Skip to content

chore: Make Workspace and WorkerJavaScriptBackend stable - #241

Merged
aron-cf merged 5 commits into
mainfrom
computer-stable
Oct 15, 2026
Merged

aron-cf merged 5 commits into
mainfrom
computer-stable

Conversation

@aron-cf

@aron-cf aron-cf commented Oct 15, 2026 •

Copy link
Copy Markdown
Collaborator

Devin Review

@changeset-bot

changeset-bot Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

馃 Changeset detected

Latest commit: e93d3ba

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@cloudflare/computer Patch
@cloudflare/dofs Patch
@cloudflare/computer-rpc Patch
@cloudflare/computerd Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@devin-ai-integration devin-ai-integration Bot left a comment •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 3 potential issues.

Devin Review

Comment thread docs/README.md
| [03. Filesystem Schema](./03_filesystem_schema.md) | Stable | SQLite schema backing the virtual filesystem. |
| [04. Filesystem Interface](./04_filesystem_interface.md) | Stable | `Workspace.fs` API: `readFile`, `writeFile`, `mkdir`, `grep`, etc. |
| [05. Runtime Interface](./05_runtime_interface.md) | Stable | `Workspace.runtime.exec/getExec/killExec/disposeExec` and backend routing. |
| [06. Mount Interface](./06_mount_interface.md) | Stable | Pre-filling paths from R2, Artifacts, GitHub, and custom sources. **(not yet implemented)** |

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

馃攳 Stable label covers planned mount APIs

The mount guide describes planned lazy mounts and write-back, while Mount supports only eager mounts. Labeling the whole guide stable obscures which examples callers can use today.

Devin Review


Was this helpful? React with 馃憤 or 馃憥 to provide feedback.

Comment thread docs/README.md
| [10. Project Layout](./10_project_layout.md) | Reference | Source tree of this package and how the pieces fit together. |
| [11. Lifecycle](./11_lifecycle.md) | Mixed: stub disposal is stable; the container and capnweb lifecycle are experimental | DO incarnations, container lifetime, capnweb session lifecycle, and hibernation. |
| [12. Worker backend](./12_worker_backend.md) | Experimental | Running the shell as just-bash inside a Dynamic Worker loaded through `env.LOADER`. |
| [13. Git interface](./13_git_interface.md) | Stable | `workspace.git` and the `git` CLI inside the shell, backed by isomorphic-git. |

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

馃攳 Git status includes experimental shell integration

The Git topic labels both workspace.git and shell git stable. Shell git runs through WorkerShellBackend, which the status table marks experimental.

Devin Review


Was this helpful? React with 馃憤 or 馃憥 to provide feedback.

Comment thread .github/SECURITY.md Outdated
> [!IMPORTANT]
> Cloudflare Computer is in an early preview/experimental state and is under active, rapid development.
> Please treat any deployment as experimental and do not rely on it for production security guarantees.
> Parts of Cloudflare Computer are stable and parts are experimental. Most of it is stable. The container backends, the Worker shell backend, the `ws:container` host module, the sync between the durable object and `computerd`, `computerd` itself, and the RPC package are experimental and under active development; the [status table](../packages/computer/README.md#status) has the full list. Do not rely on the experimental components for production security guarantees.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

馃煥 Security reports sent to public issues

When someone finds a vulnerability, the security policy directs them to open a public issue. The contribution policy requires private disclosure, so public reports can expose the flaw before remediation.

Devin Review


Was this helpful? React with 馃憤 or 馃憥 to provide feedback.

@pkg-pr-new

pkg-pr-new Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@cloudflare/computer@241

commit: e93d3ba

LegacyContainerBackend serves containers the platform schedules from
the wrangler containers block. ContainerBackend serves containers the
durable object schedules itself, and is the backend new code should
use, so the legacy one is now deprecated rather than listed beside it
as an equal choice.

LegacyContainerBackend and withLegacyWorkspaceContainer carry a
@deprecated tag that names their replacements, so editors strike them
through. The status table and the backend table in the package README
mark the legacy backend deprecated and say what deprecated means. The
multiple-backends sample and the container links point at
ContainerBackend and examples/container. The entry point tables, the
injected service and Worker backend documents, and the examples that
still use the legacy backend say it is deprecated and name the
replacement.
The security policy said parts of Cloudflare Computer are experimental
but left a reader to work out which code that means. It now lists the
directories and files that hold experimental code, the deprecated
legacy container backend, and the directories that are not part of any
published package, such as examples and test harnesses.
The notes at the top of the repository, package, and specification
READMEs listed each experimental component. They now say that
@cloudflare/computer is suitable for production use, that it contains
work-in-progress and experimental components such as ContainerBackend
that are not, and point to the package's status table, which remains
the full list.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 new potential issue.

Devin Review

backends: [
new WorkerShellBackend({ id: "shell", loader: env.LOADER, /* ... */ }),
new LegacyContainerBackend({ id: "sandbox", container: () => this, /* ... */ }),
new ContainerBackend({ id: "sandbox", container: () => this, /* ... */ }),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

馃攳 Container migration example needs full wiring

The ContainerBackend example leaves its required workspace reference inside /* ... */. Migrating from the legacy backend also needs withWorkspaceContainer and a different container configuration. Link the complete example or show that wiring here.

Devin Review


Was this helpful? React with 馃憤 or 馃憥 to provide feedback.

@aron-cf
aron-cf merged commit d950ffe into main Oct 15, 2026
23 checks passed
@aron-cf
aron-cf deleted the computer-stable branch October 15, 2026 13:54
@github-actions github-actions Bot mentioned this pull request Oct 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant