breakaway 1.4.0-main.45 → 1.4.0-main.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "breakaway",
-  "version": "1.4.0-main.45",
+  "version": "1.4.0-main.47",
   "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/scripts/tasks/install-check.js

@@ -0,0 +1,41 @@
+/**
+ * The owner's commands that write an install's secrets (rotate-sync, rotate-token, github-connect, agents-connect,
+ * repos remove) name them from the checkout's breakaway.config.json. In breakaway's own checkout that's the template's
+ * defaults, and under npx in another repository the package's, so before writing, the CLI checks the config is the
+ * board's own install, as the board's health reports it (BRK-95). Pure, so it's tested without a board.
+ */
+
+/** What the CLI compares, and how each is named when they differ. @type {[string, (v: any) => string][]} */
+const FIELDS = [
+  ['worker', (v) => `the Worker ${v}`],
+  ['secretsPrefix', (v) => `secrets named ${v}…`],
+  ['secretsStore', (v) => (v ? `the Secrets Store ${v}` : 'Worker secrets, no Secrets Store')],
+];
+
+/**
+ * Whether `local` (the checkout's install config, parsed) is the board's install (`board`, health's `install`).
+ * `ok` false stops the command before it writes anything; `warning` is for a board too old to say which it is.
+ *
+ * @param {{ worker: string, secretsPrefix: string, secretsStore: string | null }} local
+ * @param {{ worker?: string, secretsPrefix?: string, secretsStore?: string | null, installRepository?: string | null } | null | undefined} board
+ * @param {{ command: string, configFile: string }} where
+ * @returns {{ ok: boolean, message?: string, warning?: string }}
+ */
+export function checkInstall(local, board, { command, configFile }) {
+  if (!board || typeof board !== 'object')
+    return {
+      ok: true,
+      warning: `the board doesn't say which install it is (it runs a release from before BRK-95), so ${command} can't check that ${configFile} is its config. Update the board when you can.`,
+    };
+  // A board deployed before its config carried the Secrets Store doesn't say which it uses: compare the rest.
+  const differ = FIELDS.filter(([key]) => board[key] !== undefined && board[key] !== local[key]);
+  if (!differ.length) return { ok: true };
+  const describe = (side) => differ.map(([key, name]) => name(side[key])).join(', ');
+  const from = board.installRepository
+    ? `a checkout of ${board.installRepository}, the repository the board deploys from`
+    : `the checkout whose breakaway.config.json is the board's (the Worker ${board.worker ?? 'it runs as'})`;
+  return {
+    ok: false,
+    message: `${configFile} isn't this board's install: it says ${describe(local)}, and the board is ${describe(board)}. Nothing was written. Run npx breakaway ${command} from ${from}.`,
+  };
+}

package/scripts/tasks.mjs

@@ -42,6 +42,7 @@ import { looksLikeSecret } from '../src/ping.js';
 import { promptPathOf } from '../src/repos.js';
 import { hookFailure, sessionProxy, routeThroughSessionProxy } from './tasks/proxy.js';
 import { githubFromRemote, inRepo, pickRepo } from './tasks/repo.js';
+import { checkInstall } from './tasks/install-check.js';
 import { NO_TERMINAL, ask as askIn } from './tasks/ask.js';
 import {
   CLI_PACKAGE,
@@ -128,6 +129,17 @@ function installConfig() {
   }
 }
 
