Leo/Arcrun
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
91 Commits 8 Branches 0 Tags
93bb4d332769970de78acb849b28b2011b7966ad
Commit Graph

9 Commits

Author SHA1 Message Date
Leo 17a076d35c feat(arcrun): Phase 2 降級假零件成 recipe + credential 鏈路修復 
Phase 1（credential 注入鏈路）：
- 修 auth_static_key ENCRYPTION_KEY 漂移根因（見 docs/incidents）
- component-loader: readBodyOnce() 修 "Body has already been used"

Phase 2（降級假零件成 recipe，registry/components 33→22）：
- 引擎: RecipeDefinition 加 auth_service（多 recipe 共用一把 auth）
  auth-dispatcher 先查 recipe.auth_service 再 fallback componentId
- 引擎: auth_static_key inject.path + makeRecipeRunner {{auth.K}}
  （endpoint 可插 secret，解 telegram 類 URL-path token）
- 引擎: makeRecipeRunner auto-body 剔除 _ 前綴內部欄位
- 降級並刪除: kbdb_{get,create_block,patch_block,delete,ingest}
  gmail/telegram/line_notify/google_sheets（改建為 recipe）
- 刪除: ai_transform_{compile,run}（Arcrun 是 AI 呼叫的工具，
  工作流不該內嵌 AI 節點回頭呼叫 AI）
- deferred（源碼暫留）: claude_api/km_writer（交 Mira 收成工作流）、
  kbdb_upsert_block（交 KBDB 出 upsert endpoint）

文件: DECISIONS.md（工作流是 default/建零件人類閘門/AI→工具）、
BACKLOG.md、auth-recipe.md §七、docs/incidents 加密 key 漂移

驗收: KBDB get/create/ingest/delete 2xx；telegram auth 注入綠；
gmail/sheets/line recipe 正確但缺 credential 未驗收；
kbdb patch 403 為 KBDB 端 bug（已交 kbdb/docs）

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-29 16:18:18 +08:00
Leo c830897988 fix(cypher): register kbdb_upsert_block + workers_dev=true on all 32 components 
兩件事一起補：

1. cypher-executor 的 WASM_HTTP_RUNNER_IDS 白名單漏加 kbdb_upsert_block。
   mira 7B.3f 端對端 debug 才發現 upsert 節點直接拋「找不到零件」。
   建零件時要記得同步註冊到 loader。

2. .component-builds/*/wrangler.toml (×32) 全部加 workers_dev = true。
   解決每次新部署 component 都要去 CF Dashboard 手動啟用 workers.dev URL
   的痛點（leo 今天踩這個踩了好幾次）。zero-touch deploy + free tier 友好，
   符合 arcrun 「fork 後 self-host 用 free tier 跑得起來」的核心目標。

對 mira 端：wiki_synthesis.yaml 還原回完整鏈
（lookup → compose → upsert + 平行的 FOREACH paragraphs/triplets）。
 2026-05-14 11:37:28 +08:00
Leo 4e746986b4 feat(arcrun): add kbdb_upsert_block component for idempotent block writes 
對應 mira 7B.3f：per-entity index-entry 維護需要「找有則 PATCH 沒找到 POST」，
arcrun workflow 沒 IF/branch 能力（已知限制 #1 + 新 P1 #1），用 kbdb_upsert_block
零件把分支邏輯封進零件內：GET /blocks?page_name=X → user_id filter → 找到 PATCH 沒找到 POST。
page_name 當 idempotency key，未來其他「找有則改沒則建」場景共用。

SDD：polaris/mira/.agents/specs/mira-app/design.md §3.5.12.4.1
     matrix/arcrun/.agents/specs/arcrun/arcrun.md 三-A P1 #1 + 三-B 新零件加入紀錄
 2026-05-14 10:18:21 +08:00
Leo 519423cb0d feat(arcrun): mira wiki page with tag filter + accumulated WIP 
- landing/app/mira/wiki: tag=mira-wiki list now shows all wiki paragraphs
  (depends on KBDB tag filter exposed in matrix/kbdb commit, separate repo)
- landing: app/mira hub + feed split + various WIP from prior sessions
- registry/components: claude_api / kbdb_create_block / kbdb_get / km_writer /
  platform_crypto / auth_oauth2 contracts + main.go (accumulated)
- .component-builds: pkg-lock updates + index.ts adjustments (WIP)
- .agents/specs/arcrun/frontend-redesign: design notes
- docs/test_credentials, docs/user_requirements/arcrun-landing-page: WIP docs
- cypher-executor: auth-dispatcher / wasi-shim adjustments (WIP)

Includes accumulated work from prior sessions plus the wiki UI tag-filter
update that surfaces the AI-generated wiki paragraphs at /mira/wiki.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-07 16:52:01 +08:00
Leo 497f92a268 feat(arcrun): recipe system + resumable workflow + component registry canon 
Three new platform capabilities + one component (kbdb_get) to enable
real AI workflow execution through cypher binding YAML.

## Recipe System (容器 + Recipe 模式)
SDD: .agents/specs/recipe-system/

- prompt_recipe schema (Zod): fragments + inputs + assembly + output
- recipe-expander.ts: expand recipe ref → real prompt by fetching KBDB blocks
  + pulling context fields with transforms (pluck_content / extract_field / etc)
- 7 transform whitelist: json_array / to_string / join / markdown_list /
  extract_field / first / pluck_content
- graph-executor hooks: detect node.data.recipe → expand → inject into ctx
- output JSON parser (with markdown fence stripping for Claude-wrapped JSON)
- Stored in RECIPES KV under prompt_recipe:{name}

## Resumable Workflow (webhook callback resume)
SDD: .agents/specs/resumable-workflow/

- WorkflowPaused class + paused-runs.ts (persist/load/consume in EXEC_CONTEXT KV, 24h TTL)
- graph-executor: detect {pending:true, task_id} → persist state → throw WorkflowPaused
- cypher-handlers: catch → return {success:true, paused:true, task_id, run_id}
- POST /workflows/resume route: consume KV state → resumeFromPaused()
- Auto-inject callback_url for claude_api nodes (PUBLIC_BASE_URL or default cypher.arcrun.dev)
- claude_api/main.go: forward callback_url to Mira daemon, default timeout 25s→120s
- Idempotent (consume = load+delete)

## Component Registry Canon
SDD: .agents/specs/component-registry-canon/

- Add POST /components/index-only endpoint (metadata-only, no wasm/sandbox)
- Backfill script (mjs): scan registry/components/*/contract.yaml → submit to KV
- register-component.sh: SSOT for local + CI hook (deploy.yml change in next commit)
- Drop R2 dead storage from submitComponent + types + wrangler
- Schema relaxed: category enum + auth/ai/platform; cold_start 50→500ms; size 2→8MB

## kbdb_get component
- registry/components/kbdb_get/: TinyGo WASM, two modes (block_id / page_name list)
- .component-builds/kbdb_get/: WASI shim worker (kbdb-get.arcrun.dev)

End-to-end validation: AI uses MCP execute_workflow with recipe ref →
cypher-executor expands prompt from KBDB schema/skill blocks + drafts →
claude_api calls Mira daemon → daemon callback fires resume route →
workflow continues. Verified with real 2KB+ Karpathy LLM Wiki draft.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-07 15:52:19 +08:00
Leo 500d796573 feat: 15 logic component Workers + cypher-executor auth/credentials routing 
Component Workers:
- Deploys if_control, switch, filter, merge, try_catch, wait, set,
  array_ops, string_ops, number_ops, date_ops, validate_json,
  ai_transform_compile, ai_transform_run, foreach_control as
  independent Workers, backing cypher-executor's SVC_* service
  bindings (fast internal RPC for logic components).

cypher-executor routing:
- New routes: /auth (recipe resolution), /credentials (CRUD),
  /webhooks/named (user-friendly alias for cmp_/rec_ hashes).
- auth-recipe-seeds.ts: 20 pre-built platform auth recipes
  (Google Sheets, Gmail, Telegram, etc.) seeded into RECIPES KV.
- graph-executor + cypher-handlers + search-nodes updated for
  the new resolution chain.
- scripts/seed-auth-recipes.ts: one-shot tool to push seeds to KV.
- wrangler.toml: 15 SVC_* bindings wired to the new logic Workers.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-20 17:40:02 +08:00
Leo 6a3219e51b feat(components): move 6 API components to independent WASM Workers 
Deploys gmail, telegram, line_notify, google_sheets, http_request, cron
as independent Cloudflare Workers at {name-kebab}.arcrun.dev. Each
wraps the TinyGo WASM from registry/components/{name}/main.go via
wasi-shim cross-import (Method A).

component-loader no longer carries BUILTIN_API_RECIPES — those
hardcoded gmail.googleapis.com / api.telegram.org / sheets / line-notify
endpoints all lived in TS, violating "all business logic in WASM".
Resolution chain now routes the 6 canonical IDs straight to their
{name}.arcrun.dev Worker URLs via WASM_HTTP_RUNNER_IDS.

Per .agents/specs/arcrun/credential-primitives-wasm Phase 3.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-20 17:36:06 +08:00
Leo 8c14562a2f feat(auth): auth_service_account WASM primitive + remove TS JWT signer 
- registry/components/auth_service_account: TinyGo impl for Google
  Service Account (JWT-bearer → token exchange) and base structure
  for AWS SigV4.
- .component-builds/auth_service_account: independent Worker at
  auth-service-account.arcrun.dev, extends wasi-shim with an
  http_request host function for the token exchange step.
- Delete cypher-executor/src/lib/wasm-executor.ts (legacy, replaced
  by component-loader WASM HTTP runner path).
- credential-injector.ts service_account branch now throws — all
  service_account recipes must route through auth-dispatcher.

Per .agents/specs/arcrun/credential-primitives-wasm Phase 2.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-20 17:34:42 +08:00
Leo 18f04448ce feat(auth): auth_static_key WASM primitive + host functions 
- wasi-shim gains kv_get / crypto_decrypt / crypto_sign_rs256 host
  functions with strict boundary (ENCRYPTION_KEY never exits Worker).
- registry/components/auth_static_key: TinyGo impl for API-key /
  Bearer / Basic Auth recipes (80% of supported services).
- .component-builds/auth_static_key: independent Worker at
  auth-static-key.arcrun.dev, imports wasi-shim cross-directory.
- cypher-executor/auth-dispatcher routes static_key recipes to the
  new Worker instead of credential-injector TS.

Replaces TS credential injection per
.agents/specs/arcrun/credential-primitives-wasm Phase 1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-20 16:54:18 +08:00