@wardby/cli 0.6.0 → 0.8.0

package/dist/sandbox/user-tool.js

@@ -5,9 +5,9 @@
  * JSON error result. Worker-safe: it touches no database or provider, only the
  * privileged host it is given, so the native sandbox worker runs it as is.
  */
-import { runToolCode } from "./run-in-sandbox.js";
+import { runToolCode, toolLimits } from "./run-in-sandbox.js";
 import { validateParams } from "./zod-params.js";
-export async function runUserToolCall(tool, argsJson, privileged, limits) {
+export async function runUserToolCall(tool, argsJson, privileged, options = {}) {
     let parsedArgs;
     try {
         // Some providers stream no JSON delta at all for a zero-parameter
@@ -24,7 +24,13 @@ export async function runUserToolCall(tool, argsJson, privileged, limits) {
     if (!validation.ok) {
         return JSON.stringify({ error: "validation_failed", message: validation.errorMessage });
     }
-    const result = await runToolCode({ code: tool.code, params: validation.value, limits, privileged });
+    const result = await runToolCode({
+        code: tool.code,
+        params: validation.value,
+        limits: toolLimits(tool.timeoutMs, options.limits),
+        signal: options.signal,
+        privileged,
+    });
     if (!result.ok) {
         return JSON.stringify({ error: result.errorKind, message: result.errorMessage });
     }

package/dist/sandbox/zod-params.d.ts

@@ -5,18 +5,50 @@
  * eval (pure computation, no host I/O — `installExtras` is a no-op):
  *
  *  - `deriveJsonSchema`: registration-time. Compiles the schema and derives
- *    its JSON Schema (via the vendored `zod-to-json-schema`) — what's sent
- *    to the model as the tool's `parameters`. A malformed schema fails here,
- *    not at call time.
+ *    its JSON Schema — what's sent to the model as the tool's `parameters`.
+ *    A malformed schema fails here, not at call time.
  *  - `validateParams`: call-time. Compiles the same schema (again, inside
  *    the sandbox) and parses the model-supplied arguments against it.
  *    Zod's own validation error (a real thrown `ZodError`, whose `.message`
  *    is already a readable issue list) becomes the sandbox failure the
  *    engine feeds back to the model as a tool-result error — not a run
  *    failure.
+ *
+ * Zod 3 compatibility window (this release only): wardby itself runs Zod 4,
+ * but a custom tool's paramsZod is still compiled with Zod 4's built-in Zod 3
+ * API (`zod/v3`) first, so a schema written for Zod 3 keeps working exactly as
+ * before, and its JSON Schema comes from zod-to-json-schema (the converter it
+ * was derived with before). Source Zod 3 can't compile (a schema written for
+ * Zod 4, such as one using `z.email()`) falls back to Zod 4, whose JSON Schema
+ * is `z.toJSONSchema` rewritten in zod-to-json-schema's spelling
+ * (core/zod-json-schema.ts). `zod4Compatibility` finds the schemas the next
+ * release, which compiles with Zod 4 only, would break; zod3-window.ts warns
+ * about them. To close the window: set PARAMS_ZOD_APIS to ["v4"], and drop the
+ * Zod 3 bundle (scripts/build-sandbox-vendor.mjs) and the window's warnings.
  */
 import { type SandboxResult } from "./eval-core.js";
+/** A Zod API a tool's paramsZod can compile against. */
+export type ZodApi = "v3" | "v4";
+/** The APIs a tool's paramsZod is compiled with, in order: the first that compiles it is used. */
+export declare const PARAMS_ZOD_APIS: readonly ZodApi[];
 /** Registration-time: compiles the schema source and derives its JSON Schema. */
-export declare function deriveJsonSchema(paramsZodSource: string): Promise<SandboxResult>;
+export declare function deriveJsonSchema(paramsZodSource: string, apis?: readonly ZodApi[]): Promise<SandboxResult>;
 /** Call-time: compiles the schema source and validates the model-supplied args against it. */
-export declare function validateParams(paramsZodSource: string, rawArgs: unknown): Promise<SandboxResult>;
+export declare function validateParams(paramsZodSource: string, rawArgs: unknown, apis?: readonly ZodApi[]): Promise<SandboxResult>;
+export type Zod4Compatibility = {
+    compatible: true;
+}
+/** `removed` lists the removed Zod 3 API it uses (fixed labels); empty when it fails some other way. */
+ | {
+    compatible: false;
+    removed: string[];
+}
+/** The probe hit a sandbox limit, or the source compiles under neither API: nothing to report. */
+ | {
+    compatible: "unknown";
+};
+/**
+ * Whether the source compiles with Zod 4 alone, as it must from the next
+ * release on. Only meaningful for source the current release accepts.
+ */
+export declare function zod4Compatibility(paramsZodSource: string): Promise<Zod4Compatibility>;

package/dist/sandbox/zod-params.js

@@ -5,56 +5,211 @@
  * eval (pure computation, no host I/O — `installExtras` is a no-op):
  *
  *  - `deriveJsonSchema`: registration-time. Compiles the schema and derives
- *    its JSON Schema (via the vendored `zod-to-json-schema`) — what's sent
- *    to the model as the tool's `parameters`. A malformed schema fails here,
- *    not at call time.
+ *    its JSON Schema — what's sent to the model as the tool's `parameters`.
+ *    A malformed schema fails here, not at call time.
  *  - `validateParams`: call-time. Compiles the same schema (again, inside
  *    the sandbox) and parses the model-supplied arguments against it.
  *    Zod's own validation error (a real thrown `ZodError`, whose `.message`
  *    is already a readable issue list) becomes the sandbox failure the
  *    engine feeds back to the model as a tool-result error — not a run
  *    failure.
+ *
+ * Zod 3 compatibility window (this release only): wardby itself runs Zod 4,
+ * but a custom tool's paramsZod is still compiled with Zod 4's built-in Zod 3
+ * API (`zod/v3`) first, so a schema written for Zod 3 keeps working exactly as
+ * before, and its JSON Schema comes from zod-to-json-schema (the converter it
+ * was derived with before). Source Zod 3 can't compile (a schema written for
+ * Zod 4, such as one using `z.email()`) falls back to Zod 4, whose JSON Schema
+ * is `z.toJSONSchema` rewritten in zod-to-json-schema's spelling
+ * (core/zod-json-schema.ts). `zod4Compatibility` finds the schemas the next
+ * release, which compiles with Zod 4 only, would break; zod3-window.ts warns
+ * about them. To close the window: set PARAMS_ZOD_APIS to ["v4"], and drop the
+ * Zod 3 bundle (scripts/build-sandbox-vendor.mjs) and the window's warnings.
  */
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import { evalToJson } from "./eval-core.js";
+import { legacyJsonSchema } from "../core/zod-json-schema.js";
 const GENERATED_DIR = fileURLToPath(new URL("./generated/", import.meta.url));
-let vendorPreludeCache;
-function getVendorPrelude() {
-    if (vendorPreludeCache)
-        return vendorPreludeCache;
-    let zodBundle;
-    let zodToJsonSchemaBundle;
+/** The APIs a tool's paramsZod is compiled with, in order: the first that compiles it is used. */
+export const PARAMS_ZOD_APIS = ["v3", "v4"];
+const BUNDLES = {
+    v4: { file: "zod.bundle.js", prelude: "const z = __zodModule.default.z;" },
+    v3: {
+        file: "zod3.bundle.js",
+        prelude: "const z = __zod3Module.default.z;\nconst zodToJsonSchema = __zod3Module.default.zodToJsonSchema;",
+    },
+};
+const vendorPreludeCache = new Map();
+function getVendorPrelude(api) {
+    const cached = vendorPreludeCache.get(api);
+    if (cached)
+        return cached;
+    let bundle;
     try {
-        zodBundle = readFileSync(path.join(GENERATED_DIR, "zod.bundle.js"), "utf8");
-        zodToJsonSchemaBundle = readFileSync(path.join(GENERATED_DIR, "zod-to-json-schema.bundle.js"), "utf8");
+        bundle = readFileSync(path.join(GENERATED_DIR, BUNDLES[api].file), "utf8");
     }
     catch (err) {
         throw new Error(`Sandbox vendor bundles missing (run "npm run build:vendor" first): ${err instanceof Error ? err.message : String(err)}`, { cause: err });
     }
-    vendorPreludeCache =
-        `${zodBundle}\n${zodToJsonSchemaBundle}\n` +
-            `const z = __zodModule.default.z;\n` +
-            `const zodToJsonSchema = __zodToJsonSchemaModule.default.zodToJsonSchema;\n`;
-    return vendorPreludeCache;
+    const prelude = `${bundle}\n${BUNDLES[api].prelude}\n`;
+    vendorPreludeCache.set(api, prelude);
+    return prelude;
 }
-/** Registration-time: compiles the schema source and derives its JSON Schema. */
-export async function deriveJsonSchema(paramsZodSource) {
-    const code = `${getVendorPrelude()}
+/**
+ * Prefixed to the message of an error thrown while compiling the schema
+ * source (as opposed to parsing arguments with it), so the host can tell "this
+ * API can't compile it" from a validation failure. Never shown: stripped below.
+ */
+const COMPILE_FAILED = "__wardby_zod_compile_failed__:";
+/**
+ * Compiles the source into `schema`. A sandbox limit (QuickJS's uncatchable
+ * interrupt, or an out-of-memory InternalError) is rethrown as is: only an
+ * ordinary compile error is marked.
+ */
+function compileStatement(paramsZodSource) {
+    return `let schema;
+  try {
+    schema = (${paramsZodSource});
+    if (schema === null || typeof schema !== "object" || typeof schema.safeParse !== "function") {
+      throw new TypeError("paramsZod did not evaluate to a Zod schema");
+    }
+  } catch (e) {
+    if (e instanceof InternalError) throw e;
+    const marked = new Error(${JSON.stringify(COMPILE_FAILED)} + (e && e.message !== undefined ? e.message : String(e)));
+    marked.name = e && typeof e.name === "string" ? e.name : "Error";
+    throw marked;
+  }`;
+}
+function isCompileFailure(result) {
+    return !result.ok && result.errorKind === "thrown" && result.errorMessage.includes(COMPILE_FAILED);
+}
+function unmark(result) {
+    return result.ok ? result : { ...result, errorMessage: result.errorMessage.replace(COMPILE_FAILED, "") };
+}
+/** Runs `attempt` with each API in turn until one compiles the source; the first API's failure otherwise. */
