cursedops 0.10.23 → 0.10.25

package/README.md

@@ -12,7 +12,7 @@ bun add cursedops
 | `cursedops/paths` | the generation's whole-tree laws (`check-paths`, `check-doc-citations`, plus any `--also`) run over ONE repo, from a checkout or a worktree — and its `forge-paths` bin (0.5.0) |
 | `cursedops/launchd` | installing, replacing and removing a macOS launchd user agent, and the port a LIVE job serves on (`livePort`, 0.5.0) |
 | `cursedops/smoke` | the scaffolding of a deployed smoke — the ledger, the fetch, the DNS hint, the exit code — the one check no app owns (every address of a deployment serving the same built client), and since 0.5.0 its VERDICTS: the origin asked on loopback, the smoke's own environment, a network that lies about DNS, and a version that has settled |
-| `cursedops/worker-deploy` | the sequence that ships a Cloudflare Worker — clean tree, stage first, schema, `--var` stamp, secrets, smoke — and the readers it needs (0.5.0); `readWranglerFile(root)` since 0.9.0, lifted from four apps' `readWrangler` (task 2153) |
+| `cursedops/worker-deploy` | the sequence that ships a Cloudflare Worker — clean tree, stage first, schema, `--var` stamp, secrets, smoke — and the readers it needs (0.5.0); `readWranglerFile(root)` since 0.9.0, lifted from four apps' `readWrangler` (task 2153); since 0.10.25 every run, red or green, appends a `kind: "deploy"` line with each leg's wall clock (`install`, `stage`, `walk`, `build`, `schema`, `upload`, `secrets`, `smoke`) to the generation's ledger (task 2246) |
 | `cursedops/worker-deploy` (CPU) | a `wrangler tail` around the traffic a deploy already sends, each request's BILLED CPU charged to its declared route, red on an undeclared, over-budget or uncapped route — and `runWorkerDeploy`'s `stageWalk` + `cpuTail` that wrap the walk and the smoke in it (0.7.0, task 2134, lifted from collections) |
 | `cursedops/worker-secrets` | a Worker holding EXACTLY its deployment's secrets, uploaded over a pipe, read back (0.5.0) |
 | `cursedops/worker-rollback` | a hostname back on its Mac origin: origin first, route second, the route found rather than typed (0.5.0) |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.23",
+	"version": "0.10.25",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/workerDeploy.ts

@@ -53,8 +53,9 @@
  * refusal without wrangler, git or a network.
  */
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { forgeState } from "cursedops/roots";
 
 /** The two deployments every Worker app here has. */
 export type WorkerEnv = "production" | "stage";
@@ -305,6 +306,58 @@ export interface DeployDeps {
 	read?: (path: string) => string;
 	log?: (line: string) => void;
 	error?: (line: string) => void;
+	/** The clock the legs are timed on. Default `Date.now`. */
+	now?: () => number;
+	/**
+	 * Where the run's {@link DeployEventLine} goes, on EVERY exit — refused, red or green.
+	 * {@link workerDeployDeps} appends it to the generation's ledger; absent, nothing is recorded.
+	 * A throw here is swallowed: a ledger that can fail a deploy is worse than none.
+	 */
+	record?: (line: DeployEventLine) => void;
+}
+
+/**
+ * One line per deploy into the generation's ledger (`$FORGE_STATE/state/autopilot/events.jsonl`,
+ * the file `autopilot timings` reads), with the wall clock of every LEG.
+ *
+ * 🔴 Why here: until 0.10.25 the whole ledger held 3 `deploy` events, all backfilled by hand, while
+ * `autopilot phases` measured deploys at ~110 agent-minutes a day (2026-09-24 → 28) — the slowest
+ * thing a task did once gates stopped re-proving unchanged bytes. Every app's `worker:deploy`,
+ * stage and production, passes through {@link runWorkerDeploy}, so this is the one seam that sees
+ * all of them. A production deploy runs its stage deploy as a child, which records its OWN line
+ * (`env: "stage"`) — so the `stage` leg here and that line's legs together say where it went.
+ */
+export interface DeployEventLine {
+	at: string;
+	kind: "deploy";
+	what: "cursedops/worker-deploy";
+	repo: string;
+	env: WorkerEnv;
+	ms: number;
+	ok: boolean;
+	/** The step it stopped at, or `done` / `cpu-unmeasured` — {@link DeployResult.step}. */
+	outcome: string;
+	commit: string;
+	dirty: boolean;
+	/**
+	 * Milliseconds per leg, in the order they ran: `prepare` (git and the refusals), `install`,
+	 * `stage` (the stage deploy a production deploy runs first), `walk`, `build`, `schema`,
+	 * `upload` (`wrangler deploy`), `secrets`, `smoke`. A leg that did not run is absent.
+	 */
+	legs: Record<string, number>;
+}
+
+/** Append one line to the ledger under a state root. Never throws; `false` when it did not write. */
+export function recordDeployEvent(state: string | null, line: DeployEventLine): boolean {
+	if (!state) return false;
+	try {
+		const file = join(state, "state", "autopilot", "events.jsonl");
+		mkdirSync(dirname(file), { recursive: true });
+		appendFileSync(file, `${JSON.stringify(line)}\n`);
+		return true;
+	} catch {
+		return false;
+	}
 }
 
 export interface DeployResult {
@@ -344,6 +397,9 @@ export function workerDeployDeps(cwd: string): DeployDeps {
 		},
 		git: (args) => (spawnSync("git", [...args], { cwd, encoding: "utf8" }).stdout ?? "").trim(),
 		read: (path) => readFileSync(join(cwd, path), "utf8"),
+		record: (line) => {
+			recordDeployEvent(forgeState(cwd), line);
+		},
 	};
 }
 
@@ -498,13 +554,46 @@ export const INSTALL: readonly string[] = ["bun", "install", "--frozen-lockfile"
 export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): DeployResult {
 	const log = deps.log ?? ((line: string) => console.log(line));
 	const error = deps.error ?? ((line: string) => console.error(line));
+	const now = deps.now ?? Date.now;
+	const started = now();
+	const legs: Record<string, number> = {};
+	let leg = "prepare";
+	let legFrom = started;
+	/** Close the leg in flight and open `next` — see {@link DeployEventLine.legs}. */
+	const enter = (next: string): void => {
+		const at = now();
+		legs[leg] = (legs[leg] ?? 0) + (at - legFrom);
+		leg = next;
+		legFrom = at;
+	};
 	const tag = `[${spec.app}]`;
 	const commit = deps.git(["rev-parse", "HEAD"]);
 	const porcelain = deps.git(["status", "--porcelain"]);
 	const dirty = porcelain.length > 0;
+	const finish = (result: DeployResult): DeployResult => {
+		enter("");
+		try {
+			deps.record?.({
+				at: new Date(started).toISOString(),
+				kind: "deploy",
+				what: "cursedops/worker-deploy",
+				repo: spec.app,
+				env: spec.env,
+				ms: now() - started,
+				ok: result.code !== 1,
+				outcome: result.step,
+				commit: commit.slice(0, 8),
+				dirty,
+				legs,
+			});
+		} catch {
+			// never the deploy's verdict — see DeployDeps.record
+		}
+		return result;
+	};
 	const stop = (step: string, detail: string): DeployResult => {
 		error(`\n🔴 ${tag} ${detail}`);
-		return { code: 1, step, detail, commit, dirty };
+		return finish({ code: 1, step, detail, commit, dirty });
 	};
 	const step = (message: string): void => log(`\n▸ ${message}`);
 	/** What passed under a CPU tail that never attached — decision 6 of the CPU check. */
@@ -538,17 +627,20 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	 * no-op when they already agree, and refuses, rather than rewriting the lock, when they cannot.
 	 */
 	step("make node_modules match bun.lock");
+	enter("install");
 	if (deps.run(INSTALL, {}) !== 0) {
 		return stop("install", `\`${INSTALL.join(" ")}\` failed — node_modules cannot be made to match bun.lock, so nothing was built or deployed.`);
 	}
 	if (spec.env === "production") {
 		for (const command of spec.stageFirst ?? []) {
 			step(`the stage first — production waits on it: ${command.join(" ")}`);
+			enter("stage");
 			if (deps.run(command, {}) !== 0) return stop("stage", `\`${command.join(" ")}\` failed — production was NOT touched.`);
 		}
 		for (const walk of spec.stageWalk ?? []) {
 			const command = spec.cpuTail ? underCpuTail(spec.cpuTail, "stage", walk) : [...walk];
 			step(`walk the stage signed in${spec.cpuTail ? ", under a CPU tail" : ""}: ${command.join(" ")}`);
+			enter("walk");
 			const walked = deps.run(command, {});
 			if (spec.cpuTail && walked === TAIL_UNATTACHED_EXIT) unmeasured.push("the stage walk");
 			else if (walked !== 0) return stop("stage", `\`${command.join(" ")}\` failed — production was NOT touched.`);
@@ -556,8 +648,10 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	}
 	if (spec.build) {
 		step("build");
+		enter("build");
 		if (deps.run(spec.build, {}) !== 0) return stop("build", "the build failed — nothing was deployed.");
 	}
+	enter("prepare");
 	for (const refusal of spec.beforeShip ?? []) {
 		const why = refusal();
 		if (why) return stop("refusal", `${why} — nothing was deployed.`);
@@ -566,6 +660,7 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	if (spec.databaseName) {
 		const schema = spec.schemaFile ?? "db/schema.sql";
 		step(`apply ${schema} to D1 \`${spec.databaseName}\``);
+		enter("schema");
 		let commands: string[];
 		try {
 			commands = schemaCommands((deps.read ?? ((path: string) => readFileSync(path, "utf8")))(schema));
@@ -592,15 +687,18 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 	const stamp = spec.stampVars
 		? ["--var", `${spec.stampVars.commit}:${commit}`, "--var", `${spec.stampVars.dirty}:${dirty ? "true" : "false"}`]
 		: [];
+	enter("upload");
 	if (deps.run(["bunx", "wrangler", "deploy", ...envArgs, ...stamp], spec.credential) !== 0) return stop("deploy", "wrangler deploy failed.");
 	if (spec.secrets) {
 		step("attach the secrets — exactly this deployment's set, over a pipe");
+		enter("secrets");
 		if (deps.run(spec.secrets, spec.credential) !== 0) {
 			return stop("secrets", "the Worker is deployed and its secrets are NOT attached — it serves nothing until they are.");
 		}
 	}
 	if (spec.smoke) {
 		step(`smoke every address this deployment answers on${spec.cpuTail ? ", under a CPU tail" : ""}`);
+		enter("smoke");
 		const smoke = spec.cpuTail ? underCpuTail(spec.cpuTail, spec.env, spec.smoke) : spec.smoke;
 		const smoked = deps.run(smoke, {});
 		if (spec.cpuTail && smoked === TAIL_UNATTACHED_EXIT) unmeasured.push("the smoke");
@@ -617,10 +715,10 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 			`${detail} Worker CPU UNMEASURED — the tail never attached around ${unmeasured.join(" and ")}, which PASSED. ` +
 			"Nothing is wrong with the deployment and nothing needs rolling back; rerun the smoke under the app's CPU wrapper to measure it.";
 		error(`\n🟡 ${tag} ${why}`);
-		return { code: TAIL_UNATTACHED_EXIT, step: "cpu-unmeasured", detail: why, commit, dirty };
+		return finish({ code: TAIL_UNATTACHED_EXIT, step: "cpu-unmeasured", detail: why, commit, dirty });
 	}
 	log(`\n✅ ${detail}`);
-	return { code: 0, step: "done", detail, commit, dirty };
+	return finish({ code: 0, step: "done", detail, commit, dirty });
 }
 
 /**

package/src/workerSecrets.ts

@@ -89,19 +89,40 @@ export interface SecretSync {
 	after: string[];
 }
 
+/** Tries per put. A put is idempotent, so a retry can only turn a network blip into a success. */
+export const SECRET_PUT_ATTEMPTS = 3;
+
 /**
  * Apply `plan`: put every value, delete every extra, then READ THE ACCOUNT BACK and fail unless it
  * holds exactly the set. Refuses without touching anything when the plan has `absent` keys.
+ *
+ * 🔴 **A failed put is tried again, up to {@link SECRET_PUT_ATTEMPTS} times.** On 2026-09-28 one
+ * `wrangler secret put` of three hit `fetch failed` and the whole deploy stopped with
+ * collections-stage holding a Worker and no secrets — serving nothing — for a blip the next
+ * attempt would have cleared. The read-back is still the verdict.
  */
-export async function syncSecrets(plan: SecretPlan, ops: SecretOps): Promise<SecretSync> {
+export async function syncSecrets(
+	plan: SecretPlan,
+	ops: SecretOps,
+	options: { attempts?: number; pause?: (ms: number) => Promise<void> } = {},
+): Promise<SecretSync> {
+	const attempts = Math.max(1, options.attempts ?? SECRET_PUT_ATTEMPTS);
+	const pause = options.pause ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
 	const lines: string[] = [];
 	if (plan.absent.length > 0) {
 		return { ok: false, lines: [`the secrets file has no ${plan.absent.join(" and no ")} — nothing was changed`], after: await ops.held() };
 	}
 	let bad = 0;
 	for (const { name, from, value } of plan.put) {
-		const ok = await ops.put(name, value);
-		lines.push(`put ${name}${from === name ? "" : ` (from ${from})`} (${value.length} bytes) — ${ok ? "ok" : "FAILED"}`);
+		let ok = false;
+		let tries = 0;
+		while (!ok && tries < attempts) {
+			if (tries > 0) await pause(2_000 * tries);
+			ok = await ops.put(name, value);
+			tries++;
+		}
+		const retried = tries > 1 ? ` after ${tries} attempts` : "";
+		lines.push(`put ${name}${from === name ? "" : ` (from ${from})`} (${value.length} bytes) — ${ok ? "ok" : "FAILED"}${retried}`);
 		if (!ok) bad++;
 	}
 	for (const name of plan.remove) {