The device plane: author, build, flash, provision, observe, update - #5
Merged
Conversation
Statements ran one at a time, so a failure part-way left the schema half-applied and the retry restarted from the first statement. That is only safe while every statement is idempotent — the first ALTER TABLE would turn a partial failure into a permanent failure loop on an instance nobody can see. db.batch() is a real transaction. The applied_at write rides inside it, so d1_migrations can never record a migration that did not commit.
Durable Objects get no migration runner, so each class now carries an ordered list of schema changes and walks itself forward inside transactionSync() the first time it wakes after a deploy. One that throws rolls back rather than stranding storage between versions, and the constructor runs before any method, so no caller sees a half-migrated object. The baseline is the existing schema unchanged, so an object that predates versioning replays it as a no-op and converges on the version a fresh object reaches. SchedulerDO is key-value only and needs none of this.
The build preserved each deployment's wrangler.toml verbatim, which froze its topology at whatever the Deploy button wrote on day one: a binding, cron or compatibility flag added upstream never reached anyone who had already deployed. Bindings, flags and build config now come from upstream's carrier template, while the Worker name, account, routes, resource ids and vars come from the deployment. Taking upstream's name instead would create a second Worker and orphan the live one, so identity is merged in by binding rather than by position. The build script is fetched from master while the source clone is the latest release tag, so a release predating the merge script falls back to the previous behaviour instead of failing.
The monitor holds an exclusive reader on the port and the flasher needs it closed, so both go through claim(), which tears down the read loop, closes the port, hands it over, and restores the monitor at its previous baud. Two owners racing for the same lock is what produces "port already open" errors that survive a reload. Console lines are source-tagged, because flash progress never arrives over the port — esptool-js speaks binary to the ROM loader and reports separately. Web Serial is absent from TypeScript's DOM lib, hence the types dependency.
Splits the stream into levels the console can colour: SDK lines by their message, ESP-IDF lines by their severity letter, boot ROM output by its prefixes, and anything else as plain sketch output. Entries commit once per animation frame rather than per line — a board at 115200 baud can outrun per-line reactivity. Pausing holds new lines aside instead of dropping them. Tracks whether recent output is mostly replacement and control characters, which is what a wrong baud rate looks like.
A Device section under each project, with a console that connects a board over Web Serial and shows what it prints. Output follows the tail only while the view is at the bottom — a chatty board otherwise makes it impossible to read back through a fault. Browsers without Web Serial get a page naming the ones that do and saying this is the only part of nodrix that needs USB, rather than a dead button. The hub takes the tabbed shape Variables and Automations already use, with one tab for now.
Turns SDK debug output into a banner above the console — "Token rejected", "The server refused the connection" — instead of leaving a red line for the reader to interpret. The newest significant line wins, so recovering from a fault clears the stale error. Wi-Fi state is tracked separately from cloud state, which is what makes a compound reading possible: "Wi-Fi is up" in front of a server failure says the radio is fine and the problem is further along. diagnose() takes an entry array and holds no reactive state, so the rules are tested directly rather than through a mounted component.
Adds a devices table and a default device per project, then rebuilds project_variables with device_id in its unique key. Telemetry that names no device lands on the default, so a plain curl with only a token keeps working. project_variables is rebuilt rather than altered because device_id is NOT NULL with a foreign key and the unique key changes shape. Nothing references that table by foreign key, so the rebuild needs no deferral. Default device ids derive from the project id, which keeps the migration deterministic without generating ids in SQL, and one default per project is enforced by a partial unique index rather than left to convention. Tested against SQLite: an instance seeded before the upgrade and a fresh install come out with byte-identical schemas, and replaying the baseline over a migrated database does not reinstate the old two-column unique index.