+async function withFirstCompilingApi(apis, attempt) {
+    let first;
+    for (const api of apis) {
+        const result = await attempt(api);
+        if (!isCompileFailure(result))
+            return unmark(result);
+        first ??= result;
+    }
+    if (!first)
+        throw new Error("withFirstCompilingApi needs at least one API");
+    return unmark(first);
+}
+async function deriveWith(paramsZodSource, api) {
+    const toJson = api === "v4"
+        ? `z.toJSONSchema(schema, { target: "draft-07", io: "input", unrepresentable: "any" })`
+        : `zodToJsonSchema(schema)`;
+    const code = `${getVendorPrelude(api)}
 (async () => {
-  const schema = (${paramsZodSource});
-  return JSON.stringify(zodToJsonSchema(schema));
+  ${compileStatement(paramsZodSource)}
+  return JSON.stringify(${toJson});
 })()`;
-    return evalToJson(code, undefined, () => { });
+    const result = await evalToJson(code, undefined, () => { });
+    if (!result.ok || api === "v3")
+        return result;
+    return { ...result, value: legacyJsonSchema(result.value, { closeObjects: true }) };
 }
-/** Call-time: compiles the schema source and validates the model-supplied args against it. */
-export async function validateParams(paramsZodSource, rawArgs) {
-    const code = `${getVendorPrelude()}
+async function validateWith(paramsZodSource, rawArgs, api) {
+    const code = `${getVendorPrelude(api)}
 (async () => {
-  const schema = (${paramsZodSource});
+  ${compileStatement(paramsZodSource)}
   const args = ${JSON.stringify(rawArgs)};
   return JSON.stringify(schema.parse(args));
 })()`;
     return evalToJson(code, undefined, () => { });
 }
+/** Registration-time: compiles the schema source and derives its JSON Schema. */
+export async function deriveJsonSchema(paramsZodSource, apis = PARAMS_ZOD_APIS) {
+    return withFirstCompilingApi(apis, (api) => deriveWith(paramsZodSource, api));
+}
+/** Call-time: compiles the schema source and validates the model-supplied args against it. */
+export async function validateParams(paramsZodSource, rawArgs, apis = PARAMS_ZOD_APIS) {
+    return withFirstCompilingApi(apis, (api) => validateWith(paramsZodSource, rawArgs, api));
+}
+/** Zod 3 schema methods Zod 4 removed. */
+const REMOVED_METHODS = [
+    "nonstrict",
+    "deepPartial",
+    "augment",
+    "setKey",
+    "ip",
+    "cidr",
+    "refinement",
+    "promise",
+    "args",
+    "returns",
+];
+/** Zod 3 `z.*` functions Zod 4 removed, each with a stand-in that keeps the probe compiling. */
+const REMOVED_FUNCTIONS = {
+    ostring: "() => real.string().optional()",
+    onumber: "() => real.number().optional()",
+    oboolean: "() => real.boolean().optional()",
+    effect: "(s) => s",
+    transformer: "(s) => s",
+    pipeline: "(a, b) => a.pipe(b)",
+};
+/** A label the probe may report: one of the fixed names above, never the schema's own text. */
+const LABEL = /^(z)?\.[A-Za-z]+\(\)$/;
+/**
+ * Compiles the source with Zod 4, with a recording stand-in for each removed
+ * Zod 3 method or function (so one run finds all of them, not only the
+ * first), then derives its JSON Schema as registration would.
+ */
+function zod4ProbeCode(paramsZodSource) {
+    const shimEntries = Object.entries(REMOVED_FUNCTIONS)
+        .map(([name, fn]) => `${name}: (...a) => (hit("z.${name}()"), (${fn})(...a))`)
+        .join(", ");
+    return `${getVendorPrelude("v4")}
+(async () => {
+  const real = z;
+  const hits = [];
+  const hit = (label) => { if (!hits.includes(label)) hits.push(label); };
+  for (const value of Object.values(real)) {
+    if (typeof value !== "function" || !value.prototype || !/^Zod/.test(value.name)) continue;
+    for (const name of ${JSON.stringify(REMOVED_METHODS)}) {
+      if (name in value.prototype) continue;
+      Object.defineProperty(value.prototype, name, {
+        configurable: true,
+        value: function () { hit("." + name + "()"); return this; },
+      });
+    }
+  }
+  const shim = { ...real, ${shimEntries} };
+  let compiled = true;
+  try {
+    const schema = ((z) => (${paramsZodSource}))(shim);
+    if (schema === null || typeof schema !== "object" || typeof schema.safeParse !== "function") throw new TypeError();
+    real.toJSONSchema(schema, { target: "draft-07", io: "input", unrepresentable: "any" });
+  } catch (e) {
+    if (e instanceof InternalError) throw e;
+    compiled = false;
+  }
+  return JSON.stringify({ compiled: compiled && hits.length === 0, removed: hits });
+})()`;
+}
+/**
+ * Whether the source compiles with Zod 4 alone, as it must from the next
+ * release on. Only meaningful for source the current release accepts.
+ */
+export async function zod4Compatibility(paramsZodSource) {
+    const probe = await evalToJson(zod4ProbeCode(paramsZodSource), undefined, () => { });
+    if (!probe.ok)
+        return { compatible: "unknown" };
+    const { compiled, removed } = probe.value;
+    if (compiled)
+        return { compatible: true };
+    const labels = removed.filter((label) => LABEL.test(label));
+    if (labels.length === 0) {
+        // Zod 4 can't compile it and it uses none of the known removed API: does Zod 3 compile it?
+        const v3 = await deriveJsonSchema(paramsZodSource, ["v3"]);
+        if (!v3.ok)
+            return { compatible: "unknown" };
+    }
+    return { compatible: false, removed: labels };
+}

package/dist/serve.js

@@ -24,8 +24,10 @@ import { DISABLED_POWER } from "./core/power.js";
 import { startNotifications } from "./core/notifications.js";
 import { startReconciler } from "./core/reconciler.js";
 import { createRepoAccessGate } from "./core/repo-access.js";
+import { markRunFailedFromExecutorError } from "./core/dispatch.js";
 import { startScheduler } from "./core/scheduler.js";
 import { drainDeferredRuns } from "./providers/executor/deferred.js";
+import { resolveDeferredCodingRun } from "./core/deferred-coding.js";
 import { buildMcpProviders, startMcp } from "./mcp/index.js";
 const serveLog = logger.child({ module: "serve" });
 export async function startServe(options = {}) {
@@ -72,7 +74,12 @@ export async function startServe(options = {}) {
         onLeaderTick: async () => {
             await drainCodingQueue({ db: prisma, executor: providers.executor, ...concurrency, selfDefects });
             // Runs the native sandbox gateway dispatched (or asked to stop): it holds no executor of its own.
-            await drainDeferredRuns({ db: prisma, executor: providers.executor });
+            await drainDeferredRuns({
+                db: prisma,
+                executor: providers.executor,
+                beforeStart: (runId) => resolveDeferredCodingRun({ db: prisma, executor: providers.executor, runId }),
+                onStartFailed: (runId, err) => markRunFailedFromExecutorError(prisma, runId, err, selfDefects),
+            });
             // Scale idle coding-proxy/native-gateway Deployments to zero (no-op unless WARDBY_LOW_POWER=1).
             await power.sleepIfIdle().catch((err) => serveLog.warn({ err }, "power_sleep_failed"));
         },