app/worker/src/index.ts

+// Proof-of-mechanism Worker for the Cloudflare backend

+// (site/content/remote-backend/index.md). /full-protocol-test is the

+// real target: the actual agent/tools.ts tool surface, through a real

+// MaintainerDO, doing the real protocol end to end (propose -> work ->

+// changeset_review -> submit_changeset -> commit -> Ladder write ->

+// read back) against a real Artifacts repo. The other routes are the

+// smaller, lower-level proofs built incrementally to get there, kept

+// as regression checks for the mechanisms underneath (native reads,

+// isomorphic-git writes, the Ladder's scoped notes checkout).

+import { writeRung, readRung, appendRepoChildren } from "./cloudflareLadderBackend.js";

+// Artifacts/ArtifactsRepo/ArtifactsCreateRepoResult are ambient globals

+// from @cloudflare/workers-types (tsconfig's "types" pulls them in) --

+// no hand-rolled copy needed, and no import either; a hand-rolled copy

+// used to live here (and drifted from the real shape -- see

+// cloudflareGitBackend.ts's header for the same fix made there).

+ ARTIFACTS: Artifacts;

+async function seedRepo(env: Env, repoName: string, files: { path: string; content: string }[]): Promise<{ remote: string; commitOid: string }> {

+ const created = await env.ARTIFACTS.create(repoName, { setDefaultBranch: "main" });

+ const fs = createMemFs();

+ const dir = "/seed";

+ await git.init({ fs, dir, defaultBranch: "main" });

+ const entries = [];

+ for (const f of files) {

+ const oid = await git.writeBlob({ fs, dir, blob: new TextEncoder().encode(f.content) });

+ entries.push({ mode: "100644", path: f.path, oid, type: "blob" as const });

+ }

+ const tree = await git.writeTree({ fs, dir, tree: entries });

+ const person = { name: "seed", email: "seed@local", timestamp: Math.floor(Date.now() / 1000), timezoneOffset: 0 };

+ const commitOid = await git.writeCommit({ fs, dir, commit: { message: "seed", tree, parent: [], author: person, committer: person } });

+ await git.writeRef({ fs, dir, ref: "refs/heads/main", value: commitOid, force: true });

+ await git.push({ fs, http, dir, url: created.remote, onAuth: () => ({ username: "x-token-auth", password: tokenString(created.token) }), ref: "main", remoteRef: "main" });

+ return { remote: created.remote, commitOid };

+}

+// The real tool surface, through a real DO, doing the real protocol

+// end to end -- the thing all the other routes were building toward.

+// Skips run_in_sandbox (can't run on a Worker, by design) and composes

+// file content directly instead, same as the rest of this test's

+// seeding does; everything else is the actual zz protocol, unmodified.

+async function testFullProtocol(env: Env): Promise<Response> {

+ const repoName = "full-protocol-" + Date.now();

+ const actor = "zz-worker-test";

+ const { commitOid: seedCommitOid } = await seedRepo(env, repoName, [{ path: "clamp.js", content: "export function clamp(v,min,max){return Math.min(Math.max(v,min),max);}\n" }]);

+ steps.seeded = seedCommitOid;

+ const id = env.MAINTAINER_DO.idFromName(repoName);

+ await stub.configure(repoName);

+ const call = (name: string, args: Record<string, unknown>) => stub.callTool(name, args);

+ const lane = (await call("lane_propose", { repo: repoName, name: "full-protocol-test", objective: "prove the real tool surface end to end", scope: ["**"], actor })) as { id: string };

+ steps.lane = lane;

+ const workAsk = (await call("ask_post", { repo: repoName, lane_id: lane.id, kind: "work", from: "human", payload: { description: "add isOdd to index.js" } })) as { id: string };

+ await call("ask_claim", { repo: repoName, lane_id: lane.id, ask_id: workAsk.id, actor });

+ const proposedFiles = [

+ { path: "clamp.js", content: "export function clamp(v,min,max){return Math.min(Math.max(v,min),max);}\n" },

+ { path: "index.js", content: "export { clamp } from \"./clamp.js\";\n\nexport function isOdd(n) { return n % 2 !== 0; }\n" },

+ ];

+ // The Maintainer-role gate from earlier this session: a review has

+ // to exist and be granted before submit_changeset is even

+ // claimable (enforced in engine/lane.ts's answer(), not just

+ // hoped for) -- so post and grant it first, same order

+ // agent/scriptedWork.ts's real flow uses.

+ const review = (await call("ask_post", { repo: repoName, lane_id: lane.id, kind: "changeset_review", from: actor, payload: { taskDescription: "add isOdd", files: proposedFiles, message: "add isOdd", summary: "Add isOdd(n)" } })) as { id: string };

+ await call("ask_claim", { repo: repoName, lane_id: lane.id, ask_id: review.id, actor });

+ await call("ask_answer", { repo: repoName, lane_id: lane.id, ask_id: review.id, actor, action: "grant" });

+ steps.reviewGranted = true;

+ const submit = (await call("ask_post", {

+ repo: repoName,

+ lane_id: lane.id,

+ kind: "submit_changeset",

+ from: actor,

+ payload: { files: proposedFiles, message: "add isOdd", summary: "Add isOdd(n)" },

+ depends_on: [workAsk.id, review.id],

+ })) as { id: string };

+ await call("ask_answer", { repo: repoName, lane_id: lane.id, ask_id: workAsk.id, actor, action: "complete", payload: { summary: "proposed" } });

+ await call("ask_claim", { repo: repoName, lane_id: lane.id, ask_id: submit.id, actor });

+ const commitResult = (await call("commit_changeset", { repo: repoName, files: proposedFiles, message: "add isOdd", author_name: actor, author_email: `${actor}@local` })) as { commitOid: string };

+ steps.commitOid = commitResult.commitOid;

+ const now = new Date().toISOString();

+ const source = [{ kind: "commit", ref: commitResult.commitOid, title: "add isOdd", author: actor, at: now }];

+ // appendRepoChildren (called by mergeLaneLadder after every

+ // non-root rung write) requires the "_repo" root note to already

+ // exist -- demo/greenfield.ts's own bootstrap writes this once,

+ // first, before anything else; this test has to do the same.

+ await call("ladder_write_rung", { repo: repoName, rung: { path: "_repo", kind: "repo", summary: "A test repo for the full protocol.", sources: source, children: [] } });

+ steps.rootRungWritten = true;

+ await call("ladder_write_rung", { repo: repoName, rung: { path: "index.js", kind: "file", summary: "Re-exports clamp and adds isOdd.", sources: source, children: [] } });

+ steps.fileRungWritten = true;

+ await call("ladder_write_rung", {

+ repo: repoName,

+ rung: { path: `changesets/${commitResult.commitOid}`, kind: "changeset", summary: "Add isOdd.", sources: source, children: [{ path: `changesets/${commitResult.commitOid}/index.js`, kind: "filechange", summary: "Added isOdd.", sources: source, children: [] }] },

+ });

+ steps.changesetRungWritten = true;

+ await call("ask_answer", { repo: repoName, lane_id: lane.id, ask_id: submit.id, actor, action: "complete", payload: { commitOid: commitResult.commitOid } });

+ steps.answered = true;

+ steps.readIndexRung = await call("ladder_read", { repo: repoName, path: "index.js" });

+ steps.readLane = await call("lane_get", { repo: repoName, lane_id: lane.id });

+ steps.readFileAtCommit = await call("git_show_file", { repo: repoName, sha: commitResult.commitOid, path: "index.js" });

+ await env.ARTIFACTS.delete(repoName);

+ steps.cleanedUp = true;

+ await env.ARTIFACTS.delete(repoName).catch(() => {});

+ return Response.json({ ok: false, error: err instanceof Error ? (err.stack ?? err.message) : String(err), steps }, { status: 500 });

+ const { remote, commitOid: seedCommitOid } = await seedRepo(env, repoName, [

+ { path: "index.js", content: "export { clamp } from \"./clamp.js\";\n" },

+ { path: "clamp.js", content: "export function clamp(v,min,max){return Math.min(Math.max(v,min),max);}\n" },

+ ]);

+ remote,

+ return Response.json({ ok: false, error: err instanceof Error ? (err.stack ?? err.message) : String(err), steps }, { status: 500 });

+ const { remote, commitOid: seedCommitOid } = await seedRepo(env, repoName, [{ path: "clamp.js", content: "export function clamp(v,min,max){return Math.min(Math.max(v,min),max);}\n" }]);

+ await writeRung(remote, writeToken, repo, {

+ using repo2 = await env.ARTIFACTS.get(repoName);

+ const readToken = await repo2.createToken("read", 3600);

+ steps.readFileRung = await readRung(remote, readToken, repo2, "file", "clamp.js");

+ await env.ARTIFACTS.delete(repoName);

+ steps.cleanedUp = true;

+ return Response.json({ ok: true, steps });

+ } catch (err) {

+ await env.ARTIFACTS.delete(repoName).catch(() => {});

+ return Response.json({ ok: false, error: err instanceof Error ? (err.stack ?? err.message) : String(err), steps }, { status: 500 });

+ }

+}

+// Diagnostic only: what does git.fetch() actually return for a ref

+// that genuinely doesn't exist on the remote yet? scopedNotesCheckout

+// (cloudflareLadderBackend.ts) assumes it throws or returns a falsy

+// fetchHead -- this checks that assumption directly against a real

+// Artifacts repo instead of guessing from a confusing downstream error.

