dsh-edge 0.15.0-alpha.1 → 0.15.0

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority.
 # After editing either side, update both and re-record every pair with:
 #   pnpm run doc-pairs -- --write
-README.md: df37b120d64d39186c91bdcb811cf2ac1f1745ac
-README.zh.md: 2348c8e25572a915c0423ed940abc1a80638381e
+README.md: 313b3877f1f962865c6a8d8ba3e3a05f11599346
+README.zh.md: 786e48302fb57a8d7b9646991a1b600eace86fec

package/README.md

@@ -325,8 +325,13 @@ pnpm --filter dsh-edge example:install
 - After each committed inbox splice, mux publishes a complete `session/queue` snapshot. Reconnecting clients receive pending live-inbox baselines.
 - `POST /api/commands/list` uses the upstream generated-Remote envelope with an empty catalog because the Edge preset registers no human commands.
 - `GET /api/health` returns the public release/mode identifier and configured attachment default (`private-r2` or `temporary-do`). It validates owner authentication, deployment-scoped DeepSeek credentials, model/transport choices, and command timeouts before reporting ready.
+- `GET /api/ready` requires the owner cookie and waits for session migration, workspace registration, the browser's session/workspace controllers, and registration of the DeepSeek model adapter. It does not make a provider request. It returns HTTP 503 with `runtime-initialization-failed` if startup fails; public health alone does not prove runtime readiness. Ordinary authenticated routes wait for base initialization without requiring the model adapter, preserving history and recovery access when only model initialization failed.
 - Health does not call the provider, Durable Object, R2, VFS, or shell. The authenticated agent-preset projection reports the pinned backend, temporary cap, deployment-default model, and runtime-derived upstream catalog with session selection scope.
 
+Release upgrades automatically normalize the known legacy Edge cancellation records and migrate all outdated session logs, summaries, and blank headers in one SQLite transaction. All old logs are decoded and validated before the first migration write, so incompatible later logs cannot repeatedly consume earlier migration writes on restart. Preflight discards each decoded artifact; migration decodes again in the same synchronous transaction to avoid retaining every history in memory. If any session is incompatible or a write fails, that startup migration is rolled back in full. No session is silently skipped or deleted. This transaction covers session-format migration, not arbitrary plugin storage changes or external side effects. The installer matches the Cloudflare Worker version ID from upload output against both public health and authenticated readiness, so an earlier deployment of the same package cannot satisfy the check. The version metadata binding is included in both modes. The installer checks runtime readiness before reporting success; a timeout is reported as unverified, and a confirmed startup failure reports an error with recovery details. It never automatically rolls back Worker code after a schema upgrade. Release tests boot both prebuilt modes with legacy cancellation data, verify continuation, and reject false readiness on incompatible data; the packed npm artifact is also checked for authenticated runtime readiness.
+
+SQLite `DELETE` operations consume the daily row-write allowance too. During format migration, Edge compares the number of legacy and current event rows: a single index-backed probe stops once copying current rows would cost more; when copying is cheaper, it writes the migrated compact logs into a replacement table and swaps tables inside the same transaction, avoiding a billed delete for every legacy token delta. Otherwise it replaces only the affected sessions. Current session logs are preserved, and failed migrations roll back the table swap. This reduces migration writes but cannot guarantee that every database fits the Free plan's 100,000 daily row-write allowance; sufficiently large upgrades or earlier daily usage can still exhaust it. Point-in-time recovery restores data, not the account's consumed daily quota.
+
 ### Diagnostic REST routes
 
 - `PUT /api/workspace/file?path=/workspace/...` writes a UTF-8 file.

package/README.zh.md

@@ -325,8 +325,13 @@ pnpm --filter dsh-edge example:install
 - 每次 inbox splice 提交后，mux 都发布完整的 `session/queue` snapshot。客户端重连时会收到待处理的 live-inbox baseline。
 - `POST /api/commands/list` 使用上游 generated-Remote envelope 返回空 catalog，因为 Edge preset 没有注册 human command。
 - `GET /api/health` 返回公开 release/mode identifier 与配置的 attachment 默认值（`private-r2` 或 `temporary-do`）。它先验证 owner authentication、部署级 DeepSeek 凭据、模型/传输选择与命令 timeout，再报告 ready。
+- `GET /api/ready` 要求 owner cookie，等待会话迁移、工作区注册、浏览器所需的会话/工作区控制器就绪，以及 DeepSeek 模型适配器完成注册。此检查不会向模型服务发起请求。启动失败时返回 HTTP 503 和 `runtime-initialization-failed`；公开 health 响应不能单独证明运行时可用。普通认证路由只等待基础初始化，不要求模型适配器可用；仅模型初始化失败时，仍保留历史记录和恢复访问。
 - Health 不调用 provider、Durable Object、R2、VFS 或 shell。认证后的 agent-preset projection 会报告固定 backend、临时存储上限、部署默认模型，以及 runtime 实际读取的上游 catalog 与 session 选择范围。
 
+Release 升级会自动兼容已知的旧版 Edge 取消记录，并在一个 SQLite 事务中迁移所有旧格式会话日志、摘要和空会话头。首次迁移写入前会解码并校验所有旧日志，避免后面的不兼容日志导致每次重启都重复消耗前面会话的迁移写入。预检会释放每份解码结果；迁移阶段在同一同步事务内再次解码，避免把所有历史同时保留在内存中。任一会话不兼容或写入失败时，本次启动的迁移会整体回滚，不会静默跳过或删除会话。此事务覆盖会话格式迁移，不涵盖任意插件存储改动或外部副作用。安装器会把上传输出中的 Cloudflare Worker 版本 ID 与公开 health 和经过认证的就绪响应分别比对，同一软件包的旧部署不能满足该检查；两种模式都包含版本元数据绑定。安装器检查运行时就绪状态，通过后才报告成功；超时会报告尚未验证，确认启动失败则报告错误和恢复信息。它不会在存储格式升级后自动回滚 Worker 代码。发布测试使用含旧取消记录的数据启动两种预构建模式，验证继续聊天，并确认不兼容数据不会误报就绪；打包后的 npm 产物也会验证经过认证的运行时就绪状态。
+
+SQLite 的 `DELETE` 操作也会消耗每日行写入额度。迁移格式时，Edge 会比较旧格式与当前格式的事件行数：单条利用索引的探测查询在确认复制成本更高时即停止；如果复制当前事件的成本更低，就把迁移后的压缩日志写入替代表，并在同一事务内交换表，避免为每个旧 token 片段支付逐行删除费用；否则只替换需要迁移的会话。已有当前格式日志会保留，迁移失败也会回滚表交换。这会降低迁移写入量，但不能保证所有数据库都满足 Free 计划每日 100,000 行写入额度；数据库足够大或当天已使用较多额度时，仍可能触及上限。时间点恢复恢复的是数据，不会恢复账户已经消耗的每日额度。
+
 ### 诊断 REST 路由
 
 - `PUT /api/workspace/file?path=/workspace/...` 写入 UTF-8 文件。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-edge",
-  "version": "0.15.0-alpha.1",
+  "version": "0.15.0",
   "description": "Your DeepSeek Harness, anywhere — deploy a persistent personal coding agent to Cloudflare Workers in one command",
   "author": "pawaca",
   "license": "MIT",

package/scripts/activation.d.mts

@@ -7,6 +7,7 @@ export interface ActivationObservation {
 }
 
 export interface ExpectedHealth {
+  workerVersionId: string
   deploymentId: string
   shell: 'just-bash-direct' | 'just-bash-isolated'
 }
@@ -18,6 +19,8 @@ export const ACTIVATION_RETRY_MS: number
 export function observePublicActivation(options: {
   publicUrl: string
   mode: RuntimeMode
+  ownerSecret?: string
+  versionId?: string
   fetchImpl?: typeof fetch
   now?: () => number
   requestTimeoutMs?: number
@@ -32,3 +35,5 @@ export function observePublicActivation(options: {
 }): Promise<ActivationObservation>
 
 export function isExpectedHealth(value: unknown, expected: ExpectedHealth): boolean
+
+export class RuntimeActivationError extends Error {}

