dataiku-sdk 3.8.0 → 4.0.0

package/dist/src/resources/jobs.d.ts

@@ -9,6 +9,20 @@ import { BaseResource } from "./base.js";
  */
 export type JobBuildTargetType = "DATASET" | "MANAGED_FOLDER" | "MODEL_EVALUATION_STORE";
 export type JobLogFilter = "stdout" | "stderr" | "user" | "errors";
+/** A retrieved job log plus what the byte-bounded download dropped or scanned. */
+export interface JobLogDetails {
+    /** Redacted, filtered and line-limited log text (what {@link JobsResource.log} returns). */
+    text: string;
+    /**
+     * True when the log exceeded the byte cap and only its most recent bytes
+     * were retained: earlier lines were never scanned or filtered.
+     */
+    truncated: boolean;
+    /** Lines in the retained log before filtering and the line limit. */
+    scannedLines: number;
+    /** Byte cap applied to the download (the most recent this-many bytes are kept). */
+    maxLogBytes: number;
+}
 export interface JobLogProgress {
     lastProgressLine?: string;
     doneLine?: string;
@@ -80,13 +94,17 @@ export declare class JobsResource extends BaseResource {
     /**
      * Retrieve job log text.
      * Returns the last `maxLogLines` lines (default 500) from the tail.
-     * Use `0` or `-1` to return the log without line truncation.
+     * Use `0` or `-1` to return the log without line truncation. Credential-like
+     * JSON pairs (`"jobTicketSecret":"..."`) are redacted.
      *
-     * The download is byte-bounded and deadline-covered: at most `maxLogBytes`
-     * (default 10 MiB) of the *most recent* log output is retained, so a
-     * collaborator-influenced oversized log cannot exhaust client memory while
-     * the line limit previously only applied after a full unbounded download.
-     * Logs up to the cap are returned in full.
+     * The download is byte-bounded: at most `maxLogBytes` (default 10 MiB) of
+     * the *most recent* log output is retained, so a collaborator-influenced
+     * oversized log cannot exhaust client memory while the line limit
+     * previously only applied after a full unbounded download. The request
+     * timeout is a stall deadline (per received chunk), so a large log that
+     * keeps arriving is not cut off by a total-transfer budget. Logs up to the
+     * cap are returned in full. Use {@link logDetails} to learn whether bytes
+     * were dropped.
      */
     log(jobId: string, opts?: {
         activity?: string;
@@ -96,6 +114,19 @@ export declare class JobsResource extends BaseResource {
         maxLogBytes?: number;
         projectKey?: string;
     }): Promise<string>;
+    /**
+     * Same retrieval as {@link log}, additionally reporting whether the
+     * byte-bounded download dropped early log bytes (`truncated`) and how many
+     * lines were scanned before filtering (`scannedLines`).
+     */
+    logDetails(jobId: string, opts?: {
+        activity?: string;
+        logId?: string;
+        logFilter?: JobLogFilter;
+        maxLogLines?: number;
+        maxLogBytes?: number;
+        projectKey?: string;
+    }): Promise<JobLogDetails>;
     logFromUrl(logUrl: string, opts?: {
         maxLogLines?: number;
         maxLogBytes?: number;

