Cloud editing MVP

admin/jobs/river/reconcile_deployment.go

@@ -3,6 +3,8 @@ package river
 import (
 	"context"
 	"errors"
+	"strings"
+	"time"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/rilldata/rill/admin"
@@ -24,6 +26,12 @@ type ReconcileDeploymentWorker struct {
 	admin *admin.Service
 }
 
+// NextRetryAt uses exponential backoff starting at 15s: ~15s, ~30s, ~60s, ~120s.
+// This keeps total retry duration under ~4 minutes so users aren't stuck waiting.
+func (w *ReconcileDeploymentWorker) NextRetryAt(job *river.Job[ReconcileDeploymentArgs]) time.Time {
+	return time.Now().Add(15 * time.Second * time.Duration(1<<(job.Attempt-1)))
+}
+
 // NewReconcileDeploymentWorker creates a new ReconcileDeploymentWorker. Only to be used in tests to trigger the worker directly.
 func NewReconcileDeploymentWorker(admin *admin.Service) *ReconcileDeploymentWorker {
 	return &ReconcileDeploymentWorker{
@@ -74,8 +82,10 @@ func (w *ReconcileDeploymentWorker) Work(ctx context.Context, job *river.Job[Rec
 			}
 
 			// Initialize the deployment (by provisioning a runtime and creating an instance on it)
-			err := w.admin.StartDeploymentInner(ctx, depl)
-			if err != nil {
+			if err := w.admin.StartDeploymentInner(ctx, depl); err != nil {
+				if w.isNonRetryable(err) || job.Attempt >= job.MaxAttempts {
+					return w.cancelAsErrored(ctx, depl.ID, err)
+				}
 				return err
 			}
 		}
@@ -115,12 +125,18 @@ func (w *ReconcileDeploymentWorker) Work(ctx context.Context, job *river.Job[Rec
 		// Delete the deployment and all its resources.
 		err := w.admin.StopDeploymentInner(ctx, depl)
 		if err != nil {
+			if job.Attempt >= job.MaxAttempts {
+				return w.cancelAsErrored(ctx, depl.ID, err)
+			}
 			return err
 		}
 
 		// Delete the deployment
 		err = w.admin.DB.DeleteDeployment(ctx, depl.ID)
 		if err != nil {
+			if job.Attempt >= job.MaxAttempts {
+				return w.cancelAsErrored(ctx, depl.ID, err)
+			}
 			return err
 		}
 
@@ -153,3 +169,20 @@ func (w *ReconcileDeploymentWorker) Work(ctx context.Context, job *river.Job[Rec
 
 	return nil
 }
+
+// isNonRetryable returns true for errors that won't resolve with retries,
+// such as capacity limits or configuration errors.
+func (w *ReconcileDeploymentWorker) isNonRetryable(err error) bool {
+	msg := err.Error()
+	return strings.Contains(msg, "no runtimes found with sufficient available slots") ||
+		strings.Contains(msg, "Invalid environment") ||
+		strings.Contains(msg, "not a valid version")
+}
+
+// cancelAsErrored marks the deployment as errored and cancels the river job.
+func (w *ReconcileDeploymentWorker) cancelAsErrored(ctx context.Context, deplID string, err error) error {
+	if _, dbErr := w.admin.DB.UpdateDeploymentStatus(ctx, deplID, database.DeploymentStatusErrored, err.Error()); dbErr != nil {
+		w.admin.Logger.Error("reconcile deployment: failed to set errored status", observability.ZapCtx(ctx), zap.Error(dbErr))
+	}
+	return river.JobCancel(err)
+}

admin/jobs/river/river.go

@@ -335,7 +335,7 @@ func (c *Client) ReconcileDeployment(ctx context.Context, deploymentID string) (
 	res, err := c.riverClient.Insert(ctx, ReconcileDeploymentArgs{
 		DeploymentID: deploymentID,
 	}, &river.InsertOpts{
-		MaxAttempts: 25, // Last retry, ~3 weeks after first run
+		MaxAttempts: 5, // Retries at ~15s, 30s, 60s, 120s (see NextRetryAt override)
 		UniqueOpts: river.UniqueOpts{
 			ByArgs: true,
 			ByState: []rivertype.JobState{

admin/server/deployment.go

@@ -262,6 +262,7 @@ func (s *Server) GetDeployment(ctx context.Context, req *adminv1.GetDeploymentRe
 	}
 	if depl.Environment == "dev" {
 		instancePermissions = append(instancePermissions,
+			runtime.ReadInstance,
 			runtime.ReadOLAP,
 			runtime.ReadProfiling,
 			runtime.ReadRepo,

admin/server/projects.go

@@ -31,7 +31,7 @@ import (
 
 const devDeplTTL = 6 * time.Hour
 
-const devSlots = 8
+const devSlots = 4
 
 const prodDeplTTL = 14 * 24 * time.Hour
 
@@ -456,6 +456,24 @@ func (s *Server) GetProject(ctx context.Context, req *adminv1.GetProjectRequest)
 			runtime.EditTrigger,
 		)
 	}
+	// Grant permissions for branch deployments: viewers get dashboard access, editors get full dev access
+	if req.Branch != "" {
+		instancePermissions = append(
+			instancePermissions,
+			runtime.ReadInstance,
+			runtime.ReadOLAP,
+			runtime.ReadResolvers,
+		)
+		if permissions.ManageDev {
+			instancePermissions = append(
+				instancePermissions,
+				runtime.ReadProfiling,
+				runtime.ReadRepo,
+				runtime.EditRepo,
+				runtime.EditTrigger,
+			)
+		}
+	}
 
 	var systemPermissions []runtime.Permission
 	if req.IssueSuperuserToken {
@@ -2200,6 +2218,7 @@ func (s *Server) projToDTO(p *database.Project, orgName string) *adminv1.Project
 		Provisioner:         p.Provisioner,
 		ProdVersion:         p.ProdVersion,
 		ProdSlots:           int64(p.ProdSlots),
+		DevSlots:            int64(p.DevSlots),
 		PrimaryBranch:       p.PrimaryBranch,
 		Subpath:             p.Subpath,
 		GitRemote:           safeStr(p.GitRemote),

package.json

@@ -20,7 +20,8 @@
     "local-test": "cd web-local && npx playwright test --headed --project=e2e-chrome -g",
     "gen:colors": "node web-common/src/features/themes/gen-colors.ts",
     "quality": "bash ./scripts/web-test-code-quality.sh",
-    "quality:ci": "FAIL_FAST=true bash ./scripts/web-test-code-quality.sh"
+    "quality:ci": "FAIL_FAST=true bash ./scripts/web-test-code-quality.sh",
+    "check:edit-route-parity": "node ./scripts/check-edit-route-parity.js"
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^7.0.0",

runtime/drivers/admin/repo_git.go

@@ -255,10 +255,7 @@ func (r *gitRepo) commitAndPushToPrimaryBranch(ctx context.Context, message stri
 		return fmt.Errorf("failed to open repository: %w", err)
 	}
 	_, err = r.commitAll(repo, message)
-	if err != nil {
-		if errors.Is(err, git.ErrEmptyCommit) {
-			return nil // No changes to commit
-		}
+	if err != nil && !errors.Is(err, git.ErrEmptyCommit) {
 		return fmt.Errorf("failed to commit changes: %w", err)
 	}
 
@@ -401,7 +398,7 @@ func (r *gitRepo) fetchCurrentBranch(ctx context.Context) error {
 		RemoteURL: r.remoteURL,
 		RefSpecs:  []config.RefSpec{config.RefSpec(fmt.Sprintf("refs/heads/%s:refs/remotes/origin/%s", head.Name().Short(), head.Name().Short()))},
 	})
-	if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
+	if err != nil && !(errors.Is(err, git.NoErrAlreadyUpToDate) || git.NoMatchingRefSpecError{}.Is(err)) {
 		return err
 	}
 	return nil

runtime/feature_flags.go

@@ -60,6 +60,8 @@ var defaultFeatureFlags = map[string]string{
 	"developer_agent": "true",
 	// Controls if the dashboard state is persisted when navigating to a different dashboard.
 	"sticky_dashboard_state": "false",
+	// Controls visibility of the cloud editing feature (Edit button and edit routes)
+	"cloud_editing": "false",
 	// Controls visibility of the custom chart option in canvas dashboards
 	"custom_charts": "false",
 }

runtime/feature_flags_test.go

@@ -43,6 +43,7 @@ func Test_ResolveFeatureFlags(t *testing.T) {
 				"deploy":               true,
 				"developerAgent":       true,
 				"stickyDashboardState": false,
+				"cloudEditing":         false,
 				"customCharts":         false,
 			},
 		},
@@ -68,6 +69,7 @@ func Test_ResolveFeatureFlags(t *testing.T) {
 				"deploy":               true,
 				"developerAgent":       true,
 				"stickyDashboardState": false,
+				"cloudEditing":         false,
 				"customCharts":         false,
 			},
 		},
@@ -93,6 +95,7 @@ func Test_ResolveFeatureFlags(t *testing.T) {
 				"deploy":               true,
 				"developerAgent":       true,
 				"stickyDashboardState": false,
+				"cloudEditing":         false,
 				"customCharts":         false,
 			},
 		},
@@ -118,6 +121,7 @@ func Test_ResolveFeatureFlags(t *testing.T) {
 				"deploy":               true,
 				"developerAgent":       true,
 				"stickyDashboardState": false,
+				"cloudEditing":         false,
 				"customCharts":         false,
 			},
 		},

runtime/server/auth/claims.go

@@ -27,9 +27,10 @@ type jwtClaims struct {
 var _ ClaimsProvider = (*jwtClaims)(nil)
 
 func (c *jwtClaims) Claims(instanceID string) *runtime.SecurityClaims {
-	attrs := c.Attrs
-	if attrs == nil {
-		attrs = make(map[string]any)
+	// Copy attrs to avoid concurrent map writes when Claims is called from multiple goroutines.
+	attrs := make(map[string]any, len(c.Attrs)+1)
+	for k, v := range c.Attrs {
+		attrs[k] = v
 	}
 	if _, ok := attrs["id"]; !ok {
 		attrs["id"] = c.RegisteredClaims.Subject

runtime/server/sse.go

@@ -9,6 +9,7 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"time"
 
 	runtimev1 "github.com/rilldata/rill/proto/gen/rill/runtime/v1"
 	"github.com/rilldata/rill/runtime/pkg/observability"
@@ -296,29 +297,48 @@ func serveSSEUntilClose(w http.ResponseWriter, events chan *sseEvent) {
 	fmt.Fprint(w, ":ok\n\n")
 	flusher.Flush()
 
+	// Send periodic keep-alive comments to prevent proxies and load balancers
+	// from closing idle connections. SSE comments (lines starting with ':')
+	// are no-ops per the spec and ignored by clients.
+	keepAlive := time.NewTicker(30 * time.Second)
+	defer keepAlive.Stop()
+
 	// Consume events from channel and write to response (the loop ends when the channel is closed)
-	for ev := range events {
-		// Skip empty events
-		if ev == nil || len(ev.Data) == 0 {
-			continue
-		}
+	for {
+		select {
+		case ev, ok := <-events:
+			if !ok {
+				return
+			}
+			// Skip empty events
+			if ev == nil || len(ev.Data) == 0 {
+				continue
+			}
 
-		// Write the event
-		if ev.Event != "" {
-			_, err := fmt.Fprintf(w, "event: %s\n", ev.Event)
+			// Write the event
+			if ev.Event != "" {
+				_, err := fmt.Fprintf(w, "event: %s\n", ev.Event)
+				if err != nil {
+					return
+				}
+			}
+			_, err := fmt.Fprintf(w, "data: %s\n", ev.Data)
 			if err != nil {
 				return
 			}
+			_, err = fmt.Fprint(w, "\n")
+			if err != nil {
+				return
+			}
+			flusher.Flush()
+
+		case <-keepAlive.C:
+			_, err := fmt.Fprint(w, ":keepalive\n\n")
+			if err != nil {
+				return
+			}
+			flusher.Flush()
 		}
-		_, err := fmt.Fprintf(w, "data: %s\n", ev.Data)
-		if err != nil {
-			return
-		}
-		_, err = fmt.Fprint(w, "\n")
-		if err != nil {
-			return
-		}
-		flusher.Flush()
 	}
 }