breakaway 2.0.0-main.70 → 2.0.0-main.72

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.70",
+  "version": "2.0.0-main.72",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "breakaway",
-      "version": "2.0.0-main.70",
+      "version": "2.0.0-main.72",
       "license": "FSL-1.1-Apache-2.0",
       "bin": {
         "breakaway": "scripts/tasks.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.70",
+  "version": "2.0.0-main.72",
   "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/src/infra-cloudflare-plan.js

@@ -12,7 +12,11 @@
  * Only Workers can be scoped one by one (Workers Editor, BRK-243); a database, namespace, bucket, or queue permission
  * reaches every one on the account. So the provider keeps every change inside the environment's scope itself: it
  * refuses to make a resource that already exists on the account outside the scope, a database, namespace, bucket, or
- * queue no Worker in the desired state binds, and a delete of something a remaining Worker still binds.
+ * queue no Worker in the desired state binds, and a delete of something a remaining Worker still binds. Discovery
+ * follows bindings to other Workers, so the plan also refuses a change to the install's own Worker (`scope.board`), to
+ * another environment's target (`scope.others`), or to anything reached only through one of them, never deletes them,
+ * and sends a route or custom domain only to the environment's own Workers, on a pattern or hostname nobody else has
+ * (BRK-251).
  *
  * `apply` runs only inside the apply runner (CLI-12), with the environment's write token. It discovers again first
  * and refuses a change whose resource moved since it was planned, then calls Cloudflare one change at a time, in the
@@ -33,6 +37,7 @@ import {
   cloudflare,
   cost,
   discover,
+  ownership,
   priceResource,
   reader,
   refuses,
@@ -263,7 +268,14 @@ export async function plan(ctx, desired) {
   const live = /** @type {LiveAccount} */ (found.live);
   if (!live.account || !live.scripts.includes(String(ctx.scope?.target ?? '')))
     refuse(`${ctx.scope?.target ?? 'the target'} isn’t a Worker on the account yet: deploy it first, then plan`);
+  if (ctx.scope?.board && ctx.scope.board === ctx.scope.target)
+    refuse(
+      `${ctx.scope.target} is the Worker this board runs on: Architect only observes it, so it never plans for it`,
+    );
   const have = viewOf(found);
+  const own = ownership(found, ctx.scope);
+  /** Why the environment can't change a resource it found, or null when it's its own (BRK-251). */
+  const notOurs = (h) => own.why(ctx.environment, h);
   const cf = reader(ctx);
 
   // Match each desired resource to what's there: by ID, else by kind and name.
@@ -318,6 +330,20 @@ export async function plan(ctx, desired) {
     return boundAfter[type].has(r.kind === 'r2' || r.kind === 'queue' ? r.name : cfId(r.id));
   };
 
+  /** Whether a route or custom domain may send to this Worker: one of the environment's, or one this plan makes. */
+  const mine = (worker) => own.workers.has(worker) || desiredWorkers.some((w) => w.name === worker && !match.has(w.id));
+  /** Refuses a route pattern or custom domain hostname another Worker already has: it's that Worker's traffic. */
+  const inUse = (r) => {
+    const held =
+      r.kind === 'route'
+        ? live.routes.find((x) => x.pattern === r.name)
+        : live.domains.find((x) => x.hostname === r.name);
+    if (held)
+      refuse(
+        `${r.name} already sends to ${held.worker}: a ${r.kind} can’t take a ${r.kind === 'route' ? 'pattern' : 'hostname'} that’s already in use, so remove it there first or pick another`,
+      );
+  };
+
   /** @type {Change[]} */
   const changes = [];
   for (const r of desired.resources) {
@@ -325,7 +351,7 @@ export async function plan(ctx, desired) {
     const managed = MANAGED[r.kind] ?? [];
     const wanted = isObject(r.attrs) ? r.attrs : {};
     if (!h) {
-      changes.push(await created(ctx, cf, live, r, wanted, boundAfter));
+      changes.push(await created(ctx, cf, live, r, wanted, boundAfter, { mine, inUse }));
       continue;
     }
     /** @type {Record<string, unknown>} */
@@ -363,8 +389,14 @@ export async function plan(ctx, desired) {
         changed = true;
       }
     }
-    if (r.kind === 'route' && changed && !live.scripts.includes(String(after.worker)))
-      refuse(`route ${r.name} would send to ${after.worker}, which isn’t a Worker on the account`);
+    if (changed && notOurs(h)) refuse(/** @type {string} */ (notOurs(h)));
+    if ((r.kind === 'route' || r.kind === 'custom-domain') && changed) {
+      if (!live.scripts.includes(String(after.worker)))
+        refuse(`${r.kind} ${r.name} would send to ${after.worker}, which isn’t a Worker on the account`);
+      if (!mine(String(after.worker)))
+        refuse(`${r.kind} ${r.name} would send to ${after.worker}, which isn’t one of ${ctx.environment}’s Workers`);
+      if (r.name !== h.name) inUse(r);
+    }
     if (changed)
       changes.push({
         op: 'update',
@@ -378,6 +410,8 @@ export async function plan(ctx, desired) {
   }
   for (const h of have.values()) {
     if (taken.has(h.id)) continue;
+    // What only the install's Worker or another environment reaches isn't this environment's to delete (BRK-251).
+    if (notOurs(h)) continue;
     if (h.kind === 'durable-object')
       refuse(
         `${h.name} isn’t in the desired state: a Durable Object class is deleted by a migration in its Worker’s code, so keep it listed and remove it in the code`,
@@ -388,6 +422,13 @@ export async function plan(ctx, desired) {
       refuse(`${h.name} is still bound by a Worker: remove the binding in the desired state before you delete it`);
     if (h.kind === 'worker' && boundAfter.service.has(h.name))
       refuse(`${h.name} is still called by a Worker’s service binding: remove the binding before you delete it`);
+    const outsider = found.relations.find(
+      (rel) => rel.to === h.id && rel.from.startsWith('worker:') && !own.workers.has(cfId(rel.from)),
+    );
+    if (outsider)
+      refuse(
+        `${h.name} is still used by ${cfId(outsider.from)}, which is outside ${ctx.environment}: Architect never deletes what another Worker relies on`,
+      );
     const reversible = !LOST[h.kind];
     changes.push({
       op: 'delete',
@@ -411,10 +452,11 @@ export async function plan(ctx, desired) {
 
 /**
  * A resource to make, checked against the scope: nothing of the same name already on the account, and every
- * database, namespace, bucket, and queue bound by a desired Worker, so the next discovery finds it.
+ * database, namespace, bucket, and queue bound by a desired Worker, so the next discovery finds it. A route or custom
+ * domain sends to one of the environment's Workers, on a pattern or hostname no other Worker has (BRK-251).
  * @returns {Promise<Change>}
  */
-async function created(ctx, cf, live, r, wanted, boundAfter) {
+async function created(ctx, cf, live, r, wanted, boundAfter, { mine, inUse }) {
   const a = encodeURIComponent(live.account);
   const outside = `${r.name} already exists on the account outside ${ctx.environment}’s scope: Architect never takes over a resource another environment may run on`;
   /** @type {Record<string, unknown>} */
@@ -435,6 +477,11 @@ async function created(ctx, cf, live, r, wanted, boundAfter) {
       refuse(
         `${r.kind} ${r.name} needs attrs.zone, one of the zones the token reaches (${Object.keys(live.zones).sort().join(', ') || 'none'})`,
       );
+    if (!mine(wanted.worker))
+      refuse(
+        `${r.kind} ${r.name} would send to ${wanted.worker}, which isn’t one of ${ctx.environment}’s Workers: send it to the target or a Worker it calls`,
+      );
+    inUse(r);
     after.zone = wanted.zone;
   } else {
     const type = Object.keys(BOUND_KIND).find((t) => BOUND_KIND[t][0] === r.kind);

package/src/infra-cloudflare.js

@@ -57,12 +57,21 @@ const ENVELOPE = {
   container: { changes: ['scale', 'restart'], scales: 'maxInstances' },
   queue: { changes: ['scale'], scales: 'maxConcurrency' },
 };
+/**
+ * The kinds that decide what reaches a Worker: a route or a custom domain can send a hostname somewhere else, so every
+ * change to one asks the owner, whatever a repository's allow rules say (the policy's access guard; BRK-229).
+ */
+const ACCESS = ['route', 'custom-domain'];
+
 export const CLOUDFLARE_KINDS = Object.fromEntries(
   Object.entries(MANAGED).map(([k, settings]) => [
     k,
-    ENVELOPE[k]
-      ? { changes: [...BASE, ...ENVELOPE[k].changes], scales: ENVELOPE[k].scales, settings: [...settings] }
-      : { changes: [...BASE], settings: [...settings] },
+    {
+      ...(ENVELOPE[k]
+        ? { changes: [...BASE, ...ENVELOPE[k].changes], scales: ENVELOPE[k].scales, settings: [...settings] }
+        : { changes: [...BASE], settings: [...settings] }),
+      ...(ACCESS.includes(k) ? { access: true } : {}),
+    },
   ]),
 );
 
@@ -93,6 +102,92 @@ export function refuses(r, op) {
   return null;
 }
 
+/**
+ * What an environment owns of what discovery found (BRK-251). Discovery follows the target's service and Durable
+ * Object bindings to other Workers, so it can reach the install's own Worker (`scope.board`) or another environment's
+ * target (`scope.others`): those are foreign, and so is everything reached only through them. The environment's own
+ * Workers are the target and the Workers it reaches without passing through a foreign one. A database, namespace,
+ * bucket, or queue is its own when one of its Workers binds, sends to, or consumes it; a Durable Object namespace when
+ * its class runs in one of its Workers, and a container application when its namespace is its own; a route or custom
+ * domain when it serves one of its Workers.
+ * @param {import('./infra-provider.js').Discovery} found
+ * @param {Record<string, unknown> | undefined} scope
+ */
+export function ownership(found, scope) {
+  const target = String(scope?.target ?? '');
+  const board = typeof scope?.board === 'string' && scope.board !== target ? scope.board : null;
+  const others = new Set(
+    (Array.isArray(scope?.others) ? scope.others : []).filter((w) => typeof w === 'string' && w && w !== target),
+  );
+  const foreign = (name) => name === board || others.has(name);
+  const byId = new Map(found.resources.map((r) => [r.id, r]));
+  const name = (id) => id.slice(id.indexOf(':') + 1);
+  const from = new Map();
+  for (const rel of found.relations) from.set(rel.from, [...(from.get(rel.from) ?? []), rel]);
+  /** @type {Set<string>} */
+  const workers = new Set();
+  const queue = byId.has(rid('worker', target)) ? [target] : [];
+  while (queue.length) {
+    const w = /** @type {string} */ (queue.shift());
+    if (workers.has(w) || foreign(w)) continue;
+    workers.add(w);
+    for (const rel of from.get(rid('worker', w)) ?? []) {
+      if (rel.kind === 'calls') queue.push(name(rel.to));
+      if (rel.kind === 'uses' && rel.to.startsWith('durable-object:'))
+        for (const runs of from.get(rel.to) ?? []) if (runs.kind === 'runs-in') queue.push(name(runs.to));
+    }
+  }
+  /** @type {Set<string>} */
+  const own = new Set([...workers].map((w) => rid('worker', w)));
+  for (const rel of found.relations) {
+    const r = byId.get(rel.to);
+    if (!r || !own.has(rel.from) || r.kind === 'durable-object' || r.kind === 'worker') continue;
+    own.add(r.id);
+  }
+  for (const rel of found.relations)
+    if (rel.kind === 'runs-in' && own.has(rel.to)) {
+      own.add(rel.from);
+      for (const runs of from.get(rel.from) ?? []) if (runs.kind === 'runs') own.add(runs.to);
+    }
+  return {
+    workers,
+    /** @param {string} w a Worker's name */
+    foreign,
+    /**
+     * Why the environment can't change this resource, in words, or null when it's its own.
+     * @param {string} environment
+     * @param {Resource} r
+     */
+    why(environment, r) {
+      if (r.kind === 'worker' && r.name === board)
+        return `${r.name} is the Worker this board runs on: Architect only observes it, so no plan or act changes it`;
+      if (r.kind === 'worker' && others.has(r.name))
+        return `${r.name} is another environment’s target: change it in that environment, not ${environment}`;
+      if (own.has(r.id)) return null;
+      return `${r.name} is reached only through a Worker outside ${environment} (the install’s own or another environment’s), so it isn’t ${environment}’s to change`;
+    },
+  };
+}
+
+/**
+ * Why an act can't change this resource in the environment (BRK-251): `ownership`'s answer, and for a queue's scale,
+ * the Worker consuming it, whose concurrency it sets, must be the environment's too.
+ * @param {import('./infra-provider.js').ProviderContext} ctx
+ * @param {import('./infra-provider.js').Discovery} found
+ * @param {Resource} r
+ * @returns {string | null}
+ */
+export function outside(ctx, found, r) {
+  const own = ownership(found, ctx.scope);
+  const why = own.why(ctx.environment, r);
+  if (why) return why;
+  const consumers = r.kind === 'queue' ? /** @type {any[]} */ (r.attrs?.consumers ?? []) : [];
+  const consumer = consumers.find((c) => c?.type === 'worker');
+  if (consumer && !own.workers.has(String(consumer.worker ?? '')))
+    return `${r.name} is consumed by ${consumer.worker}, which is outside ${ctx.environment}, so its concurrency isn’t ${ctx.environment}’s to change`;
+  return null;
+}
+
 /**
  * Cloudflare's Workers role the board reads Workers with (BRK-243): Metadata Read-Only at the Workers product scope,
  * which reads settings and never a Worker's code. It replaces the legacy Workers Scripts Read, which Cloudflare maps to
@@ -305,6 +400,9 @@ export function bindingTarget(b) {
  * @property {string[]} scripts
  * @property {Record<string, Array<Record<string, string>>>} bindings by Worker
  * @property {Record<string, string>} zones zone IDs by name
+ * @property {Array<{ pattern: string, zone: string, worker: string }>} routes every route on those zones, whichever
+ *   Worker it sends to, so a new one can't take a pattern another Worker already has (BRK-251)
+ * @property {Array<{ hostname: string, worker: string }>} domains every custom domain on the account, likewise
  */
 
