breakaway 2.0.0-main.76 → 2.0.0-main.78

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.76",
+  "version": "2.0.0-main.78",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "breakaway",
-      "version": "2.0.0-main.76",
+      "version": "2.0.0-main.78",
       "license": "FSL-1.1-Apache-2.0",
       "bin": {
         "breakaway": "scripts/tasks.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.76",
+  "version": "2.0.0-main.78",
   "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/src/infra-cloudflare.js

@@ -225,8 +225,8 @@ const MAX_WORKERS = 50;
 const MAX_PAGES = 20;
 
 /**
- * Paths discover must never call: a KV value, an R2 object, or a Worker's code (BRK-188). Every call is checked against
- * these before it's made, so a bug can't turn a read of settings into a read of data.
+ * Paths discover must never call: a KV value, an R2 object, a Worker's code (BRK-188), or its logs (BRK-253). Every
+ * call is checked against these before it's made, so a bug can't turn a read of settings into a read of data.
  */
 export const NEVER_CALLED = [
   /\/storage\/kv\/namespaces\/[^/]+\/(values|keys|bulk)/u,
@@ -235,6 +235,9 @@ export const NEVER_CALLED = [
   /\/workers\/scripts\/[^/]+$/u,
   /\/versions\/[^/?]+\?.*include=modules/u,
   /\/secrets\/[^/]+$/u,
+  // Workers Observability's logs and telemetry, and a Worker's live tail: what its requests carried (BRK-253).
+  /\/workers\/observability\//u,
+  /\/workers\/scripts\/[^/]+\/tails/u,
 ];
 
 /** A permission as a 403 names it: with its legacy names in parentheses, for a token made before Cloudflare renamed it. */

package/src/infra-environments.js

@@ -70,7 +70,14 @@ export function checkSwitch(value, field) {
  * @param {{ target: string | null }} row
  * @param {string} worker the install's Worker
  */
-export const runsTheBoard = (row, worker) => Boolean(row.target) && row.target === worker;
+export const runsTheBoard = (row, worker) => {
+  // Compared as names (BRK-253): ` Breakaway ` is still the install's Worker, so no spelling of it escapes observe only.
+  const name = (value) =>
+    String(value ?? '')
+      .trim()
+      .toLowerCase();
+  return Boolean(name(row.target)) && name(row.target) === name(worker);
+};
 
 /**
  * The environment as the API shows it.

package/src/infra-inventory.js

@@ -94,3 +94,26 @@ export function resourceView(row, environment, task) {
     seen: new Date(row.seen).toISOString(),
   };
 }
+
+/** How often the cron refreshes a provider's inventory by itself (BRK-248). */
+export const REFRESH_EVERY_MS = 15 * 60 * 1000;
+
+/** At most this many providers refresh on one cron tick, the longest-waiting first, so they stagger. */
+export const REFRESH_PER_TICK = 2;
+
+/** A platform's answers that mean the token can't read: the cron stops trying until a new token is pasted. */
+const REFUSED = new Set([401, 403]);
+
+/**
+ * Whether the cron refreshes a provider now (BRK-248): never refreshed, or not in the last 15 minutes. One whose last
+ * refresh the platform refused (401 or 403) waits for a new token instead: Connections already says why.
+ * @param {{ at: number, ok: boolean, status: number | null } | null} last the provider's last refresh
+ * @param {number} now
+ * @param {number | null} [tokenEdited] when the provider's token was last pasted
+ */
+export function refreshDue(last, now, tokenEdited = null) {
+  if (!last) return true;
+  if (!last.ok && last.status !== null && REFUSED.has(last.status) && !(tokenEdited !== null && tokenEdited > last.at))
+    return false;
+  return now - last.at >= REFRESH_EVERY_MS;
+}

package/template/infra/apply.yml

@@ -5,7 +5,8 @@
 # stops before it reads the write token. That token is CLOUDFLARE_API_TOKEN, a secret of the GitHub environment named
 # for the environment (for every short-lived environment, the one GitHub environment named short-lived), which only
 # {{branchName}} may use. It checks out none of this repository's code: it runs breakaway's runner, pinned to
-# {{version}}, and reports each step to the board. Agents never run this workflow.
+# {{version}} and installed once, before any step holds the token, from the package's own lockfile with no install
+# scripts, and reports each step to the board. Agents never run this workflow.
 name: Apply infrastructure
 run-name: Apply plan ${{ inputs.plan }} to ${{ inputs.environment }}
 
@@ -47,9 +48,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: ${{ inputs.github_environment || inputs.environment }}
-    # id-token proves to the board which repository, environment, workflow, and run asks for the plan.
+    # id-token proves to the board which repository, environment, workflow, and run asks for the plan. Nothing is
+    # checked out, so the run reads nothing of the repository.
     permissions:
-      contents: read
       id-token: write
     env:
       BREAKAWAY_URL: ${{ vars.BREAKAWAY_URL }}
@@ -61,16 +62,22 @@ jobs:
         with:
           node-version: 22
 
+      # The only download: the package ships npm-shrinkwrap.json and has no dependencies, so this installs exactly
+      # what was published, and runs none of its scripts. The steps after it run that copy, so nothing is fetched while
+      # the write token is in a step's environment.
+      - name: Install the runner
+        run: npm install --global --ignore-scripts --no-audit --no-fund breakaway@{{version}}
+
       - name: Check the plan
-        run: npx --yes breakaway@{{version}} infra runner check
+        run: breakaway infra runner check
 
       - name: Apply the plan
         env:
           BREAKAWAY_WRITE_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npx --yes breakaway@{{version}} infra runner apply
+        run: breakaway infra runner apply
 
       - name: Report the end
         if: always()
         env:
           OUTCOME: ${{ job.status }}
-        run: npx --yes breakaway@{{version}} infra runner end
+        run: breakaway infra runner end