Release v0.2.26

Author: dxcodeagent

.github/workflows/ci.yml

@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6.1.0
         with:
-          version: 9.15.0
+          version: 12.14.0
       - uses: actions/setup-node@v4
         with:
           node-version: 22.19.0
@@ -24,6 +24,8 @@ jobs:
       - run: pnpm format:check
       - run: pnpm lint
       - run: pnpm typecheck
+      # Web's React tests run in this Chromium.
+      - run: pnpm --filter @dx/web exec playwright install --with-deps chromium-headless-shell
       - run: pnpm test:unit
       - run: pnpm test:dxd
       - run: pnpm build

.github/workflows/deploy.yml

@@ -66,9 +66,9 @@ jobs:
             printf '%s\n' "$SELFHOST_CREDENTIALS" > ".dx/alchemy/selfhost-$name/credentials.json"
           fi
           echo "domain=$(jq -r '.domain // empty' .dx/deploy.selfhost.json)" >> "$GITHUB_OUTPUT"
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6.1.0
         with:
-          version: 9.15.0
+          version: 12.14.0
       - uses: actions/setup-node@v4
         with:
           node-version: 22.19.0

README.md

@@ -6,7 +6,7 @@ accounts you control.
 
 ## Deploy
 
-Node.js 22.19 or newer, pnpm 9, a Cloudflare account, and at least one Orb
+Node.js 22.19 or newer, pnpm 12, a Cloudflare account, and at least one Orb
 provider are required: an E2B API key, or Cloudflare Containers (Workers Paid
 plan and Docker on the deploying machine).
 

RELEASE.json

@@ -1,18 +1,18 @@
 {
-  "version": "0.2.25",
+  "version": "0.2.26",
   "license": "FSL-1.1-ALv2",
   "baselineSha256": "7847f65a9b20b366a60d52d19ca3cd6bdd1bb09b8cb506659a270f27a21d8877",
   "e2b": {
     "recipeSha256": "761809ee2efa2b6c750451ace29283cbb8e55b6ce3b5b14c2bb4509df71df801",
     "profileSha256": "414dbecee2d47de36016ea05c736e2edff3a0deb298babf923887ea184a01c10"
   },
   "dxd": {
-    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.2.25/dxd-linux-x64",
+    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.2.26/dxd-linux-x64",
     "sha256": "76f424e6253874df89ceeb8f42d2f2a67ff3024d4116639cec5d04624ab4f345"
   },
   "toolchain": {
     "node": ">=22.19.0",
-    "pnpm": "9.15.0",
+    "pnpm": "12.14.0",
     "rust": "1.89.0"
   }
 }

THIRD_PARTY_NOTICES.md

@@ -2,14 +2,28 @@
 
 ## Alchemy Cloudflare state-store selection
 
-`third-party/alchemy/alchemy@2.0.0-beta.74.patch` modifies Alchemy's Cloudflare
+`third-party/alchemy/alchemy@2.0.0-beta.83.patch` modifies Alchemy's Cloudflare
 state-store login to select the Secrets Store containing Alchemy's token rather
-than an unrelated account store.
+than an unrelated account store, and adds the scopes named in
+`ALCHEMY_CLOUDFLARE_OAUTH_EXTRA_SCOPES` to its Basic and Custom OAuth scope
+choices.
 
 - Source: <https://github.com/alchemy-run/alchemy>
 - License: Apache-2.0
 - License text: <https://github.com/alchemy-run/alchemy/blob/main/LICENSE>
 
+## Ghostty Web rendering
+
+`third-party/ghostty-web/ghostty-web@0.4.0.patch` modifies Ghostty Web's
+renderer to read the terminal viewport once per frame, its resize to
+allocate the canvas once, its Terminal to draw only when something changed
+and not while hidden, and its WebAssembly loader to fetch the module by URL
+without a second, embedded copy.
+
+- Source: <https://github.com/coder/ghostty-web>
+- License: MIT
+- License text: <https://github.com/coder/ghostty-web/blob/main/LICENSE>
+
 ## ElevenLabs UI waveform
 
 `apps/web/src/shared/ui/waveform.tsx` adapts the base canvas waveform from

alchemy.run.ts

@@ -250,134 +250,134 @@ export default Alchemy.Stack(
   Effect.gen(function* () {
     const stack = yield* Stack;
     const configuration = yield* Config.all({
-      environment: Config.string("DX_DEPLOYMENT_ENVIRONMENT"),
-      deploymentTarget: Config.string("DX_DEPLOYMENT_TARGET"),
-      deploymentLabel: Config.string("DX_DEPLOYMENT_LABEL"),
+      environment: Config.String("DX_DEPLOYMENT_ENVIRONMENT"),
+      deploymentTarget: Config.String("DX_DEPLOYMENT_TARGET"),
+      deploymentLabel: Config.String("DX_DEPLOYMENT_LABEL"),
       deploymentName: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_NAME"),
+        Config.NonEmptyString("DX_DEPLOYMENT_NAME"),
       ),
-      adminEmail: Config.option(Config.nonEmptyString("DX_ADMIN_EMAIL")),
-      adminPassword: Config.option(Config.redacted("DX_ADMIN_PASSWORD")),
+      adminEmail: Config.option(Config.NonEmptyString("DX_ADMIN_EMAIL")),
+      adminPassword: Config.option(Config.Redacted("DX_ADMIN_PASSWORD")),
       adminPasswordReset: Config.withDefault(
-        Config.boolean("DX_ADMIN_PASSWORD_RESET"),
+        Config.Boolean("DX_ADMIN_PASSWORD_RESET"),
         false,
       ),
       integrations: Config.withDefault(
-        Config.string("DX_DEPLOYMENT_INTEGRATIONS"),
+        Config.String("DX_DEPLOYMENT_INTEGRATIONS"),
         "",
       ),
-      origin: Config.string("DX_DEPLOYMENT_ORIGIN"),
+      origin: Config.String("DX_DEPLOYMENT_ORIGIN"),
       authEmailFrom: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_AUTH_EMAIL_FROM"),
+        Config.NonEmptyString("DX_DEPLOYMENT_AUTH_EMAIL_FROM"),
       ),
-      revision: Config.string("DX_DEPLOYMENT_REVISION"),
-      workerName: Config.string("DX_DEPLOYMENT_WORKER_NAME"),
-      databaseName: Config.string("DX_DEPLOYMENT_DATABASE_NAME"),
-      bucketName: Config.string("DX_DEPLOYMENT_BUCKET_NAME"),
-      credentialsFile: Config.string("DX_DEPLOYMENT_CREDENTIALS_FILE"),
+      revision: Config.String("DX_DEPLOYMENT_REVISION"),
+      workerName: Config.String("DX_DEPLOYMENT_WORKER_NAME"),
+      databaseName: Config.String("DX_DEPLOYMENT_DATABASE_NAME"),
+      bucketName: Config.String("DX_DEPLOYMENT_BUCKET_NAME"),
+      credentialsFile: Config.String("DX_DEPLOYMENT_CREDENTIALS_FILE"),
       bootstrapRepository: Config.withDefault(
-        Config.string("DX_DEPLOYMENT_BOOTSTRAP_REPOSITORY"),
+        Config.String("DX_DEPLOYMENT_BOOTSTRAP_REPOSITORY"),
         "",
       ),
-      packageDirectory: Config.string("DX_DEPLOYMENT_PACKAGE_DIR"),
-      e2bTemplate: Config.string("DX_DEPLOYMENT_E2B_TEMPLATE"),
-      e2bTemplateBuildId: Config.string("DX_DEPLOYMENT_E2B_TEMPLATE_BUILD_ID"),
-      dxdChecksum: Config.string("DX_DEPLOYMENT_DXD_CHECKSUM"),
-      dxdReleaseUrl: Config.string("DX_DEPLOYMENT_DXD_RELEASE_URL"),
+      packageDirectory: Config.String("DX_DEPLOYMENT_PACKAGE_DIR"),
+      e2bTemplate: Config.String("DX_DEPLOYMENT_E2B_TEMPLATE"),
+      e2bTemplateBuildId: Config.String("DX_DEPLOYMENT_E2B_TEMPLATE_BUILD_ID"),
+      dxdChecksum: Config.String("DX_DEPLOYMENT_DXD_CHECKSUM"),
+      dxdReleaseUrl: Config.String("DX_DEPLOYMENT_DXD_RELEASE_URL"),
       sourceShallowClone: Config.withDefault(
-        Config.boolean("DX_DEPLOYMENT_SOURCE_SHALLOW_CLONE"),
+        Config.Boolean("DX_DEPLOYMENT_SOURCE_SHALLOW_CLONE"),
         true,
       ),
       workspaceInactivityMs: Config.option(
-        Config.number("DX_DEPLOYMENT_WORKSPACE_INACTIVITY_MS"),
+        Config.Number("DX_DEPLOYMENT_WORKSPACE_INACTIVITY_MS"),
       ),
       turnstileTestKeys: Config.withDefault(
-        Config.boolean("DX_DEPLOYMENT_TURNSTILE_TEST_KEYS"),
+        Config.Boolean("DX_DEPLOYMENT_TURNSTILE_TEST_KEYS"),
         false,
       ),
       // Self-host only: whether magic link needs a Turnstile widget. Hosted
       // targets derive it from their sender.
-      turnstile: Config.option(Config.boolean("DX_DEPLOYMENT_TURNSTILE")),
-      e2bApiKey: Config.option(Config.redacted("E2B_API_KEY")),
-      githubApp: Config.option(Config.redacted("DX_INTEGRATION_GITHUB_APP")),
-      sarvamApiKey: Config.option(Config.redacted("SARVAM_API_KEY")),
+      turnstile: Config.option(Config.Boolean("DX_DEPLOYMENT_TURNSTILE")),
+      e2bApiKey: Config.option(Config.Redacted("E2B_API_KEY")),
+      githubApp: Config.option(Config.Redacted("DX_INTEGRATION_GITHUB_APP")),
+      sarvamApiKey: Config.option(Config.Redacted("SARVAM_API_KEY")),
       // How attachment bytes move: "token" deployments mint a bucket-scoped
       // R2 token Core signs direct URLs with; "core" deployments (Alchemy
       // OAuth, which cannot create tokens) carry the bytes through Core.
       attachmentSigning: Config.withDefault(
-        Config.literals(
+        Config.Literals(
           ["token", "core"] as const,
           "DX_DEPLOYMENT_ATTACHMENT_SIGNING",
         ),
         "token",
       ),
       cloudflareAccountId: Config.option(
-        Config.nonEmptyString("CLOUDFLARE_ACCOUNT_ID"),
+        Config.NonEmptyString("CLOUDFLARE_ACCOUNT_ID"),
       ),
-      exaApiKey: Config.option(Config.redacted("EXA_API_KEY")),
+      exaApiKey: Config.option(Config.Redacted("EXA_API_KEY")),
       // Self-host sign-in providers and admission, validated by the runner.
-      signIn: Config.option(Config.nonEmptyString("DX_DEPLOYMENT_SIGN_IN")),
+      signIn: Config.option(Config.NonEmptyString("DX_DEPLOYMENT_SIGN_IN")),
       googleClientSecret: Config.option(
-        Config.redacted("DX_GOOGLE_CLIENT_SECRET"),
+        Config.Redacted("DX_GOOGLE_CLIENT_SECRET"),
       ),
-      plugins: Config.withDefault(Config.string("DX_DEPLOYMENT_PLUGINS"), ""),
+      plugins: Config.withDefault(Config.String("DX_DEPLOYMENT_PLUGINS"), ""),
       // Orb providers the deployment installs: e2b, cloudflare, or both.
       orbProviders: Config.withDefault(
-        Config.string("DX_DEPLOYMENT_ORB_PROVIDERS"),
+        Config.String("DX_DEPLOYMENT_ORB_PROVIDERS"),
         "e2b",
       ),
       orbWorkerName: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_ORB_WORKER_NAME"),
+        Config.NonEmptyString("DX_DEPLOYMENT_ORB_WORKER_NAME"),
       ),
       workloadIdentitySigningKeys: Config.option(
-        Config.redacted("DX_WORKLOAD_IDENTITY_SIGNING_KEYS"),
+        Config.Redacted("DX_WORKLOAD_IDENTITY_SIGNING_KEYS"),
       ),
       bitbucketOAuth: Config.option(
-        Config.redacted("DX_INTEGRATION_BITBUCKET_OAUTH"),
+        Config.Redacted("DX_INTEGRATION_BITBUCKET_OAUTH"),
       ),
       deploymentZone: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_ZONE"),
+        Config.NonEmptyString("DX_DEPLOYMENT_ZONE"),
       ),
       workersDevSubdomain: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_WORKERS_DEV_SUBDOMAIN"),
+        Config.NonEmptyString("DX_DEPLOYMENT_WORKERS_DEV_SUBDOMAIN"),
       ),
       daemonIngressName: Config.withDefault(
-        Config.nonEmptyString("DX_DEPLOYMENT_DAEMON_INGRESS_NAME"),
+        Config.NonEmptyString("DX_DEPLOYMENT_DAEMON_INGRESS_NAME"),
         "dx-dxd",
       ),
       signupEnabled: Config.withDefault(
-        Config.boolean("DX_SIGNUP_ENABLED"),
+        Config.Boolean("DX_SIGNUP_ENABLED"),
         false,
       ),
       githubCopilotClientId: Config.option(
-        Config.nonEmptyString("DX_GITHUB_COPILOT_CLIENT_ID"),
+        Config.NonEmptyString("DX_GITHUB_COPILOT_CLIENT_ID"),
       ),
       modelDeploymentProviders: Config.option(
-        Config.nonEmptyString("DX_MODEL_DEPLOYMENT_PROVIDERS"),
+        Config.NonEmptyString("DX_MODEL_DEPLOYMENT_PROVIDERS"),
       ),
       modelEndpointAllowlist: Config.option(
-        Config.nonEmptyString("DX_MODEL_ENDPOINT_ALLOWLIST"),
+        Config.NonEmptyString("DX_MODEL_ENDPOINT_ALLOWLIST"),
       ),
       workersAiEnabled: Config.withDefault(
-        Config.boolean("DX_MODEL_WORKERS_AI_ENABLED"),
+        Config.Boolean("DX_MODEL_WORKERS_AI_ENABLED"),
         true,
       ),
       workerTraces: Config.withDefault(
-        Config.boolean("DX_DEPLOYMENT_WORKER_TRACES"),
+        Config.Boolean("DX_DEPLOYMENT_WORKER_TRACES"),
         false,
       ),
       // Portals: a dedicated zone (never the app's registrable domain) whose
       // first-level labels `t-<uuid>-p<port>` serve guest ports. Universal
       // SSL covers one wildcard level, so the domain is the zone apex.
       portalDomain: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_PORTAL_DOMAIN"),
+        Config.NonEmptyString("DX_DEPLOYMENT_PORTAL_DOMAIN"),
       ),
       portalZoneId: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_PORTAL_ZONE_ID"),
+        Config.NonEmptyString("DX_DEPLOYMENT_PORTAL_ZONE_ID"),
       ),
       // The deployment runner names it within the 63-character script limit.
       portalWorkerName: Config.option(
-        Config.nonEmptyString("DX_DEPLOYMENT_PORTAL_WORKER_NAME"),
+        Config.NonEmptyString("DX_DEPLOYMENT_PORTAL_WORKER_NAME"),
       ),
     });
 

apps/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dx/core",
   "private": true,
-  "version": "0.2.25",
+  "version": "0.2.26",
   "license": "FSL-1.1-ALv2",
   "type": "module",
   "scripts": {
@@ -19,8 +19,8 @@
     "@better-auth/utils": "0.4.2",
     "@dx/api": "workspace:^",
     "@dx/domain": "workspace:^",
-    "@effect/sql-d1": "4.0.0-rc.110",
-    "@flue/runtime": "file:../../third-party/flue/runtime-56db2a40ca0e69d97adc53098874ea33c5b617c9.tgz",
+    "@effect/sql-d1": "4.0.5",
+    "@flue/runtime": "file:../../third-party/flue/runtime-e7bef20be3c74f4ffdeeed83b1fe161a1fb5f0c8.tgz",
     "@jitl/quickjs-wasmfile-release-sync": "0.32.0",
     "@logtape/logtape": "2.3.1",
     "@modelcontextprotocol/client": "2.0.0",
@@ -29,7 +29,7 @@
     "better-auth": "1.7.7",
     "diff": "9.0.0",
     "e2b": "2.44.0",
-    "effect": "4.0.0-rc.110",
+    "effect": "4.0.5",
     "hono": "4.12.32",
     "jose": "6.2.3",
     "quickjs-emscripten-core": "0.32.0",
@@ -43,8 +43,8 @@
     "@cloudflare/vitest-plugin": "1.0.0",
     "@cloudflare/workers-types": "5.20260820.1",
     "@earendil-works/pi-ai": "0.85.1",
-    "@flue/sdk": "file:../../third-party/flue/sdk-56db2a40ca0e69d97adc53098874ea33c5b617c9.tgz",
-    "@flue/vite": "file:../../third-party/flue/vite-56db2a40ca0e69d97adc53098874ea33c5b617c9.tgz",
+    "@flue/sdk": "file:../../third-party/flue/sdk-e7bef20be3c74f4ffdeeed83b1fe161a1fb5f0c8.tgz",
+    "@flue/vite": "file:../../third-party/flue/vite-e7bef20be3c74f4ffdeeed83b1fe161a1fb5f0c8.tgz",
     "@msw/cloudflare": "^0.0.1",
     "@types/ws": "8.18.1",
     "@valibot/to-json-schema": "1.7.1",

apps/core/src/auth/requirements.ts

@@ -25,10 +25,10 @@ const parseUrl = (value: string, reason: AuthenticationConfigurationReason) =>
   Effect.try({ try: () => new URL(value), catch: () => fail(reason) });
 
 const configuration = Config.all({
-  environment: Config.nonEmptyString("DX_ENV"),
-  authUrl: Config.nonEmptyString("DX_AUTH_URL"),
-  trustedOrigins: Config.nonEmptyString("DX_AUTH_TRUSTED_ORIGINS"),
-  secret: Config.redacted("BETTER_AUTH_SECRET"),
+  environment: Config.NonEmptyString("DX_ENV"),
+  authUrl: Config.NonEmptyString("DX_AUTH_URL"),
+  trustedOrigins: Config.NonEmptyString("DX_AUTH_TRUSTED_ORIGINS"),
+  secret: Config.Redacted("BETTER_AUTH_SECRET"),
 });
 
 export interface AuthenticationRequirements {

apps/core/src/dev/reference-lifecycle/config.ts

@@ -24,10 +24,10 @@ export interface ReferenceLifecycleConfig {
 }
 
 const configuration = Config.all({
-  baseUrl: Config.string("DX_BASE_URL"),
-  apiToken: Config.redacted("DX_TEMP_API_TOKEN"),
-  projectName: Config.option(Config.string("DX_REFERENCE_PROJECT_NAME")),
-  projectId: Config.option(Config.string("DX_REFERENCE_PROJECT_ID")),
+  baseUrl: Config.String("DX_BASE_URL"),
+  apiToken: Config.Redacted("DX_TEMP_API_TOKEN"),
+  projectName: Config.option(Config.String("DX_REFERENCE_PROJECT_NAME")),
+  projectId: Config.option(Config.String("DX_REFERENCE_PROJECT_ID")),
 });
 
 const decodeBaseUrl = Effect.fn("decodeReferenceBaseUrl")(function* (

apps/core/src/execution/cloudflare/provider.ts

@@ -53,7 +53,7 @@ const InactivityMs = Schema.Finite.check(
 
 const inactivityMs = (bindings: Bindings) =>
   Effect.runPromise(
-    Config.number("DX_WORKSPACE_INACTIVITY_MS")
+    Config.Number("DX_WORKSPACE_INACTIVITY_MS")
       .pipe(Config.withDefault(DEFAULT_WORKSPACE_INACTIVITY_MS))
       .parse(ConfigProvider.fromUnknown(bindings))
       .pipe(