Release v0.2.0

Author: dxcodeagent

README.md

@@ -6,8 +6,9 @@ accounts you control.
 
 ## Deploy
 
-Node.js 22.19 or newer, pnpm 9, a Cloudflare account, and an E2B API key are
-required.
+Node.js 22.19 or newer, pnpm 9, a Cloudflare account, and at least one Orb
+provider are required: an E2B API key, or Cloudflare Containers (Workers Paid
+plan and Docker on the deploying machine).
 
 ```sh
 pnpm install --frozen-lockfile

RELEASE.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.1.2",
+  "version": "0.2.0",
   "license": "FSL-1.1-ALv2",
   "baselineSha256": "7847f65a9b20b366a60d52d19ca3cd6bdd1bb09b8cb506659a270f27a21d8877",
   "e2b": {
-    "recipeSha256": "8159896206584133aec265e481f4c915ed48b6736d6b24b7569712b4672bf5d6",
+    "recipeSha256": "761809ee2efa2b6c750451ace29283cbb8e55b6ce3b5b14c2bb4509df71df801",
     "profileSha256": "414dbecee2d47de36016ea05c736e2edff3a0deb298babf923887ea184a01c10"
   },
   "dxd": {
-    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.1.2/dxd-linux-x64",
+    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.2.0/dxd-linux-x64",
     "sha256": "810626730c00c4bbe3952566b2ebfdc92bf375fd87446fb61d6c0a8041e65bac"
   },
   "toolchain": {

THIRD_PARTY_NOTICES.md

@@ -63,3 +63,37 @@ from the Flue `sandbox/e2b@1` blueprint distributed with Flue 2.0.3:
 
 The source/version marker is retained in the copied file so later changes can
 be reviewed against the licensed upstream blueprint.
+
+## QuickJS and quickjs-emscripten
+
+The Code plugin distributes QuickJS WebAssembly through
+`quickjs-emscripten-core` and `@jitl/quickjs-wasmfile-release-sync` 0.32.0.
+
+- Source: <https://github.com/justjake/quickjs-emscripten>
+- QuickJS source: <https://bellard.org/quickjs/>
+- License: MIT
+
+quickjs-emscripten copyright (c) 2019-2024 Jake Teton-Landis
+
+QuickJS Javascript Engine
+
+Copyright (c) 2017-2021 Fabrice Bellard
+Copyright (c) 2017-2021 Charlie Gordon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

alchemy.run.ts

@@ -18,9 +18,16 @@ import {
   E2BProfiles,
   e2bRecipeHash,
   HeldSecret,
+  OrbContainers,
+  orbRecipeHash,
   selfhostProviders,
 } from "./deploy/selfhost/alchemy-resources.ts";
-import { E2B_ORB_PROFILES } from "./packages/domain/src/settings/runner-profile.ts";
+import CLOUDFLARE_ORB_PROFILES from "./packages/domain/cloudflare-orb-profiles.json" with {
+  type: "json",
+};
+import E2B_ORB_PROFILES from "./packages/domain/e2b-orb-profiles.json" with {
+  type: "json",
+};
 import { decodeGitHubAppDeploymentConfiguration } from "./packages/domain/src/source-control/github-app-configuration.ts";
 
 type RecordValue<T> = T extends Record<string, infer Value> ? Value : never;
@@ -81,6 +88,28 @@ const defaultE2BOrbProfile = E2B_ORB_PROFILES.find(
 );
 if (defaultE2BOrbProfile === undefined)
   throw new Error("The default E2B Orb profile is missing from the catalog.");
+const defaultCloudflareOrbProfile = CLOUDFLARE_ORB_PROFILES.find(
+  ({ id }) => id === "cf.standard-2",
+);
+if (defaultCloudflareOrbProfile === undefined)
+  throw new Error(
+    "The default Cloudflare Orb profile is missing from the catalog.",
+  );
+/** What every deployed Orb size offers; see RunnerProfileCatalogConfiguration. */
+const deployedOrbCapabilities = [
+  "git",
+  "environment-variables",
+  "internet-access",
+  "persistent-workspace",
+  "pause-resume",
+] as const;
+const cloudflareOrbProfiles = CLOUDFLARE_ORB_PROFILES.map((profile) => ({
+  ...profile,
+  adapter: "cloudflare",
+  isolation: "container",
+  availability: "available",
+  capabilities: deployedOrbCapabilities,
+}));
 
 const productionWorkerBindings = <
   Groups extends Record<string, Record<string, unknown>>,
@@ -264,6 +293,16 @@ export default Alchemy.Stack(
       e2bApiKey: Config.option(Config.redacted("E2B_API_KEY")),
       githubApp: Config.option(Config.redacted("DX_INTEGRATION_GITHUB_APP")),
       sarvamApiKey: Config.option(Config.redacted("SARVAM_API_KEY")),
+      exaApiKey: Config.option(Config.redacted("EXA_API_KEY")),
+      plugins: Config.withDefault(Config.string("DX_DEPLOYMENT_PLUGINS"), ""),
+      // Orb providers the deployment installs: e2b, cloudflare, or both.
