Integrate strict CTO remediation fixes

.claude/rules/07-env-and-urls.md

@@ -85,6 +85,10 @@ The CI quality check (`pnpm quality:wrangler-bindings`) verifies:
 1. No `[env.*]` sections exist in checked-in `wrangler.toml` files
 2. All required binding types are present at the top level
 
+### Required action when adding a Worker var consumed by sync-wrangler-config
+
+If `scripts/deploy/sync-wrangler-config.ts` reads a GitHub Environment variable from `process.env` to generate Worker `[vars]`, add it to the centralized `wrangler_sync_env` mapping in `.github/workflows/deploy-reusable.yml`. Do not add ad hoc per-step sync env blocks. First deploys run the sync script twice (initial sync, then tail-consumer re-sync), and both invocations must receive identical optional Worker env inputs so the second sync cannot silently drop operator overrides or restore script defaults.
+
 ### Why this architecture
 
 Wrangler does NOT inherit bindings (D1, KV, R2, DO, AI, tail_consumers) from top-level into `[env.*]` sections. Previously, this required manually duplicating every binding 3x (top-level + staging + production). Now the sync script generates complete env sections, eliminating duplication and making the config fork-friendly.

.github/workflows/deploy-reusable.yml

@@ -357,6 +357,7 @@ jobs:
           BASE_DOMAIN: ${{ vars.BASE_DOMAIN }}
           RESOURCE_PREFIX: ${{ steps.prefix.outputs.value }}
           REQUIRE_APPROVAL: ${{ vars.REQUIRE_APPROVAL }}
+          SETUP_FORCE: ${{ vars.SETUP_FORCE }}
           HETZNER_BASE_IMAGE: ${{ vars.HETZNER_BASE_IMAGE }}
           PLATFORM_FEEDBACK_PROJECT_ID: ${{ vars.PLATFORM_FEEDBACK_PROJECT_ID }}
           REPORT_ISSUE_TITLE_MAX_LENGTH: ${{ vars.REPORT_ISSUE_TITLE_MAX_LENGTH }}
@@ -373,11 +374,16 @@ jobs:
           DO_MIGRATION_STATE_PROBE_RETRY_DELAY_MS: ${{ vars.DO_MIGRATION_STATE_PROBE_RETRY_DELAY_MS }}
           CF_CONTAINER_ENABLED: ${{ vars.CF_CONTAINER_ENABLED }}
           CF_CONTAINER_SLEEP_AFTER: ${{ vars.CF_CONTAINER_SLEEP_AFTER }}
+          CF_CONTAINER_ACTIVE_WORK_MAX_MS: ${{ vars.CF_CONTAINER_ACTIVE_WORK_MAX_MS }}
+          CF_CONTAINER_KEEPALIVE_RENEW_INTERVAL_MS: ${{ vars.CF_CONTAINER_KEEPALIVE_RENEW_INTERVAL_MS }}
           CF_CONTAINER_PORT_READY_TIMEOUT_MS: ${{ vars.CF_CONTAINER_PORT_READY_TIMEOUT_MS }}
           CF_CONTAINER_WAKE_TIMEOUT_MS: ${{ vars.CF_CONTAINER_WAKE_TIMEOUT_MS }}
+          CF_CONTAINER_RECOVERY_MAX_ATTEMPTS: ${{ vars.CF_CONTAINER_RECOVERY_MAX_ATTEMPTS }}
           CF_CONTAINER_CREATE_WORKSPACE_TIMEOUT_MS: ${{ vars.CF_CONTAINER_CREATE_WORKSPACE_TIMEOUT_MS }}
           CF_CONTAINER_CLONE_FILTER: ${{ vars.CF_CONTAINER_CLONE_FILTER }}
           CF_CONTAINER_VM_AGENT_PORT: ${{ vars.CF_CONTAINER_VM_AGENT_PORT }}
+          SANDBOX_CONTAINER_MAX_INSTANCES: ${{ vars.SANDBOX_CONTAINER_MAX_INSTANCES }}
+          VM_AGENT_CONTAINER_MAX_INSTANCES: ${{ vars.VM_AGENT_CONTAINER_MAX_INSTANCES }}
           SANDBOX_ENABLED: ${{ vars.SANDBOX_ENABLED }}
           MAX_CONCURRENT_SETUP_SESSIONS: ${{ vars.MAX_CONCURRENT_SETUP_SESSIONS }}
           SETUP_SESSION_TTL_MS: ${{ vars.SETUP_SESSION_TTL_MS }}
@@ -447,8 +453,10 @@ jobs:
           elif [ "$HTTP_CODE" -eq 409 ]; then
             echo "workers.dev subdomain already configured (OK)"
           else
-            echo "::warning::Failed to set workers.dev subdomain (HTTP ${HTTP_CODE}): ${BODY}"
-            echo "Cron triggers may not work. Initialize manually: CF Dashboard > Workers & Pages > Settings > Domains & Routes"
+            echo "::error::Failed to set workers.dev subdomain (HTTP ${HTTP_CODE}): ${BODY}"
+            echo "Deployment cannot continue because Cloudflare cron triggers require the workers.dev subdomain prerequisite."
+            echo "Initialize manually: CF Dashboard > Workers & Pages > Settings > Domains & Routes"
+            exit 1
           fi
 
       # Verify Pages custom domain is active (must run BEFORE Worker deploys wildcard routes)
@@ -686,10 +694,42 @@ jobs:
           BASE_DOMAIN: ${{ vars.BASE_DOMAIN }}
           RESOURCE_PREFIX: ${{ steps.prefix.outputs.value }}
           REQUIRE_APPROVAL: ${{ vars.REQUIRE_APPROVAL }}
+          SETUP_FORCE: ${{ vars.SETUP_FORCE }}
           HETZNER_BASE_IMAGE: ${{ vars.HETZNER_BASE_IMAGE }}
+          PLATFORM_FEEDBACK_PROJECT_ID: ${{ vars.PLATFORM_FEEDBACK_PROJECT_ID }}
+          REPORT_ISSUE_TITLE_MAX_LENGTH: ${{ vars.REPORT_ISSUE_TITLE_MAX_LENGTH }}
+          REPORT_ISSUE_DESCRIPTION_MAX_LENGTH: ${{ vars.REPORT_ISSUE_DESCRIPTION_MAX_LENGTH }}
+          REPORT_ISSUE_CONTENT_MAX_LENGTH: ${{ vars.REPORT_ISSUE_CONTENT_MAX_LENGTH }}
+          RATE_LIMIT_REPORT_ISSUE_POST: ${{ vars.RATE_LIMIT_REPORT_ISSUE_POST }}
+          PLATFORM_FEEDBACK_TRIAGE_WINDOW_MINUTES: ${{ vars.PLATFORM_FEEDBACK_TRIAGE_WINDOW_MINUTES }}
+          PLATFORM_FEEDBACK_TRIAGE_ERROR_LIMIT: ${{ vars.PLATFORM_FEEDBACK_TRIAGE_ERROR_LIMIT }}
+          PLATFORM_FEEDBACK_TRIAGE_GROUP_LIMIT: ${{ vars.PLATFORM_FEEDBACK_TRIAGE_GROUP_LIMIT }}
+          PLATFORM_FEEDBACK_TRIAGE_EVIDENCE_LIMIT: ${{ vars.PLATFORM_FEEDBACK_TRIAGE_EVIDENCE_LIMIT }}
+          PLATFORM_FEEDBACK_TRIAGE_CLAIM_TTL_MS: ${{ vars.PLATFORM_FEEDBACK_TRIAGE_CLAIM_TTL_MS }}
           ARTIFACTS_BINDING_ENABLED: ${{ vars.ARTIFACTS_BINDING_ENABLED }}
           DO_MIGRATION_STATE_PROBE_ATTEMPTS: ${{ vars.DO_MIGRATION_STATE_PROBE_ATTEMPTS }}
           DO_MIGRATION_STATE_PROBE_RETRY_DELAY_MS: ${{ vars.DO_MIGRATION_STATE_PROBE_RETRY_DELAY_MS }}
+          CF_CONTAINER_ENABLED: ${{ vars.CF_CONTAINER_ENABLED }}
+          CF_CONTAINER_SLEEP_AFTER: ${{ vars.CF_CONTAINER_SLEEP_AFTER }}
+          CF_CONTAINER_ACTIVE_WORK_MAX_MS: ${{ vars.CF_CONTAINER_ACTIVE_WORK_MAX_MS }}
+          CF_CONTAINER_KEEPALIVE_RENEW_INTERVAL_MS: ${{ vars.CF_CONTAINER_KEEPALIVE_RENEW_INTERVAL_MS }}
+          CF_CONTAINER_PORT_READY_TIMEOUT_MS: ${{ vars.CF_CONTAINER_PORT_READY_TIMEOUT_MS }}
+          CF_CONTAINER_WAKE_TIMEOUT_MS: ${{ vars.CF_CONTAINER_WAKE_TIMEOUT_MS }}
+          CF_CONTAINER_RECOVERY_MAX_ATTEMPTS: ${{ vars.CF_CONTAINER_RECOVERY_MAX_ATTEMPTS }}
+          CF_CONTAINER_CREATE_WORKSPACE_TIMEOUT_MS: ${{ vars.CF_CONTAINER_CREATE_WORKSPACE_TIMEOUT_MS }}
+          CF_CONTAINER_CLONE_FILTER: ${{ vars.CF_CONTAINER_CLONE_FILTER }}
+          CF_CONTAINER_VM_AGENT_PORT: ${{ vars.CF_CONTAINER_VM_AGENT_PORT }}
+          SANDBOX_CONTAINER_MAX_INSTANCES: ${{ vars.SANDBOX_CONTAINER_MAX_INSTANCES }}
+          VM_AGENT_CONTAINER_MAX_INSTANCES: ${{ vars.VM_AGENT_CONTAINER_MAX_INSTANCES }}
+          SANDBOX_ENABLED: ${{ vars.SANDBOX_ENABLED }}
+          MAX_CONCURRENT_SETUP_SESSIONS: ${{ vars.MAX_CONCURRENT_SETUP_SESSIONS }}
+          SETUP_SESSION_TTL_MS: ${{ vars.SETUP_SESSION_TTL_MS }}
+          SETUP_SESSION_CAPTURE_POLL_MS: ${{ vars.SETUP_SESSION_CAPTURE_POLL_MS }}
+          CODEX_DEVICE_AUTH_REQUEST_TIMEOUT_MS: ${{ vars.CODEX_DEVICE_AUTH_REQUEST_TIMEOUT_MS }}
+          SETUP_SESSION_SWEEP_MAX_CANDIDATES: ${{ vars.SETUP_SESSION_SWEEP_MAX_CANDIDATES }}
+          POOL_LEASE_BUFFER_MS: ${{ vars.POOL_LEASE_BUFFER_MS }}
+          SANDBOX_EXEC_TIMEOUT_MS: ${{ vars.SANDBOX_EXEC_TIMEOUT_MS }}
+          SANDBOX_VM_AGENT_PORT: ${{ vars.SANDBOX_VM_AGENT_PORT }}
 
