fix(tw): 🐛 wire CUSTOMER_JWT_SECRET + async-track queue into worker sandboxes

Author: SirTenzin

scripts/tw/commands/refreshWarm.ts

@@ -18,6 +18,7 @@ import {
 	REDIS_URL,
 	SERVER_PORT,
 	SQS_QUEUE_URL_V2,
+	TRACK_ASYNC_SQS_QUEUE_URL,
 	TRACK_SQS_QUEUE_URL,
 	WARM_SANDBOX_PREFIX,
 } from "../constants.ts";
@@ -122,6 +123,7 @@ const buildWarmEnv = (): Record<string, string> => ({
 	CACHE_V2_DRAGONFLY_URL: REDIS_URL,
 	SQS_QUEUE_URL_V2,
 	TRACK_SQS_QUEUE_URL,
+	TRACK_ASYNC_SQS_QUEUE_URL,
 	AUTUMN_DB_DIRECT: "1",
 	TW_WORKER_MODE: "1",
 	TW_SKIP_STRIPE_ACCOUNT: "1",

scripts/tw/commands/run.ts

@@ -48,7 +48,9 @@ import {
 	REGISTRY_DIR,
 	SERVER_PORT,
 	SQS_QUEUE_URL_V2,
+	TRACK_ASYNC_SQS_QUEUE_URL,
 	TRACK_SQS_QUEUE_URL,
+	TW_CUSTOMER_JWT_SECRET,
 	TW_ENV,
 	WARM_SANDBOX_PREFIX,
 	WORKER_VCPUS,
@@ -642,6 +644,8 @@ const buildWorkerEnv = ({
 		CACHE_V2_DRAGONFLY_URL: REDIS_URL,
 		SQS_QUEUE_URL_V2,
 		TRACK_SQS_QUEUE_URL,
+		TRACK_ASYNC_SQS_QUEUE_URL,
+		CUSTOMER_JWT_SECRET: TW_CUSTOMER_JWT_SECRET,
 		// baked secrets (every worker).
 		ENCRYPTION_IV: requireSecret("ENCRYPTION_IV"),
 		ENCRYPTION_PASSWORD: requireSecret("ENCRYPTION_PASSWORD"),
@@ -734,6 +738,7 @@ const buildWarmEnv = (): Record<string, string> => ({
 	CACHE_V2_DRAGONFLY_URL: REDIS_URL,
 	SQS_QUEUE_URL_V2,
 	TRACK_SQS_QUEUE_URL,
+	TRACK_ASYNC_SQS_QUEUE_URL,
 	AUTUMN_DB_DIRECT: "1",
 	TW_WORKER_MODE: "1",
 	TW_SKIP_STRIPE_ACCOUNT: "1",

scripts/tw/constants.ts

@@ -180,3 +180,8 @@ export const CACHE_V2_DRAGONFLY_URL = REDIS_URL;
 export const ELASTICMQ_BASE_URL = `http://localhost:${ELASTICMQ_PORT}/000000000000`;
 export const SQS_QUEUE_URL_V2 = `${ELASTICMQ_BASE_URL}/autumn.fifo`;
 export const TRACK_SQS_QUEUE_URL = `${ELASTICMQ_BASE_URL}/autumn-track.fifo`;
+export const TRACK_ASYNC_SQS_QUEUE_URL = `${ELASTICMQ_BASE_URL}/autumn-track-async.fifo`;
+
+/** Harness-only, ≥32 chars (customerJwt getSecret) so bad tokens 401 instead of 500. */
+export const TW_CUSTOMER_JWT_SECRET =
+	"tw-test-customer-jwt-secret-0123456789abcdef";

scripts/tw/helpers/freestyle.ts

@@ -42,7 +42,9 @@ import {
 	REDIS_URL,
 	SERVER_PORT,
 	SQS_QUEUE_URL_V2,
+	TRACK_ASYNC_SQS_QUEUE_URL,
 	TRACK_SQS_QUEUE_URL,
+	TW_CUSTOMER_JWT_SECRET,
 	WORKER_TIMEOUT_MS,
 } from "../constants.ts";
 import { READY_SENTINEL } from "../worker/boot.ts";
@@ -332,6 +334,8 @@ const warmServerEnv = (): Record<string, string> => {
 		CACHE_V2_DRAGONFLY_URL: REDIS_URL,
 		SQS_QUEUE_URL_V2,
 		TRACK_SQS_QUEUE_URL,
+		TRACK_ASYNC_SQS_QUEUE_URL,
+		CUSTOMER_JWT_SECRET: TW_CUSTOMER_JWT_SECRET,
 		ENCRYPTION_IV: requireSecret("ENCRYPTION_IV"),
 		ENCRYPTION_PASSWORD: requireSecret("ENCRYPTION_PASSWORD"),
 		BETTER_AUTH_SECRET: requireSecret("BETTER_AUTH_SECRET"),

