deepline 0.1.198 → 0.1.200

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/bundle.ts

@@ -0,0 +1,264 @@
+import { createHash } from 'node:crypto';
+import { access, readdir, readFile } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+import {
+  setSpanAttributes,
+  withActiveSpan,
+} from '@shared_libs/observability/tracing';
+
+const runtimeRequire = createRequire(import.meta.url);
+const esbuild = runtimeRequire('esbuild') as {
+  build: (options: Record<string, unknown>) => Promise<{
+    outputFiles?: Array<{ text: string }>;
+    metafile?: {
+      inputs: Record<string, unknown>;
+    };
+  }>;
+};
+
+type EsbuildOnResolveArgs = {
+  importer: string;
+  path: string;
+};
+
+type EsbuildPluginBuild = {
+  onResolve: (
+    options: { filter: RegExp },
+    callback: (args: EsbuildOnResolveArgs) =>
+      | {
+          path?: string;
+          errors?: Array<{ text: string }>;
+        }
+      | undefined,
+  ) => void;
+};
+
+/**
+ * SECURITY: These are the only allowed module-scope caches in the play runner.
+ *
+ * They cache compiled runner CODE solely by source hash. They must never cache
+ * org-scoped, workflow-scoped, credential-bearing, or otherwise run-derived
+ * material. Future edits: do not thread execution config, play input, API
+ * responses, sandbox ids, or customer data into this cache key or payload.
+ */
+let cachedRunnerBundle: Promise<string> | null = null;
+let cachedRunnerSourceHash: string | null = null;
+
+async function readPrebuiltRunnerBundle(): Promise<string | null> {
+  const bundlePath = process.env.DEEPLINE_PLAY_RUNNER_BUNDLE_PATH?.trim();
+  if (!bundlePath) {
+    return null;
+  }
+  try {
+    await access(bundlePath);
+    const bundle = await readFile(bundlePath, 'utf-8');
+    console.info('[plays.runner.bundle.prebuilt]', {
+      bundlePath,
+      bytes: bundle.length,
+    });
+    return bundle;
+  } catch (error) {
+    console.warn('[plays.runner.bundle.prebuilt_missing]', {
+      bundlePath,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return null;
+  }
+}
+
+async function listFiles(dir: string): Promise<string[]> {
+  const entries = await readdir(dir, { withFileTypes: true });
+  const values = await Promise.all(
+    entries.map(async (entry) => {
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        return await listFiles(fullPath);
+      }
+      return entry.isFile() ? [fullPath] : [];
+    }),
+  );
+  return values.flat().sort();
+}
+
+async function hashRunnerSources(rootDirs: string[]): Promise<string> {
+  const sourceFiles = (
+    await Promise.all(rootDirs.map(async (rootDir) => await listFiles(rootDir)))
+  )
+    .flat()
+    .sort();
+  const hash = createHash('sha256');
+  for (const filePath of sourceFiles) {
+    hash.update(filePath);
+    hash.update(await readFile(filePath));
+  }
+  return hash.digest('hex');
+}
+
+function isInsidePath(candidate: string, parent: string): boolean {
+  const relativePath = relative(parent, candidate);
+  return (
+    Boolean(relativePath) &&
+    !relativePath.startsWith('..') &&
+    !relativePath.startsWith('/')
+  );
+}
+
+function createRunnerBoundaryPlugin(projectRoot: string) {
+  const forbiddenRoots = [
+    resolve(projectRoot, 'src'),
+    resolve(projectRoot, 'convex'),
+  ];
+
+  function rejectionForImport(args: EsbuildOnResolveArgs): string | null {
+    if (args.path.startsWith('@/') || args.path.startsWith('@convex/')) {
+      return `play-runner bundle cannot import ${args.path}; move shared runtime code to shared_libs or call the app over the runtime API`;
+    }
+
+    if (!args.path.startsWith('.') || !args.importer) {
+      return null;
+    }
+
+    const resolvedImport = resolve(dirname(args.importer), args.path);
+    const forbiddenRoot = forbiddenRoots.find(
+      (root) => isInsidePath(resolvedImport, root) || resolvedImport === root,
+    );
+    if (!forbiddenRoot) {
+      return null;
+    }
+
+    const relativeForbiddenPath = relative(projectRoot, resolvedImport);
+    return `play-runner bundle cannot import ${args.path} from ${args.importer}; it resolves into ${relativeForbiddenPath}`;
+  }
+
+  return {
+    name: 'deepline-play-runner-boundary',
+    setup(build: EsbuildPluginBuild) {
+      build.onResolve({ filter: /.*/ }, (args) => {
+        const rejection = rejectionForImport(args);
+        if (!rejection) {
+          return undefined;
+        }
+        return {
+          errors: [{ text: rejection }],
+        };
+      });
+    },
+  };
+}
+
+function assertBundleInputsStayInsideRunnerBoundary(
+  projectRoot: string,
+  inputs: Record<string, unknown> | undefined,
+) {
+  if (!inputs) {
+    return;
+  }
+  const forbiddenInputs = Object.keys(inputs)
+    .map((inputPath) => resolve(projectRoot, inputPath))
+    .filter(
+      (inputPath) =>
+        isInsidePath(inputPath, resolve(projectRoot, 'src')) ||
+        isInsidePath(inputPath, resolve(projectRoot, 'convex')) ||
+        inputPath === resolve(projectRoot, 'src') ||
+        inputPath === resolve(projectRoot, 'convex'),
+    );
+  if (forbiddenInputs.length === 0) {
+    return;
+  }
+  throw new Error(
+    [
+      'play-runner bundle crossed into app/server source:',
+      ...forbiddenInputs.map(
+        (inputPath) => `- ${relative(projectRoot, inputPath)}`,
+      ),
+    ].join('\n'),
+  );
+}
+
+export async function buildPlayRunnerBundle(): Promise<string> {
+  return await withActiveSpan(
+    'plays.runner.bundle',
+    {
+      tracer: 'deepline.plays',
+    },
+    async (span) => {
+      const prebuiltBundle = await readPrebuiltRunnerBundle();
+      if (prebuiltBundle) {
+        span.setAttribute('plays.bundle_prebuilt', true);
+        setSpanAttributes(span, {
+          'plays.bundle_bytes': prebuiltBundle.length,
+        });
+        return prebuiltBundle;
+      }
+      span.setAttribute('plays.bundle_prebuilt', false);
+
+      const sourceRoots = [
+        resolve(process.cwd(), 'apps', 'play-runner', 'src'),
+        resolve(process.cwd(), 'shared_libs'),
+      ];
+      const sourceHash = await hashRunnerSources(sourceRoots);
+      setSpanAttributes(span, {
+        'plays.runner_source_hash': sourceHash,
+      });
+
+      if (cachedRunnerBundle && cachedRunnerSourceHash === sourceHash) {
+        span.setAttribute('plays.bundle_cache_hit', true);
+        const bundle = await cachedRunnerBundle;
+        setSpanAttributes(span, {
+          'plays.bundle_bytes': bundle.length,
+        });
+        return bundle;
+      }
+
+      span.setAttribute('plays.bundle_cache_hit', false);
+      cachedRunnerSourceHash = sourceHash;
+      cachedRunnerBundle = (async () => {
+        const projectRoot = process.cwd();
+        const runnerRoot = resolve(process.cwd(), 'apps', 'play-runner', 'src');
+        return await withActiveSpan(
+          'plays.runner.bundle_build',
+          {
+            tracer: 'deepline.plays',
+            attributes: {
+              'plays.runner_source_hash': sourceHash,
+            },
+          },
+          async (buildSpan) => {
+            const result = await esbuild.build({
+              entryPoints: [resolve(runnerRoot, 'entry.ts')],
+              bundle: true,
+              platform: 'node',
+              format: 'cjs',
+              target: ['node18'],
+              write: false,
+              sourcemap: false,
+              minify: true,
+              tsconfig: resolve(
+                process.cwd(),
+                'tsconfig.apps.play-runner.json',
+              ),
+              metafile: true,
+              plugins: [createRunnerBoundaryPlugin(projectRoot)],
+            });
+            assertBundleInputsStayInsideRunnerBoundary(
+              projectRoot,
+              result.metafile?.inputs,
+            );
+            const bundle = result.outputFiles?.[0]?.text ?? '';
+            setSpanAttributes(buildSpan, {
+              'plays.bundle_bytes': bundle.length,
+            });
+            return bundle;
+          },
+        );
+      })();
+
+      const bundle = await cachedRunnerBundle;
+      setSpanAttributes(span, {
+        'plays.bundle_bytes': bundle.length,
+      });
+      return bundle;
+    },
+  );
+}

