mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 18:37:24 +00:00
Neil
e95a147837
* fix(sandbox-control): read the orgRole claim that Orca Cloud auth mints (#29) Auth mints the live org role as orgRole on sandbox tokens (same claim as billing tokens, stablyai/orca-cloud#695); the verifier read org_role, so admins would never have been recognized. * wip(cloud): environment builds control plane * wip(cloud): environment build boot path, staleness, routes * wip(cloud): env build tests, anonymous staleness fallback * wip(cloud): migration 0008 (claimed), quieter recovered clone errors * fix(cloud): env build review: interrupted-snapshot recovery, bounded log reads, secret redaction, activation guard, hook/prelude fixes * fix(cloud): wait briefly for the build exit code after its log ends; print the base image and package manager * wip(desktop): org environments client, IPC, CLI, settings UI, orcad disk usage + low-disk banner * perf(cloud): smoke-boot each environment build before activating it; skip the redundant prelude fetch * fix(cloud): a GitHub token error fails the build as github_unavailable instead of cloning anonymously * perf(cloud): warm pool VMs per hot environment build, so a create from an org environment skips the provider boot * wip(desktop): cloud environment UI round-3 fixes * fix(cloud): pool-per-build review: smoke race safety, provider hiccups skip smoke, usage-based hot builds with caps, bounded boots, index * fix(desktop): Configure with an agent hands the prompt over at launch (trust dialog swallowed the pasted Enter); CLI builds table widths * polish(desktop): W10 P2s — InlineError action slot, shared focus-ring, copy * feat(cloud): build event stream heartbeat every 20 s * fix(desktop): FE review — stable virtualizer, shadow-buffer replays, heartbeat-aware build watch, CLI follower restarts, repo import path checks, poll races * feat(cloud): meter environment build sandbox time to the member who started it; no setup-script nudge for workspaces booted from an env build * fix(cloud): environment builds progress server-side on a Durable Object alarm, not only while someone streams their log
47 lines
2.5 KiB
JSON
47 lines
2.5 KiB
JSON
{
|
|
"$schema": "node_modules/wrangler/config-schema.json",
|
|
// DEV deployment only (workers.dev, no custom domain). Deploy:
|
|
// wrangler deploy -c wrangler.dev.jsonc
|
|
// Secrets (wrangler secret put -c wrangler.dev.jsonc, never here): VERCEL_TOKEN, SANDBOX_DEV_JWKS,
|
|
// EGRESS_DEV_STATIC_AUTHORIZATION, CONTROL_PLANE_TOKEN (same value as on
|
|
// orca-billing-dev), GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY (PKCS#8), SECRETS_KEK (base64 32 bytes),
|
|
// OPERATOR_TOKEN (/v1/internal/*), GITHUB_STATE_SECRET; for the GitHub connect flow also
|
|
// GITHUB_APP_CLIENT_ID + GITHUB_APP_CLIENT_SECRET (app settings → generate a client secret).
|
|
"name": "orca-sandbox-control-dev",
|
|
"main": "src/index.ts",
|
|
"compatibility_date": "2026-11-01",
|
|
"workers_dev": true,
|
|
"d1_databases": [
|
|
{
|
|
"binding": "SANDBOX_DB",
|
|
"database_name": "orca-sandbox-control-dev",
|
|
"database_id": "e9f259e9-94b3-4e18-a132-2d807693a498",
|
|
"migrations_dir": "migrations"
|
|
}
|
|
],
|
|
// Same-account Workers cannot call each other over workers.dev (error 1042); BILLING_URL names the origin.
|
|
"services": [{ "binding": "BILLING", "service": "orca-billing-dev" }],
|
|
// Every minute for routines (src/routines); the rest of the cron work runs on minute % 5 == 0.
|
|
// Environment builds advance on Durable Object alarms (EnvironmentBuildRunner), not on readers.
|
|
"durable_objects": { "bindings": [{ "name": "ENV_BUILD_RUNNER", "class_name": "EnvironmentBuildRunner" }] },
|
|
"migrations": [{ "tag": "env-build-runner-v1", "new_sqlite_classes": ["EnvironmentBuildRunner"] }],
|
|
"triggers": { "crons": ["* * * * *"] },
|
|
"vars": {
|
|
"SANDBOX_ENV": "dev",
|
|
"SANDBOX_POOL_SIZE": "2",
|
|
// The golden orcad tracks this branch (host RPCs ship there first); rebuilt when HEAD touches VM code.
|
|
"GOLDEN_IMAGE_SOURCE": "git:https://github.com/nwparker/orca-private#cloud/integration",
|
|
"SANDBOX_JWT_AUDIENCE": "orca-sandbox",
|
|
"SANDBOX_JWKS_URL": "https://login.onorca.dev/.well-known/jwks.json",
|
|
"SANDBOX_AUTH_ISSUER": "https://login.onorca.dev",
|
|
"VERCEL_TEAM_ID": "team_c5IO9DfEYAxKEUgMxrbEtO0a",
|
|
"VERCEL_PROJECT_ID": "prj_SkVtv6zJurF9dUHpfTRy4v9avwPq",
|
|
"VERCEL_REGION": "iad1",
|
|
"BILLING_URL": "https://orca-billing-dev.lovecast.workers.dev",
|
|
// Golden image from image/build-golden-image.ts; lifecycle routes answer 503 without one.
|
|
"GOLDEN_SNAPSHOT_ID": "snap_vpcmcCAgTtISiTZgsCosOlThQbFd",
|
|
"GITHUB_APP_SLUG": "orca-cloud-dev",
|
|
"EGRESS_PROXY_URL": "https://orca-sandbox-control-dev.lovecast.workers.dev/v1/egress/proxy"
|
|
}
|
|
}
|