cursedops 0.10.10 → 0.10.12

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.10",
+	"version": "0.10.12",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/relay.ts

@@ -59,6 +59,16 @@ export interface ResponseFrame {
 
 export type LinkFrame = RequestFrame | ResponseFrame;
 
+/**
+ * The link's keepalive, as bare text (never JSON, so neither {@link parseFrame} nor
+ * {@link parseWarmFrame} can mistake one for a frame). The Mac sends {@link LINK_PING}; the
+ * object answers {@link LINK_PONG} through `setWebSocketAutoResponse`, which the runtime does
+ * WITHOUT waking a hibernated object — so the heartbeat bills nothing. `cursedops/relay-link`
+ * has why it exists: a half-open socket after the Mac slept.
+ */
+export const LINK_PING = "ping";
+export const LINK_PONG = "pong";
+
 /**
  * Sent UP by the Mac once, right after it connects (station, task 089): the GETs every page
  * performs, so a {@link RelayLink} with an offline cache can refresh it while the Mac is awake.
@@ -223,6 +233,8 @@ export interface LinkState {
 	acceptWebSocket(socket: LinkSocket, tags?: string[]): void;
 	getWebSockets(tag?: string): LinkSocket[];
 	storage: LinkStorage;
+	/** workerd's — answers {@link LINK_PING} without waking the object. Optional: a test has none. */
+	setWebSocketAutoResponse?(pair: unknown): void;
 }
 
 /** What `/healthz` and a smoke may know about the link. No content — the body is public. */
@@ -349,6 +361,9 @@ export class RelayLink {
 		this.timeoutMs = options.timeoutMs ?? DEFAULT_RELAY_TIMEOUT_MS;
 		this.maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
 		this.now = options.now ?? Date.now;
+		// The heartbeat's answer, given by the runtime while the object sleeps (see LINK_PING).
+		const Pair = (globalThis as { WebSocketRequestResponsePair?: new (request: string, response: string) => unknown }).WebSocketRequestResponsePair;
+		if (Pair && state.setWebSocketAutoResponse) state.setWebSocketAutoResponse(new Pair(LINK_PING, LINK_PONG));
 	}
 
 	async fetch(request: Request): Promise<Response> {
@@ -499,8 +514,16 @@ export class RelayLink {
 		});
 	}
 
-	webSocketMessage(_socket: LinkSocket, message: string | ArrayBuffer): void | Promise<void> {
+	webSocketMessage(socket: LinkSocket, message: string | ArrayBuffer): void | Promise<void> {
 		if (typeof message !== "string") return;
+		// Only reached where the runtime's auto-response is not armed (a test, an old runtime): a
+		// Mac whose pings went unanswered would redial every minute.
+		if (message === LINK_PING) {
+			try {
+				socket.send(LINK_PONG);
+			} catch {}
+			return;
+		}
 		const warm = parseWarmFrame(message);
 		if (warm) return this.warm(warm.paths);
 		const frame = parseFrame(message);

package/src/relayLink.ts

@@ -10,13 +10,26 @@
  * 🔴 **The Mac listens on nothing for the relay.** What reaches the app arrives down a socket this
  * process opened to a hostname it verified over TLS, holding a key only the Worker's digest matches.
  *
- * 🔴 **No timer asks anything** (owner, 2026-09-15: *"There should be no polling"*). The one
- * `setTimeout` is the reconnect after the socket CLOSES — a sleeping Mac's socket dies, and the link
- * is back within seconds of waking, backing off to a minute while the Worker is unreachable.
+ * 🔴 **No timer asks for DATA** (owner, 2026-09-15: *"There should be no polling"*). One timer
+ * exists, and it is a keepalive on the idle socket, not a request for anything: {@link dialLink}'s
+ * heartbeat. It used to say "a sleeping Mac's socket dies, and the link is back within seconds of
+ * waking" — measured FALSE on 2026-09-25. The owner powered the Mac off and on; both `com.roms.link`
+ * and `com.station.link` came back up holding a socket the Worker had long since dropped. No `close`
+ * event ever fired on the Mac for a half-open TCP connection, so nothing redialed, and roms and
+ * station answered "the Mac is not connected" for every API call with the Mac awake, logging
+ * `✓ linked` the whole time. A `ping` every {@link LINK_HEARTBEAT_MS} that the Worker's object
+ * answers `pong` WITHOUT waking (`setWebSocketAutoResponse`, `cursedops/relay`) is what notices, and
+ * a tick that arrives far later than it was scheduled is the Mac having slept — redialed at once.
  */
 import { spawnSync } from "node:child_process";
 import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-import { frameToRequest, parseFrame, type ResponseFrame, responseFrame, sha256Hex, toBase64 } from "cursedops/relay";
+import { frameToRequest, LINK_PING, LINK_PONG, parseFrame, type ResponseFrame, responseFrame, sha256Hex, toBase64 } from "cursedops/relay";
+
+/**
+ * How often an idle link proves the Worker still holds its other end. A dead socket is noticed
+ * within two of these (one ping unanswered), and a slept Mac on its first tick after waking.
+ */
+export const LINK_HEARTBEAT_MS = 30_000;
 import { readEnvFile } from "cursedops/worker-deploy";
 
 export interface LinkSettings {
@@ -129,11 +142,24 @@ export interface DialOptions {
 	/** Sent right after each connect — station's `warm` frame. */
 	onOpen?: (socket: DialSocket) => void;
 	log?: (line: string) => void;
+	/** Default {@link LINK_HEARTBEAT_MS}; 0 turns the heartbeat off (a test of the redial alone). */
+	heartbeatMs?: number;
 	/** Tests only. */
 	openSocket?: (url: string, headers: Record<string, string>) => DialSocket;
 	setTimer?: (fn: () => void, ms: number) => unknown;
+	/** Tests only — a repeating timer; returns its cancel. */
+	every?: (fn: () => void, ms: number) => () => void;
+	/** Tests only — the wall clock the sleep detector reads. */
+	now?: () => number;
 }
 
+const repeat = (fn: () => void, ms: number): (() => void) => {
+	const timer = setInterval(fn, ms);
+	// Never the reason the process stays up — the socket is.
+	(timer as { unref?: () => void }).unref?.();
+	return () => clearInterval(timer);
+};
+
 export interface DialedLink {
 	/** Stop reconnecting and close the socket. */
 	close(): void;
@@ -158,25 +184,75 @@ export function dialLink(options: DialOptions): DialedLink {
 	const log = options.log ?? ((line: string) => console.log(line));
 	const open = options.openSocket ?? bunSocket;
 	const later = options.setTimer ?? ((fn: () => void, ms: number) => setTimeout(fn, ms));
+	const every = options.every ?? repeat;
+	const now = options.now ?? Date.now;
+	const heartbeatMs = options.heartbeatMs ?? LINK_HEARTBEAT_MS;
 	let backoff = 1_000;
 	let stopped = false;
 	let current: DialSocket | null = null;
 	let isOpen = false;
+	let stopHeartbeat: (() => void) | null = null;
 	const connect = () => {
 		if (stopped) return;
 		const socket = open(options.settings.url, { ...(options.headers ?? {}), authorization: `Bearer ${options.settings.key}` });
 		current = socket;
+		/**
+		 * Give up on THIS socket and dial a new one now. 🔴 Never by waiting for its `close`: a
+		 * half-open socket's close handshake waits on a peer that is gone, which is the whole
+		 * failure. Its late events are ignored because it is no longer `current`.
+		 */
+		const abandon = (why: string) => {
+			if (current !== socket) return;
+			stopHeartbeat?.();
+			stopHeartbeat = null;
+			isOpen = false;
+			current = null;
+			log(`[${options.app}-link] ✗ ${why}; redialing now`);
+			try {
+				socket.close(4001, why.slice(0, 120));
+			} catch {}
+			backoff = 1_000;
+			connect();
+		};
+		let awaitingPong = false;
 		socket.addEventListener("open", () => {
+			if (current !== socket) return;
 			backoff = 1_000;
 			isOpen = true;
 			log(`[${options.app}-link] ✓ linked to ${origin} — answering its requests`);
 			options.onOpen?.(socket);
+			if (heartbeatMs > 0) {
+				let lastTick = now();
+				stopHeartbeat = every(() => {
+					const at = now();
+					const late = at - lastTick;
+					lastTick = at;
+					// The timer could not fire because the machine was asleep — whatever the socket
+					// says, the Worker dropped its end long ago (the owner's power cycle, 2026-09-25).
+					if (late > heartbeatMs * 3) return abandon(`no tick for ${Math.round(late / 1000)}s — this Mac slept`);
+					if (awaitingPong) return abandon(`the Worker did not answer a ping within ${heartbeatMs / 1000}s — the socket is half-open`);
+					awaitingPong = true;
+					try {
+						socket.send(LINK_PING);
+					} catch (error) {
+						abandon(`a ping could not be sent (${(error as Error).message})`);
+					}
+				}, heartbeatMs);
+			}
 		});
 		socket.addEventListener("message", async (event) => {
-			const reply = await answerFrame(options.fetch, String(event.data), origin, options.app);
+			if (current !== socket) return;
+			// ANY frame proves the far end is there; a pong carries nothing else.
+			awaitingPong = false;
+			const text = String(event.data);
+			if (text === LINK_PONG) return;
+			const reply = await answerFrame(options.fetch, text, origin, options.app);
 			if (reply) socket.send(JSON.stringify(reply));
 		});
 		socket.addEventListener("close", (event) => {
+			if (current !== socket) return;
+			stopHeartbeat?.();
+			stopHeartbeat = null;
 			isOpen = false;
 			if (stopped) return;
 			log(`[${options.app}-link] link closed (${event.code}${event.reason ? ` ${event.reason}` : ""}); reconnecting in ${backoff / 1000}s`);
@@ -191,6 +267,8 @@ export function dialLink(options: DialOptions): DialedLink {
 	return {
 		close() {
 			stopped = true;
+			stopHeartbeat?.();
+			stopHeartbeat = null;
 			current?.close(1000, "closed by the Mac");
 		},
 		connected: () => isOpen,

package/src/workerDeploy.ts

@@ -193,6 +193,61 @@ export function underCpuTail(wrapper: readonly string[], env: WorkerEnv, command
 	return [...wrapper, "--env", env, "--", ...command];
 }
 
+/** A zone name off a route: its `zone_name`, or the last two labels of a custom domain's host. */
+const routeZones = (routes: unknown): { zones: Set<string>; hosts: Set<string> } => {
+	const zones = new Set<string>();
+	const hosts = new Set<string>();
+	for (const route of Array.isArray(routes) ? routes : []) {
+		const r = (typeof route === "string" ? { pattern: route } : route) as { pattern?: string; zone_name?: string };
+		const host = (r.pattern ?? "").replace(/^https?:\/\//, "").split("/")[0]?.replace(/^\*\.?/, "") ?? "";
+		if (host) hosts.add(host);
+		const zone = r.zone_name ?? host.split(".").slice(-2).join(".");
+		if (zone) zones.add(zone);
+	}
+	return { zones, hosts };
+};
+
+/**
+ * 🔴 Why a Worker must not `fetch` another hostname on its own zone — refused at deploy, for every
+ * Worker app and every relay, because this is the one seam all of them pass through.
+ *
+ * A subrequest from a Worker to a hostname on the SAME zone skips every other Worker's route and
+ * goes straight to the zone's ORIGIN. On `cursedalchemy.com` the origin of `auth.` and
+ * `binary-server.` is a tunnel into the owner's Mac, so the call works while the Mac is on and
+ * dies the moment it is off, with nothing in any suite able to tell. Met twice: auth's JWKS
+ * refresh (task 2150, fixed with an `AUTH` binding), then every server-side byte read — the owner
+ * turned the Mac off on 2026-09-25 and family's tree lost every face, although its bytes rest in
+ * R2. The cure is a service binding, which reaches the Worker itself.
+ *
+ * The rule, over the config wrangler deploys for `env` (a named env inherits none of `vars`,
+ * `routes` or `services`): every `vars` entry named `*_URL` whose https host is a DIFFERENT host on
+ * a zone this Worker is routed on needs a `services` binding named the var's stem or its last
+ * words — `BINARY_SERVER_URL` → `BINARY_SERVER`, `FAMILY_AUTH_URL` → `AUTH`. The Worker's own
+ * hostname is exempt; so is a Worker with no route on the zone (a `workers.dev`-only preview's
+ * subrequests DO run the target's route). Returns the refusal, or `null`.
+ */
+export function sameZoneFetchRefusal(config: Record<string, unknown>, env: WorkerEnv): string | null {
+	const scope = (env === "stage" ? ((config.env as Record<string, Record<string, unknown>> | undefined)?.stage ?? {}) : config) as Record<string, unknown>;
+	const { zones, hosts } = routeZones(scope.routes);
+	if (zones.size === 0) return null;
+	const bindings = (Array.isArray(scope.services) ? scope.services : []).map((s) => String((s as { binding?: string }).binding ?? ""));
+	const missing: string[] = [];
+	for (const [name, value] of Object.entries((scope.vars as Record<string, unknown> | undefined) ?? {})) {
+		if (!name.endsWith("_URL") || typeof value !== "string") continue;
+		const host = /^https:\/\/([^/:]+)/.exec(value)?.[1];
+		if (!host || hosts.has(host)) continue;
+		if (![...zones].some((zone) => host === zone || host.endsWith(`.${zone}`))) continue;
+		const stem = name.slice(0, -"_URL".length);
+		if (bindings.some((b) => b && (stem === b || stem.endsWith(`_${b}`)))) continue;
+		missing.push(`${name} (${host}) → a \`services\` binding named ${stem}`);
+	}
+	if (missing.length === 0) return null;
+	return (
+		`${env} would fetch another hostname on its own zone without a service binding, and a same-zone subrequest skips that hostname's Worker and lands on the zone's origin — the Mac's tunnel, so it fails whenever the Mac is off: ${missing.join("; ")}. ` +
+		"Add the binding to wrangler.jsonc (for THIS env — named envs inherit none) and send the calls through it (`cursedbelt-server/binary-store`'s `fetch` option, or `env.<BINDING>.fetch`)."
+	);
+}
+
 /** A refusal an app adds to the sequence: a sentence saying why not, or `null` to proceed. */
 export type Refusal = () => string | null;
 
@@ -408,6 +463,16 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		const why = refusal();
 		if (why) return stop("refusal", why);
 	}
+	// Built in, never an app's to remember: see `sameZoneFetchRefusal`. A deploy with no readable
+	// config would fail at wrangler anyway, so an unreadable file is not a pass we invent here.
+	let wrangler: Record<string, unknown> | null = null;
+	try {
+		wrangler = readWranglerJsonc((deps.read ?? ((path: string) => readFileSync(path, "utf8")))("wrangler.jsonc"));
+	} catch {}
+	for (const env of spec.env === "production" ? (["stage", "production"] as const) : (["stage"] as const)) {
+		const why = wrangler ? sameZoneFetchRefusal(wrangler, env) : null;
+		if (why) return stop("same-zone", `${why} Nothing was deployed.`);
+	}
 	if (spec.env === "production") {
 		for (const command of spec.stageFirst ?? []) {
 			step(`the stage first — production waits on it: ${command.join(" ")}`);