ci, web: enumerate the account, reap leaked previews, and fix three 301s onto a 404

[JulienMartel]

What

Two things, both found by taking the one open item §5.3 left — "a look at the Cloudflare dashboard's Workers ▸ Routes for both zones".

1. .github/workflows/preview-sweep.yml — a daily (+ workflow_dispatch, with dry_run) sweep that lists the account's Workers, asks GitHub whether each nebelhaus-pr-<n>'s PR is still open, and deletes the ones that aren't. hausfold.co gets the same file in its own repo.
2. web/worker.js — three published nebelhaus.com URLs have been 301'ing onto a 404 since rename: drop nebelhaus — decision 10, §11, and the workshop half #372 deployed at 10:06Z today. Fixed, plus two tests that would have caught it.

Also: README.md and AGENTS.md picked up "new installs scaffold haus" in #372. They don't — haus's bootstrap.sh:567 writes inputs.nebelhaus.url for a fresh install.

Why

The look didn't need the dashboard, and it wasn't clean. The wrangler OAuth token on the machine carries account (read) + workers_scripts, so two REST calls enumerate everything — a check something can run, not a thing to remember. It found:

nebelhaus-init	✅ confirmed gone
nebelhaus.com/* → nebelhaus	✅ the map, as declared
api.hausfold.co → nebelhaus	🚨 a route in no config in either repo; dormant only because that subdomain has no DNS record. 👤 — no merge removes it
4 leaked PR previews	🚨 nebelhaus-pr-321/341, hausfold-pr-16/22 — all public

🚨 The two nebelhaus-pr-* re-opened the hole §5.3 closed. They predate the 301 map, so they are copies of the old site Worker: …/init.sh → 200 with bootstrap.sh, and ?ref=<a real 40-hex sha> → 200 with the bootstrap from that ref. Deleting nebelhaus-init closed the path it sat on, not the code — the code lives on in every preview upload of that era, each with its own hostname.

preview-web.yml's cleanup job isn't at fault; all three leak modes are its trigger failing, which no pull_request job can fix: the paths: filter is judged on the PR's whole diff (321 touched web/** early, merged one notes/ file); a PR closed in the same operation that deletes its head branch gets no run at all (341); and a closed PR never re-fires, so one transient delete failure leaks forever.

The 404s are a narrower lesson: when a rename moves a page, curl the destination — don't derive it by substituting the new name into the old path. /desktops/hacker/ looked right and never existed.

Verify

# the workflow, before merge
shellcheck <the extracted run body>          # clean
# and driven against the live account in dry-run:
#   would delete nebelhaus-pr-321 (PR #321 is closed)
#   would delete nebelhaus-pr-341 (PR #341 is closed)
# — those two and nothing else

cd web && npm ci && npm test                 # 17 pass (15 before)

# after merge, to actually clear them (two runs — each repo sweeps its own prefix)
gh workflow run preview-sweep.yml -R hausfold/workshop
gh workflow run preview-sweep.yml -R hausfold/hausfold.co

# and the 301s, after deploy-web.yml runs
curl -sIL https://nebelhaus.com/start/first-run   # → 200, was 404

Watch out

• ⚠️ Each sweep copy only reaps its own prefix — deliberately: both repos' Workers share one Cloudflare account and the name match is anchored at both ends, so neither production Worker (nebelhaus, hausfold) nor the sibling's previews can be caught. Clearing all four is therefore two dispatches.
• ⚠️ The list call's scope is inference until the first run. The CI token is provisioned Workers Scripts:Edit; Read comes with Edit on Cloudflare's table, but nothing here has ever exercised a list. The job fails loudly and names the scope if not.
• 👤 api.hausfold.co is account-side and in no config — see §5.3's box for the delete.
• The sweep asserts result_info.total_count against what it got and refuses to run on a truncated page, rather than paging speculatively — a silently truncated list is the same "reports clean forever" failure this whole section is about.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkTBtapKcZTCeTqfhRZEJ7