Skip to content

feat: durable REPL capabilities — recorded object-graph grants - #157

Closed
ben-reitz wants to merge 1 commit into
feat/durable-replfrom
feat/durable-repl-capabilities
Closed

ben-reitz wants to merge 1 commit into
feat/durable-replfrom
feat/durable-repl-capabilities

Conversation

@ben-reitz

Copy link
Copy Markdown

Thanks for your interest in Cloudflare Computer.

This repository does not accept unsolicited pull requests. Please open one of the accepted contribution types instead:

Maintainers may close pull requests that do not come from an approved collaborator. If a maintainer asked you to open this pull request, they can add the allow-pr label and reopen it.

workspace.repl(name, { capabilities }) grants live objects into a session
as globals. Method calls cross a host-side recorder bridge (native Workers
RPC) and commit into the session log as effects; replaying committed cells
makes zero live calls — state survives eviction without re-firing a single
side effect.

- capability(target, meta?): wrap any object, class instance, RPC stub, or
  bare function; description and per-method docs ride along as typed meta.
- Handles: callable results (tabs, responses, …) become host-registered
  handles, chainable across cells. They die with the session host; new
  code using a dead handle gets a stale-lease error carrying its
  acquisition recipe. Revoking a root grant cuts every handle descending
  from it.
- Attach-time grants: every repl() call re-attaches. Committed cells
  replay under the grant shapes (including data snapshots) they were
  recorded with; new cells see the current attachment.
- fetchCapability(): ambient / gateway / allowlisted fetch as an ordinary
  capability; ambient fetch inside cells fails with guidance instead.
- workspaceFs(): the workspace filesystem as a capability — writes are
  recorded once and never re-fired on replay.
- Structured error kinds: stale-lease, not-granted, oversized-result
  (reject, never truncate); replay divergence is now args-aware.
- One JSON-safe value codec (undefined, Date, bigint, bytes, Map, Set)
  shared host/isolate by injecting its source into the runner module.
@github-actions

Copy link
Copy Markdown
Contributor

Thanks for your interest in Cloudflare Computer.

This repository does not accept unsolicited pull requests. Please use one of the accepted contribution paths instead:

If a maintainer asked you to open this pull request, they can add the allow-pr label and reopen it.

@github-actions github-actions Bot closed this Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant