lael-labs/executor

apps/cloud/src/edge/index.ts+4−5

 // ---------------------------------------------------------------------------
-// Edge concerns — the analytics/marketing/docs request middlewares that run at
+// Edge concerns — request middleware that runs before the app's own mcp + api
-// the worker edge BEFORE the app's own mcp + api dispatch. None of these touch
+// dispatch. These proxy or tunnel to external services without touching the
-// the Effect app layer; they proxy or tunnel to external services (the
+// Effect app layer. Marketing is dispatched even earlier, from server.ts, so a
-// marketing worker, Sentry, PostHog, Mintlify docs).
+// public page never loads the TanStack Start graph.
 // ---------------------------------------------------------------------------
-export { marketingMiddleware } from "./marketing";
 export { sentryTunnelMiddleware } from "./sentry-tunnel";
 export { posthogProxyMiddleware } from "./posthog";
 export { docsProxyMiddleware } from "./docs";

apps/cloud/src/edge/marketing.test.ts+52−1

@@ -1,6 +1,6 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import { describe, expect, it } from "@effect/vitest";
2		2
3	import { isMarketingPath } from "./marketing";	3	import { isMarketingPath, marketingProxyRequest } from "./marketing";
4		4
5	// On executor.sh the marketing middleware proxies an allow-list of paths to the	5	// On executor.sh the marketing middleware proxies an allow-list of paths to the
6	// `executor-marketing` worker; everything else falls through to the auth-gated	6	// `executor-marketing` worker; everything else falls through to the auth-gated
@@ -38,3 +38,54 @@ describe("isMarketingPath", () => { · 31 unmodified lines
38	});	38	});
39	}	39	}
40	});	40	});
		41
		42	describe("marketingProxyRequest", () => {
		43	it("routes a signed-out homepage request", () => {
		44	const request = new Request("https://executor.sh/?source=test");
		45
		46	const proxied = marketingProxyRequest(request);
		47
		48	expect(proxied?.url).toBe("https://executor.sh/?source=test");
		49	});
		50
		51	it("leaves the signed-in homepage with the cloud application", () => {
		52	const request = new Request("https://executor.sh/", {
		53	headers: { cookie: "other=value; wos-session=sealed" },
		54	});
		55
		56	expect(marketingProxyRequest(request)).toBeNull();
		57	});
		58
		59	it("routes public content even when a session cookie is present", () => {
		60	const request = new Request("https://executor.sh/blog/post", {
		61	headers: { cookie: "wos-session=sealed" },
		62	});
		63
		64	expect(marketingProxyRequest(request)?.url).toBe("https://executor.sh/blog/post");
		65	});
		66
		67	it("rewrites the public home alias to the marketing root", () => {
		68	const request = new Request("https://executor.sh/home?source=test");
		69
		70	expect(marketingProxyRequest(request)?.url).toBe("https://executor.sh/?source=test");
		71	});
		72
		73	it("preserves the request method, headers, and body", async () => {
		74	const request = new Request("https://executor.sh/_astro/_ph/capture", {
		75	method: "POST",
		76	headers: { "content-type": "application/json", "x-request-id": "request-1" },
		77	body: JSON.stringify({ event: "test" }),
		78	});
		79
		80	const proxied = marketingProxyRequest(request);
		81
		82	expect(proxied?.method).toBe("POST");
		83	expect(proxied?.headers.get("x-request-id")).toBe("request-1");
		84	await expect(proxied?.json()).resolves.toEqual({ event: "test" });
		85	});
		86
		87	it("does not proxy non-production hosts or app-owned paths", () => {
		88	expect(marketingProxyRequest(new Request("http://executor-cloud.localhost/"))).toBeNull();
		89	expect(marketingProxyRequest(new Request("https://executor.sh/login"))).toBeNull();
		90	});
		91	});

apps/cloud/src/edge/marketing.ts+22−34

@@ -3,14 +3,10 @@ · 2 unmodified lines
3	//	3	//
4	// On the production domain (`executor.sh`), marketing paths and the	4	// On the production domain (`executor.sh`), marketing paths and the
5	// unauthenticated landing page are served by the separate `executor-marketing`	5	// unauthenticated landing page are served by the separate `executor-marketing`
6	// worker (bound as `env.MARKETING`). In local dev that worker isn't running, so	6	// worker. This module deliberately has no TanStack Start or cloud application
7	// unauthenticated visits fall through to the cloud app's routes (the sign-in	7	// imports: the Worker entry calls it before loading the Start server graph.
8	// page).
9	// ---------------------------------------------------------------------------	8	// ---------------------------------------------------------------------------
10		9
11	import { env } from "cloudflare:workers";
12	import { createMiddleware } from "@tanstack/react-start";
13
14	import { parseCookie } from "../auth/cookies";	10	import { parseCookie } from "../auth/cookies";
15		11
16	const MARKETING_PATHS = [	12	const MARKETING_PATHS = [
@@ -28,33 +24,25 @@ const MARKETING_PATHS = [ · 11 unmodified lines
28	"/pattern-graph-paper.svg",	24	"/pattern-graph-paper.svg",
29	];	25	];
30		26
31	export const isMarketingPath = (pathname: string) =>	27	const SESSION_COOKIE = "wos-session";
32	MARKETING_PATHS.some((p) => pathname === p \|\| pathname.startsWith(`${p}/`));
33
34	const getMarketingWorker = () => env.MARKETING as { fetch: typeof fetch } \| undefined;
35
36	export const marketingMiddleware = createMiddleware({ type: "request" }).server(
37	async ({ pathname, request, next }) => {
38	// Only proxy to the marketing worker on the production domain. In local
39	// dev we don't run `executor-marketing`, so unauthenticated visits fall
40	// through to the cloud app's routes (which show the sign-in page).
41	const host = new URL(request.url).hostname;
42	if (host !== "executor.sh") return next();
43		28
44	const shouldProxyToMarketing =	29	/** Whether an exact pathname belongs to the public marketing worker. */
45	isMarketingPath(pathname) \|\|	30	export const isMarketingPath = (pathname: string): boolean =>
46	(pathname === "/" && !parseCookie(request.headers.get("cookie"), "wos-session"));	31	MARKETING_PATHS.some((p) => pathname === p \|\| pathname.startsWith(`${p}/`));
47
48	if (!shouldProxyToMarketing) return next();
49
50	const marketing = getMarketingWorker();
51	if (!marketing) return next();
52		32
53	const url = new URL(request.url);	33	/**
54	// Rewrite /home to / so marketing worker serves its homepage	34	* Project a production request onto the marketing service-binding request.
55	if (pathname === "/home") {	35	* Returns `null` when the cloud application owns the request instead.
56	url.pathname = "/";	36	*/
57	}	37	export const marketingProxyRequest = (request: Request): Request \| null => {
58	return marketing.fetch(new Request(url, request));	38	const url = new URL(request.url);
59	},	39	if (url.hostname !== "executor.sh") return null;
60	);	40
		41	const shouldProxy =
		42	isMarketingPath(url.pathname) \|\|
		43	(url.pathname === "/" && !parseCookie(request.headers.get("cookie"), SESSION_COOKIE));
		44	if (!shouldProxy) return null;
		45
		46	if (url.pathname === "/home") url.pathname = "/";
		47	return new Request(url, request);
		48	};

apps/cloud/src/server.ts+9−0

 import handler from "@tanstack/react-start/server-entry";
 import { isAppOwnedPath } from "./app-paths";
+import { marketingProxyRequest } from "./edge/marketing";
 import { makeCloudMcpAgentHandler } from "./mcp/agent-handler";
 import { classifyMcpPath, prepareMcpOrgScope } from "./mcp/mount";
 import { parseTraceparent } from "./mcp/traceparent";
 const cloudflareHandler: ExportedHandler<Env> = {
   fetch: async (request, env, ctx) => {
+    // Public pages must not enter TanStack Start: its first-request dynamic
+    // import loads the entire React + Effect server graph and can take seconds
+    // on a cold isolate. Classify and service-bind marketing at the Worker
+    // entry, before telemetry or fetchHandler touches that graph.
+    const marketingRequest = marketingProxyRequest(request);
+    const marketing: Fetcher | undefined = env.MARKETING;
+    if (marketingRequest && marketing) return marketing.fetch(marketingRequest);
     // Browser OTLP ingress — before the server span opens: exporter traffic
     // must never trace itself (the browser already excludes /v1/traces from
     // its own tracing for the same reason).

apps/cloud/src/start.ts+10−12

 import { prepareMcpOrgScope } from "./mcp/mount";
 import {
   docsProxyMiddleware,
-  marketingMiddleware,
   openAiAppsChallengeMiddleware,
   posthogProxyMiddleware,
   sentryTunnelMiddleware,
   },
 );
-// The edge concerns (marketing proxy, docs proxy, sentry tunnel, posthog proxy)
+// The remaining edge concerns (docs proxy, sentry tunnel, posthog proxy) live
-// live in `./edge`; they run before the app's own dispatch. Ordering is
+// in `./edge`; they run before the app's own dispatch. Marketing is handled in
-// load-bearing: marketing first (production landing/page proxy), then the docs
+// server.ts before this module is loaded. Ordering here is load-bearing: public
-// proxy and analytics tunnels, then the unified app plane (api + mcp), and last
+// challenges and docs, then analytics tunnels, then the unified app plane (api
-// the SSR auth gate — it only sees document requests nothing above claimed, so
+// + mcp), and last the SSR auth gate — it only sees document requests nothing
-// signed-out visitors are redirected to /login before the SPA (and its
+// above claimed, so signed-out visitors are redirected to /login before the SPA
-// app-shell skeleton) is served. The docs proxy sits among the edges (not after
+// (and its app-shell skeleton) is served. The docs proxy sits among the edges
-// the auth gate) because `/docs` is public and must skip the sign-in redirect;
+// (not after the auth gate) because `/docs` is public and must skip the sign-in
-// its path is disjoint from every other matcher, so its slot is not otherwise
+// redirect; its path is disjoint from every other matcher, so its slot is not
-// load-bearing.
+// otherwise load-bearing.
 export const startInstance = createStart(() => ({
   requestMiddleware: [
     openAiAppsChallengeMiddleware,
-    marketingMiddleware,
     docsProxyMiddleware,
     sentryTunnelMiddleware,
     posthogProxyMiddleware,