 /**
@@ -324,7 +422,7 @@ export async function discover(ctx, { live = false } = {}) {
   /** @type {string[]} */
   const missing = [];
   /** @type {LiveAccount} */
-  const seen = { account: '', scripts: [], bindings: {}, zones: {} };
+  const seen = { account: '', scripts: [], bindings: {}, zones: {}, routes: [], domains: [] };
   const add = (r) => resources.set(r.id, r);
   const relate = (from, to, kind) => relations.set(`${from} ${kind} ${to}`, { from, to, kind });
   const done = () => ({
@@ -583,6 +681,7 @@ export async function discover(ctx, { live = false } = {}) {
     const routes =
       (await cf.get(`/zones/${enc(zone.id)}/workers/routes`, { permission: 'Workers Routes Read' })).result ?? [];
     for (const route of routes) {
+      seen.routes.push({ pattern: String(route.pattern), zone: String(zone.name), worker: String(route.script ?? '') });
       if (!workers.has(String(route.script))) continue;
       add({
         id: rid('route', route.id),
@@ -597,6 +696,7 @@ export async function discover(ctx, { live = false } = {}) {
   // Custom domains attached to a Worker in scope.
   const domains = (await cf.get(`/accounts/${a}/workers/domains`, { permission: WORKERS_READ })).result ?? [];
   for (const d of domains) {
+    seen.domains.push({ hostname: String(d.hostname), worker: String(d.service ?? '') });
     if (!workers.has(String(d.service))) continue;
     add({
       id: rid('custom-domain', d.id),
@@ -1198,6 +1298,7 @@ export const cloudflare = {
     check: checkToken,
   },
   refuses,
+  outside,
   discover,
   plan: (ctx, desired) => plan(ctx, desired),
   apply: (ctx, p) => apply(ctx, p),

