cursedops 0.17.0 → 0.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.17.0",
+	"version": "0.19.0",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/relayStage.ts

@@ -220,13 +220,14 @@ export async function putStageLinkDigest(put: DigestPut): Promise<{ ok: boolean;
 	return { ok: held.converged, stderr: done.stderr, detail: `every answer holds it — ${held.detail}` };
 }
 
-/**
- * Sign the stage owner in through auth-stage's emailed second factor and grant `app`'s stage —
- * `apps/auth-stage/scripts/inbox.ts` `grant <app>`, whose last stdout line is the grant.
- * Never production's accounts service: nothing under test signs in there (`tools/check-prod-auth.ts`).
- */
-export function grantStageOwner(spec: { forge: string; app: string; run?: Run; stderr?: (text: string) => void }): { ok: boolean; grant: string } {
-	const done = (spec.run ?? realRun)(["bun", "run", "scripts/inbox.ts", "grant", spec.app], {
+/** Which stage account a grant signs in as — `inbox.ts`'s `StageAccount`. */
+type StageAccount = "owner" | "member";
+
+type GrantSpec = { forge: string; app: string; run?: Run; stderr?: (text: string) => void };
+
+/** `apps/auth-stage/scripts/inbox.ts` `grant <app> [--member]`, whose last stdout line is the grant. */
+function grantStage(spec: GrantSpec, account: StageAccount): { ok: boolean; grant: string } {
+	const done = (spec.run ?? realRun)(["bun", "run", "scripts/inbox.ts", "grant", spec.app, ...(account === "member" ? ["--member"] : [])], {
 		cwd: join(spec.forge, "apps", "auth-stage"),
 		timeout: 300_000,
 	});
@@ -235,6 +236,23 @@ export function grantStageOwner(spec: { forge: string; app: string; run?: Run; s
 	return { ok: done.status === 0 && grant.length > 100, grant };
 }
 
+/**
+ * Sign the stage owner in through auth-stage's emailed second factor and grant `app`'s stage.
+ * Never production's accounts service: nothing under test signs in there (`tools/check-prod-auth.ts`).
+ */
+export function grantStageOwner(spec: GrantSpec): { ok: boolean; grant: string } {
+	return grantStage(spec, "owner");
+}
+
+/**
+ * The same grant for the stage's seeded household MEMBER — an ordinary account, never the owner —
+ * so a walk can prove on the real edge what an app keeps from everyone but its owner (roms' closed
+ * consoles, forge task 3288). Same door, same rules: never production's accounts service.
+ */
+export function grantStageMember(spec: GrantSpec): { ok: boolean; grant: string } {
+	return grantStage(spec, "member");
+}
+
 export interface RotationSpec {
 	/** Stop the Mac end, resolving once it has exited. */
 	stop: () => Promise<void>;

package/src/smoke.ts

@@ -1030,8 +1030,13 @@ export interface WorkerSmokeSpec {
 	deployment: { env: string; workerName: string; publicUrl: string; previewUrl: string | null };
 	/** Addresses given on the command line. Empty: the preview (no cache in front) and the public URL. */
 	urls?: readonly string[];
-	/** The checkout's HEAD, as `/healthz` reports a commit (`git rev-parse --short=8 HEAD`). */
+	/**
+	 * The checkout's HEAD, as `/healthz` reports a commit (`git rev-parse --short=8 HEAD`). Under
+	 * `runWorkerDeploy` the commit it STAMPED wins — see {@link DEPLOYED_COMMIT_ENV}.
+	 */
 	head: string;
+	/** Where {@link DEPLOYED_COMMIT_ENV} is read. Default `process.env`. */
+	env?: Record<string, string | undefined>;
 	/**
 	 * Every private route; each must refuse an anonymous caller with 401 (`door: "access"`: 403 on
 	 * the preview, 200 through the token on the public host). Empty is a FAILURE.
@@ -1059,6 +1064,25 @@ export interface WorkerSmokeSpec {
 	log?: (line: string) => void;
 }
 
+/**
+ * 🔴 The commit `runWorkerDeploy` stamped into the Worker it just uploaded, handed to its smoke.
+ *
+ * Each app's smoke reads its checkout's HEAD when it starts, minutes after the deploy read it to
+ * stamp the build. On 2026-10-18 music's fast lane built and stamped `a0bca487`, a batch landed an
+ * e2e-only commit two minutes in, and the smoke — asking for the new HEAD `43c2bae8` — waited out
+ * its steady window and then failed a healthy production deploy on `commit`. The smoke proves
+ * what was DEPLOYED, so it asks for this commit when it is set, and for HEAD only when run alone.
+ */
+export const DEPLOYED_COMMIT_ENV = "CURSEDOPS_DEPLOYED_COMMIT";
+
+/** The commit `/healthz` must report, and the words the `commit` check says it in. */
+export function expectedCommit(spec: Pick<WorkerSmokeSpec, "head" | "env">): { commit: string; said: string } {
+	const stamped = (spec.env ?? process.env)[DEPLOYED_COMMIT_ENV]?.trim();
+	if (!stamped) return { commit: spec.head, said: `HEAD ${spec.head}` };
+	const commit = stamped.slice(0, spec.head.length || 8);
+	return { commit, said: commit === spec.head ? `HEAD ${commit}` : `deployed ${commit} (HEAD has moved on to ${spec.head} since)` };
+}
+
 /**
  * The whole anonymous `worker:smoke` of a deployed Worker, lifted out of `apps/family` and
  * `apps/music` (task 2145). Per address: `/healthz` settles on THIS commit with the door mounted
@@ -1078,6 +1102,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 			? [...spec.urls]
 			: [...new Set([deployment.previewUrl, deployment.publicUrl].filter((u): u is string => Boolean(u)))];
 	const smoke = createSmoke({ base: deployment.publicUrl || (urls[0] as string), ...spec.smokeOptions });
+	const want = expectedCommit(spec);
 
