Skip to content

feat: durable REPL capabilities - recorded grants - #153

Draft
ben-reitz wants to merge 1 commit into
feat/durable-replfrom
feat/durable-repl-capabilities
Draft

ben-reitz wants to merge 1 commit into
feat/durable-replfrom
feat/durable-repl-capabilities

Conversation

@ben-reitz

@ben-reitz ben-reitz commented Sep 23, 2026 •

Copy link
Copy Markdown

Lets a session call host code through granted capabilities (capability(), fetchCapability(), workspace fs).

  • Every capability call is recorded once and replayed from the log, so rebuilding a session makes zero live calls.
  • Returned objects become durable handles; after a host restart they fail with a clear "re-acquire via …" error instead of silently breaking.
  • Grants are snapshotted per cell, and fetch is deny-by-default with a host allowlist.

workspace.repl(name, { capabilities }) grants live objects into a session
as globals. Method calls cross a host-side recorder bridge (native Workers
RPC) and commit into the session log as effects; replaying committed cells
makes zero live calls — state survives eviction without re-firing a single
side effect.

- capability(target, meta?): wrap any object, class instance, RPC stub, or
  bare function; description and per-method docs ride along as typed meta.
- Handles: callable results (tabs, responses, …) become host-registered
  handles, chainable across cells. They die with the session host; new
  code using a dead handle gets a stale-lease error carrying its
  acquisition recipe. Revoking a root grant cuts every handle descending
  from it.
- Attach-time grants: every repl() call re-attaches. Committed cells
  replay under the grant shapes (including data snapshots) they were
  recorded with; new cells see the current attachment.
- fetchCapability(): ambient / gateway / allowlisted fetch as an ordinary
  capability; ambient fetch inside cells fails with guidance instead.
- workspaceFs(): the workspace filesystem as a capability — writes are
  recorded once and never re-fired on replay.
- Structured error kinds: stale-lease, not-granted, oversized-result
  (reject, never truncate); replay divergence is now args-aware.
- One JSON-safe value codec (undefined, Date, bigint, bytes, Map, Set)
  shared host/isolate by injecting its source into the runner module.
@ben-reitz
ben-reitz added this pull request to stack #155 September 23, 2026 09:13
@changeset-bot

changeset-bot Bot commented Sep 23, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 627fe47

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions

Copy link
Copy Markdown
Contributor

Thanks for your interest in Cloudflare Computer.

This repository does not accept unsolicited pull requests. Please use one of the accepted contribution paths instead:

If a maintainer asked you to open this pull request, they can add the allow-pr label and reopen it.

@github-actions github-actions Bot closed this Sep 23, 2026
@ben-reitz ben-reitz changed the title feat: durable REPL capabilities — recorded object-graph grants feat: durable REPL capabilities — recorded grants Sep 23, 2026

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 7 potential issues.

Devin Review

Comment thread packages/computer/src/repl/session.ts
Comment thread packages/computer/src/repl/runner.ts
Comment thread packages/computer/src/repl/session.ts
Comment thread packages/computer/src/repl/bridge.ts
Comment thread packages/computer/src/repl/bridge.ts
Comment thread packages/computer/src/repl/bridge.ts
Comment thread packages/computer/src/index.ts
@ben-reitz ben-reitz changed the title feat: durable REPL capabilities — recorded grants feat: durable REPL capabilities - recorded grants Sep 23, 2026
@ben-reitz ben-reitz added the allow-pr Allow a PR to remain open. label Sep 23, 2026
@ben-reitz ben-reitz reopened this Sep 23, 2026
@ben-reitz
ben-reitz marked this pull request as draft September 23, 2026 09:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

allow-pr Allow a PR to remain open.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant