@runtypelabs/cli 2.33.6 → 2.33.7

package/dist/index.js

@@ -38455,6 +38455,33 @@ function sanitizeCodeToolIdentifier(name) {
   if (/^[0-9]/.test(safe)) safe = "_" + safe;
   return safe;
 }
+var DEFAULT_SANDBOX_PROVIDER = "cloudflare-worker";
+var SANDBOX_PROVIDER_LANGUAGES = Object.assign(
+  /* @__PURE__ */ Object.create(null),
+  {
+    quickjs: ["javascript"],
+    "cloudflare-worker": ["javascript"],
+    "runtype-sandbox": ["javascript", "typescript", "python"],
+    "cloudflare-sandbox": ["javascript", "typescript", "python"],
+    daytona: ["javascript", "typescript", "python"]
+  }
+);
+function resolveSandboxProvider(provider) {
+  return typeof provider === "string" ? provider : DEFAULT_SANDBOX_PROVIDER;
+}
+function lookupLanguages(provider) {
+  const resolved = resolveSandboxProvider(provider);
+  if (!Object.prototype.hasOwnProperty.call(SANDBOX_PROVIDER_LANGUAGES, resolved)) return void 0;
+  const languages = SANDBOX_PROVIDER_LANGUAGES[resolved];
+  return Array.isArray(languages) ? languages : void 0;
+}
+function isJsOnlySandboxProvider(provider) {
+  const languages = lookupLanguages(provider);
+  return languages !== void 0 && languages.length === 1 && languages[0] === "javascript";
+}
+function supportsCodeModeToolPool(provider) {
+  return resolveSandboxProvider(provider) === "cloudflare-worker";
+}
 function snakeToCamel(str) {
   return str.replace(/_([a-z])/g, (_2, letter) => letter.toUpperCase());
 }
@@ -38569,6 +38596,42 @@ function validateSandboxNetworkAccess(config3, stepIndex, stepRef, buckets) {
     buckets
   );
 }
+function validateTransformLanguageProviderPair(config3, stepIndex, stepRef, buckets) {
+  const language = typeof config3.language === "string" ? config3.language : void 0;
+  if (!language || language === "javascript") return;
+  const provider = resolveSandboxProvider(config3.sandboxProvider);
+  if (!isJsOnlySandboxProvider(provider)) return;
+  addIssue(
+    "warning",
+    {
+      code: "TRANSFORM_LANGUAGE_PROVIDER_MISMATCH",
+      message: `Step requests language "${language}" but sandboxProvider "${provider}" only runs JavaScript. Switch to the "runtype-sandbox" or "daytona" provider to run this language, or set language to "javascript".`,
+      path: `flowSteps[${stepIndex}].config.language`,
+      step: stepRef,
+      details: { language, sandboxProvider: provider }
+    },
+    buckets
+  );
+}
+function validateTransformToolPoolProvider(config3, stepIndex, stepRef, buckets) {
+  const tools = isObjectRecord(config3.tools) ? config3.tools : void 0;
+  if (!tools) return;
+  const poolSize = (Array.isArray(tools.runtimeTools) ? tools.runtimeTools.length : 0) + (Array.isArray(tools.toolIds) ? tools.toolIds.length : 0) + (Array.isArray(tools.mcpServers) ? tools.mcpServers.length : 0);
+  if (poolSize === 0) return;
+  const provider = resolveSandboxProvider(config3.sandboxProvider);
+  if (supportsCodeModeToolPool(provider)) return;
+  addIssue(
+    "warning",
+    {
+      code: "TRANSFORM_POOL_TOOLS_ON_CONTAINER_PROVIDER",
+      message: `Step configures tools but sandboxProvider "${provider}" cannot bind a code-mode tool pool, so the tools are not callable from this script and any call to one fails at runtime. Use the "cloudflare-worker" provider to call tools from a transform-data step, or remove the tools.`,
+      path: `flowSteps[${stepIndex}].config.tools`,
+      step: stepRef,
+      details: { sandboxProvider: provider, poolSize }
+    },
+    buckets
+  );
+}
 function validateCodeToolNameCollisions(toolNames, stepRef, code, preSeededCount = 0) {
   const seen = /* @__PURE__ */ new Map();
   for (const [i, tool] of toolNames.entries()) {
@@ -39997,6 +40060,8 @@ function collectFlowStructureIssues(flowData, deps, buckets) {
       const sandboxProvider = config3.sandboxProvider || "cloudflare-worker";
       const resolvedProvider = sandboxProvider === "cloudflare-sandbox" ? "runtype-sandbox" : sandboxProvider;
       validateSandboxNetworkAccess(config3, stepIndex, stepRef, buckets);
+      validateTransformLanguageProviderPair(config3, stepIndex, stepRef, buckets);
+      validateTransformToolPoolProvider(config3, stepIndex, stepRef, buckets);
       if (resolvedProvider === "runtype-sandbox" && !config3.language) {
         addIssue(
           "warning",
@@ -40456,7 +40521,7 @@ var API_INPROCESS_CAPABILITY_MATRIX = {
   // `vendored-export` (it rides the same host `CodeModeExecutor` seam as
   // `transformDataCodeModeTools`) — see {@link VENDORED_EXPORT_REFOLDS}.
   // Rollback lever: revert the bit to `true` (plus its test).
-  version: "2026-08-08.1",
+  version: "2026-08-11.1",
   unsupportedStepTypes: ["wait-until", "crawl"],
   unsupportedFeatures: {
     approvalSteps: true,
@@ -40515,7 +40580,34 @@ var API_INPROCESS_CAPABILITY_MATRIX = {
     // decision attribution but no longer folds.
     // Rollback lever: revert this bit to `true` (plus its test).
     transformDataMcpServers: false,
-    unsupportedTransformExecution: true,
+    // SUPPORTED as of 2026-08-11 (#6521): `TransformSandboxRouter`
+    // (`apps/api/src/lib/runtime/transform-sandbox-router.ts`) selects a
+    // concrete executor per `execute()` call from the step's own
+    // `sandboxProvider`, so a container-backed or Daytona `transform-data` step
+    // now has a faithful runtime-lane execution. The api owns the router (it
+    // holds the SANDBOX binding and the Daytona credentials), which is why the
+    // `vendored-export` matrix RE-FOLDS this bit rather than inheriting the
+    // graduation — see {@link VENDORED_EXPORT_REFOLDS}.
+    //
+    // The fold does NOT disappear: `transformDataHasUnsupportedExecution`
+    // (`apps/api/src/lib/runtime/flow-eligibility-facts.ts`) narrowed to the
+    // shapes the router still throws on — an unroutable provider, and a non-JS
+    // `language` on a JS-only provider (which legacy runs as JavaScript
+    // because it never forwards `language` to those branches). Both would
+    // otherwise land as `success: true` with a null output, since
+    // `transform-data` default-continues.
+    //
+    // Rollback lever: flip this bit back to `true` (plus its test). That
+    // re-folds every container/Daytona transform to legacy without touching
+    // the router or the narrowed predicate.
+    unsupportedTransformExecution: false,
+    // NOT graduated, and not graduating with its sibling: these are the shapes
+    // the router THROWS on, which `transform-data`'s default-continue turns
+    // into `success: true` + null rather than a visible failure. Keeping this
+    // bit `true` is what stops the graduation above from being a silent data
+    // bug for `python` + `cloudflare-worker` (which legacy runs as JavaScript
+    // today). See {@link FlowEligibilityFacts.hasUnroutableTransformExecution}.
+    unroutableTransformExecution: true,
     // #6023 leg 1 (2026-08-05): a custom runtime tool requesting code_mode / a
     // non-JS language / a container-backed sandbox provider has no runtime-lane
     // port — `runCustom` ignores all three and silently misexecutes as JS. Same
@@ -40609,7 +40701,7 @@ var VENDORED_EXPORT_CAPABILITY_MATRIX = {
   // Bumped 2026-08-08.1: `transformDataMcpServers` graduated on the base and
   // becomes the fourth documented re-fold here — the discovered tools still
   // need the host `CodeModeExecutor` to be bound as sandbox callables.
-  version: "2026-08-08.1",
+  version: "2026-08-11.1",
   unsupportedStepTypes: [
     // ── Carried over from api-inprocess: durable-host-only step types. A
     // self-contained container has no durable host (BYOC §3.3 / S0 — the
@@ -40738,8 +40830,19 @@ var VENDORED_EXPORT_CAPABILITY_MATRIX = {
     // `CodeModeExecutor` seam as the sibling bit above — discovery itself is
     // portable, the BINDING is not. Same graduation lever.
     transformDataMcpServers: true,
+    // VENDORED RE-FOLD (as of 2026-08-11, when the base graduated on #6521):
+    // api-inprocess reaches container / Daytona `transform-data` execution
+    // through `TransformSandboxRouter`, which needs the api's `SANDBOX` service
+    // binding and api-resolved Daytona credentials. An export bundle has
+    // neither, and `.claude/rules/runtime.md` forbids in-runtime dispatch
+    // across providers, so the runtime's ONE wired executor would run the
+    // step's container/Python source on whatever JS-only sandbox the export
+    // carries. Graduation lever: a portable provider-routing fulfillment in the
+    // standard export — then flip to false and drop from
+    // {@link VENDORED_EXPORT_REFOLDS}.
     unsupportedTransformExecution: true,
-    // api-inprocess fold (G5); carried over.
+    // Inherited from the base, which never graduates it.
+    unroutableTransformExecution: true,
     customToolExecution: true,
     // api-inprocess fold (#6023 leg 1); carried over.
     // `promptMcpServers` inherits the base SUPPORTED (`false`). The runtime owns
@@ -41474,6 +41577,9 @@ var MODEL_FAMILY_PROVIDER_IDS = {
     "togetherai": "togetherai/deepseek-ai/DeepSeek-V4-Pro",
     "vercel": "deepseek/deepseek-v4-pro"
   },
+  "deepseek-v4-pro-0813": {
+    "vercel": "deepseek/deepseek-v4-pro-0813"
+  },
   "devstral-2": {
     "vercel": "mistral/devstral-2"
   },
@@ -41901,6 +42007,10 @@ var MODEL_FAMILY_PROVIDER_IDS = {
     "vercel": "xai/grok-4.5",
     "xai": "grok-4.5"
   },
+  "grok-4-6": {
+    "vercel": "xai/grok-4.6",
+    "xai": "grok-4.6"
+  },
   "grok-4.20-0309-non-reasoning": {
     "xai": "grok-4.20-0309-non-reasoning"
   },
@@ -41927,6 +42037,10 @@ var MODEL_FAMILY_PROVIDER_IDS = {
     "vercel": "xai/grok-4.5",
     "xai": "grok-4.5"
   },
+  "grok-4.6": {
+    "vercel": "xai/grok-4.6",
+    "xai": "grok-4.6"
+  },
   "grok-build-0-1": {
     "vercel": "xai/grok-build-0.1",
     "xai": "grok-build-0.1"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.33.6",
+  "version": "2.33.7",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -27,8 +27,8 @@
     "rosie-skills": "0.8.1",
     "yaml": "^2.9.0",
     "@runtypelabs/ink-components": "0.3.6",
-    "@runtypelabs/terminal-animations": "0.2.3",
-    "@runtypelabs/sdk": "7.1.0"
+    "@runtypelabs/sdk": "7.2.0",
+    "@runtypelabs/terminal-animations": "0.2.3"
   },
   "devDependencies": {
     "@modelcontextprotocol/server": "2.0.0",
@@ -43,7 +43,7 @@
     "tsx": "^4.7.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.0",
-    "@runtypelabs/shared": "3.20.0"
+    "@runtypelabs/shared": "3.21.0"
   },
   "engines": {
     "node": ">=22.12.0"