+      orbProviders: Config.withDefault(
+        Config.string("DX_DEPLOYMENT_ORB_PROVIDERS"),
+        "e2b",
+      ),
+      orbWorkerName: Config.option(
+        Config.nonEmptyString("DX_DEPLOYMENT_ORB_WORKER_NAME"),
+      ),
       workloadIdentitySigningKeys: Config.option(
         Config.redacted("DX_WORKLOAD_IDENTITY_SIGNING_KEYS"),
       ),
@@ -323,13 +362,29 @@ export default Alchemy.Stack(
     const integrations = new Set(
       configuration.integrations.split(",").filter(Boolean),
     );
-    const e2bApiKey = selfhost
-      ? (yield* HeldSecret("E2BApiKey", {
-          value: Option.getOrUndefined(configuration.e2bApiKey),
-        })).value
-      : Option.isSome(configuration.e2bApiKey)
-        ? configuration.e2bApiKey.value
-        : yield* Effect.die("E2B_API_KEY is required.");
+    const orbProviders = new Set(
+      configuration.orbProviders.split(",").filter(Boolean),
+    );
+    if (
+      orbProviders.size === 0 ||
+      [...orbProviders].some(
+        (provider) => provider !== "e2b" && provider !== "cloudflare",
+      )
+    )
+      return yield* Effect.die(
+        "DX_DEPLOYMENT_ORB_PROVIDERS must name e2b, cloudflare, or both.",
+      );
+    const e2bInstalled = orbProviders.has("e2b");
+    const cloudflareInstalled = orbProviders.has("cloudflare");
+    const e2bApiKey = !e2bInstalled
+      ? undefined
+      : selfhost
+        ? (yield* HeldSecret("E2BApiKey", {
+            value: Option.getOrUndefined(configuration.e2bApiKey),
+          })).value
+        : Option.isSome(configuration.e2bApiKey)
+          ? configuration.e2bApiKey.value
+          : yield* Effect.die("E2B_API_KEY is required.");
     const githubApp = selfhost
       ? integrations.has("github")
         ? (yield* HeldSecret("GitHubAppSecret", {
@@ -351,22 +406,59 @@ export default Alchemy.Stack(
             value: Option.getOrUndefined(configuration.bitbucketOAuth),
           })).value
         : Option.getOrUndefined(configuration.bitbucketOAuth);
+    // The Speech plugin's deployment-scope Sarvam key. The self-host
+    // integration keeps its `sarvam` name and HeldSecret ID.
     const sarvamApiKey =
       selfhost && integrations.has("sarvam")
         ? (yield* HeldSecret("SarvamApiKey", {
             value: Option.getOrUndefined(configuration.sarvamApiKey),
           })).value
         : Option.getOrUndefined(configuration.sarvamApiKey);
-    const selfhostProfiles = selfhost
-      ? yield* E2BProfiles("E2BProfiles", {
-          apiKey: e2bApiKey,
-          deploymentName: Option.getOrElse(
-            configuration.deploymentName,
-            () => "",
-          ),
-          recipeHash: yield* Effect.promise(() => e2bRecipeHash()),
-        } as never)
-      : undefined;
+    // Plugin installation is deployment scope. Hosted targets install every
+    // first-party plugin; self-host installs what `pnpm dx:deploy` recorded.