package/dist/src/resources/jobs.js

@@ -2,6 +2,7 @@ import { ClientValidationError, DataikuError, } from "../errors.js";
 import { JobSummaryArraySchema, } from "../schemas.js";
 import { computeNextPollDelayMs, DEFAULT_POLL_INTERVAL_MS, DEFAULT_TIMEOUT_MS, isRequestDeadlineError, } from "../utils/polling.js";
 import { asRecord, } from "../utils/records.js";
+import { redactCredentialPairs, } from "../utils/secret-sanitize.js";
 import { BaseResource, } from "./base.js";
 const DEFAULT_MAX_LOG_LINES = 500;
 /**
@@ -65,6 +66,12 @@ function jobBuildDefinition(targets, defaultProjectKey, opts) {
 function jobLogLines(log) {
     return log.split(/\r?\n/).map((line) => line.trimEnd());
 }
+function countLogLines(log) {
+    if (!log)
+        return 0;
+    const lines = jobLogLines(log);
+    return lines[lines.length - 1] === "" ? lines.length - 1 : lines.length;
+}
 /**
  * DSS tags recipe subprocess output by reader thread: `[null-out-N]` carries
  * the child's stdout and `[null-err-N]` its stderr. The legacy fallback is an
@@ -80,6 +87,13 @@ const LEGACY_STDERR_RECORD = /^\s*stderr:/i;
  * continuation of that record (exception chain, JVM frames, ...).
  */
 const DSS_RECORD_HEADER = /^\[\d{4}\/\d{2}\/\d{2}-\d{2}:\d{2}:\d{2}\.\d{3}\]/;
+/**
+ * Job-level outcome line the job engine writes outside any record, e.g.
+ * `2026-10-12T09:13:22.189: Job is incompatible with build state: [...]` when
+ * another running job already builds the target. It carries no level word but
+ * is the only reason DSS gives for such a failure.
+ */
+const JOB_OUTCOME_LINE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}: \S/;
 const ERROR_KEYWORDS = /\b(error|failed|failure|exception|traceback)\b/i;
 /**
  * Exception class names ending in the `Exception`/`Error` suffix (e.g.
@@ -104,6 +118,41 @@ function dssRecordMessage(line) {
 function isErrorContent(line) {
     return ERROR_KEYWORDS.test(line) || ERROR_CLASS_NAME.test(line) || PY_FILE_FRAME.test(line);
 }
+/**
+ * Remove embedded JSON object payloads (`{"...": ...}`) from a DSS record
+ * line. Structured payloads such as `SQL status {"statusWarnLevel":"ERROR",...}`
+ * carry level/class words as data, not as a failure of the record itself.
+ * An unbalanced payload (truncated line) is dropped to the end of the line.
+ */
+function stripJsonPayloads(line) {
+    let out = "";
+    let from = 0;
+    for (let start = line.indexOf('{"'); start !== -1; start = line.indexOf('{"', from)) {
+        out += line.slice(from, start);
+        let depth = 0;
+        let inString = false;
+        let end = line.length;
+        for (let i = start; i < line.length; i++) {
+            const ch = line[i];
+            if (inString) {
+                if (ch === "\\")
+                    i++;
+                else if (ch === '"')
+                    inString = false;
+            }
+            else if (ch === '"')
+                inString = true;
+            else if (ch === "{")
+                depth++;
+            else if (ch === "}" && --depth === 0) {
+                end = i + 1;
+                break;
+            }
+        }
+        from = end;
+    }
+    return out + line.slice(from);
+}
 function lineMatchesLogFilter(line, filter) {
     const normalized = line.toLowerCase();
     switch (filter) {
@@ -113,7 +162,7 @@ function lineMatchesLogFilter(line, filter) {
         case "stderr":
             return normalized.includes("[null-err-") || LEGACY_STDERR_RECORD.test(line);
         case "errors":
-            return isErrorContent(line);
+            return isErrorContent(line) || JOB_OUTCOME_LINE.test(line);
         case "user":
             return !/^\d{4}[-/]\d{2}[-/]\d{2}/.test(line)
                 && !normalized.includes("backend-log")
@@ -159,8 +208,13 @@ function filterJobLogToErrors(lines) {
             }
             pyTraceback = false;
         }
+        if (JOB_OUTCOME_LINE.test(line)) {
+            kept.push(line);
+            recordMatches = false;
+            continue;
+        }
         if (isHeader) {
-            recordMatches = isErrorContent(line) || PY_FILE_FRAME.test(message);
+            recordMatches = isErrorContent(stripJsonPayloads(line)) || PY_FILE_FRAME.test(message);
             if (recordMatches && (PY_TRACEBACK_HEAD.test(message) || PY_FILE_FRAME.test(message))) {
                 pyTraceback = true;
             }
@@ -176,7 +230,7 @@ function filterJobLogToErrors(lines) {
         if (recordMatches
             && !JVM_STACK_FRAME.test(line)
             && !JVM_MORE_FRAMES.test(line)
-            && isErrorContent(line))
+            && isErrorContent(stripJsonPayloads(line)))
             kept.push(line);
     }
     return kept.join("\n");
@@ -283,22 +337,42 @@ export class JobsResource extends BaseResource {
     /**
      * Retrieve job log text.
      * Returns the last `maxLogLines` lines (default 500) from the tail.
-     * Use `0` or `-1` to return the log without line truncation.
+     * Use `0` or `-1` to return the log without line truncation. Credential-like
+     * JSON pairs (`"jobTicketSecret":"..."`) are redacted.
      *
-     * The download is byte-bounded and deadline-covered: at most `maxLogBytes`
-     * (default 10 MiB) of the *most recent* log output is retained, so a
-     * collaborator-influenced oversized log cannot exhaust client memory while
-     * the line limit previously only applied after a full unbounded download.
-     * Logs up to the cap are returned in full.
+     * The download is byte-bounded: at most `maxLogBytes` (default 10 MiB) of
+     * the *most recent* log output is retained, so a collaborator-influenced
+     * oversized log cannot exhaust client memory while the line limit
+     * previously only applied after a full unbounded download. The request
+     * timeout is a stall deadline (per received chunk), so a large log that
+     * keeps arriving is not cut off by a total-transfer budget. Logs up to the
+     * cap are returned in full. Use {@link logDetails} to learn whether bytes
+     * were dropped.
      */
     async log(jobId, opts) {
+        return (await this.logDetails(jobId, opts)).text;
+    }
+    /**
+     * Same retrieval as {@link log}, additionally reporting whether the
+     * byte-bounded download dropped early log bytes (`truncated`) and how many
+     * lines were scanned before filtering (`scannedLines`).
+     */
+    async logDetails(jobId, opts) {
         const jobEnc = encodeURIComponent(jobId);
         const query = opts?.activity ? `?activity=${encodeURIComponent(opts.activity)}` : "";
         // DSS cat-activity-log URLs require a browser session; API-key callers must use the public log endpoint.
         const path = `/public/api/projects/${this.enc(opts?.projectKey)}/jobs/${jobEnc}/log/${query}`;
         const maxLogBytes = Math.max(1, opts?.maxLogBytes ?? DEFAULT_MAX_LOG_BYTES);
-        const { text, } = await this.client.getTextTailLimited(path, maxLogBytes);
-        return limitJobLog(filterJobLog(text, opts?.logFilter), opts?.maxLogLines);
+        const { text, truncated, } = await this.client.getTextTailLimited(path, maxLogBytes);
+        // Single download choke point (logFromUrl and wait/summary go through here):
+        // DSS logs embed the job ticket secret in start_session JSON.
+        const redacted = redactCredentialPairs(text);
+        return {
+            text: limitJobLog(filterJobLog(redacted, opts?.logFilter), opts?.maxLogLines),
+            truncated,
+            scannedLines: countLogLines(redacted),
+            maxLogBytes,
+        };
     }
     async logFromUrl(logUrl, opts) {
         const parsed = new URL(logUrl, "http://dss.local");
@@ -399,6 +473,28 @@ export class JobsResource extends BaseResource {
         const startedAt = Date.now();
         let pollCount = 0;
         let lastJ;
+        // The wait only stops polling: the job keeps running in DSS and is never
+        // cancelled, so the result says so explicitly.
+        const timedOutResult = (last, elapsedMs) => {
+            const bs = last?.baseStatus ?? {};
+            const gs = last?.globalState ?? {};
+            return {
+                success: false,
+                jobId,
+                state: bs.state ?? "unknown",
+                type: bs.def?.type ?? "unknown",
+                elapsedMs,
+                pollCount,
+                timedOut: true,
+                cancelled: false,
+                progress: {
+                    done: gs.done ?? 0,
+                    failed: gs.failed ?? 0,
+                    running: gs.running ?? 0,
+                    total: gs.total ?? null,
+                },
+            };
+        };
         while (true) {
             const elapsedBeforeMs = Date.now() - startedAt;
             // The first observation always happens, even when the budget is
@@ -406,24 +502,7 @@ export class JobsResource extends BaseResource {
             // the loop reports the structured timeout from the last observed
             // state instead of issuing a request the budget cannot cover.
             if (lastJ !== undefined && elapsedBeforeMs >= timeout) {
-                const bs = lastJ.baseStatus ?? {};
-                const def = bs.def ?? {};
-                const gs = lastJ.globalState ?? {};
-                return {
-                    success: false,
-                    jobId,
-                    state: bs.state ?? "unknown",
-                    type: def.type ?? "unknown",
-                    elapsedMs: elapsedBeforeMs,
-                    pollCount,
-                    timedOut: true,
-                    progress: {
-                        done: gs.done ?? 0,
-                        failed: gs.failed ?? 0,
-                        running: gs.running ?? 0,
-                        total: gs.total ?? null,
-                    },
-                };
+                return timedOutResult(lastJ, elapsedBeforeMs);
             }
             pollCount += 1;
             // Requests issued while budget remains are bounded by the remaining
@@ -443,21 +522,8 @@ export class JobsResource extends BaseResource {
                 // error escape the loop.
                 if (!isRequestDeadlineError(error, startedAt + timeout))
                     throw error;
-                return {
-                    success: false,
-                    jobId,
-                    state: "unknown",
-                    type: "unknown",
-                    elapsedMs: Date.now() - startedAt,
-                    pollCount,
-                    timedOut: true,
-                    progress: {
-                        done: 0,
-                        failed: 0,
-                        running: 0,
-                        total: null,
-                    },
-                };
+                // A deadline mid-poll keeps the last state a previous poll observed.
+                return timedOutResult(lastJ, Date.now() - startedAt);
             }
             lastJ = j;
             const bs = j.baseStatus ?? {};

package/dist/src/resources/projects.js

@@ -188,7 +188,7 @@ export class ProjectsResource extends BaseResource {
                         && settings.targetProjectKey.trim() !== ""
                         ? { targetProjectKey: settings.targetProjectKey, }
                         : {}),
-                });
+                }, { cause: error, });
             }
             throw error;
         }
@@ -246,7 +246,7 @@ export class ProjectsResource extends BaseResource {
         catch (error) {
             if (error instanceof DataikuError
                 && (error.status === 404 || error.status === 0 || error.status >= 500)) {
-                throw new ClientValidationError(`DSS reported import success for project ${usedProjectKey}, but the project could not be re-read for verification.`, "ambiguous_outcome", PROJECT_IMPORT_AMBIGUOUS_REMEDIATION, { importId, usedProjectKey, });
+                throw new ClientValidationError(`DSS reported import success for project ${usedProjectKey}, but the project could not be re-read for verification.`, "ambiguous_outcome", PROJECT_IMPORT_AMBIGUOUS_REMEDIATION, { importId, usedProjectKey, }, { cause: error, });
             }
             throw error;
         }

package/dist/src/resources/recipes.d.ts

@@ -65,6 +65,14 @@ export interface RecipeCloneResult {
     payloadTextRewrites: Record<string, string>;
     copiedOutputDatasets: string[];
 }
+/**
+ * Validate an update patch against the current recipe document and return the
+ * document to PUT. `recipe` is deep-merged, except `recipe.params.envSelection`,
+ * which the patch replaces wholesale so no stale `envName` survives an
+ * EXPLICIT_ENV to INHERIT switch. `envSelection` outside `recipe.params` is
+ * rejected: neither DSS nor the CLI reads it there.
+ */
+export declare function buildRecipeUpdate(current: Record<string, unknown>, data: Record<string, unknown>): Record<string, unknown>;
 export declare class RecipesResource extends BaseResource {
     /** List all recipes in a project. */
     list(projectKey?: string): Promise<RecipeSummary[]>;
@@ -136,7 +144,10 @@ export declare class RecipesResource extends BaseResource {
     }): Promise<RecipeUpdateSchemaResult>;
     /**
      * Update a recipe by merging the patch into the current definition.
-     * The `recipe` sub-object is deep-merged to preserve nested fields.
+     * The `recipe` sub-object is deep-merged to preserve nested fields, except
+     * `recipe.params.envSelection`: when the patch provides it, the whole object
+     * is replaced (not merged), so switching EXPLICIT_ENV to INHERIT cannot leave
+     * a stale `envName` behind. `envSelection` outside `recipe.params` is rejected.
      */
     update(recipeName: string, data: Record<string, unknown>, projectKey?: string): Promise<void>;
     /** Replace a full recipe API document. */

package/dist/src/resources/recipes.js

@@ -1,4 +1,3 @@
-import { writeFile, } from "node:fs/promises";
 import { resolve, } from "node:path";
 import { ClientValidationError, DataikuError, nonJsonResponseBody, unexpectedResponseError, } from "../errors.js";
 import { ProjectMetadataSchema, RecipeSchemaUpdatesSchema, RecipeSummaryArraySchema, } from "../schemas.js";
@@ -40,6 +39,37 @@ const RECIPE_DEFINITION_FIELDS = new Set(["params", "inputs", "outputs", "script
 function rootRecipeDefinitionFields(data) {
     return Object.keys(data).filter((key) => RECIPE_DEFINITION_FIELDS.has(key));
 }
+/**
+ * Validate an update patch against the current recipe document and return the
+ * document to PUT. `recipe` is deep-merged, except `recipe.params.envSelection`,
+ * which the patch replaces wholesale so no stale `envName` survives an
+ * EXPLICIT_ENV to INHERIT switch. `envSelection` outside `recipe.params` is
+ * rejected: neither DSS nor the CLI reads it there.
+ */
+export function buildRecipeUpdate(current, data) {
+    const currentRecipe = asRecord(current.recipe) ?? {};
+    const recipePatch = asRecord(data.recipe) ?? {};
+    const misplacedEnvSelection = [
+        ...("envSelection" in data ? ["envSelection",] : []),
+        ...("envSelection" in recipePatch ? ["recipe.envSelection",] : []),
+    ];
+    if (misplacedEnvSelection.length > 0) {
+        throw new ClientValidationError(`envSelection at ${misplacedEnvSelection.join(" and ")} is ignored; it only applies under recipe.params. Example: {"recipe":{"params":{"envSelection":{"envMode":"EXPLICIT_ENV","envName":"py311_env"}}}}`, "validation_failed");
+    }
+    const misplacedRecipeFields = rootRecipeDefinitionFields(data);
+    if (misplacedRecipeFields.length > 0) {
+        throw new ClientValidationError(`Recipe fields ${misplacedRecipeFields.join(", ")} must be nested under "recipe". Example: {"recipe":{"outputs":{...},"params":{...}}}`, "validation_failed");
+    }
+    const mergedRecipe = deepMerge(currentRecipe, recipePatch);
+    const paramsPatch = asRecord(recipePatch.params);
+    if (paramsPatch && "envSelection" in paramsPatch) {
+        mergedRecipe.params = {
+            ...asRecord(mergedRecipe.params),
+            envSelection: paramsPatch.envSelection,
+        };
+    }
+    return { ...current, ...data, recipe: mergedRecipe, };
+}
 function normalizeRecipeOutputType(value) {
     if (typeof value !== "string")
         return undefined;
@@ -823,22 +853,19 @@ export class RecipesResource extends BaseResource {
     }
     /**
      * Update a recipe by merging the patch into the current definition.
-     * The `recipe` sub-object is deep-merged to preserve nested fields.
+     * The `recipe` sub-object is deep-merged to preserve nested fields, except
+     * `recipe.params.envSelection`: when the patch provides it, the whole object
+     * is replaced (not merged), so switching EXPLICIT_ENV to INHERIT cannot leave
+     * a stale `envName` behind. `envSelection` outside `recipe.params` is rejected.
      */
     async update(recipeName, data, projectKey) {
         const enc = this.enc(projectKey);
         const rnEnc = encodeURIComponent(recipeName);
         const current = await this.client.get(`/public/api/projects/${enc}/recipes/${rnEnc}`);
-        const currentRecipe = asRecord(current.recipe);
-        if (!currentRecipe) {
+        if (!asRecord(current.recipe)) {
             throw new ClientValidationError(`Recipe "${recipeName}" was not found or returned an empty definition.`, "validation_failed");
         }
-        const misplacedRecipeFields = rootRecipeDefinitionFields(data);
-        if (misplacedRecipeFields.length > 0) {
-            throw new ClientValidationError(`Recipe fields ${misplacedRecipeFields.join(", ")} must be nested under "recipe". Example: {"recipe":{"outputs":{...},"params":{...}}}`, "validation_failed");
-        }
-        const mergedRecipe = deepMerge(currentRecipe, asRecord(data.recipe) ?? {});
-        const merged = { ...current, ...data, recipe: mergedRecipe, };
+        const merged = buildRecipeUpdate(current, data);
         await this.client.put(`/public/api/projects/${enc}/recipes/${rnEnc}`, merged);
     }
     /** Replace a full recipe API document. */
@@ -922,7 +949,7 @@ export class RecipesResource extends BaseResource {
         }
         const safeRecipeName = sanitizeFileName(recipeName, "recipe");
         const filePath = opts?.outputPath ?? resolve(process.cwd(), `${safeRecipeName}${inferRecipeCodeExtension(result.recipe.type)}`);
-        await writeFile(filePath, result.payload, "utf-8");
+        await Bun.write(filePath, result.payload);
         return filePath;
     }
     /** Get only the code payload of a recipe as a raw string. */
@@ -965,7 +992,7 @@ export class RecipesResource extends BaseResource {
         const recipe = await this.client.get(`/public/api/projects/${enc}/recipes/${rnEnc}`);
         const safeRecipeName = sanitizeFileName(recipeName, "recipe");
         const filePath = opts?.outputPath ?? resolve(process.cwd(), `${safeRecipeName}.json`);
-        await writeFile(filePath, JSON.stringify(recipe, null, 2), "utf-8");
+        await Bun.write(filePath, JSON.stringify(recipe, null, 2));
         return filePath;
     }
 }

