Release v0.1.2

Author: dxcodeagent

RELEASE.json

@@ -1,14 +1,14 @@
 {
-  "version": "0.1.1",
+  "version": "0.1.2",
   "license": "FSL-1.1-ALv2",
   "baselineSha256": "7847f65a9b20b366a60d52d19ca3cd6bdd1bb09b8cb506659a270f27a21d8877",
   "e2b": {
-    "recipeSha256": "87bc0f64f07c3a4db8368720c3f69742d53bf6deec41124379b5e7b59a18b0dd",
+    "recipeSha256": "8159896206584133aec265e481f4c915ed48b6736d6b24b7569712b4672bf5d6",
     "profileSha256": "414dbecee2d47de36016ea05c736e2edff3a0deb298babf923887ea184a01c10"
   },
   "dxd": {
-    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.1.1/dxd-linux-x64",
-    "sha256": "011bed7a79ceabf7b1552587d0c09297c51eccef881c0eaf6f7b775b67ac9eb7"
+    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.1.2/dxd-linux-x64",
+    "sha256": "810626730c00c4bbe3952566b2ebfdc92bf375fd87446fb61d6c0a8041e65bac"
   },
   "toolchain": {
     "node": ">=22.19.0",

alchemy.run.ts

@@ -257,6 +257,10 @@ export default Alchemy.Stack(
       workspaceInactivityMs: Config.option(
         Config.number("DX_DEPLOYMENT_WORKSPACE_INACTIVITY_MS"),
       ),
+      turnstileTestKeys: Config.withDefault(
+        Config.boolean("DX_DEPLOYMENT_TURNSTILE_TEST_KEYS"),
+        false,
+      ),
       e2bApiKey: Config.option(Config.redacted("E2B_API_KEY")),
       githubApp: Config.option(Config.redacted("DX_INTEGRATION_GITHUB_APP")),
       sarvamApiKey: Config.option(Config.redacted("SARVAM_API_KEY")),
@@ -269,6 +273,13 @@ export default Alchemy.Stack(
       deploymentZone: Config.option(
         Config.nonEmptyString("DX_DEPLOYMENT_ZONE"),
       ),
+      workersDevSubdomain: Config.option(
+        Config.nonEmptyString("DX_DEPLOYMENT_WORKERS_DEV_SUBDOMAIN"),
+      ),
+      daemonIngressName: Config.withDefault(
+        Config.nonEmptyString("DX_DEPLOYMENT_DAEMON_INGRESS_NAME"),
+        "dx-dxd",
+      ),
       signupEnabled: Config.withDefault(
         Config.boolean("DX_SIGNUP_ENABLED"),
         false,
@@ -357,6 +368,14 @@ export default Alchemy.Stack(
         } as never)
       : undefined;
 
+    if (
+      configuration.turnstileTestKeys &&
+      configuration.environment !== "preview"
+    )
+      return yield* Effect.die(
+        "DX_DEPLOYMENT_TURNSTILE_TEST_KEYS is restricted to previews.",
+      );
+
     if (Option.isSome(configuration.workspaceInactivityMs)) {
       const inactivityMs = configuration.workspaceInactivityMs.value;
       if (configuration.environment !== "preview")
@@ -390,6 +409,15 @@ export default Alchemy.Stack(
     }
 