package/scripts/activation.mjs

@@ -7,10 +7,12 @@ export const ACTIVATION_RETRY_MS = 1_500
 
 const MAX_HEALTH_BYTES = 64 * 1024
 
-/** Observe when Cloudflare serves the exact Worker release without making it an install gate. */
+/** Verify the exact uploaded release and its authenticated runtime before reporting ready. */
 export async function observePublicActivation({
   publicUrl,
   mode,
+  ownerSecret,
+  versionId,
   fetchImpl = globalThis.fetch,
   now = Date.now,
   requestTimeoutMs = ACTIVATION_REQUEST_TIMEOUT_MS,
@@ -29,6 +31,7 @@ export async function observePublicActivation({
 
   const healthUrl = publicHealthUrl(publicUrl)
   const expected = {
+    workerVersionId: versionId,
     deploymentId: `dsh-edge@${edgePackage.version}/${mode}`,
     shell: mode === 'direct' ? 'just-bash-direct' : 'just-bash-isolated',
   }
@@ -59,12 +62,18 @@ export async function observePublicActivation({
       if (response.ok) {
         const health = await readBoundedJson(response, MAX_HEALTH_BYTES)
         if (isExpectedHealth(health, expected)) {
-          return activationResult('ready', attempts, startedAt, now())
+          if (typeof ownerSecret !== 'string' || Buffer.byteLength(ownerSecret, 'utf8') < 32 || Buffer.byteLength(ownerSecret, 'utf8') > 512) {
+            throw new RuntimeActivationError('Runtime verification requires the owner access key.')
+          }
+          if (await verifyRuntime({ publicUrl, ownerSecret, fetchImpl, signal: requestSignal, expected })) {
+            return activationResult('ready', attempts, startedAt, now())
+          }
         }
       } else {
         await response.body?.cancel()
       }
-    } catch {
+    } catch (error) {
+      if (error instanceof RuntimeActivationError) throw error
       if (signal?.aborted) signal.throwIfAborted()
       // DNS, routing, challenge, timeout, and placeholder responses are all
       // transient observations until the bounded wait expires.
@@ -85,6 +94,8 @@ export function isExpectedHealth(value, expected) {
     && value.deploymentId === expected.deploymentId
     && value.shell === expected.shell
     && value.version === edgePackage.version
+    && typeof expected.workerVersionId === 'string' && expected.workerVersionId.length > 0
+    && value.workerVersionId === expected.workerVersionId
 }
 
 function publicHealthUrl(publicUrl) {
@@ -131,3 +142,31 @@ function activationResult(status, attempts, startedAt, finishedAt) {
     status,
   }
 }
+
+/** An upload succeeded, but its application is definitively not ready. */
+export class RuntimeActivationError extends Error {}
+
+async function verifyRuntime({ publicUrl, ownerSecret, fetchImpl, signal, expected }) {
+  // Login and readiness use the same validated origin. Never follow redirects
+  // with owner credentials, and keep the short-lived probe cookie in memory.
+  const login = await fetchImpl(new URL('/api/auth/login', publicUrl).href, {
+    method: 'POST', redirect: 'manual', signal,
+    headers: { 'content-type': 'application/x-www-form-urlencoded', origin: new URL(publicUrl).origin },
+    body: new URLSearchParams({ accessKey: ownerSecret }).toString(),
+  })
+  const cookie = login.headers.get('set-cookie')?.split(';', 1)[0]
+  await login.body?.cancel()
+  // A same-version deployment may still serve the previous owner key during propagation.
+  if (login.status === 401) return false
+  if (login.status !== 303 || !/^__Host-dsh_edge_owner=v1\.[0-9]+\.[A-Za-z0-9_-]+$/u.test(cookie ?? '')) return false
+  const response = await fetchImpl(new URL('/api/ready', publicUrl).href, {
+    redirect: 'manual', signal,
+    headers: { accept: 'application/json', 'cache-control': 'no-cache', cookie },
+  })
+  const state = await readBoundedJson(response, MAX_HEALTH_BYTES)
+  if (response.status === 503 && state?.code === 'runtime-initialization-failed'
+    && state.workerVersionId === expected.workerVersionId) {
+    throw new RuntimeActivationError('Worker uploaded, but session or workspace initialization failed. Upgrade is not ready. Do not delete stored data; install a compatible release. No automatic rollback was attempted.')
+  }
+  return response.ok && state?.runtime === true && isExpectedHealth(state, expected)
+}

