Skip to content

feat: login-free Cloudflare Workers demo with free Workers AI, live citations and daily quotas - #15

Merged
FelixFangX merged 16 commits into
masterfrom
feat/cloudflare-demo
Oct 17, 2026
Merged

FelixFangX merged 16 commits into
masterfrom
feat/cloudflare-demo

Conversation

@FelixFangX

Copy link
Copy Markdown
Owner

Summary

Rebuilds the public demo as a login-free Cloudflare Worker (preview only: https://research-thinking.ledring.workers.dev, no custom domain or routes yet).

What changed

  • Worker (worker/, wrangler.jsonc): serves the SPA with Workers Static Assets, plus:
    • POST /api/llm: streams from the Workers AI binding. Only free-plan models are allowed (@cf/zai-org/glm-4.7-flash is the default, @cf/google/gemma-4-26b-a4b-it is optional). Callers can't pass a base URL. It uses JSON mode and turns GLM thinking off. Request limits: 48 KB body, 12 messages, max_tokens ≤ 3072.
    • Quotas in D1 (research-thinking): 3,000 neurons/day global (30% of the shared 10k free allocation, so strands keeps 70%), 600 neurons/day per IP, 12 LLM requests/min per IP. Costs are reserved before each call and settled from the real neuron usage in the stream. IPs are stored only as salted hashes.
    • POST /api/evidence: server-side OpenAlex search (polite User-Agent and mailto). An optional OPENALEX_API_KEY secret is supported. If OpenAlex rate-limits or fails, it falls back to Crossref. Responses are cached in the Cache API for 24 h.
    • GET /api/status: available models and remaining quota.
  • App:
    • Removed the Supabase auth gate, the share page and the Pro paywall from the public build. The supabase/ folder is untouched.
    • Real evidence feeds the main flow and the demo mode, with linked DOI citations and citation chips. The source label always shows where the evidence came from.
    • Clear notices for quota exhausted, rate limited and model unavailable, each with a "Run demo" fallback.
    • Bring-your-own key moved under Settings → Advanced. It still goes from the browser straight to the provider and never reaches the Worker.
  • China-safe:
    • Fonts are self-hosted (@fontsource/fira-code). No Google Fonts, no ipapi lookup.
    • PostHog loads only through a dynamic import, and only if a key is set at build time and the user opts in.
    • 0 third-party requests on page load.
    • _headers sets CSP and Cache-Control: … no-transform on HTML, which stops the zone from injecting Web Analytics (same fix as lakeboard-convert fix(watch): run without the now-private digest, report its status #12).
  • UI: minimal neutral design with one accent color, automatic light/dark, and a mobile-first layout.
  • Robustness: lenient JSON repair, plus one retry per stage if the free model returns malformed JSON.
  • Eval: new pnpm eval --mode worker --limit N runs against the deployed Worker.

Verification

  • pnpm lint, pnpm test (89 tests), pnpm build, pnpm typecheck:server, pnpm typecheck:worker: all pass.
  • Playwright on the preview at 1440 light/dark and 390 light/dark:
    • Full flow works without login and the LLM output streams.
    • 8 real DOI citations per run, and every citation chip resolves to its evidence item.
    • 0 third-party requests, 0 page errors, no horizontal overflow.
  • Quota states were checked by deploying temporarily with --var IP_REQUESTS_PER_MINUTE:1 (rate-limit notice shown) and --var GLOBAL_DAILY_NEURONS:100 (quota-exhausted notice shown, demo still works with real evidence). Production values were then restored.
  • Eval, worker mode, first 5 interests, GLM-4.7 Flash:
Mode Schema valid Structure OK Interest coverage On-topic evidence Citations verified
worker 100% 100% 1.00 0.85 100%
openalex (baseline, same 5) 100% 100% 0.95 0.85 100%
demo (baseline, same 5) 100% 100% 1.00 0.33 0%

Total cost: 357 neurons (about 71 per run). A UI run with a seed idea costs about 115.

Not in this PR / needs a decision

  • research.ledring.dev is not attached yet.
  • The Vercel and Supabase projects are untouched. Merging this to master will change what the git-connected Vercel project builds: a login-free SPA without /api/*, where only BYO key and the demo would work there.
  • Keyless OpenAlex is rate-limited from Cloudflare egress IPs, so evidence currently comes from Crossref. A free OpenAlex API key (wrangler secret put OPENALEX_API_KEY) would bring OpenAlex back as the primary source.

@vercel

vercel Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
research-thinking-ai Ready Ready Preview Oct 17, 2026 8:58am UTC

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-10-17T08:25:10.660905Z 67ea85e PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 7456a5a5-bf33-4354-b708-eadb3351e3fe
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Raw API responses such as 'API 502: {"error":"upstream_error"}' no longer
reach the toast or the inline run error. Free-tier failures map to the
existing quota/unavailable notices, other API errors to a generic localized
message (en, zh). Raw details are logged to the console only.
Adds a custom_domain route to wrangler.jsonc and keeps workers.dev enabled.
The Worker has no origin or host checks, so no code change is needed.
Docs point to the new domain.
@FelixFangX
FelixFangX merged commit 8903e63 into master Oct 17, 2026
4 checks passed

This branch was successfully deployed

1 active deployment
Preview — 761d2000 Deployed Oct 17, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant