feat: over-the-air firmware updates - #14
Open
decoded-cipher wants to merge 58 commits into
Open
decoded-cipher wants to merge 58 commits into
decoded-cipher wants to merge 58 commits into
Conversation
Statements ran one at a time, so a failure part-way left the schema half-applied and the retry restarted from the first statement. That is only safe while every statement is idempotent — the first ALTER TABLE would turn a partial failure into a permanent failure loop on an instance nobody can see. db.batch() is a real transaction. The applied_at write rides inside it, so d1_migrations can never record a migration that did not commit.
Durable Objects get no migration runner, so each class now carries an ordered list of schema changes and walks itself forward inside transactionSync() the first time it wakes after a deploy. One that throws rolls back rather than stranding storage between versions, and the constructor runs before any method, so no caller sees a half-migrated object. The baseline is the existing schema unchanged, so an object that predates versioning replays it as a no-op and converges on the version a fresh object reaches. SchedulerDO is key-value only and needs none of this.
The build preserved each deployment's wrangler.toml verbatim, which froze its topology at whatever the Deploy button wrote on day one: a binding, cron or compatibility flag added upstream never reached anyone who had already deployed. Bindings, flags and build config now come from upstream's carrier template, while the Worker name, account, routes, resource ids and vars come from the deployment. Taking upstream's name instead would create a second Worker and orphan the live one, so identity is merged in by binding rather than by position. The build script is fetched from master while the source clone is the latest release tag, so a release predating the merge script falls back to the previous behaviour instead of failing.
The monitor holds an exclusive reader on the port and the flasher needs it closed, so both go through claim(), which tears down the read loop, closes the port, hands it over, and restores the monitor at its previous baud. Two owners racing for the same lock is what produces "port already open" errors that survive a reload. Console lines are source-tagged, because flash progress never arrives over the port — esptool-js speaks binary to the ROM loader and reports separately. Web Serial is absent from TypeScript's DOM lib, hence the types dependency.
Splits the stream into levels the console can colour: SDK lines by their message, ESP-IDF lines by their severity letter, boot ROM output by its prefixes, and anything else as plain sketch output. Entries commit once per animation frame rather than per line — a board at 115200 baud can outrun per-line reactivity. Pausing holds new lines aside instead of dropping them. Tracks whether recent output is mostly replacement and control characters, which is what a wrong baud rate looks like.
A Device section under each project, with a console that connects a board over Web Serial and shows what it prints. Output follows the tail only while the view is at the bottom — a chatty board otherwise makes it impossible to read back through a fault. Browsers without Web Serial get a page naming the ones that do and saying this is the only part of nodrix that needs USB, rather than a dead button. The hub takes the tabbed shape Variables and Automations already use, with one tab for now.
Turns SDK debug output into a banner above the console — "Token rejected", "The server refused the connection" — instead of leaving a red line for the reader to interpret. The newest significant line wins, so recovering from a fault clears the stale error. Wi-Fi state is tracked separately from cloud state, which is what makes a compound reading possible: "Wi-Fi is up" in front of a server failure says the radio is fine and the problem is further along. diagnose() takes an entry array and holds no reactive state, so the rules are tested directly rather than through a mounted component.
Adds a devices table and a default device per project, then rebuilds project_variables with device_id in its unique key. Telemetry that names no device lands on the default, so a plain curl with only a token keeps working. project_variables is rebuilt rather than altered because device_id is NOT NULL with a foreign key and the unique key changes shape. Nothing references that table by foreign key, so the rebuild needs no deferral. Default device ids derive from the project id, which keeps the migration deterministic without generating ids in SQL, and one default per project is enforced by a partial unique index rather than left to convention. Tested against SQLite: an instance seeded before the upgrade and a fresh install come out with byte-identical schemas, and replaying the baseline over a migrated database does not reinstate the old two-column unique index.