     const deploymentHostname = new URL(configuration.origin).hostname;
+    // A resumed guest's daemon reconnects through a dependency-free Worker on
+    // the account's workers.dev subdomain. Its isolate starts in milliseconds,
+    // where the Core bundle's cold start (about a second) otherwise sits on
+    // every wake. Without a workers.dev subdomain Core serves ingress itself.
+    const daemonIngressName = configuration.daemonIngressName;
+    const daemonIngressOrigin = Option.map(
+      configuration.workersDevSubdomain,
+      (subdomain) => `https://${daemonIngressName}.${subdomain}.workers.dev/`,
+    );
     const database = yield* Cloudflare.D1.Database("Database", {
       name: configuration.databaseName,
       migrations: `apps/core/${migrationManifest.d1Directory}`,
@@ -398,13 +426,20 @@ export default Alchemy.Stack(
       name: configuration.bucketName,
       forceDestroy: false,
     });
-    const turnstile = hostedAuthentication
-      ? yield* Cloudflare.Turnstile.Widget("AccessTurnstile", {
-          name: `dx access · ${deploymentHostname}`,
-          domains: [deploymentHostname],
-          mode: "managed",
-        })
-      : undefined;
+    // Previews may use Cloudflare's published always-pass test keys instead of
+    // creating a widget, because the account caps widgets at 20.
+    const turnstile = !hostedAuthentication
+      ? undefined
+      : configuration.turnstileTestKeys
+        ? {
+            sitekey: "1x00000000000000000000AA",
+            secret: "1x0000000000000000000000000000000AA",
+          }
+        : yield* Cloudflare.Turnstile.Widget("AccessTurnstile", {
+            name: `dx access · ${deploymentHostname}`,
+            domains: [deploymentHostname],
+            mode: "managed",
+          });
     const email = hostedAuthentication
       ? yield* Cloudflare.Email.SendEmail("MagicLinkEmail", {
           allowedSenderAddresses: [
@@ -465,7 +500,7 @@ export default Alchemy.Stack(
           `${configuration.e2bTemplate}-${defaultE2BOrbProfile.templateSuffix}`,
         DX_E2B_TEMPLATE_BUILD_ID:
           selfhostProfiles?.defaultBuildId ?? configuration.e2bTemplateBuildId,
-        DX_E2B_TIMEOUT_MS: "600000",
+        DX_E2B_TIMEOUT_MS: "300000",
         ...(Option.isSome(configuration.workspaceInactivityMs)
           ? {
               DX_WORKSPACE_INACTIVITY_MS: String(
@@ -474,7 +509,10 @@ export default Alchemy.Stack(
             }
           : {}),
         DX_DEPLOYMENT_REVISION: configuration.revision,
-        DX_DXD_PUBLIC_URL: configuration.origin,
+        DX_DXD_PUBLIC_URL: Option.getOrElse(
+          daemonIngressOrigin,
+          () => configuration.origin,
+        ),
         DX_DXD_RELEASE_URL: configuration.dxdReleaseUrl,
         DX_DXD_RELEASE_SHA256: configuration.dxdChecksum,
         DX_MIGRATION_MANIFEST_VERSION: String(migrationManifest.version),
@@ -670,6 +708,25 @@ export default Alchemy.Stack(
         : {}),
     });
 
+    // The Thread execution object checks the key; this Worker only forwards.
+    if (Option.isSome(daemonIngressOrigin))
+      yield* Cloudflare.Worker("DaemonIngress", {
+        name: daemonIngressName,
+        main: "apps/core/src/threads/daemon-ingress.ts",
+        compatibility: { date: "2026-08-20" },
+        env: {
+          THREAD_EXECUTION: Cloudflare.DurableObject("THREAD_EXECUTION", {
+            className: "ThreadExecutionObject",
+            scriptName: worker.workerName,
+          }),
+        },
+        workersDev: true,
+        observability: {
+          enabled: true,
+          logs: { enabled: true, invocationLogs: true },
+        },
+      });
+
     if (!selfhost)
       yield* Command.Exec("Verify", {
         command: "node scripts/verify-alchemy-preview.mjs",

apps/core/migration-manifest.json

@@ -2,7 +2,7 @@
   "version": 1,
   "d1Directory": "migrations",
   "previousAcceptedD1Migration": "0000_baseline_v0.1.0.sql",
-  "acceptedDestructiveD1Migrations": [],
+  "acceptedDestructiveD1Migrations": ["0002_release_v0.1.2.sql"],
   "d1": [
     {
       "filename": "0000_baseline_v0.1.0.sql",
@@ -13,6 +13,11 @@
       "filename": "0001_release_v0.1.1.sql",
       "sha256": "2e4fa92cfedebf3ccefaef8637a175a578318df91f3c0e7ef6d52faaa8f4ab78",
       "classification": "non-destructive"
+    },
+    {
+      "filename": "0002_release_v0.1.2.sql",
+      "sha256": "cf1f518a05062a8c4204694833640c5c9f6b811bb1b020826fa2a0500a308c55",
+      "classification": "destructive"
     }
   ],
   "durableObjects": [