scripts/tw/helpers/modalImage.ts

@@ -12,7 +12,8 @@
  *   - Dragonfly  → /opt/autumn-tw/bin/dragonfly
  *   - goaws (native Go SQS, via crane) → /opt/autumn-tw/bin/goaws
  *   - goaws config → /opt/autumn-tw/goaws/goaws.yaml (port 9324, AccountId
- *     "000000000000", EnableDuplicates env-level, queues autumn.fifo + autumn-track.fifo)
+ *     "000000000000", EnableDuplicates env-level, queues autumn.fifo +
+ *     autumn-track.fifo + autumn-track-async.fifo)
  *   - bun (pinned to .bun-version) → /usr/local/bin/bun, with `node` symlinked
  *     to bun so the whole image runs on one runtime (ingress + native installs)
  *
@@ -149,6 +150,7 @@ export const buildBaseImage = (
 				"'  Port: 9324' '  Region: us-east-1' '  AccountId: \"000000000000\"' " +
 				"'  LogToFile: false' '  LogLevel: warn' '  EnableDuplicates: true' " +
 				"'  Queues:' '    - Name: autumn.fifo' '    - Name: autumn-track.fifo' " +
+				"'    - Name: autumn-track-async.fifo' " +
 				`> ${TW_PREFIX}/goaws/goaws.yaml`,
 		])
 		// 6. bun → /usr/local/bin/bun (pinned to .bun-version, so `bun` resolves for

scripts/tw/image/build-base.sh

@@ -190,8 +190,9 @@ Local:
   Queues:
     - Name: autumn.fifo
     - Name: autumn-track.fifo
+    - Name: autumn-track-async.fifo
 EOF
-log "Wrote goaws config to $GOAWS_CONF (autumn.fifo + autumn-track.fifo, dedup on)"
+log "Wrote goaws config to $GOAWS_CONF (autumn.fifo + autumn-track[-async].fifo, dedup on)"
 
 # ---------------------------------------------------------------------------
 # 5. ClickHouse (optional — only when analytics tests are in scope).

scripts/tw/image/freestyle-base.sh

@@ -68,6 +68,7 @@ Local:
   Queues:
     - Name: autumn.fifo
     - Name: autumn-track.fifo
+    - Name: autumn-track-async.fifo
 YAML
 
 echo "[freestyle-base] 6/7 bun (pinned to .bun-version) + node symlink"

scripts/tw/image/start-services.sh

@@ -127,6 +127,13 @@ wait_for "PostgreSQL" "pg_isready -h localhost -p $PG_PORT" 60 "$LOG_DIR/pg.log"
 wait_for "Dragonfly" "redis-cli -p $DRAGONFLY_PORT PING" 60 "$LOG_DIR/dragonfly.log"
 wait_for "goaws" "$goaws_ready_probe" 120 "$LOG_DIR/goaws.log"
 
+# Queues added after a base/warm snapshot was baked are missing from its
+# goaws.yaml — CreateQueue is idempotent, so ensure them on every boot.
+for queue in autumn.fifo autumn-track.fifo autumn-track-async.fifo; do
+  curl -s -o /dev/null --data "Action=CreateQueue&QueueName=$queue&Version=2012-11-05" \
+    "http://localhost:$ELASTICMQ_PORT/" || log "WARN: CreateQueue $queue failed"
+done
+
 # ---------------------------------------------------------------------------
 # 4. ClickHouse (optional).
 # ---------------------------------------------------------------------------

scripts/tw/image/warmup.sh

@@ -51,6 +51,7 @@ export CACHE_URL="$REDIS_URL"
 export CACHE_V2_DRAGONFLY_URL="$REDIS_URL"
 export SQS_QUEUE_URL_V2="http://localhost:${ELASTICMQ_PORT}/000000000000/autumn.fifo"
 export TRACK_SQS_QUEUE_URL="http://localhost:${ELASTICMQ_PORT}/000000000000/autumn-track.fifo"
+export TRACK_ASYNC_SQS_QUEUE_URL="http://localhost:${ELASTICMQ_PORT}/000000000000/autumn-track-async.fifo"
 
 # Bypass Infisical for all DB CLI ops (env.ts:66-74): direct mode requires
 # DATABASE_URL injected, which we just set.