Boards identify themselves with an X-Nodrix-Device header; the value maps to a device row, created on first sight. Anything that names no device lands on the project's default, so an existing board or a plain curl keeps working untouched. The reported key is untrusted input — normalised, length-capped, and bounded at 100 devices per project so a board that reports a fresh key every boot can't grow the table without limit. It is kept apart from the device id so renaming stays free and a MAC never surfaces in anything a user reads. Device creation reads back after inserting rather than trusting the id it generated: two isolates racing on the same first boot both insert, one loses the conflict, and returning its own id would attribute telemetry to a row that does not exist. createProject now writes the project and its default device in one batch. The migration only covers projects that already existed, so without this a project created after upgrading would have no default device at all.
latest_state is rebuilt on (device_id, variable), ring_buffer and pending_control gain the column, and the ring index follows. '' marks the project's default device and every pre-devices row backfills to it. NULL cannot serve there: SQLite treats NULLs as distinct in a unique key, so the upsert would never match and each write would append a duplicate row instead of updating one. pending_control does use NULL, where it means a control write with no target that still broadcasts. R2 keeps its shape — the device goes in the NDJSON row, not the key path, so an hour isn't fragmented into one small object per device. Rows written before this read back as the default device. Series reads take an optional device filter; omitting it queries the whole project, which is what dashboards still do.
Ingest now carries the device through to Durable Object storage, and /state groups by device rather than returning a flat key map. Those had to change together: two boards reporting the same key into a flat map means the second silently overwrites the first, which is the whole point of having devices. resolveDevice returns both ids it is asked for — the D1 id that owns the variable rows, and the storage id the DO keys by, which is '' for the default device. Callers get what they need without either of them knowing the rule. Adds list, rename and forget. The default device can't be forgotten; without one, telemetry that names no device has nowhere to land. Forgetting drops D1 rows and DO state but leaves R2 history, which is only safe because the device is named in each row rather than in the key path.
Adds a hello frame carrying the device key and optional chip and firmware. An all-WS board never sends an HTTP header, so without this it had no way to say which board it was and everything landed on the default device. The socket's device is held in serializeAttachment rather than memory: a hibernated Durable Object keeps the attachment but loses anything in an isolate, so an idle board that wakes hours later stays attributed. Connect and hello split the pending-control flush. A socket has to catch up the moment it connects, but its identity isn't known until hello arrives, so it starts as the default device and takes broadcasts and default-device writes, then re-scopes and drains its own queue on hello. The two queries can't overlap, and a hello that fails to resolve returns rather than falling through to the default. Control writes can now target one device; a null target still broadcasts.
Devices becomes the first tab under Device and the console moves alongside it. Renaming matters more than it looks: a board identifies itself by something MAC-derived, and without a name that string would surface in every variable a user reads. The default device is badged and has no Forget control, mirroring the server rule rather than trusting the client to know it. The forget confirmation spells out what happens, because none of it is guessable: variables and recent history go, archived telemetry stays, and the board reappears if it ever reports again. Focus on the rename input is set from a function ref. A template ref declared inside v-for collects into an array — the compiler decides that by lexical position, so the v-if narrowing it to one row makes no difference — and calling focus() on the array would have thrown.
Variable triggers take an optional device, defaulting to any. Both readings are real — one rule per place, or one rule for every place — and neither was expressible before. An automation now stays on the device that fired it: set_variable targets it and condition reads come from its state, so a rule about one greenhouse can't switch the fan in another. Pending control was returned in full to any polling board, so a second device executed writes meant for the first. Listing and acking are both scoped now — a device sees broadcasts and its own, and can't consume another's queue. Triggers name devices by their D1 id while storage calls the default device '', so the id is mapped before comparing. Without that a trigger pinned to the default device matches nothing and the automation silently never fires.
Drives esptool-js through the port handoff the console already owns, so the monitor tears down cleanly and comes back when the write finishes. Flasher progress is pushed into the same console buffer. It arrives out of band — the port is speaking binary to the ROM loader at the time — and without it the console simply goes dead for twenty seconds mid-session. after() resets the board once writing completes; skipping it leaves the chip in the ROM bootloader until it is physically unplugged, which reads as a bricked board. The transport is disconnected in a finally so a failed flash doesn't leave the port held for the rest of the session. esptool-js is 106 kB, so it stays in the lazily loaded Flash chunk rather than the main bundle.
