breakaway 2.0.0-main.77 → 2.0.0-main.79

package/README.md

@@ -121,8 +121,18 @@ Claude Code asks for your board’s address and its token, which it keeps in you
 
 ## Architect
 
+<picture>
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/architect-light.png">
+  <img alt="Agents propose it. You approve it. In three steps: 1, an agent changes staging in a pull request, #41, to staging.json. 2, the plan waits for you: 2 changes, 6.40 dollars more a month, estimated, and it can be undone. 3, you press Approve, and the board applies it and checks its health." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/architect-dark.png" width="100%">
+</picture>
+
 **In the 2.0.0 pre-releases.** The board can run what your repositories run on too: environments, plans you approve, and incidents, in an **Infrastructure** view, pushes, and `npx breakaway infra`. Code still ships through the deploy flow; Architect looks after what exists around it.
 
+<picture>
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/infra-light.png">
+  <img alt="The Infrastructure view, with made-up environments of a repository called widgets on Cloudflare: production is down, 1 of 7 resources, at 24.30 dollars a month inside its 60 dollar budget; staging is healthy, at 13.50 dollars a month inside its 20 dollar budget, and plan-2 waits for you." src="https://raw.githubusercontent.com/TheAnarchoX/breakaway/main/docs/media/infra-dark.png" width="100%">
+</picture>
+
 - **Changed by pull request.** What should exist is a file per environment in `.github/breakaway-infra/`, started from what already runs. A pull request that changes one shows its plan as a check: what changes, what it costs, what else it touches, and whether it can be undone.
 - **You approve, the board applies.** Every plan waits for you by default, and you approve it from your phone. A workflow in the repository applies it, with its write token in a GitHub environment: the board holds only a read-only token, and agents never apply anything. Bounds you approve once on an environment (an envelope) let it scale and restart inside them.
 - **It watches.** Health, the platform's alerts, and cost come in as signals. A critical one opens an incident, a task in the repository that owns what broke, and production's push to your phone. Drift and what nobody owns become plans; nothing changes by itself.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.77",
+  "version": "2.0.0-main.79",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "breakaway",
-      "version": "2.0.0-main.77",
+      "version": "2.0.0-main.79",
       "license": "FSL-1.1-Apache-2.0",
       "bin": {
         "breakaway": "scripts/tasks.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.77",
+  "version": "2.0.0-main.79",
   "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/scripts/brand-lint.mjs

@@ -23,7 +23,7 @@ const DEFAULT = [
   'SECURITY.md',
 ];
 const KINDS = new Set(['.md', '.html', '.js', '.jsx', '.mjs', '.css', '.json']);
-const SKIP = new Set(['node_modules', '.git', 'dist', 'previews', 'logo', 'package-lock.json']);
+const SKIP = new Set(['node_modules', '.git', '.wrangler', 'dist', 'previews', 'logo', 'package-lock.json']);
 
 function walk(path, out) {
   if (!existsSync(path)) return;

package/src/infra-cloudflare.js

@@ -225,8 +225,8 @@ const MAX_WORKERS = 50;
 const MAX_PAGES = 20;
 
 /**
- * Paths discover must never call: a KV value, an R2 object, or a Worker's code (BRK-188). Every call is checked against
- * these before it's made, so a bug can't turn a read of settings into a read of data.
+ * Paths discover must never call: a KV value, an R2 object, a Worker's code (BRK-188), or its logs (BRK-253). Every
+ * call is checked against these before it's made, so a bug can't turn a read of settings into a read of data.
  */
 export const NEVER_CALLED = [
   /\/storage\/kv\/namespaces\/[^/]+\/(values|keys|bulk)/u,
@@ -235,6 +235,9 @@ export const NEVER_CALLED = [
   /\/workers\/scripts\/[^/]+$/u,
   /\/versions\/[^/?]+\?.*include=modules/u,
   /\/secrets\/[^/]+$/u,
+  // Workers Observability's logs and telemetry, and a Worker's live tail: what its requests carried (BRK-253).
+  /\/workers\/observability\//u,
+  /\/workers\/scripts\/[^/]+\/tails/u,
 ];
 
 /** A permission as a 403 names it: with its legacy names in parentheses, for a token made before Cloudflare renamed it. */

package/src/infra-environments.js

@@ -70,7 +70,14 @@ export function checkSwitch(value, field) {
  * @param {{ target: string | null }} row
  * @param {string} worker the install's Worker
  */
-export const runsTheBoard = (row, worker) => Boolean(row.target) && row.target === worker;
+export const runsTheBoard = (row, worker) => {
+  // Compared as names (BRK-253): ` Breakaway ` is still the install's Worker, so no spelling of it escapes observe only.
+  const name = (value) =>
+    String(value ?? '')
+      .trim()
+      .toLowerCase();
+  return Boolean(name(row.target)) && name(row.target) === name(worker);
+};
 
 /**
  * The environment as the API shows it.

package/template/infra/apply.yml

@@ -5,7 +5,8 @@
 # stops before it reads the write token. That token is CLOUDFLARE_API_TOKEN, a secret of the GitHub environment named
 # for the environment (for every short-lived environment, the one GitHub environment named short-lived), which only
 # {{branchName}} may use. It checks out none of this repository's code: it runs breakaway's runner, pinned to
-# {{version}}, and reports each step to the board. Agents never run this workflow.
+# {{version}} and installed once, before any step holds the token, from the package's own lockfile with no install
+# scripts, and reports each step to the board. Agents never run this workflow.
 name: Apply infrastructure
 run-name: Apply plan ${{ inputs.plan }} to ${{ inputs.environment }}
 
@@ -47,9 +48,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: ${{ inputs.github_environment || inputs.environment }}
-    # id-token proves to the board which repository, environment, workflow, and run asks for the plan.
+    # id-token proves to the board which repository, environment, workflow, and run asks for the plan. Nothing is
+    # checked out, so the run reads nothing of the repository.
     permissions:
-      contents: read
       id-token: write
     env:
       BREAKAWAY_URL: ${{ vars.BREAKAWAY_URL }}
@@ -61,16 +62,22 @@ jobs:
         with:
           node-version: 22
 
+      # The only download: the package ships npm-shrinkwrap.json and has no dependencies, so this installs exactly
+      # what was published, and runs none of its scripts. The steps after it run that copy, so nothing is fetched while
+      # the write token is in a step's environment.
+      - name: Install the runner
+        run: npm install --global --ignore-scripts --no-audit --no-fund breakaway@{{version}}
+
       - name: Check the plan
-        run: npx --yes breakaway@{{version}} infra runner check
+        run: breakaway infra runner check
 
       - name: Apply the plan
         env:
           BREAKAWAY_WRITE_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: npx --yes breakaway@{{version}} infra runner apply
+        run: breakaway infra runner apply
 
       - name: Report the end
         if: always()
         env:
           OUTCOME: ${{ job.status }}
-        run: npx --yes breakaway@{{version}} infra runner end
+        run: breakaway infra runner end