package/dist/src/resources/scenarios.d.ts

@@ -107,6 +107,10 @@ export interface ScenarioScriptRunResult {
     elapsedMs: number;
     pollCount: number;
     output?: string;
+    /** True when the captured script output was cut (wrapper byte budget or log read cap); `output` then holds the last part only. */
+    outputTruncated?: boolean;
+    /** Bytes of script output the wrapper dropped from the front; absent when the cut happened in the log read instead. */
+    outputOmittedBytes?: number;
     log: string;
     logTruncated: boolean;
     maxLogBytes: number;
@@ -186,12 +190,15 @@ export declare class ScenariosResource extends BaseResource {
      * Get the log of a scenario run (GET /scenarios/{id}/{runId}/log), optionally
      * scoped to a single step via `stepId`. The text is byte-bounded: at most
      * `maxLogBytes` (default 1 MiB) of the beginning of the log is retained and
-     * `truncated` reports whether the cap cut the body.
+     * `truncated` reports whether the cap cut the body. With `tail: true` the
+     * last `maxLogBytes` are retained instead (used by code runs, whose output
+     * markers sit at the end of the log).
      */
     getRunLog(scenarioId: string, runId: string, opts?: {
         stepId?: string;
         maxLogBytes?: number;
         projectKey?: string;
+        tail?: boolean;
     }): Promise<ScenarioRunLog>;
     /** Get the payload of a (custom) scenario (GET /scenarios/{id}/payload). */
     getPayload(scenarioId: string, opts?: {

package/dist/src/resources/scenarios.js

@@ -32,6 +32,14 @@ export class ScenarioScriptRunWithCleanupFailureError extends Error {
 const DEFAULT_CODE_RUN_MAX_LOG_BYTES = 1_048_576;
 const CODE_RUN_OUTPUT_START = "<<<DSS_CODE_RUN_OUTPUT_b7e3a1>>>";
 const CODE_RUN_OUTPUT_END = "<<<DSS_CODE_RUN_OUTPUT_END_b7e3a1>>>";
+/** Written right after the END marker when the wrapper cut the captured output; carries the omitted byte count. */
+const CODE_RUN_OUTPUT_TRUNCATED_RE = /^<<<DSS_CODE_RUN_OUTPUT_TRUNCATED_b7e3a1:(\d+)>>>$/;
+/**
+ * The wrapper keeps at most `maxLogBytes / CODE_RUN_OUTPUT_BUDGET_DIVISOR` bytes
+ * of script output. The remainder of the read cap is headroom for the per-line
+ * DSS log prefix, so the markers still fit in what `runScript` reads back.
+ */
+const CODE_RUN_OUTPUT_BUDGET_DIVISOR = 4;
 /** Prefer the current runId field, with the legacy id field as fallback. */
 function triggerRunIdOf(trigger, scenarioId) {
     const runId = trigger?.runId ?? trigger?.id;
@@ -80,8 +88,10 @@ function scenarioLightStatusFromRaw(raw) {
  * wrapper noise. The script is base64-encoded to avoid quoting/escaping issues and
  * exec'd as `__main__`. A failing script re-raises SystemExit(1) so the scenario
  * outcome is FAILED while the captured traceback still lands between the markers.
+ * Only the last `maxOutputBytes` UTF-8 bytes of output are re-emitted; when output
+ * was cut, a truncation marker with the omitted byte count follows the END marker.
  */
-function buildCodeRunScript(script) {
+function buildCodeRunScript(script, maxOutputBytes) {
     const encoded = Buffer.from(script, "utf-8").toString("base64");
     return [
         "import base64 as _dku_b64, sys as _dku_sys, io as _dku_io, traceback as _dku_tb",
@@ -99,9 +109,14 @@ function buildCodeRunScript(script) {
         "\t_dku_tb.print_exc()",
         "finally:",
         "\t_dku_sys.stdout, _dku_sys.stderr = _dku_out, _dku_err",
+        '\t_dku_bytes = _dku_buf.getvalue().encode("utf-8", "replace")',
+        `\t_dku_omitted = max(0, len(_dku_bytes) - ${maxOutputBytes})`,
+        '\t_dku_text = _dku_bytes[_dku_omitted:].decode("utf-8", "ignore")',
         `\t_dku_out.write("${CODE_RUN_OUTPUT_START}\\n")`,
-        "\t_dku_out.write(_dku_buf.getvalue())",
+        "\t_dku_out.write(_dku_text)",
         `\t_dku_out.write("\\n${CODE_RUN_OUTPUT_END}\\n")`,
+        "\tif _dku_omitted:",
+        '\t\t_dku_out.write("<<<DSS_CODE_RUN_OUTPUT_TRUNCATED_b7e3a1:%d>>>\\n" % _dku_omitted)',
         "\t_dku_out.flush()",
         "if _dku_code:",
         "\traise SystemExit(_dku_code)",
@@ -112,10 +127,13 @@ function buildCodeRunScript(script) {
  * Pull the script's own stdout/stderr back out of the full DSS run log by slicing
  * the `[process]` lines between the markers emitted by {@link buildCodeRunScript}.
  * Returns undefined if the markers are absent (e.g. the harness never ran), in which
- * case callers should fall back to the full log.
+ * case callers should fall back to the full log. When the log read itself was cut
+ * (`logTruncated`) the START marker may be gone while END survives; the output is
+ * then whatever precedes END, reported as truncated.
  */
-function extractCodeRunOutput(log) {
-    const messageRe = /^\[[^\]]*\] \[[^\]]*\] \[[^\]]*\] \[process\]  - (.*)$/;
+function extractCodeRunOutput(log, logTruncated) {
+    // `[\s\S]` (not `.`): CR, U+2028 and U+2029 inside a printed line must not drop it.
+    const messageRe = /^\[[^\]]*\] \[[^\]]*\] \[[^\]]*\] \[process\]  - ([\s\S]*)$/;
     const contents = [];
     for (const rawLine of log.split("\n")) {
         const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
@@ -125,7 +143,7 @@ function extractCodeRunOutput(log) {
     }
     // First start + last end, so a script that prints a marker string stays body content.
     const start = contents.indexOf(CODE_RUN_OUTPUT_START);
-    if (start < 0)
+    if (start < 0 && !logTruncated)
         return undefined;
     let end = -1;
     for (let i = contents.length - 1; i > start; i--) {
@@ -140,7 +158,13 @@ function extractCodeRunOutput(log) {
     // Drop only the single trailing separator the harness writes before the end marker.
     if (body.length > 0 && body[body.length - 1] === "")
         body.pop();
-    return body.join("\n");
+    const omitted = CODE_RUN_OUTPUT_TRUNCATED_RE.exec(contents[end + 1] ?? "");
+    const omittedBytes = omitted ? Number(omitted[1]) : undefined;
+    return {
+        output: body.join("\n"),
+        truncated: omitted !== null || start < 0,
+        ...(omittedBytes !== undefined ? { omittedBytes, } : {}),
+    };
 }
 function scenarioStepWarningSummary(stepResult) {
     const container = stepResult?.warnings;
@@ -441,7 +465,10 @@ export class ScenariosResource extends BaseResource {
                 type: "custom_python",
                 params: { envSelection, },
             });
-            await this.client.putVoid(`${base}/payload`, { script: buildCodeRunScript(script), extension: "py", });
+            await this.client.putVoid(`${base}/payload`, {
+                script: buildCodeRunScript(script, Math.floor(maxLogBytes / CODE_RUN_OUTPUT_BUDGET_DIVISOR)),
+                extension: "py",
+            });
             const trigger = await this.client.post(`${base}/run/`, {});
             const tracked = await this.trackTriggerRun(scenarioId, base, trigger, {
                 startedAt,
@@ -454,9 +481,12 @@ export class ScenariosResource extends BaseResource {
             pollCount = tracked.pollCount;
             timedOut = tracked.timedOut;
             if (runId && outcome !== "TIMEOUT") {
+                // Tail read: the markers are printed last, so a log over the cap loses
+                // DSS start-up noise instead of the END marker.
                 const limitedLog = await this.getRunLog(scenarioId, runId, {
                     projectKey: opts?.projectKey,
                     maxLogBytes,
+                    tail: true,
                 });
                 log = limitedLog.text;
                 logTruncated = limitedLog.truncated;
@@ -475,7 +505,7 @@ export class ScenariosResource extends BaseResource {
             }
             throw primaryError;
         }
-        const output = extractCodeRunOutput(log);
+        const extracted = extractCodeRunOutput(log, logTruncated);
         return {
             scenarioId,
             runId,
@@ -483,7 +513,11 @@ export class ScenariosResource extends BaseResource {
             success: outcome === "SUCCESS",
             elapsedMs: Date.now() - startedAt,
             pollCount,
-            output,
+            output: extracted?.output,
+            ...(extracted?.truncated ? { outputTruncated: true, } : {}),
+            ...(extracted?.omittedBytes !== undefined
+                ? { outputOmittedBytes: extracted.omittedBytes, }
+                : {}),
             log,
             logTruncated,
             maxLogBytes,
@@ -519,7 +553,9 @@ export class ScenariosResource extends BaseResource {
      * Get the log of a scenario run (GET /scenarios/{id}/{runId}/log), optionally
      * scoped to a single step via `stepId`. The text is byte-bounded: at most
      * `maxLogBytes` (default 1 MiB) of the beginning of the log is retained and
-     * `truncated` reports whether the cap cut the body.
+     * `truncated` reports whether the cap cut the body. With `tail: true` the
+     * last `maxLogBytes` are retained instead (used by code runs, whose output
+     * markers sit at the end of the log).
      */
     async getRunLog(scenarioId, runId, opts) {
         if (opts?.stepId !== undefined)
@@ -529,7 +565,10 @@ export class ScenariosResource extends BaseResource {
         const query = opts?.stepId !== undefined
             ? `?stepId=${encodeURIComponent(opts.stepId)}`
             : "";
-        const { text, truncated, } = await this.client.getTextLimited(`/public/api/projects/${this.enc(opts?.projectKey)}/scenarios/${scEnc}/${encodeURIComponent(runId)}/log${query}`, maxLogBytes);
+        const readText = opts?.tail === true
+            ? this.client.getTextTailLimited.bind(this.client)
+            : this.client.getTextLimited.bind(this.client);
+        const { text, truncated, } = await readText(`/public/api/projects/${this.enc(opts?.projectKey)}/scenarios/${scEnc}/${encodeURIComponent(runId)}/log${query}`, maxLogBytes);
         return { text, truncated, maxLogBytes, };
     }
     /** Get the payload of a (custom) scenario (GET /scenarios/{id}/payload). */

package/dist/src/resources/wiki.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import { stat as statFile, } from "node:fs/promises";
 import path from "node:path";
 import { ClientValidationError, } from "../errors.js";
 import { WikiArticleDataArraySchema, WikiArticleDataSchema, WikiSettingsSchema, } from "../schemas.js";
@@ -19,13 +19,9 @@ export function wikiAttachmentNotFound(data, smartId) {
 }
 /** Check that a local path is a readable regular file before any DSS call. */
 export async function statWikiAttachmentFile(localPath) {
-    let stat;
-    try {
-        stat = await fs.promises.stat(localPath);
-    }
-    catch (error) {
+    const stat = await statFile(localPath).catch((error) => {
         throw new ClientValidationError(`Could not read attachment file ${localPath}: ${error instanceof Error ? error.message : String(error)}.`, "not_found", "Verify the file path and that it is readable.");
-    }
+    });
     if (!stat.isFile()) {
         throw new ClientValidationError(`${localPath} is not a regular file.`);
     }

package/dist/src/skill.js

@@ -1,7 +1,6 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { fileURLToPath, } from "node:url";
 import { ClientValidationError, } from "./errors.js";
 import { sha256Hex, } from "./utils/stable-hash.js";
 const SKILL_URLS = [
@@ -114,7 +113,7 @@ function skillState(target, expectedSha256) {
 }
 /** Load the packaged tree, keeping portable relative paths in the report. */
 function skillFiles() {
-    const root = fileURLToPath(skillDirectory());
+    const root = Bun.fileURLToPath(skillDirectory());
     const files = new Map();
     function visit(relativeDir) {
         const dir = path.join(root, relativeDir);