GitHub's API sends CORS headers but release assets do not — they redirect to a host that sends none — so the browser can read the catalogue and cannot read the binary. The worker proxies both, which also keeps every browser off the unauthenticated GitHub rate limit. The download endpoint takes a tag and a filename, never a URL, and builds the target from a fixed repo. Both parts are charset-checked and '..' is rejected on its own, since the charset allows dots and v1..2 would otherwise climb out of the release path. The catalogue caches in KV behind an ETag. No published release reads as an empty catalogue rather than an error, and the panel falls back to picking a local .bin, which is what it did before.
Assigning firmware to a device sets desired state and returns. The board compares its reported version against that and pulls when they differ — nothing is pushed at it, no job is tracked, and the slow part runs on the ESP32 where a Worker CPU limit can't reach it. Devices get two endpoints, both on the token and device header they already use for telemetry: one asks whether to update, one streams the image from R2. Success is the board reporting the desired version on its next hello. That's the only honest signal available — the cloud cannot know a device booted. A failed insert deletes the image it already wrote, so losing the unique version race can't strand an object in R2 that nothing points at. The nudge crosses into Durable Object storage, where the default device is '' rather than its D1 id, so it goes through storageIdOf. That mapping has now caught three call sites and lives in one place.
The devices table reads "Running" and "Should run" rather than offering a start button, because that is what the system does — you state desired state and the board reconciles when it next checks. There is no job to watch. The upload form warns that the version must match what the sketch reports. A mismatch updates the board and never marks it done, which is the easiest way to be confused by any of this. Images post as a raw body rather than through the JSON helper; base64 in JSON would inflate a megabyte image by a third for nothing.
A CodeMirror editor with C++ highlighting, seeded from the SDK examples and kept per project in localStorage. Example sources are read at the same release tag the binaries were built from, not the default branch, so what's on screen is what a published image was compiled from. raw.githubusercontent sends CORS headers, so unlike release assets this needs no proxy. The compile box explains why a browser can't run a C++ toolchain and what to do instead, rather than offering a button that does nothing. CodeMirror and esptool-js are both excluded from the service worker precache. Workbox globs every chunk, so ~630 kB of toolchain was being downloaded on install by people who may never open either tab.
Deleting a variable cleared its hot state for every device in the project, not the one that owned it. Five sensors reporting temp from five places meant removing one wiped all five — the exact case device scoping exists for. Deleting a project wiped telemetry/ but not firmware/, leaving images in R2 that nothing could reach and nothing would ever remove.
The migration to 2.0 runs once, unattended, on instances nobody can observe. Every other safeguard — batched statements, transaction-wrapped Durable Object steps — lowers the chance of failure without putting a floor under it. This is the floor: a copy taken before upgrading, and something to compare against afterwards. NDJSON, one typed record per line, streamed from an async generator so a project carrying a year of telemetry never sits in memory. No secrets leave: token hashes, sealed integration config and dashboard share tokens are all omitted. That makes the file safe to hand to someone, and means it restores data rather than credentials.
The image endpoint serves about a megabyte a call and had no throttle. A boot-looping board — likelier than an attacker — would pull it in a loop against R2 egress. The counter lives in Durable Object SQLite rather than KV. The existing auth throttle is deliberately soft and fails open, which is right when the cost of over-blocking is locking someone out of their own instance. Here the cost is money, and a device hammering in a loop can outrun an eventually consistent counter, so this one is strongly consistent and fails closed.
Durable Objects have no migration runner, so an object created today and one that predates devices arrive by different routes. The divergence that matters is silent — a column NOT NULL on one and nullable on the other — so the two are now compared directly rather than assumed equal. Also asserts what the '' sentinel exists for: two writes to the default device produce one row. With NULL they would produce two, because SQLite treats NULLs as distinct in a unique key. The schema ladder moves to its own module so a test can drive it without pulling in the Durable Object runtime.
The ring buffer capped 1,000 rows for the whole project. That is generous with one board and quietly wrong with five — 200 points each, charts thinning as hardware is added, and nothing anywhere explaining why.
Derived from last_seen at read time rather than stored. A device that goes quiet never writes anything, so there is nothing to flip a stored flag.
A key stopped being unique once variables became device-scoped. set_variable checked existence with project and key alone, so an LLM could target one device using a variable that only exists on another. Reading with no device still spans the project, which is what a single-device instance always returned. Writing with no device targets the default rather than broadcasting — a model steering hardware should reach one board unless it says otherwise.
Every upload was an artifact nothing would ever remove — around 1.5 MB each against a 10 GB free tier, unbounded. Keeps the ten most recent, plus anything a device runs or is waiting to run. Those exclusions are the point: dropping a desired image strands a pending update behind a dangling reference, and dropping a running version loses the image a board in the field is actually on. Pruning can't fail an upload that already succeeded, so a failure leaves one extra image behind until the next one.
Dashboard widgets bind to a bare variable key, but storage is per device now. A second board reporting the same key made getLatestState return both rows — the widget showing whichever came last — and merged both into one chart series. Silently, with no error and no way to tell. The automation engine had the same shape for schedule, sunset and manual runs, which carry no device. That one was accidentally right, since '' sorts before any generated id; it no longer depends on collation. /state still returns every device grouped — showing all of them is its job.
Widgets bind to a bare variable key, so a dashboard needs to say which board those keys belong to. Layout gains an optional device; absent means the project's default, which is what every dashboard did before devices existed — so no stored layout changes and nothing needs migrating. Dashboard-level rather than per-widget. Per-widget would touch every widget's props, the extractor, the builder and the snapshot API to fetch several devices at once; this composes with that later rather than blocking it. The cost today is that five sensors in five places means five dashboards.
The selector only appears once a project has more than one device, so a single-board instance gains no control it has no use for. normalizeLayout rebuilds the layout field by field and was dropping device when rescaling an older grid, which would have quietly reset a dashboard to the default device on the next save.
The agent dials into ProjectDO and its socket is tagged in the attachment, so agent frames and device frames route apart on the same object — no new Durable Object class. Nothing is queued for an absent agent. Compiling is work on someone's physical machine, and a queue would fire builds hours later when a laptop reopens; no agent connected is an immediate 409. The browser's request is held open until the agent answers, which works because a Worker has no wall-clock limit while a client is connected. Five minutes, since a first build installs a toolchain. Owner and admin at both ends, on the socket and on the build request. A member triggering a build would be arbitrary toolchain execution on someone else's laptop.
recordDeviceSeen had one caller — the WebSocket hello handler — so HTTP-mode boards never updated last_seen and the online indicator read them as never seen. On an upgraded instance every device is the default device, so that is every device. touchDevice writes at most once a minute per device and is called from HTTP ingest, the control poll, the OTA check and image download, and WS telemetry (hello alone left a long-lived socket looking stale). The WS path also attributed variables to the default device regardless of which device the socket belonged to, so a named board's telemetry landed under its own id while its variable rows were created elsewhere.
requestBuild carried the whole binary back as base64 through an object that is also running ingest, the ring buffer, R2 flushes and automation evaluation for every board in the project. The DO now carries job control only. The agent PUTs to /v1/agent/artifact which streams straight into R2, then reports the result, so ok always means the object is collectable; the browser fetches it once and the route deletes it. builds/ joins the project-delete prefix loop, and a sweep on each new build drops anything a timed-out request left behind.
… shipped An HTTP-mode board also never reported the version it runs, so offerFor compared against NULL, offered the update, and would have gone on offering it after it succeeded — boot, flash, restart, repeat, bounded only by the hourly download quota. The check route now reads X-Nodrix-Firmware and X-Nodrix-Chip and feeds them to the same recordDeviceSeen and reconcile pair the hello frame uses. offerFor takes the reported version and prefers it over the stored one, so the answer is right in the same request instead of one round trip later.
There was a problem hiding this comment.