apps/core/migrations/0002_release_v0.1.2.sql

@@ -0,0 +1,38 @@
+-- Bitbucket gateway leases authorize the Thread owner's Bitbucket connection,
+-- not one repository: the gateway takes the repository from the request path
+-- and Bitbucket decides access. Rebuild the lease table without repository,
+-- binding, and branch columns, keeping live leases. Leases last three minutes;
+-- dropping the old table cascades only its equally short-lived LFS actions.
+CREATE TABLE bitbucket_git_lease_0059 (
+  id_hash TEXT PRIMARY KEY,
+  thread_id TEXT NOT NULL,
+  actor_user_id TEXT NOT NULL,
+  connection_id TEXT NOT NULL,
+  authorization_epoch INTEGER NOT NULL,
+  operation TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  FOREIGN KEY(connection_id) REFERENCES bitbucket_connection(id)
+);
+
+INSERT INTO bitbucket_git_lease_0059 (
+  id_hash, thread_id, actor_user_id, connection_id, authorization_epoch,
+  operation, expires_at, created_at
+)
+SELECT
+  id_hash, thread_id, actor_user_id, connection_id, authorization_epoch,
+  operation, expires_at, created_at
+FROM bitbucket_git_lease;
+
+DROP TABLE bitbucket_git_lease;
+ALTER TABLE bitbucket_git_lease_0059 RENAME TO bitbucket_git_lease;
+
+CREATE INDEX bitbucket_git_lease_expiry_idx
+  ON bitbucket_git_lease(expires_at);
+
+-- While DxTitleAgent generates a new Thread's title, clients show a loading
+-- state instead of the stored fallback title. The deadline bounds that state
+-- even when the background job never finishes. NULL means the title is final.
+ALTER TABLE threads
+  ADD COLUMN title_pending_until TEXT
+  CHECK (title_pending_until IS NULL OR length(title_pending_until) BETWEEN 20 AND 40);

apps/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dx/core",
   "private": true,
-  "version": "0.1.1",
+  "version": "0.1.2",
   "license": "FSL-1.1-ALv2",
   "type": "module",
   "scripts": {

apps/core/src/app.ts

@@ -51,7 +51,7 @@ app.route("/api/workload-identity", workloadIdentityRoutes);
 app.route("/api/triggers", pluginTriggerIngressRoutes);
 app.route("/api/source/bitbucket/git", bitbucketGitGatewayRoutes);
 app.route("/v1/integrations/github", githubWebhookRoutes);
-app.route("/v1/threads", threadDaemonRoutes);
+app.route("/v1", threadDaemonRoutes);
 app.use("/v1/*", authenticate);
 app.use("/v1/*", authorizeApiTokenScope);
 app.route("/v1/dictation", dictationRoutes);

apps/core/src/auth/daemon-api-key.test.ts

@@ -22,6 +22,7 @@ vi.mock("./requirements.js", () => ({
 }));
 
 import {
+  confirmThreadDaemonApiKey,
   mintThreadDaemonApiKey,
   revokeThreadDaemonApiKey,
   verifyThreadDaemonApiKey,
@@ -111,6 +112,23 @@ describe("Thread daemon API key", () => {
     expect(mocks.verifyApiKey).toHaveBeenCalledOnce();
   });
 
+  it("confirms a key row for the active Thread owner in one read", async () => {
+    const db = database();
+    await expect(
+      confirmThreadDaemonApiKey({ DB: db.binding }, threadId, "daemon-key-id"),
+    ).resolves.toBe(true);
+    expect(db.calls).toHaveLength(1);
+    expect(db.calls[0]?.values).toEqual([
+      "daemon-key-id",
+      "daemon-keys",
+      threadId,
+    ]);
+    expect(db.calls[0]?.sql).toContain("threads.lifecycle_state = 'active'");
+    expect(db.calls[0]?.sql).toContain(
+      "threads.owner_user_id = apikey.referenceId",
+    );
+  });
+
   it("revokes only a daemon key by its opaque ID", async () => {
     const db = database();
     await revokeThreadDaemonApiKey({ DB: db.binding }, "daemon-key-id");

apps/core/src/auth/daemon-api-key.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { ThreadId, UserId } from "@dx/domain";
 import { Effect, Option, Redacted, Schema } from "effect";
 import type { Bindings } from "../http/types.js";
@@ -11,10 +12,18 @@ const DaemonKeyMetadata = Schema.Struct({
   threadId: ThreadId,
 });
 
-const bearer = (header: string | null) => {
+export const threadDaemonBearer = (header: string | null) => {
   const match = /^Bearer (dxd_[A-Za-z0-9._~-]{16,1016})$/.exec(header ?? "");
   return match?.[1];
 };
+const bearer = threadDaemonBearer;
+
+/**
+ * SHA-256 of a daemon key, hex. The Thread execution object keeps it with the
+ * authority so a registration is checked without D1.
+ */
+export const threadDaemonApiKeyHash = (key: string) =>
+  createHash("sha256").update(key).digest("hex");
 
 const database = (bindings: Bindings) => {
   if (bindings.DB === undefined) throw new Error("D1 database is unavailable.");
@@ -92,6 +101,34 @@ export const verifyThreadDaemonApiKey = async (
   return owner?.owned === 1 ? { keyId: verified.key.id } : undefined;
 };
 
+/**
+ * One read that confirms what `verifyThreadDaemonApiKey` would: the key row
+ * still exists (not revoked), is enabled and unexpired, and belongs to the
+ * owner of this active Thread. It runs behind a registration the Thread
+ * execution object already admitted by the key's hash.
+ */
+export const confirmThreadDaemonApiKey = async (
+  bindings: Bindings,
+  threadId: ThreadId,
+  keyId: string,
+) => {
+  const row = await database(bindings)
+    .prepare(
+      `SELECT 1 AS owned
+         FROM apikey
+         JOIN threads ON threads.owner_user_id = apikey.referenceId
+        WHERE apikey.id = ?
+          AND apikey.configId = ?
+          AND (apikey.enabled IS NULL OR apikey.enabled = 1)
+          AND apikey.expiresAt IS NULL
+          AND threads.id = ?
+          AND threads.lifecycle_state = 'active'`,
+    )
+    .bind(keyId, DAEMON_KEY_CONFIG, threadId)
+    .first<{ readonly owned: number }>();
+  return row?.owned === 1;
+};
+
 export const revokeThreadDaemonApiKey = async (
   bindings: Bindings,
   keyId: string | undefined,

apps/core/src/execution/activity.test.ts

@@ -159,6 +159,68 @@ describe("workspace activity coordinator", () => {
     }
   });
 
+  it("publishes the deadline again after a reconnect replaced it while retained", async () => {
+    vi.useFakeTimers();
+    try {
+      vi.setSystemTime(0);
+      const onIdle = vi.fn();
+      const provider = host();
+      const activity = createWorkspaceActivity(
+        { ...provider, onIdle },
+        undefined,
+        60_000,
+      );
+      // Idle resident Terminal: attached, then typed into once.
+      let detach = activity.attachTerminal(async () => false);
+      await vi.runAllTicks();
+      activity.recordTerminalInput();
+      await vi.runAllTicks();
+      const published = provider.setDeadline.mock.calls.length;
+      // The daemon socket drops within the input's retention window, so the
+      // coordinator survives; the wake's E2B connect then replaces the
+      // provider deadline and the daemon attaches again.
+      await vi.advanceTimersByTimeAsync(20_000);
+      detach();
+      expect(onIdle).not.toHaveBeenCalled();
+      activity.deadlineReplaced();
+      detach = activity.attachTerminal(async () => false);
+      await vi.runAllTicks();
+      expect(provider.setDeadline.mock.calls.slice(published)).toEqual([
+        [60_000],
+      ]);
+      detach();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("publishes a replaced deadline on a fresh coordinator but not while a lease renews", async () => {
+    vi.useFakeTimers();
+    try {
+      const provider = host();
+      const activity = createWorkspaceActivity(provider, undefined, 60_000);
+      // A Files-only wake: the connect set the E2B timeout and no Terminal
+      // attaches, so nothing else would publish the 60 s deadline.
+      activity.deadlineReplaced();
+      await vi.runAllTicks();
+      expect(provider.setDeadline.mock.calls).toEqual([[60_000]]);
+      // An attaching Terminal does not publish it a second time.
+      const detach = activity.attachTerminal(async () => false);
+      await vi.runAllTicks();
+      expect(provider.setDeadline).toHaveBeenCalledOnce();
+      detach();
+      const command = activity.acquireCommand(10_000);
+      await vi.runAllTicks();
+      const calls = provider.setDeadline.mock.calls.length;
+      activity.deadlineReplaced();
+      await vi.runAllTicks();
+      expect(provider.setDeadline).toHaveBeenCalledTimes(calls);
+      command.release();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("lets renewing command activity own the final deadline after terminal input", async () => {
     vi.useFakeTimers();
     try {