+/**
+ * Stops `command` before it writes a secret when this checkout's install config isn't the board's (BRK-95): its
+ * secrets would get the wrong names, or go to a Worker that isn't the board's. `health` saves a second request.
+ */
+async function ensureBoardInstall(command, health = null) {
+  const board = (health ?? (await call('GET', 'health'))).install;
+  const result = checkInstall(installConfig(), board, { command, configFile: tildePath(CONFIG_FILE, homedir()) });
+  if (!result.ok) fail(result.message);
+  if (result.warning) console.error(`tasks: ${result.warning}`);
+}
+
 /** A file in this checkout, or null when it isn't there. */
 function readOptional(path) {
   try {
@@ -1609,6 +1621,7 @@ const commands = {
     if (!readSetting('SECRET', { file: env })) fail(`${ENV_FILE} has no sync secret; this is for the owner's machine.`);
     const health = await call('GET', 'health');
     if (!health.ok) fail(`the server can't read its history (${health.replicaError}); fix that first (docs/tasks.md).`);
+    await ensureBoardInstall('rotate-sync', health);
     const next = { ...env, ...newSyncCredentials() };
     writePrivate(`${ENV_FILE}.next`, envFile(next));
     const result = await call('POST', 'admin/rekey', {
@@ -1638,6 +1651,7 @@ const commands = {
   },
   /** Owner: a new API token. Every browser is signed out; cloud environments need the new one. */
   async 'rotate-token'() {
+    await ensureBoardInstall('rotate-token');
     const env = readEnvFile();
     const token = randomBytes(32).toString('base64url');
     writePrivate(`${ENV_FILE}.next`, envFile({ ...env, [envName('TOKEN')]: token }));
@@ -1672,6 +1686,7 @@ const commands = {
     const { repos, default: fallback } = await call('GET', 'repos');
     const slug = opts.repo ? String(opts.repo).toLowerCase() : fallback;
     if (!repos.some((r) => r.slug === slug)) fail(unknownRepo(slug, repos));
+    await ensureBoardInstall('agents-connect');
     if (!process.stdin.isTTY) fail(NO_TERMINAL);
     const others = slug !== fallback ? await heldRoutines(fallback, slug, 'storing this one') : null;
     const { createInterface } = await import('node:readline');
@@ -1709,6 +1724,8 @@ const commands = {
    */
   async 'github-connect'() {
     const code = need(args[0], 'code');
+    // Before the code is traded: it works once, and the keys it gives have to go into the board's own secrets.
+    await ensureBoardInstall('github-connect');
     const res = await fetch(`https://api.github.com/app-manifests/${enc(code)}/conversions`, {
       method: 'POST',
       headers: {
@@ -2129,6 +2146,9 @@ async function promptAnswers() {
 /** repos remove (CLD-191): the board takes it off, then its routine leaves the Secrets Store and this machine's copy. */
 async function removeRepo(slug, signer) {
   const { default: fallback } = await call('GET', 'repos');
+  // Dropping a routine this machine connected rewrites the ROUTINES secret: check before anything changes.
+  if (existsSync(ROUTINES_FILE) && JSON.parse(readFileSync(ROUTINES_FILE, 'utf8'))[slug])
+    await ensureBoardInstall('repos remove');
   const res = await call('DELETE', `repos/${enc(slug)}`, { by: signer, ...(opts.force ? { force: true } : {}) });
   const lines = [
     `Took ${res.removed.slug} (${res.removed.github}) off the board. Its tasks stay, readable, and its slug and prefixes (${res.removed.areas.map((a) => a.prefix).join(', ')}) stay its own.`,

package/src/install.js

@@ -121,9 +121,10 @@ export function parseInstall(raw) {
  * The install a Worker runs as: its `TASKS_INSTALL` var, or a new install's defaults when it has none. An install
  * without a `url` (a new install's, on workers.dev) has a null `url`: the board
  * then goes by the address it was last opened at (the Durable Object's homeUrl()).
+ * `secretsStore` is undefined when the var doesn't say (a Worker deployed before BRK-95), not null: then nobody knows.
  *
  * @param {any} [env]
- * @returns {{ name: string, worker: string, url: string | null, secretsPrefix: string, store: string, docs: string | null, installRepository?: string | null, channel?: string }}
+ * @returns {{ name: string, worker: string, url: string | null, secretsPrefix: string, secretsStore?: string | null, store: string, docs: string | null, installRepository?: string | null, channel?: string }}
  */
 export function install(env) {
   const set = env?.TASKS_INSTALL;
@@ -134,6 +135,7 @@ export function install(env) {
     worker: String(raw.worker || DEFAULTS.worker),
     url: raw.url ? String(raw.url) : null,
     secretsPrefix: String(raw.secretsPrefix || DEFAULTS.secretsPrefix),
+    ...('secretsStore' in raw ? { secretsStore: raw.secretsStore ? String(raw.secretsStore) : null } : {}),
     store: String(raw.store || DEFAULTS.store),
     docs: raw.docs ? String(raw.docs) : null,
     installRepository: raw.installRepository ? String(raw.installRepository) : null,
@@ -174,6 +176,9 @@ export function wranglerConfig(config, { local = false, root = '.' } = {}) {
       worker: c.worker,
       url: c.url,
       secretsPrefix: c.secretsPrefix,
+      // Which Secrets Store its secrets are in, so the owner's commands that write them can check they're on this
+      // install's (BRK-95). Not a secret: the same ID is in secrets_store_secrets below.
+      secretsStore: local ? null : c.secretsStore,
       store: c.store,
       docs: c.docs,
     },