Boards identify themselves with an X-Nodrix-Device header; the value maps to a device row, created on first sight. Anything that names no device lands on the project's default, so an existing board or a plain curl keeps working untouched. The reported key is untrusted input — normalised, length-capped, and bounded at 100 devices per project so a board that reports a fresh key every boot can't grow the table without limit. It is kept apart from the device id so renaming stays free and a MAC never surfaces in anything a user reads. Device creation reads back after inserting rather than trusting the id it generated: two isolates racing on the same first boot both insert, one loses the conflict, and returning its own id would attribute telemetry to a row that does not exist. createProject now writes the project and its default device in one batch. The migration only covers projects that already existed, so without this a project created after upgrading would have no default device at all.
latest_state is rebuilt on (device_id, variable), ring_buffer and pending_control gain the column, and the ring index follows. '' marks the project's default device and every pre-devices row backfills to it. NULL cannot serve there: SQLite treats NULLs as distinct in a unique key, so the upsert would never match and each write would append a duplicate row instead of updating one. pending_control does use NULL, where it means a control write with no target that still broadcasts. R2 keeps its shape — the device goes in the NDJSON row, not the key path, so an hour isn't fragmented into one small object per device. Rows written before this read back as the default device. Series reads take an optional device filter; omitting it queries the whole project, which is what dashboards still do.
Ingest now carries the device through to Durable Object storage, and /state groups by device rather than returning a flat key map. Those had to change together: two boards reporting the same key into a flat map means the second silently overwrites the first, which is the whole point of having devices. resolveDevice returns both ids it is asked for — the D1 id that owns the variable rows, and the storage id the DO keys by, which is '' for the default device. Callers get what they need without either of them knowing the rule. Adds list, rename and forget. The default device can't be forgotten; without one, telemetry that names no device has nowhere to land. Forgetting drops D1 rows and DO state but leaves R2 history, which is only safe because the device is named in each row rather than in the key path.
Adds a hello frame carrying the device key and optional chip and firmware. An all-WS board never sends an HTTP header, so without this it had no way to say which board it was and everything landed on the default device. The socket's device is held in serializeAttachment rather than memory: a hibernated Durable Object keeps the attachment but loses anything in an isolate, so an idle board that wakes hours later stays attributed. Connect and hello split the pending-control flush. A socket has to catch up the moment it connects, but its identity isn't known until hello arrives, so it starts as the default device and takes broadcasts and default-device writes, then re-scopes and drains its own queue on hello. The two queries can't overlap, and a hello that fails to resolve returns rather than falling through to the default. Control writes can now target one device; a null target still broadcasts.
Devices becomes the first tab under Device and the console moves alongside it. Renaming matters more than it looks: a board identifies itself by something MAC-derived, and without a name that string would surface in every variable a user reads. The default device is badged and has no Forget control, mirroring the server rule rather than trusting the client to know it. The forget confirmation spells out what happens, because none of it is guessable: variables and recent history go, archived telemetry stays, and the board reappears if it ever reports again. Focus on the rename input is set from a function ref. A template ref declared inside v-for collects into an array — the compiler decides that by lexical position, so the v-if narrowing it to one row makes no difference — and calling focus() on the array would have thrown.
Variable triggers take an optional device, defaulting to any. Both readings are real — one rule per place, or one rule for every place — and neither was expressible before. An automation now stays on the device that fired it: set_variable targets it and condition reads come from its state, so a rule about one greenhouse can't switch the fan in another. Pending control was returned in full to any polling board, so a second device executed writes meant for the first. Listing and acking are both scoped now — a device sees broadcasts and its own, and can't consume another's queue. Triggers name devices by their D1 id while storage calls the default device '', so the id is mapped before comparing. Without that a trigger pinned to the default device matches nothing and the automation silently never fires.
