cursedops 0.10.0 → 0.10.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.0",
+	"version": "0.10.2",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/relay.ts

@@ -426,7 +426,10 @@ export class RelayLink {
 		if (declared > this.maxBodyBytes) return tooBig();
 		const id = crypto.randomUUID();
 		const frame = await requestFrame(id, request);
-		if (frame.body !== null && frame.body.length > (this.maxBodyBytes * 4) / 3 + 4) return tooBig();
+		// Exactly, off the base64: a chunked upload carries no content-length, and a slack bound let
+		// the ceiling + 2 bytes through (roms' suite caught it at MAX_BODY_BYTES + 1).
+		const pad = frame.body?.endsWith("==") ? 2 : frame.body?.endsWith("=") ? 1 : 0;
+		if (frame.body !== null && (frame.body.length / 4) * 3 - pad > this.maxBodyBytes) return tooBig();
 		return await new Promise<Response>((resolve) => {
 			const timer = setTimeout(() => {
 				this.pending.delete(id);

package/src/relayLink.ts

@@ -24,18 +24,37 @@ export interface LinkSettings {
 	key: string;
 }
 
+/**
+ * The link's three names, spelled WHOLE by the app — the env file's URL and key, and the Worker
+ * secret holding the key's digest. 🔴 Whole, not a prefix this module glues together: the app is
+ * then the visible reader of its own secrets, which is what `tools/check-secret-readers.ts` looks
+ * for (a built name like `` `${prefix}_LINK_URL` `` is invisible to it, and station's two keys read
+ * as "read by nothing" the day this module first took a prefix). A bare prefix string still works.
+ */
+export interface LinkNames {
+	url: string;
+	key: string;
+	digest: string;
+}
+
+/** `"ROMS"` → `ROMS_LINK_URL` / `ROMS_LINK_KEY` / `ROMS_LINK_KEY_SHA256`; names pass through. */
+export function linkNames(names: string | LinkNames): LinkNames {
+	return typeof names === "string" ? { url: `${names}_LINK_URL`, key: `${names}_LINK_KEY`, digest: `${names}_LINK_KEY_SHA256` } : names;
+}
+
 /**
  * The link's URL and key out of its 0600 env file (`<APP>_LINK_URL`, `<APP>_LINK_KEY`), or a sentence
  * saying what is wrong. `wss://<host>/link`, or `ws://127.0.0.1:<port>/link` for a local workerd.
  */
-export function readLinkSettings(text: string, prefix: string, mintCommand = "bun run link:key"): LinkSettings | string {
+export function readLinkSettings(text: string, names: string | LinkNames, mintCommand = "bun run link:key"): LinkSettings | string {
+	const n = linkNames(names);
 	const found = readEnvFile(text);
-	const url = found[`${prefix}_LINK_URL`]?.trim() ?? "";
-	const key = found[`${prefix}_LINK_KEY`]?.trim() ?? "";
+	const url = found[n.url]?.trim() ?? "";
+	const key = found[n.key]?.trim() ?? "";
 	if (!/^wss:\/\/[^/]+\/link$/.test(url) && !/^ws:\/\/(127\.0\.0\.1|localhost)(:\d+)?\/link$/.test(url)) {
-		return `${prefix}_LINK_URL must be wss://<host>/link (or ws://127.0.0.1:<port>/link for a local workerd), got "${url}"`;
+		return `${n.url} must be wss://<host>/link (or ws://127.0.0.1:<port>/link for a local workerd), got "${url}"`;
 	}
-	if (key.length < 32) return `${prefix}_LINK_KEY is missing or short — \`${mintCommand}\` mints one`;
+	if (key.length < 32) return `${n.key} is missing or short — \`${mintCommand}\` mints one`;
 	return { url, key };
 }
 
@@ -159,8 +178,9 @@ export function mintLinkKey(): string {
 }
 
 /** The link's env file, single-quoted so a shell `source` cannot mangle it. */
-export function linkEnvText(prefix: string, url: string, key: string, mintCommand = "bun run link:key"): string {
-	return `# ${prefix.toLowerCase()}'s link — written by \`${mintCommand}\`. The key never leaves this Mac.\n${prefix}_LINK_URL='${url}'\n${prefix}_LINK_KEY='${key}'\n`;
+export function linkEnvText(names: string | LinkNames, url: string, key: string, mintCommand = "bun run link:key"): string {
+	const n = linkNames(names);
+	return `# the link — written by \`${mintCommand}\`. The key never leaves this Mac.\n${n.url}='${url}'\n${n.key}='${key}'\n`;
 }
 
 export interface RotateSpec {
@@ -168,8 +188,8 @@ export interface RotateSpec {
 	appDir: string;
 	/** The 0600 env file the Mac reads. */
 	file: string;
-	/** `ROMS` → `ROMS_LINK_URL` / `ROMS_LINK_KEY` / `ROMS_LINK_KEY_SHA256`. */
-	prefix: string;
+	/** The three names ({@link LinkNames}) — or a prefix, `ROMS` → `ROMS_LINK_URL` / `ROMS_LINK_KEY` / `ROMS_LINK_KEY_SHA256`. */
+	names: string | LinkNames;
 	/** A new URL, or undefined to keep the file's. */
 	url?: string;
 	/** `cloudflareCredential(...)` — the env overlay wrangler runs with. */
@@ -187,10 +207,11 @@ export interface RotateSpec {
  */
 export async function rotateLinkKey(spec: RotateSpec): Promise<{ ok: true; file: string } | { ok: false; why: string }> {
 	const previous = existsSync(spec.file) ? readEnvFile(readFileSync(spec.file, "utf8")) : {};
-	const url = spec.url ?? previous[`${spec.prefix}_LINK_URL`];
+	const n = linkNames(spec.names);
+	const url = spec.url ?? previous[n.url];
 	if (!url) return { ok: false, why: `no link URL yet — pass \`--url wss://<worker host>/link\` the first time` };
 	const key = mintLinkKey();
-	const secret = `${spec.prefix}_LINK_KEY_SHA256`;
+	const secret = n.digest;
 	const put =
 		spec.putSecret ??
 		((name: string, value: string) => {
@@ -204,7 +225,7 @@ export async function rotateLinkKey(spec: RotateSpec): Promise<{ ok: true; file:
 		});
 	const done = put(secret, await sha256Hex(key));
 	if (!done.ok) return { ok: false, why: `the Worker refused the digest — nothing was changed on this Mac:\n${done.detail}` };
-	writeFileSync(spec.file, linkEnvText(spec.prefix, url, key), { mode: 0o600 });
+	writeFileSync(spec.file, linkEnvText(n, url, key), { mode: 0o600 });
 	chmodSync(spec.file, 0o600);
 	return { ok: true, file: spec.file };
 }