Leo
fb2d0b0c2d
feat(self-hosted): acr init --self-hosted installer + recipe push 把關 + commit 部署 wasm
...
讓任何 CC 用自己的 CF 帳號一鍵 self-host arcrun（戰法轉 self-hosted 開源）。
Task 1 — acr init --self-hosted installer（用戶只給 CF Account ID + token，其餘自動）：
- cli/src/lib/cf-api.ts: CfAccountClient（驗 token / 建 KV 冪等 / 建 R2 / 查 workers.dev subdomain）
- cli/src/lib/deploy.ts: 從 GitHub codeload tarball 拉部署物 → 注入用戶 KV id → wrangler deploy
（tier1 component-builds 先、tier2 cypher-executor/registry 後；部分失敗誠實回報不假綠）
- cli/src/lib/api-recipe-seeds.ts: 10 個現役 API recipe 種子（KBDB 採 Supabase 模式）
- cli/src/commands/init.ts: initSelfHosted() 改寫成 installer 流程
- cli/src/commands/update.ts: acr update（拉新 ref 重部署）
- cypher-executor/scripts/seed-api-recipes.ts: prod 補灌腳本
Task 2 — recipe 入庫把關（封鎖自製零件後，CC 唯一能擴充的是 recipe）：
- cli/src/commands/recipe.ts: 新增 probeRecipeEndpoint 打通檢查（提醒級不硬擋，
含模板誠實說明待 run 才知，401/403 標多半缺 credential 非 bug）
- 資料外流提醒沿用既有 obtainExposureConsent（非 TTY 拒絕）
部署物產製：commit 預編譯 wasm 進 repo（推翻 rule 05「wasm 不 commit」）：
- .gitignore: 放行 .component-builds/**/component.wasm（registry 中間產物仍排除）
- 只 commit 19 個正當零件 wasm；claude_api / km_writer / kbdb_upsert_block 排除
（非薄殼、是把工作流硬塞進零件，違反 DECISIONS §1，待降級）
- rule 05 同步記錄此慣例變更 + 膨脹 trade-off
SDD: sdk-and-website/self-hosted-init.md（installer 定案）、
component-gatekeeping/recipe-push-gatekeeping.md（recipe 把關）
README 重寫成單一 self-hosted 路徑。CLI typecheck exit 0。
未完（待 richblack）：push 此 commit 到 GitHub 後 codeload 才拿得到 wasm；
用第二 CF 帳號端對端驗收 acr init --self-hosted。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-02 18:44:41 +08:00
Leo
c830897988
fix(cypher): register kbdb_upsert_block + workers_dev=true on all 32 components
...
兩件事一起補：
1. cypher-executor 的 WASM_HTTP_RUNNER_IDS 白名單漏加 kbdb_upsert_block。
mira 7B.3f 端對端 debug 才發現 upsert 節點直接拋「找不到零件」。
建零件時要記得同步註冊到 loader。
2. .component-builds/*/wrangler.toml (×32) 全部加 workers_dev = true。
解決每次新部署 component 都要去 CF Dashboard 手動啟用 workers.dev URL
的痛點（leo 今天踩這個踩了好幾次）。zero-touch deploy + free tier 友好，
符合 arcrun 「fork 後 self-host 用 free tier 跑得起來」的核心目標。
對 mira 端：wiki_synthesis.yaml 還原回完整鏈
（lookup → compose → upsert + 平行的 FOREACH paragraphs/triplets）。
2026-05-14 11:37:28 +08:00
Leo
519423cb0d
feat(arcrun): mira wiki page with tag filter + accumulated WIP
...
- landing/app/mira/wiki: tag=mira-wiki list now shows all wiki paragraphs
(depends on KBDB tag filter exposed in matrix/kbdb commit, separate repo)
- landing: app/mira hub + feed split + various WIP from prior sessions
- registry/components: claude_api / kbdb_create_block / kbdb_get / km_writer /
platform_crypto / auth_oauth2 contracts + main.go (accumulated)
- .component-builds: pkg-lock updates + index.ts adjustments (WIP)
- .agents/specs/arcrun/frontend-redesign: design notes
- docs/test_credentials, docs/user_requirements/arcrun-landing-page: WIP docs
- cypher-executor: auth-dispatcher / wasi-shim adjustments (WIP)
Includes accumulated work from prior sessions plus the wiki UI tag-filter
update that surfaces the AI-generated wiki paragraphs at /mira/wiki.
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com >
2026-05-07 16:52:01 +08:00
Leo
18f04448ce
feat(auth): auth_static_key WASM primitive + host functions
...
- wasi-shim gains kv_get / crypto_decrypt / crypto_sign_rs256 host
functions with strict boundary (ENCRYPTION_KEY never exits Worker).
- registry/components/auth_static_key: TinyGo impl for API-key /
Bearer / Basic Auth recipes (80% of supported services).
- .component-builds/auth_static_key: independent Worker at
auth-static-key.arcrun.dev, imports wasi-shim cross-directory.
- cypher-executor/auth-dispatcher routes static_key recipes to the
new Worker instead of credential-injector TS.
Replaces TS credential injection per
.agents/specs/arcrun/credential-primitives-wasm Phase 1.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com >
2026-04-20 16:54:18 +08:00
Leo