+	let encoded = '';
+	for (const byte of Buffer.from(appName, 'utf8')) {
+		const c = String.fromCharCode(byte);
+		encoded += byte < 0x80 && /[A-Za-z0-9._]/.test(c) ? c : `%${byte.toString(16).toUpperCase().padStart(2, '0')}`;
+	}
+	return `app-${encoded}-${port}`;
+}
+
+/** What a dedicated worker publishes in its mirror metadata for the proxy to route by. */
+export function isolatedApplicationRoute(
+	appName: string | undefined = thisThreadsIsolatedApplication(),
+	config: Record<string, any> | undefined = getConfigObj()
+): { application: string; hosts: string[] } | undefined {
+	if (!appName) return undefined;
+	const host = config?.[appName]?.host; // a string, as the mount parser requires
+	return { application: appName, hosts: typeof host === 'string' && host ? [host] : [] };
+}

package/server/threads/logRotationTransport.ts

@@ -0,0 +1,40 @@
+'use strict';
+
+// Hands the log-rotation coordinator the thread mesh it needs, from this side of the dependency
+// edge: manageThreads already imports harper_logger, so logging can never import manageThreads.
+
+import { threadId } from 'node:worker_threads';
+import { setRotationTransport } from '../../utility/logging/logGenerationCoordinator.ts';
+import { broadcast, onMessageByType, onThreadExit } from './manageThreads.js';
+
+// Assigned to the `threads` global by manageThreads.
+declare const threads: {
+	sendToThread(threadId: number, message: any): boolean;
+	[index: number]: { threadId?: number };
+	length: number;
+};
+
+setRotationTransport({
+	threadId,
+	broadcast(message) {
+		broadcast(message);
+	},
+	sendToThread(target, message) {
+		threads.sendToThread(target, message);
+	},
+	onMessage(type, handler) {
+		onMessageByType(type, handler);
+	},
+	onThreadExit,
+	peerThreadIds() {
+		// Job workers included: they hold log descriptors whether or not they take part in ITC gossip,
+		// and the deadlock that excludes them from the schema broadcast cannot happen here — the
+		// handler only closes a descriptor, and no caller blocks its event loop on the answer.
+		const ids = new Set<number>();
+		for (let i = 0; i < threads.length; i++) {
+			const peer = threads[i].threadId;
+			if (peer !== undefined && peer !== threadId) ids.add(peer);
+		}
+		return ids;
+	},
+});