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/index.ts

@@ -0,0 +1,33 @@
+import type { PlayRunnerBackend } from './types';
+import { daytonaPlayRunnerBackend } from './backends/daytona';
+import { localProcessPlayRunnerBackend } from './backends/local-process';
+import {
+  PLAY_RUNTIME_BACKENDS,
+  normalizePlayRuntimeBackend,
+  type PlayRuntimeBackendId,
+} from '@shared_libs/play-runtime/backend';
+
+export function resolvePlayRunnerBackend(
+  backendId?: PlayRuntimeBackendId | string | null,
+): PlayRunnerBackend {
+  const backend = normalizePlayRuntimeBackend(
+    backendId ?? process.env.DEEPLINE_PLAY_RUNNER_BACKEND,
+  );
+  if (backend === PLAY_RUNTIME_BACKENDS.cloudflareWorkers) {
+    throw new Error(
+      'The Cloudflare runner-only backend has been retired. Pass ' +
+        '`body.profile=workers_edge` on POST /api/v2/plays/run to use the ' +
+        'Cloudflare scheduler/runner profile.',
+    );
+  }
+  if (backend === PLAY_RUNTIME_BACKENDS.daytona) {
+    return daytonaPlayRunnerBackend;
+  }
+  if (backend === PLAY_RUNTIME_BACKENDS.localProcess) {
+    return localProcessPlayRunnerBackend;
+  }
+  throw new Error(`Unsupported play runner backend: ${backend}`);
+}
+
+export { daytonaPlayRunnerBackend, localProcessPlayRunnerBackend };
+export type { PlayRunnerBackend };

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/runner-events.ts

@@ -0,0 +1,35 @@
+import type {
+  PlayRunnerEvent,
+  PlayRunnerResult,
+} from '@shared_libs/play-runtime/protocol';
+
+export function parsePlayRunnerEvents(stdout: string): PlayRunnerEvent[] {
+  return stdout
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .flatMap((line) => {
+      try {
+        return [JSON.parse(line) as PlayRunnerEvent];
+      } catch {
+        return [];
+      }
+    });
+}
+
+export function parsePlayRunnerEventLine(line: string): PlayRunnerEvent | null {
+  try {
+    return JSON.parse(line) as PlayRunnerEvent;
+  } catch {
+    return null;
+  }
+}
+
+export function findPlayRunnerResult(
+  events: PlayRunnerEvent[],
+): PlayRunnerResult | null {
+  const resultEvent = [...events]
+    .reverse()
+    .find((event) => event.type === 'result');
+  return resultEvent?.type === 'result' ? resultEvent.result : null;
+}

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/types.ts

@@ -0,0 +1,53 @@
+import type {
+  PlayCheckpoint,
+  PlayExecutionEvent,
+  PlayRowUpdate,
+} from '@shared_libs/play-runtime/ctx-types';
+import type {
+  PlayRunnerExecutionConfig,
+  PlayRunnerLogEvent,
+  PlayRunnerResult,
+} from '@shared_libs/play-runtime/protocol';
+
+export type PlayRunnerRuntimeResource =
+  | {
+      kind: 'daytona_sandbox';
+      sandboxId: string;
+      billingStartedAt: number;
+      cpu?: number | null;
+      memoryGiB?: number | null;
+      diskGiB?: number | null;
+    };
+
+export interface PlayRunnerCallbacks {
+  onLog?: (event: PlayRunnerLogEvent) => void;
+  onCheckpoint?: (checkpoint: PlayCheckpoint) => void;
+  onRowUpdate?: (update: PlayRowUpdate) => void;
+  onExecutionEvent?: (event: PlayExecutionEvent) => void;
+  onRuntimeResourceAcquired?: (
+    resource: PlayRunnerRuntimeResource,
+  ) => void | Promise<void>;
+  cancellationSignal?: AbortSignal;
+}
+
+export interface PlayRunnerPrepareInput {
+  context: PlayRunnerExecutionConfig['context'];
+}
+
+export interface PlayRunnerPreparedExecution {
+  kind: string;
+  dispose?: () => Promise<void>;
+}
+
+export interface PlayRunnerBackend {
+  prepare?(
+    input: PlayRunnerPrepareInput,
+    callbacks?: PlayRunnerCallbacks,
+  ): Promise<PlayRunnerPreparedExecution>;
+
+  execute(
+    config: PlayRunnerExecutionConfig,
+    callbacks?: PlayRunnerCallbacks,
+    prepared?: PlayRunnerPreparedExecution,
+  ): Promise<PlayRunnerResult>;
+}

package/dist/bundling-sources/shared_libs/play-runtime/runtime-actions.ts

@@ -147,7 +147,6 @@ export type RuntimeResultsAction = {
     error?: string;
     publicResult?: Record<string, unknown> | null;
     maxCreditsPerRun?: number | null;
-    temporalActionEstimate?: Record<string, unknown> | null;
   };
 };