package/src/infra-desired.js

@@ -29,6 +29,8 @@ export const DESIRED_MAX_BYTES = 256 * 1024;
 export const DESIRED_MAX_RESOURCES = 500;
 /** How many files one read takes from the folder: an environment per file, and a repository has at most 50. */
 export const DESIRED_MAX_FILES = 60;
+/** How deep a file may nest: far more than any real one, and well inside the stack. */
+export const MAX_DEPTH = 64;
 
 const TOP = ['version', 'provider', 'resources'];
 const RESOURCE = ['id', 'kind', 'name', 'attrs'];
@@ -115,8 +117,10 @@ export function parseWithLines(text) {
     i += match[0].length;
     return JSON.parse(match[0]);
   };
-  /** @param {string} path */
-  const value = (path) => {
+  /** @param {string} path @param {number} depth */
+  const value = (path, depth = 0) => {
+    // A file nested deeper than any real one would overflow the stack: it's refused with its line (BRK-229).
+    if (depth > MAX_DEPTH) fail(`it’s nested more than ${MAX_DEPTH} deep`);
     space();
     lines.set(path, line);
     const c = src[i];
@@ -137,7 +141,13 @@ export function parseWithLines(text) {
         space();
         if (src[i] !== ':') fail(`expected : after “${key}”, and found ${shown()}`);
         i += 1;
-        out[key] = value(path ? `${path}.${key}` : key);
+        // Defined, never assigned, so a key like __proto__ is a plain key and never the object's prototype.
+        Object.defineProperty(out, key, {
+          value: value(path ? `${path}.${key}` : key, depth + 1),
+          enumerable: true,
+          writable: true,
+          configurable: true,
+        });
         space();
         if (src[i] === ',') {
           i += 1;
@@ -159,7 +169,7 @@ export function parseWithLines(text) {
         return out;
       }
       for (;;) {
-        out.push(value(`${path}[${out.length}]`));
+        out.push(value(`${path}[${out.length}]`, depth + 1));
         space();
         if (src[i] === ',') {
           i += 1;

package/src/infra-provider.js

@@ -129,7 +129,9 @@ export const COST_NOTE_MAX = 500;
  * which only the apply runner holds. `observeOnly` environments (the board's own install, BRK-169) refuse apply.
  * @typedef {object} ProviderContext
  * @property {string} environment
- * @property {Record<string, unknown>} [scope] which of the platform's resources belong to the environment
+ * @property {Record<string, unknown>} [scope] which of the platform's resources belong to the environment: its
+ *   `target`, and for a plan or an act the install's own Worker (`board`) and the other environments' targets
+ *   (`others`), which are never its to change (BRK-251)
  * @property {boolean} [observeOnly]
  * @property {string} [token]
  * @property {string} [writeToken] the environment's write token: only the apply runner sets it (CLI-12, from its
@@ -192,6 +194,10 @@ export const COST_NOTE_MAX = 500;
  * @property {(resource: Resource, op: string) => string | null} [refuses] why the platform can't make an envelope's
  *   `scale` or `restart` to this one resource although its kind declares it (a setting of the resource rules it out),
  *   in words, or null when it can; an act asks it before it plans (BRK-227)
+ * @property {(ctx: ProviderContext, found: Discovery, resource: Resource) => string | null} [outside] why the
+ *   resource, though `discover` found it, isn't the environment's to change (it's only reached through the install's
+ *   Worker, `scope.board`, or another environment's target, `scope.others`), in words, or null when it is; an act asks
+ *   it before it plans (BRK-251)
  * @property {ReadToken} [readToken] the read-only token it needs, if any
  * @property {(ctx: ProviderContext) => Promise<Discovery>} discover
  * @property {(ctx: ProviderContext, desired: DesiredState) => Promise<PlanDiff>} plan
@@ -256,6 +262,7 @@ export function checkProvider(provider) {
   }
   if (provider.readToken !== undefined) checkReadToken(what, provider.readToken);
   if (provider.refuses !== undefined && typeof provider.refuses !== 'function') fail(what, 'refuses is not a function');
+  if (provider.outside !== undefined && typeof provider.outside !== 'function') fail(what, 'outside is not a function');
   if (provider.estimate !== undefined && typeof provider.estimate !== 'function')
     fail(what, 'estimate is not a function');
   return provider;