Drives esptool-js through the port handoff the console already owns, so the monitor tears down cleanly and comes back when the write finishes. Flasher progress is pushed into the same console buffer. It arrives out of band — the port is speaking binary to the ROM loader at the time — and without it the console simply goes dead for twenty seconds mid-session. after() resets the board once writing completes; skipping it leaves the chip in the ROM bootloader until it is physically unplugged, which reads as a bricked board. The transport is disconnected in a finally so a failed flash doesn't leave the port held for the rest of the session. esptool-js is 106 kB, so it stays in the lazily loaded Flash chunk rather than the main bundle.
GitHub's API sends CORS headers but release assets do not — they redirect to a host that sends none — so the browser can read the catalogue and cannot read the binary. The worker proxies both, which also keeps every browser off the unauthenticated GitHub rate limit. The download endpoint takes a tag and a filename, never a URL, and builds the target from a fixed repo. Both parts are charset-checked and '..' is rejected on its own, since the charset allows dots and v1..2 would otherwise climb out of the release path. The catalogue caches in KV behind an ETag. No published release reads as an empty catalogue rather than an error, and the panel falls back to picking a local .bin, which is what it did before.
Assigning firmware to a device sets desired state and returns. The board compares its reported version against that and pulls when they differ — nothing is pushed at it, no job is tracked, and the slow part runs on the ESP32 where a Worker CPU limit can't reach it. Devices get two endpoints, both on the token and device header they already use for telemetry: one asks whether to update, one streams the image from R2. Success is the board reporting the desired version on its next hello. That's the only honest signal available — the cloud cannot know a device booted. A failed insert deletes the image it already wrote, so losing the unique version race can't strand an object in R2 that nothing points at. The nudge crosses into Durable Object storage, where the default device is '' rather than its D1 id, so it goes through storageIdOf. That mapping has now caught three call sites and lives in one place.
The devices table reads "Running" and "Should run" rather than offering a start button, because that is what the system does — you state desired state and the board reconciles when it next checks. There is no job to watch. The upload form warns that the version must match what the sketch reports. A mismatch updates the board and never marks it done, which is the easiest way to be confused by any of this. Images post as a raw body rather than through the JSON helper; base64 in JSON would inflate a megabyte image by a third for nothing.
A CodeMirror editor with C++ highlighting, seeded from the SDK examples and kept per project in localStorage. Example sources are read at the same release tag the binaries were built from, not the default branch, so what's on screen is what a published image was compiled from. raw.githubusercontent sends CORS headers, so unlike release assets this needs no proxy. The compile box explains why a browser can't run a C++ toolchain and what to do instead, rather than offering a button that does nothing. CodeMirror and esptool-js are both excluded from the service worker precache. Workbox globs every chunk, so ~630 kB of toolchain was being downloaded on install by people who may never open either tab.
Deleting a variable cleared its hot state for every device in the project, not the one that owned it. Five sensors reporting temp from five places meant removing one wiped all five — the exact case device scoping exists for. Deleting a project wiped telemetry/ but not firmware/, leaving images in R2 that nothing could reach and nothing would ever remove.
The migration to 2.0 runs once, unattended, on instances nobody can observe. Every other safeguard — batched statements, transaction-wrapped Durable Object steps — lowers the chance of failure without putting a floor under it. This is the floor: a copy taken before upgrading, and something to compare against afterwards. NDJSON, one typed record per line, streamed from an async generator so a project carrying a year of telemetry never sits in memory. No secrets leave: token hashes, sealed integration config and dashboard share tokens are all omitted. That makes the file safe to hand to someone, and means it restores data rather than credentials.
The image endpoint serves about a megabyte a call and had no throttle. A boot-looping board — likelier than an attacker — would pull it in a loop against R2 egress. The counter lives in Durable Object SQLite rather than KV. The existing auth throttle is deliberately soft and fails open, which is right when the cost of over-blocking is locking someone out of their own instance. Here the cost is money, and a device hammering in a loop can outrun an eventually consistent counter, so this one is strongly consistent and fails closed.
Durable Objects have no migration runner, so an object created today and one that predates devices arrive by different routes. The divergence that matters is silent — a column NOT NULL on one and nullable on the other — so the two are now compared directly rather than assumed equal. Also asserts what the '' sentinel exists for: two writes to the default device produce one row. With NULL they would produce two, because SQLite treats NULLs as distinct in a unique key. The schema ladder moves to its own module so a test can drive it without pulling in the Durable Object runtime.
The ring buffer capped 1,000 rows for the whole project. That is generous with one board and quietly wrong with five — 200 points each, charts thinning as hardware is added, and nothing anywhere explaining why.
Derived from last_seen at read time rather than stored. A device that goes quiet never writes anything, so there is nothing to flip a stored flag.
A key stopped being unique once variables became device-scoped. set_variable checked existence with project and key alone, so an LLM could target one device using a variable that only exists on another. Reading with no device still spans the project, which is what a single-device instance always returned. Writing with no device targets the default rather than broadcasting — a model steering hardware should reach one board unless it says otherwise.
Every upload was an artifact nothing would ever remove — around 1.5 MB each against a 10 GB free tier, unbounded. Keeps the ten most recent, plus anything a device runs or is waiting to run. Those exclusions are the point: dropping a desired image strands a pending update behind a dangling reference, and dropping a running version loses the image a board in the field is actually on. Pruning can't fail an upload that already succeeded, so a failure leaves one extra image behind until the next one.
Dashboard widgets bind to a bare variable key, but storage is per device now. A second board reporting the same key made getLatestState return both rows — the widget showing whichever came last — and merged both into one chart series. Silently, with no error and no way to tell. The automation engine had the same shape for schedule, sunset and manual runs, which carry no device. That one was accidentally right, since '' sorts before any generated id; it no longer depends on collation. /state still returns every device grouped — showing all of them is its job.
Widgets bind to a bare variable key, so a dashboard needs to say which board those keys belong to. Layout gains an optional device; absent means the project's default, which is what every dashboard did before devices existed — so no stored layout changes and nothing needs migrating. Dashboard-level rather than per-widget. Per-widget would touch every widget's props, the extractor, the builder and the snapshot API to fetch several devices at once; this composes with that later rather than blocking it. The cost today is that five sensors in five places means five dashboards.
The selector only appears once a project has more than one device, so a single-board instance gains no control it has no use for. normalizeLayout rebuilds the layout field by field and was dropping device when rescaling an older grid, which would have quietly reset a dashboard to the default device on the next save.
The agent dials into ProjectDO and its socket is tagged in the attachment, so agent frames and device frames route apart on the same object — no new Durable Object class. Nothing is queued for an absent agent. Compiling is work on someone's physical machine, and a queue would fire builds hours later when a laptop reopens; no agent connected is an immediate 409. The browser's request is held open until the agent answers, which works because a Worker has no wall-clock limit while a client is connected. Five minutes, since a first build installs a toolchain. Owner and admin at both ends, on the socket and on the build request. A member triggering a build would be arbitrary toolchain execution on someone else's laptop.
recordDeviceSeen had one caller — the WebSocket hello handler — so HTTP-mode boards never updated last_seen and the online indicator read them as never seen. On an upgraded instance every device is the default device, so that is every device. touchDevice writes at most once a minute per device and is called from HTTP ingest, the control poll, the OTA check and image download, and WS telemetry (hello alone left a long-lived socket looking stale). The WS path also attributed variables to the default device regardless of which device the socket belonged to, so a named board's telemetry landed under its own id while its variable rows were created elsewhere.
requestBuild carried the whole binary back as base64 through an object that is also running ingest, the ring buffer, R2 flushes and automation evaluation for every board in the project. The DO now carries job control only. The agent PUTs to /v1/agent/artifact which streams straight into R2, then reports the result, so ok always means the object is collectable; the browser fetches it once and the route deletes it. builds/ joins the project-delete prefix loop, and a sweep on each new build drops anything a timed-out request left behind.
