cursedops 0.10.3 → 0.10.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.3",
+	"version": "0.10.5",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/edgeFetch.ts

@@ -119,7 +119,7 @@ export function parseCurlResponse(raw: Buffer, origin = "the edge", exit: number
 	return new Response(status === 204 || status === 304 ? null : new Uint8Array(body), { status: status || 599, headers });
 }
 
-/** A `fetch`-shaped function over curl — see the header. Each host is resolved once per instance. */
+/** A `fetch`-shaped function over curl — see the header. Each host is resolved once per instance — once it has an answer. */
 export function createEdgeFetch(options: EdgeFetchOptions = {}): (url: string, init?: RequestInit) => Promise<Response> {
 	const pinned = new Map<string, string>();
 	const resolve = options.resolve === undefined ? digCloudflare : options.resolve;
@@ -130,12 +130,29 @@ export function createEdgeFetch(options: EdgeFetchOptions = {}): (url: string, i
 			return { status: out.status, stdout: out.stdout ?? Buffer.alloc(0) };
 		});
 	let sequence = 0;
+	/**
+	 * The host's pinned address, asked for until there IS one. 🔴 An empty answer is never cached:
+	 * measured 2026-09-24 on roms' first stage deploy, the smoke asked `1.1.1.1` for a custom domain
+	 * seconds after wrangler created it, got nothing, and pinned that NOTHING for the life of the
+	 * process — so every request (the retries included) fell through to this Mac's resolver, which
+	 * had just cached the NXDOMAIN for the zone's 1800 s negative TTL. A green Worker, a red smoke.
+	 */
+	const pinFor = (host: string): string => {
+		if (!resolve) return "";
+		const known = pinned.get(host);
+		if (known) return known;
+		const ip = resolve(host) ?? "";
+		if (ip) pinned.set(host, ip);
+		return ip;
+	};
 	return async (url, init = {}) => {
 		const target = new URL(url);
-		if (resolve && !pinned.has(target.hostname)) pinned.set(target.hostname, resolve(target.hostname) ?? "");
-		const ip = pinned.get(target.hostname);
 		const port = target.port || (target.protocol === "http:" ? "80" : "443");
-		const args = ["-s", "-i", "--max-time", String(options.maxTimeSec ?? 60), ...(ip ? ["--resolve", `${target.hostname}:${port}:${ip}`] : [])];
+		const head = () => {
+			const ip = pinFor(target.hostname);
+			return ["-s", "-i", "--max-time", String(options.maxTimeSec ?? 60), ...(ip ? ["--resolve", `${target.hostname}:${port}:${ip}`] : [])];
+		};
+		const args: string[] = [];
 		for (const [k, v] of Object.entries(options.headersFor?.(target.hostname) ?? {})) args.push("-H", `${k}: ${v}`);
 		new Headers(init.headers).forEach((v, k) => {
 			args.push("-H", `${k}: ${v}`);
@@ -152,10 +169,11 @@ export function createEdgeFetch(options: EdgeFetchOptions = {}): (url: string, i
 			args.push("--data-binary", `@${bodyFile}`);
 		}
 		try {
-			let out = curl([...args, target.toString()]);
+			let out = curl([...head(), ...args, target.toString()]);
 			for (let retry = 1; retry <= EDGE_RETRIES && retryableCurlFailure(out.status, out.stdout, init.method); retry++) {
 				await new Promise((r) => setTimeout(r, options.retryDelayMs?.(retry) ?? 500 * retry));
-				out = curl([...args, target.toString()]);
+				// `head()` again: a host with no pin yet is asked again, so a retry can find the address.
+				out = curl([...head(), ...args, target.toString()]);
 			}
 			return parseCurlResponse(out.stdout, target.origin, out.status);
 		} finally {

package/src/relayLink.ts

@@ -74,6 +74,24 @@ export function linkAccessHeaders(env: Record<string, string | undefined>): Reco
 	return id && secret ? { "CF-Access-Client-Id": id, "CF-Access-Client-Secret": secret } : {};
 }
 
+/**
+ * Why a link would dial into Access's login page instead of the Worker, or null.
+ *
+ * 🔴 Measured at station's cutover (task 2156, 2026-09-24): `station.cursedalchemy.com` is behind the
+ * owner's Access application, so a link pointed at it was refused its handshake (1002, "Expected 101")
+ * on every try — a reconnect loop with no other error while the browser half answered 503. The
+ * preview (`*.workers.dev`) is the same Worker and the same Durable Object with no Access in front —
+ * `/link`'s own guard is the bearer key. Any other host needs the Access token in the handshake
+ * headers ({@link linkAccessHeaders}). {@link dialLink} asks this before its first connect.
+ */
+export function linkUrlRefusal(url: string, headers: Record<string, string> = {}): string | null {
+	const host = new URL(url.replace(/^ws/, "http")).hostname;
+	if (host.endsWith(".workers.dev") || host === "127.0.0.1" || host === "localhost") return null;
+	const has = (name: string) => Object.keys(headers).some((k) => k.toLowerCase() === name && headers[k]?.trim());
+	if (has("cf-access-client-id") && has("cf-access-client-secret")) return null;
+	return `${host} is behind Cloudflare Access and this link carries no Access token — dial the preview (wss://<name>.<subdomain>.workers.dev/link), the same Worker without Access, or set CF_ACCESS_CLIENT_ID/CF_ACCESS_CLIENT_SECRET`;
+}
+
 /** Answer one frame with `fetch`, never throwing: a crash in a route is a 500 on the wire. */
 export async function answerFrame(
 	fetch: (request: Request) => Response | Promise<Response>,
@@ -127,8 +145,15 @@ const bunSocket = (url: string, headers: Record<string, string>): DialSocket =>
 	// Bun's WebSocket takes `{ headers }` as its second argument; the DOM typing says protocols.
 	new WebSocket(url, { headers } as unknown as string[]) as unknown as DialSocket;
 
-/** Dial, answer, and redial on close with a 1 s → 60 s backoff. See the header. */
+/**
+ * Dial, answer, and redial on close with a 1 s → 60 s backoff. See the header.
+ *
+ * THROWS before the first connect when {@link linkUrlRefusal} refuses the URL: a link that can never
+ * be let through Access must fail loudly at start, not retry 1002 forever.
+ */
 export function dialLink(options: DialOptions): DialedLink {
+	const refused = linkUrlRefusal(options.settings.url, options.headers);
+	if (refused) throw new Error(`[${options.app}-link] ✗ ${refused}`);
 	const origin = options.origin ?? publicOriginOf(options.settings.url);
 	const log = options.log ?? ((line: string) => console.log(line));
 	const open = options.openSocket ?? bunSocket;