package/scripts/cli.mjs

@@ -279,9 +279,9 @@ export function createInstallerUi(
     },
     activationFinish(result) {
       if (activationSpinner === undefined) return
-      if (result?.status === 'ready') activationSpinner.stop('Public URL is ready.')
+      if (result?.status === 'ready') activationSpinner.stop('Chat and workspace services are ready.')
       else if (result?.status === 'pending') {
-        activationSpinner.stop('Worker uploaded; public URL activation is still pending.')
+        activationSpinner.stop('Worker uploaded; application readiness is not yet verified.')
       } else {
         activationSpinner.stop('Stopped waiting for public URL activation.')
       }
@@ -319,9 +319,9 @@ export function createInstallerUi(
         ...(result.activation?.status === 'ready'
           ? ['Status: Ready']
           : [
-              'Status: Cloudflare is still activating the public URL.',
-              'First-time workers.dev activation can take about a minute.',
-              'If the URL shows a placeholder, wait a moment and refresh.',
+              'Status: Application readiness has not been verified.',
+              'The public URL or application may still be starting.',
+              'Open the URL and confirm your chats and workspaces load before using it.',
             ]),
         '',
         `URL: ${result.publicUrl}`,
@@ -349,11 +349,11 @@ export function createInstallerUi(
       const ready = result.activation?.status === 'ready'
       const title = ready
         ? (command === 'upgrade' ? 'dsh-edge upgrade is live' : 'dsh-edge is ready')
-        : 'Worker uploaded — activation pending'
+        : 'Worker uploaded — readiness unverified'
       note(lines.join('\n'), title)
       const outro = ready
         ? (command === 'upgrade' ? 'Your dsh-edge upgrade is live.' : 'Your dsh-edge is ready.')
-        : `${command === 'upgrade' ? 'Upgrade' : 'Installation'} succeeded; Cloudflare is still activating the public URL.`
+        : 'Worker uploaded; application readiness remains unverified.'
       log(clack.outro, outro)
     },
   }

package/scripts/install.d.mts

@@ -166,6 +166,8 @@ export function installEdge(options: {
   createTemporaryDirectory?: () => Promise<string>
   removePath?: typeof import('node:fs/promises').rm
   observeActivation?: (options: {
+    ownerSecret: string
+    versionId?: string
     publicUrl: string
     mode: RuntimeMode
     signal?: AbortSignal

package/scripts/install.mjs

@@ -813,6 +813,8 @@ export async function installEdge({
         const activation = await observeActivation({
           mode,
           publicUrl: result.publicUrl,
+          ownerSecret: result.ownerSecret,
+          versionId: result.versionId,
           signal,
         })
         result = { ...result, activation }

package/scripts/smoke-installed.mjs

@@ -42,6 +42,16 @@ try {
     assert.equal(health.service, 'dsh-edge')
     assert.equal(health.shell, mode === 'direct' ? 'just-bash-direct' : 'just-bash-isolated')
     assert.equal(health.deploymentId, `dsh-edge@${edgePackage.version}/${mode}`)
+    const login = await worker.fetch('http://dsh-edge.test/api/auth/login', {
+      method: 'POST', redirect: 'manual', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ accessKey: ACCESS_KEY }).toString(),
+    })
+    assert.equal(login.status, 303)
+    const cookie = login.headers.get('set-cookie')?.split(';', 1)[0]
+    assert.ok(cookie)
+    const ready = await worker.fetch('http://dsh-edge.test/api/ready', { headers: { cookie } })
+    assert.equal(ready.status, 200)
+    assert.equal((await ready.json()).runtime, true)
     await worker.stop()
     worker = undefined
     process.stdout.write(`Installed ${mode} Worker artifact started successfully.\n`)