       - name: Re-deploy API Worker (with tail_consumers)
         if: ${{ inputs.dry_run != true && steps.first_deploy.outputs.is_first == 'true' }}

apps/api/src/db/migrations/0105_bootstrap_token_consumes.sql

@@ -0,0 +1,8 @@
+CREATE TABLE IF NOT EXISTS bootstrap_token_consumes (
+  token_hash TEXT PRIMARY KEY NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_bootstrap_token_consumes_expiry ON bootstrap_token_consumes(expires_at);
+CREATE INDEX IF NOT EXISTS idx_bootstrap_token_consumes_consumed ON bootstrap_token_consumes(consumed_at);

apps/api/src/durable-objects/project-data/messages.ts

@@ -346,7 +346,7 @@
   return size;
 }
 
 export function getMessages(
   sql: SqlStorage,
   sessionId: string,
   limit: number = 1000,
@@ -406,10 +406,39 @@
   const trimmedRows = candidateRows.slice(0, safeCount);
 
   const orderedRows = order === 'desc' ? trimmedRows.reverse() : trimmedRows;
+  const messages: Record<string, unknown>[] = [];
+  let skipped = 0;
+
+  for (const row of orderedRows) {
+    try {
+      messages.push(
+        compact ? parseChatMessageRowCompact(row, compactOptions) : parseChatMessageRow(row)
+      );
+    } catch (e) {
+      skipped++;
+      log.warn('messages.list_row_skipped', {
+        rowId: typeof row.id === 'string' ? row.id : null,
+        rowSessionId: typeof row.session_id === 'string' ? row.session_id : null,
+        requestedSessionId: sessionId,
+        compact,
+        error: String(e),
+      });
+    }
+  }
+
+  if (skipped > 0) {
+    log.warn('messages.list_degraded', {
+      sessionId,
+      requestedLimit: limit,
+      fetched: rows.length,
+      returned: messages.length,
+      skipped,
+      compact,
+    });
+  }
+
   return {
-    messages: orderedRows.map((row) =>
-      compact ? parseChatMessageRowCompact(row, compactOptions) : parseChatMessageRow(row)
-    ),
+    messages,
     hasMore,
   };
 }

apps/api/src/durable-objects/task-runner/workspace-steps.ts

@@ -404,15 +404,15 @@ async function createWorkspaceOnVmAgent(
     id: state.projectId,
     repoProvider: projectRepo?.repoProvider ?? 'github',
   });
+  const checkoutBranch = state.config.outputBranch || state.config.branch;
+  const baseBranch =
+    checkoutBranch === state.config.branch ? state.config.defaultBranch : state.config.branch;
 
   const response = await createWorkspaceOnNode(nodeId, rc.env, state.userId, {
     workspaceId,
     repository: state.config.repository,
-    branch: state.config.branch,
-    baseBranch:
-      state.config.branch === state.config.outputBranch
-        ? state.config.defaultBranch
-        : state.config.branch,
+    branch: checkoutBranch,
+    baseBranch,
     defaultBranch: state.config.defaultBranch || 'main',
     repoProvider: gitSource.repoProvider,
     cloneUrl: gitSource.cloneUrl,

apps/api/src/routes/workspaces/runtime.ts

@@ -33,6 +33,7 @@ import {
   MessageBatchSchema,
 } from '../../schemas';
 import { appendBootLog } from '../../services/boot-log';
+import { registerBootstrapTokenConsume } from '../../services/bootstrap';
 import { syncActiveAgentCredentialSecret } from '../../services/composable-credentials/agent-sync';
 import { decrypt, encrypt } from '../../services/encryption';
 import { getInstallationToken, getUserInstallationRepositories } from '../../services/github-app';
@@ -1568,6 +1569,12 @@ runtimeRoutes.post('/:id/bootstrap-token', requireAuth(), requireApproved(), asy
     createdAt: now,
   };
 
+  await registerBootstrapTokenConsume(
+    c.env.DATABASE,
+    bootstrapToken,
+    new Date(Date.now() + 60 * 1000).toISOString()
+  );
+
   await c.env.KV.put(`bootstrap:${bootstrapToken}`, JSON.stringify(data), {
     expirationTtl: 60,
   });