🟡 Changes recommended
Several control-path behaviors are inconsistent under multi-device semantics (notably dashboard control scoping and pending-control NULL device_id handling), and there are a few concrete operational/security hardening gaps that should be addressed before merge.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Implements the “device plane” across the Worker and web app: adds first-class devices per project (including a default device), device-scoped variables/dashboards/automations/control delivery, firmware storage + OTA reconciliation, a local build agent bridge, and browser-side tooling (Web Serial console, flashing, sketch editor). It also strengthens migration safety (D1 batch migrations + DO schema ladder) and adds NDJSON export as a backstop for unattended upgrades.
Changes:
- Add D1 + Durable Object schema support for devices, device-scoped state/control, OTA quota tracking, and migration verification tests.
- Introduce firmware catalog/proxy, firmware upload/assignment + OTA endpoints, and a WebSocket/HTTP protocol for local build agents + artifact transfer.
- Add web UI for device management, firmware/OTA, Web Serial console, browser flashing, and a CodeMirror-based sketch editor; adjust PWA precache to lazy-load heavy chunks.
File summaries
| File | Description |
|---|---|
| wrangler.toml | Updates build pipeline comments to reflect wrangler merge behavior. |
| worker/test/ws-protocol.test.ts | Adds WS hello/metadata parsing coverage. |
| worker/test/ota-offer.test.ts | Adds OTA offer logic regression tests. |
| worker/test/migrations.test.ts | Adds D1 migration equivalence + data survival tests. |
| worker/test/firmware-url.test.ts | Adds URL hardening tests for firmware proxy. |
| worker/test/do-schema.test.ts | Adds DO schema-ladder equivalence tests and default-device semantics. |
| worker/test/device-seen.test.ts | Adds device last_seen throttling tests. |
| worker/src/routes.ts | Registers new devices/firmware/OTA/agent routes. |
| worker/src/platform/lib/layout.ts | Extends dashboard layout validation with device selection. |
| worker/src/platform/lib/ids.ts | Adds ID prefixes for devices/firmware/builds. |
| worker/src/platform/lib/audit.ts | Adds audit target types for device/firmware. |
| worker/src/platform/engine/types.ts | Adds device scoping to variable triggers and automation context. |
| worker/src/platform/engine/run.ts | Ensures default variable reads use the default device sentinel. |
| worker/src/platform/durable-objects/schema.ts | Introduces generic DO schema migration helper. |
| worker/src/platform/durable-objects/project-schema.ts | Adds DO schema steps for device-scoped state/control + OTA quota table. |
| worker/src/platform/durable-objects/project-do.ts | Device-scopes ingest/state/control, adds OTA quota, agent build coordination, and expanded R2 cleanup. |
| worker/src/platform/durable-objects/dashboard-do.ts | Migrates DO schema and scopes dashboard snapshots to a selected device. |
| worker/src/platform/db/migrations/0002_devices.sql | Adds devices + firmware tables and migrates variables to be device-scoped. |
| worker/src/platform/db/migrations.gen.ts | Bundles the new D1 migration statements. |
| worker/src/platform/db/auto-migrate.ts | Switches D1 migrations to one db.batch() per migration for transactional rollback. |
| worker/src/mcp/tools-write.ts | Adds device parameter to MCP write tool for device-scoped control. |
| worker/src/mcp/tools-read.ts | Adds device parameter to MCP read tool for device-scoped series reads. |
| worker/src/domains/variables/service.ts | Moves state/series/control logic to be device-aware and default-device safe. |
| worker/src/domains/variables/routes.ts | Scopes variable hot-state deletion to the variable’s device. |
| worker/src/domains/telemetry/ws-protocol.ts | Adds hello frame parsing with capped metadata. |
| worker/src/domains/telemetry/variables.ts | Makes variable upsert/last_seen throttling device-scoped. |
| worker/src/domains/telemetry/telemetry.ts | Resolves/registers devices on ingest and writes per-device variable metadata. |
| worker/src/domains/telemetry/control.ts | Scopes control poll/ack to resolved device. |
| worker/src/domains/projects/service.ts | Creates default device alongside project creation via a single DB batch. |
| worker/src/domains/projects/routes.ts | Adds NDJSON project export endpoint + audit. |
| worker/src/domains/projects/export.ts | Streams project export from D1 + telemetry NDJSON from R2. |
| worker/src/domains/firmware/service.ts | Implements SDK release catalog caching and safe asset URL construction. |
| worker/src/domains/firmware/routes.ts | Adds authenticated firmware catalog + binary proxy endpoints. |
| worker/src/domains/firmware/ota.ts | Implements firmware upload/list/delete/assign, retention pruning, OTA offer/image, reconcile. |
| worker/src/domains/firmware/device.ts | Adds device OTA endpoints (offer + image streaming + quota). |
| worker/src/domains/firmware/agent.ts | Adds local build agent WS, build request routing, artifact upload/download. |
| worker/src/domains/firmware/admin.ts | Adds firmware admin endpoints for upload/delete/assign with audit. |
| worker/src/domains/devices/service.ts | Adds device resolution/creation, listing, renaming, forgetting, and last_seen tracking. |
| worker/src/domains/devices/routes.ts | Adds devices admin routes (list/rename/forget) + audit hooks. |
| web/vite.config.ts | Excludes large device-tool chunks from Workbox precache. |
| web/tsconfig.json | Adds Web Serial types to TS setup. |
| web/test/serial-diagnosis.test.ts | Adds tests for serial console diagnosis logic. |
| web/src/types.ts | Adds device/firmware/layout trigger typings. |
| web/src/stores/project.ts | Adds store state + actions for devices/firmware (CRUD + assignment). |
| web/src/router.ts | Adds device hub routes (devices/firmware/code/flash/console). |
| web/src/pages/Projects.vue | Adds project “Export data” navigation to streamed NDJSON endpoint. |
| web/src/pages/project/device/SerialConsole.vue | Implements Web Serial console UI with diagnosis + copy/pause/baud controls. |
| web/src/pages/project/device/FlashPanel.vue | Implements browser flashing via esptool-js and firmware download/file input. |
| web/src/pages/project/device/FirmwarePanel.vue | Implements firmware upload/list/delete UI and device assignment UI. |
| web/src/pages/project/device/DevicesList.vue | Implements device listing, rename, forget with online indicator. |
| web/src/pages/project/device/DeviceHub.vue | Adds device hub tabbed layout and routing container. |
| web/src/pages/project/device/CodePanel.vue | Adds CodeMirror editor, SDK example loader, build+flash flow via agent. |
| web/src/pages/project/DashboardEdit.vue | Adds dashboard device selector and loads devices for editing. |
| web/src/pages/project/automations/NodeInspector.vue | Adds “Device” field UI for variable triggers. |
| web/src/pages/project/automations/AutomationEditor.vue | Ensures devices are loaded for automation editing. |
| web/src/layouts/Sidebar.vue | Adds Device nav item + icon. |
| web/src/composables/useSerialPort.ts | Adds shared Web Serial port owner with monitor/claim workflow. |
| web/src/composables/useSerialLog.ts | Adds high-throughput log buffering, classification, garble detection. |
| web/src/composables/useSerialDiagnosis.ts | Adds rule-based plain-language diagnosis over Nodrix debug output. |
| web/src/composables/useEspFlasher.ts | Adds esptool-js flashing composable with progress + logging. |
| web/src/components/CodeEditor.vue | Adds CodeMirror-based code editor component. |
| web/src/builder/grid.ts | Persists layout.device through normalization. |
| web/src/api.ts | Adds api.bytes() helper for binary downloads. |
| web/package.json | Adds CodeMirror + esptool-js deps and Web Serial types. |
| shared/blocks/triggers.ts | Adds device selector field to variable trigger block catalog. |
| shared/blocks/index.ts | Adds device as a block field type. |
| scripts/merge-wrangler.ts | Adds wrangler.toml merger preserving deployment identity while taking upstream bindings/topology. |
| scripts/merge-wrangler.test.ts | Adds tests for wrangler merge correctness + idempotence. |
| scripts/build-from-upstream.sh | Switches CI carrier build to merge wrangler.toml from deploy template when available. |
| deploy/wrangler.toml | Updates carrier wrangler description to match new merge behavior. |
Review details
Suppressed comments (2)
worker/src/platform/durable-objects/project-do.ts:425
listPendingControl()currently treatsdevice_id IS NULLas visible to every device. After devices were introduced, rows created before the new column existed will have NULL device_id and should map to the default device (''), not be delivered to/acked by whichever device polls first. UseCOALESCE(device_id, '') = ?so legacy rows stay bound to the default device only.
worker/src/platform/durable-objects/project-do.ts:439ackControl()allows any device to ack rows with NULL device_id, which can cause a legacy/default control write to be consumed by the wrong device in a multi-device project. Mirror theCOALESCE(device_id, '') = ?scoping used for pending reads so only the intended device can ack a row.
- Files reviewed: 70/70 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+183
to
+185
| const snapshotDevice = layout.device | ||
| ? await storageIdOf(this.env, row.project_id, layout.device) | ||
| : ''; |
Comment on lines
+395
to
+399
| async addControl(id: string, variable: string, value: unknown, deviceId: string | null = null): Promise<void> { | ||
| const now = Math.floor(Date.now() / 1000); | ||
| this.sql.exec( | ||
| `INSERT INTO pending_control (id, variable, value, created_at, delivered_at) | ||
| VALUES (?, ?, ?, ?, NULL)`, | ||
| `INSERT INTO pending_control (id, variable, value, created_at, delivered_at, device_id) | ||
| VALUES (?, ?, ?, ?, NULL, ?)`, |
Comment on lines
+20
to
+25
| async function pruneArtifacts(env: Env, projectId: string): Promise<void> { | ||
| const cutoff = Date.now() - ARTIFACT_MAX_AGE_MS; | ||
| const list = await env.R2.list({ prefix: `builds/${projectId}/` }); | ||
| const stale = list.objects.filter((o) => o.uploaded.getTime() < cutoff).map((o) => o.key); | ||
| if (stale.length > 0) await env.R2.delete(stale); | ||
| } |
Comment on lines
+20
to
+28
| admin.post('/', async (c) => { | ||
| const project = c.get('project'); | ||
| try { | ||
| const row = await uploadFirmware(c.env, project.id, c.get('user').id, { | ||
| version: c.req.query('version') ?? '', | ||
| target: c.req.query('target') ?? null, | ||
| notes: c.req.query('notes') ?? null, | ||
| body: await c.req.arrayBuffer(), | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nodrix picked up at the first telemetry POST — the board was already built, flashed, on Wi-Fi and holding a token. This builds the other half.
Not a release.
package.jsonstays at 1.0.1 and no tag is cut, so release-channel deployments keep resolving the last published release. Merging only moves theedgechannel.What lands
Devices. Every project gets a default device; variables are scoped to one. Boards auto-register on first sight the way variables always have. Dashboards, automations, control delivery and the MCP tools all address a device rather than a bare key.
Browser as the tool. Serial console with plain-language diagnosis, Web Serial flashing via esptool-js, a CodeMirror sketch editor seeded from published SDK examples. Both heavy libraries are lazy chunks kept out of the PWA precache.
Firmware and OTA. A per-project firmware store in R2 with retention, and updates by desired-state reconciliation — the device pulls, nothing orchestrates. Downloads are quota'd per device per hour and R2 bodies stream untouched, since free-tier CPU is 10ms.
Builds.
nodrix-agentcompiles on your own machine with your ownarduino-cli. The DO brokers job control only; the artifact goes to R2 on a plain worker route.Data safety
The one hard constraint was that structures and APIs may break but data may not.
db.batch()each, which D1 rolls back as a transaction.exec(), which the docs suggest, stops on error without rolling back.transactionSync.sqlite_mastermatches. Same for DO storage.Known gaps
Tracked, not blocking merge, and all of them are why this isn't a release:
0x10000; no merged image and no route from a build to OTA.Telemetry ingest and control-poll throttling remain deferred pending measurement. Nothing here has touched real hardware, a real D1, or a real board.