computer - Moses Yebei

The Problem

Developers building Cloudflare Workers need a mutable, versioned filesystem that can be accessed from Durable Objects, containers, or isolated JavaScript shells. Implementing such a virtual FS from scratch requires handling SQLite state, FUSE‑style mounts, and cross‑runtime RPC, which is error‑prone and hard to test.

What This Does

The repo delivers Cloudflare Computer, a monorepo that exposes a workspace.runtime.exec(source, { backend }) API. Core logic lives in packages/computer/src/ (e.g., workspace.ts, git/index.ts, artifacts/cli.ts). The Durable Object stores state in SQLite via the dofs layer (packages/dofs/src/), with storage.ts acting as the primary hub (54 inbound imports).

Example consumers are in examples/:

examples/container/src/index.ts – builds a container, runs computerd, and mounts the workspace.
examples/worker-shell/src/index.ts – runs a Bash shell in a Dynamic Worker.
examples/think/src/agent.ts – a chat agent that treats the workspace as its file system.

How It Is Wired

Entry point – each example’s src/index.ts imports @cloudflare/computer (via the workspace package).
workspace.ts creates a Workspace object that lazily loads a backend (backendFactory.ts).
The backend calls into dofs: packages/dofs/src/fs/writeFile.ts writes through storage.ts, which forwards to SQLite via the Durable Object RPC layer (packages/computer/src/rpc.ts).
storage.ts is the largest hub (Ca = 54, Ce = 1) – any change here propagates to most of the code base.
A circular import exists among workspace.ts, git/index.ts, and stub.ts; each pulls types or helpers from the others, increasing the blast‑radius for refactors.
Execution ultimately reaches the durable object’s SQLite store, then returns results over the Cap’n Proto RPC channel (packages/computer/src/rpc.ts).

The call graph shows eight modules in cycles, and the most branching logic lives in packages/dofs/src/schema/index.ts (24 branches over 59 lines). Deep nesting (max depth = 6) appears in packages/computer/src/artifacts/cli.ts.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/computer
cd computer

# Install the monorepo (npm is the manager)
npm ci

# Build all packages
npm run build   # defined in root package.json scripts

# Run a concrete example – container backend
cd examples/container
npm ci
npm run dev    # starts a local worker that mounts the workspace

Configuration files are in each example’s root (wrangler.jsonc, worker-configuration.d.ts). No additional secrets are required for local runs; production deployments need CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID as documented in README.md.

Real‑World Use

A SaaS platform can store user‑generated scripts in a Cloudflare Computer workspace, then execute them in isolated containers for PDF generation or image processing. The platform calls workspace.runtime.exec('pandoc input.md -o output.pdf', { backend: 'container' }); the container backend mounts the SQLite state, runs pandoc, and writes the PDF back to the same workspace, all without persisting any intermediate files on the host.

Code Health & Issues

Critical – Secrets in workflow allow a forked PR to exfiltrate CLOUDFLARE_API_TOKEN (.github/workflows/release.yml).
High – GitHub Actions not pinned to commit SHAs (.github/workflows/*).
High – eval/exec on runtime‑computed strings in packages/rpc/src/server.ts.
High – Oversized files (writeFile.ts, workspace.ts, git/index.ts ≈ 917 lines each).
High – Hub module (packages/dofs/src/storage.ts) with 54 dependents; changes have wide impact.
High – Import cycle among workspace.ts, git/index.ts, stub.ts.
High – Duplicated 6‑line blocks across many example entry points.
Medium – High branching density in schema and resolve‑cache modules.
Medium – Deep nesting (max depth = 6) in CLI and test files.
Medium – No Dependabot/Renovate configured for 6 manifests.
Medium – Dockerfiles use mutable base tags (debian:stable-slim).
Medium – CI lacks a dependency‑vulnerability gate.
Medium – Container images run as root; no USER directive.
Low – Workflow jobs missing timeout-minutes (close-unrequested-prs.yml).

The Bottom Line

Cloudflare Computer provides a functional prototype for a durable, multi‑backend virtual filesystem, with a clear separation between workspace management and backend execution. However, the codebase suffers from large, highly coupled modules, an import cycle, and several security/maintenance gaps that must be addressed before production use. It is best suited for experimental projects or teams willing to invest in refactoring and hardening the core.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

552 files

TypeScript381
Markdown50
JSON35
Shell10
TSX8
YAML7

ReactExpressDocker

Module dependencies

The 10 most depended-upon modules of 399, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_packages_dofs_src_storage["storage"] n1_packages_dofs_src_fs_with_db["with-db"] n2_ckages_dofs_src_fs_writeFile["writeFile"] n3_mpare_runtimes_shared_events["events"] n4_packages_dofs_src_fs_resolve["resolve"] n5_e_runtimes_worker_run_events["run-events"] n6_packages_dofs_src_fs_mkdir["mkdir"] n7_pare_runtimes_shared_fixture["fixture"] n8_kages_computer_src_workspace["workspace"] n9_packages_dofs_src_errors["errors"] n5_e_runtimes_worker_run_events --> n3_mpare_runtimes_shared_events n6_packages_dofs_src_fs_mkdir --> n9_packages_dofs_src_errors n6_packages_dofs_src_fs_mkdir --> n0_packages_dofs_src_storage n4_packages_dofs_src_fs_resolve --> n9_packages_dofs_src_errors n4_packages_dofs_src_fs_resolve --> n0_packages_dofs_src_storage n1_packages_dofs_src_fs_with_db --> n0_packages_dofs_src_storage n2_ckages_dofs_src_fs_writeFile --> n9_packages_dofs_src_errors n2_ckages_dofs_src_fs_writeFile --> n0_packages_dofs_src_storage classDef cyc stroke:#ef4444,stroke-width:2px; class n8_kages_computer_src_workspace cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high2

medium4

low1

Keep secrets out of workflows a fork can triggercritical2 occurrences

.github/workflows/release.yml

CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID (publish or cloud scope)

Contributor-controlled input reaches a job holding a publish token or cloud credential, so a pull request becomes credential exfiltration.

Fix: Move secret-using steps into a workflow_run job that never checks out pull request code, or gate on an environment with required reviewers.

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

docker/setup-buildx-action@v3, docker/login-action@v3, changesets/action@v1

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Remove eval over a runtime valuehigh

packages/rpc/src/server.ts

exec() over a computed value

eval executes whatever the string contains, so wherever that string came from is now able to run code in the process, and the distance between the input and the eval is usually the only thing making it look safe.

Fix: Parse the value into the type you expect, with json.loads or ast.literal_eval.

Enable Dependabot or Renovatemedium

6 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

examples/container/Dockerfile

ghcr.io/cloudflare/computer-computerd-linux-x64:0.1.1, debian:stable-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Add a non-root USER to the imagemedium

examples/container/Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow

.github/workflows/close-unrequested-prs.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.