… shipped An HTTP-mode board also never reported the version it runs, so offerFor compared against NULL, offered the update, and would have gone on offering it after it succeeded — boot, flash, restart, repeat, bounded only by the hourly download quota. The check route now reads X-Nodrix-Firmware and X-Nodrix-Chip and feeds them to the same recordDeviceSeen and reconcile pair the hello frame uses. offerFor takes the reported version and prefers it over the stored one, so the answer is right in the same request instead of one round trip later.
The device plane: author, build, flash, provision, observe, update
requestBuild buffered every log line and handed them over at the end, so a cold toolchain install was minutes of a spinner and then a wall of text — which reads as a hang, and is exactly what makes people retry. It now returns NDJSON as the agent emits it: log frames, then one result frame carrying the outcome. RPC only carries byte-oriented streams, so the readable is built with type: 'bytes'; a plain TransformStream typechecks and fails at runtime. The route is a 200 either way now, since the outcome is in the body rather than the status.
It offered three things. Flashing a prebuilt SDK example is now "load the example into the editor and press Flash". Flashing a .bin you already have is not something the platform needs to own. A hand-entered flash offset is guesswork the build itself knows. That takes the release-asset proxy with it — binaryUrl, fetchBinary, the two regexes standing between it and an open redirect, and the test guarding them. The catalogue stays: the editor's example picker reads it. The build artifact also stops being deleted on read, so one build can be flashed over USB and kept for OTA rather than one or the other. The hourly sweep already collects whatever nobody promotes.
The upload form asked for a .bin and a version string, and warned in its own help text that the version "must match what the sketch reports, or the device will never be marked updated". That mismatch was possible only because uploading was divorced from building. A build now becomes a firmware version by being kept: publishBuild copies the artifact out of builds/ and gives it a row. The version is the build id, which the agent stamps into the sketch at compile time, so what the board reports and what the row says are the same string by construction. Code offers both destinations for one compile — flash over USB, or save for OTA — and reuses the artifact rather than rebuilding. Assignment moves onto the Devices table, so the firmware page and its endpoint both go.
The offset was hardcoded to 0x10000, which is where an ESP32 app sits above its bootloader and partition table. An ESP8266 sketch is the whole image and starts at zero, so picking NodeMCU wrote 64 KB past the start and left a board that could not boot. The offset now comes from the selected board.
Writing a sketch, watching it build, and watching the board boot were three tabs, so the two halves of one loop never shared a screen. Editor on top, a dock underneath with Console and Serial monitor. The dock follows the build, then switches to the monitor once a flash lands, which is the moment the board starts printing. Flash progress rides in the tab strip rather than taking a panel of its own. CodeMirror grows with its content by default, which would push the dock off screen on a long sketch, so the editor now fills the pane and scrolls itself. SerialConsole moves to components/SerialMonitor and fills the height it is given instead of naming its own. Device tabs are down to Devices and Code. The FlashPanel precache ignore goes with them — it stopped matching anything when that page was deleted.
One page to write, build, flash and watch a board
… picker Five native selects were left behind while the rest of the app moved to Dropdown: board and example on the code page, baud on the serial monitor, which build a device should run, and which device a dashboard reads. Empty options become the placeholder, which is what Dropdown already models, and the two that used :value with a change handler keep that shape. The example picker was worse than redundant, it was inert. It listed assets named <Example>-<target>.bin on the SDK's latest release, and the only published release carries no assets at all, so the list was always empty and Load was always disabled. Removing it takes the whole catalogue: the GitHub releases fetch, its ETag handling and KV cache, the /v1/admin/firmware mount, and both catalogue types. The code page now talks only to its own instance. The starter sketch still seeds an empty editor.
Custom dropdowns everywhere, and one dead feature removed
Pressing Flash without one running printed "no agent is connected" into the console and stopped there. Nothing said an agent is a thing you download and run on your own machine, and the only instructions were in another repo's README, which nobody had a reason to find. The failure now carries a code rather than a sentence to match on, and the console answers it: what the agent is for, the download named for the platform the browser is on, the instance URL already filled in, and the arduino-cli core the build will need next. The main README gained the same path, since deploying an instance was documented but flashing a board from it was not.
Tell people what an agent is when a build needs one
Compiling in the browser needed a separate binary on the operator's machine, a WebSocket protocol and a streamed build log, none of which is on the way to getting an image onto a board — an image built by the toolchain they already run is. The agent returns in a later release; the firmware it published into stays, and upload takes over as the way a version is created.
All three exist to get a first image onto a board over USB, which the Arduino IDE already does, and they carried CodeMirror and esptool-js into a page every project opens. The Device page is now a single route; Web Serial comes back with USB flashing rather than sitting behind an unused tab.
An image compiled anywhere — Arduino IDE, arduino-cli, PlatformIO — becomes a version a device can be pointed at, which is what the agent build used to do. The bytes are checked before anything is stored, because both common mistakes are silent otherwise: a file that is not an ESP image, and the merged flash image Arduino writes beside the app one, which would leave a board that took it over the air unable to boot. The header also names the chip, so the target fills itself in. Writes in this router are owner/admin now, unlike the rest of the project sub-routers: putting an image on a board isn't undoable from the dashboard.
A version typed on upload that doesn't match the one the sketch reports is the easy mistake to make, and it used to cost a board: every check offered the same image, every boot reinstalled it, forever, bounded only by the download quota. Pulls are counted now, reset when the board reports the version it was sent, and the update is marked failed at three, which stops the offer. Re-assigning the firmware clears the count and tries again. The column lands in 0002 rather than a migration of its own — devices have never been released.
The Device page lists what has been uploaded and adds an upload dialog, which is where the version rule has to be said out loud: it must match the string the sketch reports, or the board reinstalls an update it can never finish. A device whose update has been given up on says so in the row, since the board itself has no way to tell anyone. Members see what is assigned but can't change it, matching the API.
The browser-flashing section described an agent that no longer exists. What replaces it is the part people get wrong unaided: which of the files Arduino writes is the one to upload, and why the version in the sketch has to match.
The upload dialog was written but never imported, so nothing opened it. With no way to create a firmware row, the Update-to dropdown on every device was permanently empty and the README's "Devices -> Upload firmware" pointed at a control that did not exist. Devices now splits into two tabs the way Variables does. Firmware holds the upload, the images with their size, detected chip, hash and notes, delete, and how many boards are running or still pending each one. Devices keeps the table, inside the standard page container it was missing. Two things the table got wrong are fixed with it. A device that had given up after the attempt cap still read "waiting for the board", which is the opposite of what happened; it now says so and offers a retry, which is just the assignment again. And the running version is printed as reported instead of being stripped of a bld_ prefix and cut to six characters, both leftovers from the build path this branch removed.
The over-the-air section sent people to "Devices -> Upload firmware", which was never a control that existed; the upload lives on the Firmware tab. It also called setFirmwareVersion() without saying that it arrived in the Nodrix library at 0.2.0 — on anything earlier the board reports no version at all and is silently never offered an update. Also closes a heading that ran straight on from the paragraph above it.
Rename and Forget were text buttons, which is not how any other table in the app reads. They become the pencil and trash the variables table uses, same muted-until-hover treatment, with the inline rename behind the pencil unchanged. The default device keeps a spacer where its trash would be so its pencil stays in line with every other row. Forgetting a device takes all of its variables and its recent history, so the confirmation now says a dashboard reading that device needs one picked again, and that the board comes back as a new device rather than the one you forgot. That last part was worse than it sounds. A dashboard stores the device id it reads, and the editor only offered the picker when a project had more than one device — so forgetting the pinned device left the dashboard holding a dead id, reading nothing, with no control on screen to change it. The picker now also appears whenever a device is pinned, and a pinned id that no longer exists is listed as a deleted device so it can be seen and cleared. Widgets stay empty until one is picked, which beats falling back to the default device and showing plausible readings from the wrong board.
Nothing here defined a focus state, so every field fell through to the browser's default blue ring — in an app whose accent is a runtime- swappable scale. The file picker, version, notes and the devices table's inline rename now use focus:border-accent-500 with the accent ring the dropdown and date picker already use, so a focused field follows data-accent instead of Chrome. The native file input went with it. It rendered as system chrome — grey "Choose File" button, system font, its own tooltip — inside a styled form. It is now the same control as every other field, showing the filename once one is picked, with the input kept in the DOM for the click and for keyboard focus. The shell was its own invention too: a plain padded box with a text-lg heading, larger than any other dialog title in the app. It takes the structure ShareDialog and ConfirmModal share — bordered header with a close button, scrolling body, grey footer bar — plus the role, aria-modal and escape-to-close it was missing. The merged-image warning moves from the header to a hint under the field it describes, and names the 8 MB limit the API already enforces.
Opening /p/:proj/device directly showed an empty table, while arriving at the same page from the sidebar showed everything. The shell resolves the session and switches the project store asynchronously, so on a cold load the child mounts first and both loaders return early on a null project id, leaving the page to settle as "no devices yet". Variables and dashboards never showed this because switchTo loads them itself; devices and firmware are deliberately lazy. The hub now waits for the id instead of firing once on mount, which also means switching projects from the picker refetches rather than showing the previous project's boards. The file field also stops pretending to be a text input. It is a Choose file button with the filename beside it, the way the native control is shaped, in the app's own styling — the full-width version read as something you could type into.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ships firmware to a board over the air: compile with the toolchain you already use, upload the image, assign it to a device, and the board takes it on its next check. The first flash is still over USB; after that, no cable and no physical access.
How an update lands
A device reports the version it is running — in the hello frame on the control socket, or in
X-Nodrix-Firmwareon the HTTP check — and the worker reconciles that against the firmware the project has assigned it. A board on the socket is told immediately; one on HTTP finds the offer at its next check or on reboot. The board reporting the new version is what marks the update done, which is why the version on the upload has to match the string the sketch passes tosetFirmwareVersion().That match is the easy thing to get wrong, and unguarded it costs a board: every check offers the same image, every boot reinstalls it, forever. Pulls are counted, reset when the board reports the version it was sent, and the update is marked failed at three, which stops the offer and says so in the device row — the board itself has no way to tell anyone. Assigning the firmware again clears the count and retries.
Uploading an image
A version is created by uploading an image compiled anywhere — Arduino IDE,
arduino-cli, PlatformIO. The bytes are validated before anything is stored, because both common mistakes are silent otherwise: a file that is not an ESP image, and the merged flash image Arduino writes beside the app one, which would leave a board that took it over the air unable to boot. The header also names the chip, so the target fills itself in. Images cap at 8 MB, the ten newest versions per project are kept, and the image download is rate-limited per device.Writes on the firmware router are owner/admin, unlike the rest of the project sub-routers — putting an image on a board is not undoable from the dashboard. Members see what is assigned but cannot change it.
Device plane
Devices become first-class: list, rename and forget them, scope variables, automations and control delivery per device, point a dashboard at one, and see whether a board is still reporting.
touchDevicekeepslast_seencurrent from HTTP ingest, the control poll, the OTA check, the image download and WS telemetry, at most once a minute per device. Migration0002_devices.sqland a Durable Object schema migration bring existing instances across; every project gets a default device, so telemetry that names none keeps working.Also here: per-project data export, and
scripts/merge-wrangler.ts, which merges deployment identity into the latest upstreamwrangler.tomlso new bindings and flags reach existing deployments without clobbering their resource IDs.Version bumped to 1.1.0.