fix: address repository audit findings

[kitlangton]

What

Fixes concrete correctness, security, deployment, and capture issues found by a repository-wide review of Drive and the catalog.

Before / After

Before: malformed service state could pass a negative PID to process.kill, an idle control client could block shutdown, the catalog dev server could read files outside public/ through double-encoded traversal, sibling /lab/catalogue URLs were claimed by the Worker, parallel capture workers lost revision-qualified IDs, flow previews printed deleted paths, and the Cloudflare token was present while build scripts ran.

After: process IDs are constrained to safe positive integers, idle sockets are closed without interrupting active stop requests, public file resolution is root-confined, Worker routes are exact, capture workers preserve planned IDs and sequential preview semantics, HEAD captures use detached commits, failed frame fetches can retry, and only the Wrangler step receives the deployment token.

How

• packages/drive: validates service PIDs and tracks idle control sockets, with regression tests.
• apps/catalog: adds path-safe public asset resolution, exact Worker routing, retryable frame caching, deterministic parallel capture IDs, durable flow preview behavior, and committed-only HEAD capture preparation.
• .github/workflows: separates build and deploy credential scopes while retaining post-deploy verification.
• OG generation consumes the canonical persisted frame type and CI avoids duplicate catalog generation.

Scope

Larger architectural findings such as artifact leases, atomic visible-instance registration, transactional capture publication, and renderer consolidation are intentionally excluded from this focused fix set.

Testing

• bun run check
• bun run test
• bun run build && bunx wrangler deploy --dry-run in apps/catalog
• gitleaks protect --redact --no-banner
• 220 Effect/Vitest tests, 58 CLI integration tests, and 40 catalog tests pass

Flow

sequenceDiagram
  participant GitHub as GitHub Actions
  participant Build as Catalog build
  participant Wrangler as Wrangler deploy
  participant Cloudflare as Cloudflare
  GitHub->>Build: Build without deployment secret
  Build-->>GitHub: Production assets
  GitHub->>Wrangler: Inject dedicated token
  Wrangler->>Cloudflare: Deploy exact catalog routes
  GitHub->>Cloudflare: Verify live catalog

Loading