fix(ci): put COOKIE_SECRET on kody-runtime, not kody-runtime-production

.github/workflows/deploy.yml

@@ -168,7 +168,10 @@ jobs:
             echo "SENTRY_DSN is not configured; skipping jobs worker secret sync."
             exit 0
           fi
-          node tools/ci/sync-worker-secrets.ts --env production --config \
+          # --env "" with --name: wrangler secret bulk still suffixes
+          # -<env> even when --name is set, so --env production would write
+          # to kody-jobs-production while deploy uploads kody-jobs.
+          node tools/ci/sync-worker-secrets.ts --env "" --config \
             "$WRANGLER_CONFIG" --name kody-jobs --set-from-env-optional SENTRY_DSN
 
       - name: ☁️ Deploy jobs worker
@@ -343,6 +346,10 @@ jobs:
       # (Cloudflare REST capabilities). Billing (Stripe), waiting-list (Kit),
       # OAuth client credentials, and maintenance secrets stay main-only so a
       # runtime-Worker compromise cannot reach them.
+      # --env "" with --name: wrangler secret bulk still suffixes -<env>
+      # even when --name is set, so --env production would write
+      # COOKIE_SECRET to kody-runtime-production while deploy uploads
+      # kody-runtime. Preview uses the same empty-env pin.
       - name: 🔐 Sync Cloudflare Secrets to runtime worker (bulk)
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -353,8 +360,8 @@ jobs:
           AI_GATEWAY_ID: ${{ secrets.AI_GATEWAY_ID }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
         run: >
-          node tools/ci/sync-worker-secrets.ts --env production --name
-          kody-runtime --config "$WRANGLER_CONFIG" --set-from-env COOKIE_SECRET
+          node tools/ci/sync-worker-secrets.ts --env "" --name kody-runtime
+          --config "$WRANGLER_CONFIG" --set-from-env COOKIE_SECRET
           --set-from-env-optional SECRET_STORE_KEY --set-from-env-optional
           AI_GATEWAY_ID --set-from-env-optional SENTRY_DSN
           --set-from-env-optional CLOUDFLARE_API_TOKEN

docs/contributing/architecture/authentication.md

@@ -391,14 +391,17 @@ carries the parameter is rewritten without it before package code sees it.
 
 Mint and consume must share `COOKIE_SECRET`. In production the app-origin mint
 (`/@{username}/packages/...`) is forwarded to `kody-runtime`, and the subdomain
-exchange is served by that same script's zone routes. If a leftover main-worker
-route still receives `{username}.kodyapps.dev`, the main Worker must forward it
-too (`isRuntimeWorkerOwnedRequest` matches every package-app host, not only the
-apex). A `COOKIE_SECRET` mismatch, or a missing secret swallowed as "invalid
-token", leaves the visitor on the 403 page with `__kody_handoff` still in the
-URL and no `Set-Cookie`. Missing `COOKIE_SECRET` on consume fails closed with
-500; signature / expiry / path / replay rejects log a reason without the token
-and set `X-Kody-Handoff: rejected`.
+exchange is served by that same script's zone routes. Production CI therefore
+syncs `COOKIE_SECRET` onto the unsuffixed `kody-runtime` script (`--env ""` plus
+`--name`); `wrangler secret bulk --env production --name kody-runtime` still
+writes `kody-runtime-production`, which the runtime deploy does not serve. If a
+leftover main-worker route still receives `{username}.kodyapps.dev`, the main
+Worker must forward it too (`isRuntimeWorkerOwnedRequest` matches every
+package-app host, not only the apex). A `COOKIE_SECRET` mismatch, or a missing
+secret swallowed as "invalid token", leaves the visitor on the 403 page with
+`__kody_handoff` still in the URL and no `Set-Cookie`. Missing `COOKIE_SECRET`
+on consume fails closed with 500; signature / expiry / path / replay rejects log
+a reason without the token and set `X-Kody-Handoff: rejected`.
 
 **Package-app session cookie**
 (`packages/worker/src/app/package-app-session.ts`). Exchanging a valid token on

docs/contributing/architecture/runtime-worker-migration-runbook.md

@@ -141,11 +141,15 @@ node tools/ci/runtime-worker-config.ts generate \
   --out-config packages/runtime-worker/wrangler-production.generated.json
 
 # Sync secrets to both workers (full secret set to main; runtime-lane
-# allowlist to kody-runtime — see deploy.yml for the current lists):
+# allowlist to kody-runtime — see deploy.yml for the current lists).
+# Runtime uses --env "" --name so wrangler does not write
+# kody-runtime-production (secret bulk still suffixes -<env> even with
+# --name; deploy uses --name to override).
 node tools/ci/sync-worker-secrets.ts --env production \
   --config packages/worker/wrangler-production.generated.json \
   --set-from-env COOKIE_SECRET ... # copy the main-worker flag list from deploy.yml
-node tools/ci/sync-worker-secrets.ts --env production \
+node tools/ci/sync-worker-secrets.ts --env "" \
+  --name kody-runtime \
   --config packages/runtime-worker/wrangler-production.generated.json \
   --set-from-env COOKIE_SECRET \
   --set-from-env-optional SECRET_STORE_KEY \

tools/ci/runtime-worker-config.node.test.ts

@@ -143,6 +143,7 @@ test('generate rewrites worker names, copies resource ids, and writes a bootstra
 			name?: string
 			env?: {
 				preview?: {
+					name?: string
 					durable_objects?: { bindings?: Array<Record<string, unknown>> }
 					d1_databases?: Array<Record<string, unknown>>
 					queues?: { producers?: Array<Record<string, unknown>> }
@@ -154,6 +155,7 @@ test('generate rewrites worker names, copies resource ids, and writes a bootstra
 		}>(await readFile(outConfigPath, 'utf8'))
 
 		expect(runtimeConfig.name).toBe('kody-pr-7-runtime')
+		expect(runtimeConfig.env?.preview?.name).toBe('kody-pr-7-runtime')
 		const previewEnv = runtimeConfig.env?.preview
 		// Cross-script references point at the resolved main worker name.
 		const userMeter = previewEnv?.durable_objects?.bindings?.find(
@@ -246,6 +248,7 @@ test('generate publishes the package-app custom domain for production', async ()
 		const runtimeConfig = parseJsonc<{
 			env?: {
 				production?: {
+					name?: string
 					routes?: Array<{
 						pattern: string
 						custom_domain?: boolean
@@ -265,6 +268,7 @@ test('generate publishes the package-app custom domain for production', async ()
 			{ pattern: 'kodyapps.dev/*', zone_name: 'kodyapps.dev' },
 			{ pattern: '*.kodyapps.dev/*', zone_name: 'kodyapps.dev' },
 		])
+		expect(runtimeConfig.env?.production?.name).toBe('kody-runtime')
 		expect(runtimeConfig.env?.production?.workers_dev).toBe(true)
 		// The storage transfer migration survives generation untouched.
 		expect(runtimeConfig.migrations?.[0]?.tag).toBe('v1')

tools/ci/runtime-worker-config.ts

@@ -367,6 +367,10 @@ export async function generate(options: CliOptions) {
 	)
 
 	runtimeConfig.name = options.runtimeWorkerName
+	// Pin the selected env's name too. Wrangler otherwise deploys and
+	// secret-bulks `--env production` as `<name>-production`, which would not
+	// match the main worker's cross-script bindings (`kody-runtime`).
+	runtimeEnv.name = options.runtimeWorkerName
 	delete runtimeConfig.$schema
 	copyResourceIdentifiers({
 		runtimeEnv,

tools/ci/sync-worker-secrets.node.test.ts

@@ -1,5 +1,9 @@
-import { expect, test } from 'vitest'
-import { buildSpawnEnv } from './sync-worker-secrets'
+import { expect, test, vi } from 'vitest'
+import { consoleError } from '#worker/test-support/console-spies.ts'
+import {
+	buildSpawnEnv,
+	buildWranglerSecretBulkFlags,
+} from './sync-worker-secrets'
 
 const baseOptions = {
 	env: undefined,
@@ -43,3 +47,69 @@ test('buildSpawnEnv preserves optional vars only when they have values', () => {
 		'https://examplePublicKey@o0.ingest.sentry.io/0',
 	)
 })
+
+test('secret bulk omits empty --env so --name pins the unsuffixed script', () => {
+	const secretsFile = '/tmp/wrangler-secrets.env'
+	expect(
+		buildWranglerSecretBulkFlags(
+			{
+				...baseOptions,
+				env: '',
+				name: 'kody-runtime',
+				config: 'packages/runtime-worker/wrangler-production.generated.json',
+			},
+			secretsFile,
+		),
+	).toEqual([
+		'secret',
+		'bulk',
+		secretsFile,
+		'--name',
+		'kody-runtime',
+		'--config',
+		'packages/runtime-worker/wrangler-production.generated.json',
+	])
+
+	expect(
+		buildWranglerSecretBulkFlags(
+			{
+				...baseOptions,
+				env: 'production',
+				config: 'packages/worker/wrangler-production.generated.json',
+			},
+			secretsFile,
+		),
+	).toEqual([
+		'secret',
+		'bulk',
+		secretsFile,
+		'--env',
+		'production',
+		'--config',
+		'packages/worker/wrangler-production.generated.json',
+	])
+})
+
+test('secret bulk rejects --env with --name so it cannot target name-env', () => {
+	const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {
+		throw new Error('process.exit called')
+	}) as never)
+	consoleError.mockImplementation(() => {})
+	try {
+		expect(() =>
+			buildWranglerSecretBulkFlags(
+				{
+					...baseOptions,
+					env: 'production',
+					name: 'kody-runtime',
+				},
+				'/tmp/wrangler-secrets.env',
+			),
+		).toThrow('process.exit called')
+		expect(consoleError).toHaveBeenCalledWith(
+			expect.stringContaining('kody-runtime-production'),
+		)
+	} finally {
+		exitSpy.mockRestore()
+	}
+})

tools/ci/sync-worker-secrets.ts

@@ -230,28 +230,48 @@ function toDotenv(secrets: ReadonlyMap<string, string>) {
 	return `${lines.join('\n')}\n`
 }
 
+/**
+ * `wrangler secret bulk --env <env> --name <script>` still targets
+ * `<script>-<env>` (unlike `wrangler deploy --name`, which overrides the
+ * suffix). Callers that pin a script with `--name` must omit `--env`.
+ */
+export function buildWranglerSecretBulkFlags(
+	options: CliOptions,
+	secretsFilePath: string,
+): Array<string> {
+	if (options.name && options.env && options.env.length > 0) {
+		fail(
+			`wrangler secret bulk appends -<env> even when --name is set, so "${options.name}" with --env ${options.env} would target "${options.name}-${options.env}". Pass --env "" with --name to pin the unsuffixed script.`,
+		)
+	}
+	const args = ['secret', 'bulk', secretsFilePath]
+	if (options.env !== undefined && options.env.length > 0) {
+		args.push('--env', options.env)
+	}
+	if (options.name) {
+		args.push('--name', options.name)
+	}
+	if (options.config) {
+		args.push('--config', options.config)
+	}
+	return args
+}
+
 async function runWranglerSecretBulk(options: CliOptions, dotenvText: string) {
 	const wranglerBin = resolveLocalBinary('wrangler')
-	const args = [wranglerBin, 'secret', 'bulk']
 	const spawnEnv = buildSpawnEnv(options)
 	const secretsFilePath = join(
 		tmpdir(),
 		`wrangler-secrets-${Date.now()}-${randomBytes(6).toString('hex')}.env`,
 	)
+	const args = [
+		wranglerBin,
+		...buildWranglerSecretBulkFlags(options, secretsFilePath),
+	]
 	await writeFile(secretsFilePath, dotenvText, {
 		encoding: 'utf8',
 		mode: 0o600,
 	})
-	args.push(secretsFilePath)
-	if (options.env !== undefined) {
-		args.push('--env', options.env)
-	}
-	if (options.name) {
-		args.push('--name', options.name)
-	}
-	if (options.config) {
-		args.push('--config', options.config)
-	}
 
 	try {
 		const [command, ...commandArgs] = args