+// Diagnostic only: the "repo"-kind rung (anchored to rootCommitOid

+// rather than a file blob) and appendRepoChildren were both added

+// speculatively in this final phase and never exercised live --

+// testLadder only covers a "file" rung. Isolates each step so a

+// failure here points at exactly one of: writing the root note,

+// reading it back, or appending a child to it.

+async function testRepoRungAndAppend(env: Env): Promise<Response> {

+ const repoName = "repo-rung-proof-" + Date.now();

+ const steps: Record<string, unknown> = {};

+ try {

+ const { remote, commitOid: seedCommitOid } = await seedRepo(env, repoName, [{ path: "a.txt", content: "a\n" }]);

+ steps.seeded = seedCommitOid;

+ const source = [{ kind: "commit" as const, ref: seedCommitOid, title: "seed", author: "seed", at: new Date().toISOString() }];

+ using repo1 = await env.ARTIFACTS.get(repoName);

+ const writeToken1 = await repo1.createToken("write", 3600);

+ await writeRung(remote, writeToken1, repo1, { path: "_repo", kind: "repo", summary: "root", sources: source, children: [] });

+ steps.wroteRootRung = true;

+ const readToken1 = await repo2.createToken("read", 3600);

+ steps.readRootAfterWrite = await readRung(remote, readToken1, repo2, "repo", "_repo");

+ using repo3 = await env.ARTIFACTS.get(repoName);

+ const writeToken2 = await repo3.createToken("write", 3600);

+ await appendRepoChildren(remote, writeToken2, repo3, [{ path: "a.txt", kind: "file" }]);

+ steps.appended = true;

+ using repo4 = await env.ARTIFACTS.get(repoName);

+ const readToken2 = await repo4.createToken("read", 3600);

+ steps.readRootAfterAppend = await readRung(remote, readToken2, repo4, "repo", "_repo");

+ return Response.json({ ok: false, error: err instanceof Error ? (err.stack ?? err.message) : String(err), steps }, { status: 500 });

+async function testFetchMissingRef(env: Env): Promise<Response> {

+ const repoName = "fetch-missing-ref-" + Date.now();

+ const steps: Record<string, unknown> = {};

+ try {

+ const { remote } = await seedRepo(env, repoName, [{ path: "a.txt", content: "a\n" }]);

+ using repo = await env.ARTIFACTS.get(repoName);

+ const token = await repo.createToken("write", 3600);

+ const fs = createMemFs();

+ const dir = "/notes";

+ await git.init({ fs, dir, defaultBranch: "main" });

+ await git.addRemote({ fs, dir, remote: "origin", url: remote });

+ const onAuth = () => ({ username: "x-token-auth", password: tokenString(token) });

+ const ref = "refs/notes/zz/ladder/code";

+ try {

+ const result = await git.fetch({ fs, http, dir, remote: "origin", onAuth, ref, remoteRef: ref, singleBranch: true, tags: false });

+ steps.fetchResolved = true;

+ steps.fetchResult = { fetchHead: result.fetchHead, headers: result.headers ? Object.fromEntries(Object.entries(result.headers)) : null, pruned: result.pruned ?? null };

+ } catch (fetchErr) {

+ steps.fetchThrew = true;

+ steps.fetchError = fetchErr instanceof Error ? (fetchErr.stack ?? fetchErr.message) : String(fetchErr);

+ }

+ await env.ARTIFACTS.delete(repoName);

+ return Response.json({ ok: true, steps });

+ } catch (err) {

+ await env.ARTIFACTS.delete(repoName).catch(() => {});

+ return Response.json({ ok: false, error: err instanceof Error ? (err.stack ?? err.message) : String(err), steps }, { status: 500 });

+ }

+}

+ const path = new URL(req.url).pathname;

+ if (path === "/full-protocol-test") return testFullProtocol(env);

+ if (path === "/ladder-test") return testLadder(env);

+ if (path === "/changeset-test") return testChangesetCommit(env);

+ if (path === "/fetch-missing-ref-test") return testFetchMissingRef(env);

+ if (path === "/repo-rung-test") return testRepoRungAndAppend(env);

+ steps.nativeRead = { blobText: nativeBlob ? await nativeBlob.text() : null };

+ await env.ARTIFACTS.delete(repoName).catch(() => {});

+ return Response.json({ ok: false, error: err instanceof Error ? (err.stack ?? err.message) : String(err), steps }, { status: 500 });