+    const installedPlugins = selfhost ? configuration.plugins : "search,speech";
+    const exaApiKey = selfhost
+      ? integrations.has("exa")
+        ? (yield* HeldSecret("ExaApiKey", {
+            value: Option.getOrUndefined(configuration.exaApiKey),
+          })).value
+        : undefined
+      : Option.getOrUndefined(configuration.exaApiKey);
+    const selfhostProfiles =
+      selfhost && e2bApiKey !== undefined
+        ? yield* E2BProfiles("E2BProfiles", {
+            apiKey: e2bApiKey,
+            deploymentName: Option.getOrElse(
+              configuration.deploymentName,
+              () => "",
+            ),
+            recipeHash: yield* Effect.promise(() => e2bRecipeHash()),
+          } as never)
+        : undefined;
+    // Cloudflare Containers runs in this account: the Orb Worker owns one
+    // container per Thread, and Core binds its namespace across scripts.
+    const orbContainers = !cloudflareInstalled
+      ? undefined
+      : Option.isSome(configuration.orbWorkerName)
+        ? yield* OrbContainers("OrbContainers", {
+            workerName: configuration.orbWorkerName.value,
+            recipeHash: orbRecipeHash(import.meta.dirname),
+          })
+        : yield* Effect.die(
+            "DX_DEPLOYMENT_ORB_WORKER_NAME is required for Cloudflare Containers.",
+          );
+    const defaultOrbProfileId = e2bInstalled
+      ? defaultE2BOrbProfile.id
+      : defaultCloudflareOrbProfile.id;
+    const runnerProfileCatalog = (e2bProfiles: ReadonlyArray<unknown>) =>
+      JSON.stringify({
+        version: 1,
+        defaultProfileId: defaultOrbProfileId,
+        profiles: [
+          ...e2bProfiles,
+          ...(cloudflareInstalled ? cloudflareOrbProfiles : []),
+        ],
+      });
 
     if (
       configuration.turnstileTestKeys &&
@@ -495,12 +587,17 @@ export default Alchemy.Stack(
           : {}),
         DX_AUTH_URL: configuration.origin,
         DX_AUTH_TRUSTED_ORIGINS: configuration.origin,
-        DX_E2B_TEMPLATE:
-          selfhostProfiles?.defaultTemplate ??
-          `${configuration.e2bTemplate}-${defaultE2BOrbProfile.templateSuffix}`,
-        DX_E2B_TEMPLATE_BUILD_ID:
-          selfhostProfiles?.defaultBuildId ?? configuration.e2bTemplateBuildId,
-        DX_E2B_TIMEOUT_MS: "300000",
+        ...(e2bInstalled
+          ? {
+              DX_E2B_TEMPLATE:
+                selfhostProfiles?.defaultTemplate ??
+                `${configuration.e2bTemplate}-${defaultE2BOrbProfile.templateSuffix}`,
+              DX_E2B_TEMPLATE_BUILD_ID:
+                selfhostProfiles?.defaultBuildId ??
+                configuration.e2bTemplateBuildId,
+              DX_E2B_TIMEOUT_MS: "300000",
+            }
+          : {}),
         ...(Option.isSome(configuration.workspaceInactivityMs)
           ? {
               DX_WORKSPACE_INACTIVITY_MS: String(
@@ -518,50 +615,39 @@ export default Alchemy.Stack(
         DX_MIGRATION_MANIFEST_VERSION: String(migrationManifest.version),
         DX_RUNNER_PROFILE_CATALOG:
           selfhostProfiles === undefined
-            ? JSON.stringify({
-                version: 1,
-                defaultProfileId: defaultE2BOrbProfile.id,
-                profiles: E2B_ORB_PROFILES.map((profile) => ({
-                  ...profile,
-                  adapter: "e2b",
-                  template: `${configuration.e2bTemplate}-${profile.templateSuffix}`,
-                  isolation: "sandbox",
-                  availability: "available",
-                  capabilities: [
-                    "git",
-                    "environment-variables",
-                    "internet-access",
-                    "persistent-workspace",
-                    "pause-resume",
-                  ],
-                })),
-              })
+            ? runnerProfileCatalog(
+                e2bInstalled
+                  ? E2B_ORB_PROFILES.map((profile) => ({
+                      ...profile,
+                      adapter: "e2b",
+                      template: `${configuration.e2bTemplate}-${profile.templateSuffix}`,
+                      isolation: "sandbox",
+                      availability: "available",
+                      capabilities: deployedOrbCapabilities,
+                    }))
+                  : [],
+              )
             : Output.map(selfhostProfiles.profilesJson, (profilesJson) =>
-                JSON.stringify({
-                  version: 1,
-                  defaultProfileId: defaultE2BOrbProfile.id,
-                  profiles: JSON.parse(profilesJson).map(
+                runnerProfileCatalog(
+                  JSON.parse(profilesJson).map(
                     (profile: Record<string, unknown>) => ({
                       ...profile,
                       adapter: "e2b",
                       isolation: "sandbox",
                       availability: "available",
-                      capabilities: [
-                        "git",
-                        "environment-variables",
-                        "internet-access",
-                        "persistent-workspace",
-                        "pause-resume",
-                      ],
+                      capabilities: deployedOrbCapabilities,
                     }),
                   ),
-                }),
+                ),
               ),
         DX_SOURCE_CONTROL_SCHEMA_VERSION: sourceControlSchemaVersion,
         DX_SOURCE_SHALLOW_CLONE: configuration.sourceShallowClone
           ? "true"
           : "false",
         DX_MANAGED_SSH_SIGNING_ENABLED: "true",
+        ...(installedPlugins === ""
+          ? {}
+          : { DX_INSTALLED_PLUGINS: installedPlugins }),
         ...(configuration.signupEnabled ? { DX_SIGNUP_ENABLED: "true" } : {}),
         ...(Option.isSome(configuration.githubCopilotClientId)
           ? {
@@ -603,8 +689,9 @@ export default Alchemy.Stack(
         DX_CONFIG_ENCRYPTION_KEYS: encryptionKeyring,
         DX_INTEGRATION_GITHUB_APP: githubApp,
         DX_WORKLOAD_IDENTITY_SIGNING_KEYS: workloadIdentitySigningKeys,
-        E2B_API_KEY: e2bApiKey,
+        ...(e2bApiKey === undefined ? {} : { E2B_API_KEY: e2bApiKey }),
         ...(sarvamApiKey !== undefined ? { SARVAM_API_KEY: sarvamApiKey } : {}),
+        ...(exaApiKey !== undefined ? { EXA_API_KEY: exaApiKey } : {}),
         ...(bitbucketOAuth !== undefined
           ? {
               DX_INTEGRATION_BITBUCKET_OAUTH: bitbucketOAuth,
@@ -619,7 +706,17 @@ export default Alchemy.Stack(
       "workers-ai": {
         [aiBinding.name]: Cloudflare.Workers.AI(aiBinding.name),
       },
-      "durable-object": durableObjectBindings,
+      "durable-object": {
+        ...durableObjectBindings,
+        ...(orbContainers === undefined
+          ? {}
+          : {
+              ORB_CONTAINER: Cloudflare.DurableObject("ORB_CONTAINER", {
+                className: "OrbContainerObject",
+                scriptName: orbContainers.workerName,
+              }),
+            }),
+      },
     });
 
     const bootstrap = yield* Command.Exec("Bootstrap", {
@@ -651,7 +748,7 @@ export default Alchemy.Stack(
                 DX_BOOTSTRAP_REPOSITORY: configuration.bootstrapRepository,
               }),
         DX_BOOTSTRAP_DATABASE_ID: database.databaseId,
-        DX_BOOTSTRAP_RUNNER_PROFILE_ID: defaultE2BOrbProfile.id,
+        DX_BOOTSTRAP_RUNNER_PROFILE_ID: defaultOrbProfileId,
       },
       memo: false,
       timeout: "3 minutes",

apps/core/migration-manifest.json

@@ -2,7 +2,10 @@
   "version": 1,
   "d1Directory": "migrations",
   "previousAcceptedD1Migration": "0000_baseline_v0.1.0.sql",
-  "acceptedDestructiveD1Migrations": ["0002_release_v0.1.2.sql"],
+  "acceptedDestructiveD1Migrations": [
+    "0002_release_v0.1.2.sql",
+    "0003_release_v0.2.0.sql"
+  ],
   "d1": [
     {
       "filename": "0000_baseline_v0.1.0.sql",
@@ -18,6 +21,11 @@
       "filename": "0002_release_v0.1.2.sql",
       "sha256": "cf1f518a05062a8c4204694833640c5c9f6b811bb1b020826fa2a0500a308c55",
       "classification": "destructive"
+    },
+    {
+      "filename": "0003_release_v0.2.0.sql",
+      "sha256": "d6418d54cff30515745be2f50b114813bb9ad31e5125058b95cb4b8eb0720a4a",
+      "classification": "destructive"
     }
   ],
   "durableObjects": [