 	for (const base of urls) {
 		const host = new URL(base).hostname;
@@ -1104,7 +1129,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 		try {
 			const read = await steadyHealth<Record<string, unknown>>(
 				() => ask("/healthz", healthRead),
-				(body) => body.commit === spec.head && body.apiServed === true,
+				(body) => body.commit === want.commit && body.apiServed === true,
 				spec.steady,
 			);
 			health = read.body;
@@ -1120,7 +1145,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 			health.apiServed === true,
 			`apiServed ${JSON.stringify(health.apiServed)}${health.apiRefusal ? ` (${health.apiRefusal})` : ""}`,
 		);
-		smoke.record(`${tag} commit`, health.commit === spec.head, `serving ${JSON.stringify(health.commit)}, HEAD ${spec.head}`);
+		smoke.record(`${tag} commit`, health.commit === want.commit, `serving ${JSON.stringify(health.commit)}, ${want.said}`);
 		smoke.record(
 			`${tag} publicUrl`,
 			health.publicUrl === deployment.publicUrl,
@@ -1180,6 +1205,7 @@ async function accessDoorSmoke(
 	log: (line: string) => void,
 ): Promise<number> {
 	const { deployment } = spec;
+	const want = expectedCommit(spec);
 	const anonymous = spec.anonymousFetch;
 	if (!anonymous) {
 		smoke.refuseEnvironment("the anonymous fetch", 'door: "access" needs `anonymousFetch` — a fetch that carries NO Access token');
@@ -1199,7 +1225,7 @@ async function accessDoorSmoke(
 		let health: Record<string, unknown>;
 		let status: number;
 		try {
-			const read = await steadyHealth<Record<string, unknown>>(() => ask("/healthz", healthRead), (body) => body.commit === spec.head, spec.steady);
+			const read = await steadyHealth<Record<string, unknown>>(() => ask("/healthz", healthRead), (body) => body.commit === want.commit, spec.steady);
 			health = read.body;
 			status = read.response.status;
 		} catch (error) {
@@ -1208,7 +1234,7 @@ async function accessDoorSmoke(
 			continue;
 		}
 		smoke.record(`${tag} healthz`, status === 200 && health.runtime === "worker", `${status}, runtime ${JSON.stringify(health.runtime)}`);
-		smoke.record(`${tag} commit`, health.commit === spec.head, `serving ${JSON.stringify(health.commit)}, HEAD ${spec.head}`);
+		smoke.record(`${tag} commit`, health.commit === want.commit, `serving ${JSON.stringify(health.commit)}, ${want.said}`);
 		smoke.record(
 			`${tag} access`,
 			health.access === true,

package/src/workerDeploy.ts

@@ -60,6 +60,7 @@ import { join } from "node:path";
 import { liveColumns, liveColumnsQueries, missingColumnStatements, schemaTables } from "cursedops/d1-columns";
 import { wranglerRows } from "cursedops/d1-import";
 import { forgeCodeRoot, forgeState } from "cursedops/roots";
+import { DEPLOYED_COMMIT_ENV } from "cursedops/smoke";
 import { appendLedger, deferral, readShipSetting, type ShipEventLine, type ShipNowWhere, type ShipSetting } from "cursedops/ship";
 import { type StageLeaseResult, takeStageLease } from "cursedops/stage-lease";
 
@@ -977,7 +978,8 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		step(`smoke every address this deployment answers on${spec.cpuTail ? ", under a CPU tail" : ""}`);
 		enter("smoke");
 		const smoke = spec.cpuTail ? underCpuTail(spec.cpuTail, spec.env, spec.smoke) : spec.smoke;
-		const smoked = deps.run(smoke, {});
+		// The commit stamped above, not the HEAD the smoke would read minutes later (`DEPLOYED_COMMIT_ENV`).
+		const smoked = deps.run(smoke, { [DEPLOYED_COMMIT_ENV]: commit });
 		if (spec.cpuTail && smoked === TAIL_UNATTACHED_EXIT) unmeasured.push("the smoke");
 		else if (smoked !== 0) {
 			return stop(