deepline 0.1.306 → 0.1.308

package/dist/bundling-sources/sdk/src/client.ts

@@ -1785,7 +1785,6 @@ export class DeeplineClient {
       },
       headers,
       {
-        forbiddenAsApiError: true,
         timeout: options?.timeout ?? resolveToolExecuteTimeoutMs(toolId, input),
         maxRetries: options?.maxRetries ?? 0,
         exactUrlOnly: true,
@@ -1848,17 +1847,11 @@ export class DeeplineClient {
   async repairIngestionStorage(input?: {
     provider?: string;
   }): Promise<IngestionStorageRepairResult> {
-    // forbiddenAsApiError: the repair route returns a meaningful 403 for
-    // non-org-admin callers. Without it, http.ts collapses 403 into a generic
-    // AuthError (statusCode 401) and the CLI's "requires org admin" branch
-    // could never fire.
     return this.http.post<IngestionStorageRepairResult>(
       '/api/v2/ingestion/repair',
       {
         ...(input?.provider ? { provider: input.provider } : {}),
       },
-      undefined,
-      { forbiddenAsApiError: true },
     );
   }
 
@@ -2080,7 +2073,7 @@ export class DeeplineClient {
         compilerManifest,
       },
       undefined,
-      { forbiddenAsApiError: true, retryApiErrors: true },
+      { retryApiErrors: true },
     );
   }
 
@@ -2124,7 +2117,7 @@ export class DeeplineClient {
         '/api/v2/plays/artifacts',
         { artifacts },
         undefined,
-        { forbiddenAsApiError: true, retryApiErrors: true },
+        { retryApiErrors: true },
       );
     }
     const compiledArtifacts = await mapWithConcurrency(
@@ -2166,7 +2159,7 @@ export class DeeplineClient {
             artifacts: chunk,
           },
           undefined,
-          { forbiddenAsApiError: true, retryApiErrors: true },
+          { retryApiErrors: true },
         ),
       );
     }
@@ -3612,8 +3605,6 @@ export class DeeplineClient {
     return this.http.post<PublishPlayVersionResult>(
       `/api/v2/plays/${encodedName}/live`,
       request,
-      undefined,
-      { forbiddenAsApiError: true },
     );
   }
 
@@ -3935,8 +3926,7 @@ export class DeeplineClient {
    * `client.monitors.status()`.
    */
   async getMonitorsAccess(): Promise<MonitorsAccessStatus> {
-    // No forbiddenAsApiError: the endpoint answers 200 in both the granted and
-    // denied cases, so a 403 would be a real auth failure, not a denial body.
+    // The endpoint answers 200 in both the granted and denied cases.
     const payload = await this.http.request<MonitorsAccessStatus>(
       '/api/v2/monitors/access',
       { method: 'GET' },
@@ -3989,7 +3979,7 @@ export class DeeplineClient {
     const suffix = query ? `?${query}` : '';
     return this.http.request<MonitorsAvailableResult>(
       `/api/v2/monitors/tools${suffix}`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4000,7 +3990,6 @@ export class DeeplineClient {
     return this.http.request<MonitorCheckResult>('/api/v2/monitors/check', {
       method: 'POST',
       body: definition,
-      forbiddenAsApiError: true,
     });
   }
 
@@ -4019,13 +4008,11 @@ export class DeeplineClient {
       return this.http.request<MonitorDeployResult>('/api/v2/monitors/check', {
         method: 'POST',
         body: definition,
-        forbiddenAsApiError: true,
       });
     }
     return this.http.request<MonitorDeployResult>('/api/v2/monitors/deploy', {
       method: 'POST',
       body: definition,
-      forbiddenAsApiError: true,
     });
   }
 
@@ -4045,7 +4032,7 @@ export class DeeplineClient {
     const suffix = query ? `?${query}` : '';
     return this.http.request<MonitorsListResult>(
       `/api/v2/monitors/deployed${suffix}`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4053,7 +4040,7 @@ export class DeeplineClient {
   async getMonitor(key: string): Promise<MonitorDetail> {
     return this.http.request<MonitorDetail>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4061,7 +4048,7 @@ export class DeeplineClient {
   async getMonitorDependents(key: string): Promise<MonitorDependents> {
     return this.http.request<MonitorDependents>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/dependents`,
-      { method: 'GET', forbiddenAsApiError: true },
+      { method: 'GET' },
     );
   }
 
@@ -4072,7 +4059,7 @@ export class DeeplineClient {
   ): Promise<MonitorUpdateResult> {
     return this.http.request<MonitorUpdateResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: 'PATCH', body: patch, forbiddenAsApiError: true },
+      { method: 'PATCH', body: patch },
     );
   }
 
@@ -4091,7 +4078,7 @@ export class DeeplineClient {
     const query = params.toString();
     return this.http.request<MonitorDeleteResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ''}`,
-      { method: 'DELETE', forbiddenAsApiError: true },
+      { method: 'DELETE' },
     );
   }
 
@@ -4106,7 +4093,7 @@ export class DeeplineClient {
     const query = options?.dryRun ? '?dry_run=true' : '';
     return this.http.request<MonitorReactivateResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: 'POST', body: {}, forbiddenAsApiError: true },
+      { method: 'POST', body: {} },
     );
   }
 

package/dist/bundling-sources/sdk/src/errors.ts

@@ -30,7 +30,9 @@ export {
 /**
  * Thrown when the API rejects the request due to an invalid or missing API key.
  *
- * This maps to HTTP 401/403 responses. The SDK never retries auth errors —
+ * This maps to HTTP 401 responses. HTTP 403 means the caller was authenticated
+ * but lacks permission, so the SDK preserves the server's API error instead.
+ * The SDK never retries auth errors —
  * they fail immediately.
  *
  * Fix: run `deepline auth register` to obtain a valid key, or pass one via

package/dist/bundling-sources/sdk/src/http.ts

@@ -9,7 +9,7 @@
  * - **Max attempts**: `1 + maxRetries` (default: 4 total attempts)
  * - **Backoff**: exponential — 1s, 2s, 4s, 8s, ... capped at 30s
  * - **Retryable**: network errors, timeouts, HTTP 429 (rate limit)
- * - **Not retryable**: HTTP 401/403 (auth errors), other 4xx API errors
+ * - **Not retryable**: HTTP 401 (auth error), HTTP 403 and other 4xx API errors
  *
  * ## Localhost failover
  *
@@ -61,14 +61,6 @@ interface RequestOptions {
   headers?: Record<string, string>;
   /** Per-request timeout override in milliseconds. */
   timeout?: number;
-  /**
-   * Treat HTTP 403 as a regular API error instead of a generic {@link AuthError}.
-   * Use for endpoints that return 403 with a meaningful server error message
-   * (e.g. feature-flagged-off billing subscription checkout) so the server
-   * message is preserved and surfaced loudly. A provider-originated HTTP 401
-   * remains a regular API error when its response envelope says so.
-   */
-  forbiddenAsApiError?: boolean;
   /**
    * Retry HTTP 408/425/5xx JSON API responses. Use only for idempotent requests;
    * most mutating API calls must fail loudly after the first server response.
@@ -437,11 +429,10 @@ export class HttpClient {
           }
 
           if (
-            (response.status === 401 &&
-              !isProviderOriginatedHttpError(parsed)) ||
-            (response.status === 403 && !options?.forbiddenAsApiError)
+            response.status === 401 &&
+            !isProviderOriginatedHttpError(parsed)
           ) {
-            throw new AuthError();
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           if (!response.ok) {
             const retryableApiError =
@@ -576,10 +567,17 @@ export class HttpClient {
    * @typeParam T - Expected response body type
    * @param path - API path (e.g. `"/api/v2/tools"`)
    */
-  async get<T = unknown>(path: string): Promise<T> {
+  async get<T = unknown>(
+    path: string,
+    options?: Pick<
+      RequestOptions,
+      'retryApiErrors' | 'timeout' | 'maxRetries' | 'exactUrlOnly' | 'toolId'
+    >,
+  ): Promise<T> {
     return this.request<T>(path, {
       method: 'GET',
       retryApiErrors: true,
+      ...options,
     });
   }
 
@@ -614,11 +612,10 @@ export class HttpClient {
           const body = await response.text();
           const parsed = parseResponseBody(body);
           if (
-            (response.status === 401 &&
-              !isProviderOriginatedHttpError(parsed)) ||
-            response.status === 403
+            response.status === 401 &&
+            !isProviderOriginatedHttpError(parsed)
           ) {
-            throw new AuthError();
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           const htmlError = detectHtmlErrorBody(
             body,
@@ -681,12 +678,7 @@ export class HttpClient {
     headers?: Record<string, string>,
     options?: Pick<
       RequestOptions,
-      | 'forbiddenAsApiError'
-      | 'retryApiErrors'
-      | 'timeout'
-      | 'maxRetries'
-      | 'exactUrlOnly'
-      | 'toolId'
+      'retryApiErrors' | 'timeout' | 'maxRetries' | 'exactUrlOnly' | 'toolId'
     >,
   ): Promise<T> {
     return this.request<T>(path, {

package/dist/bundling-sources/sdk/src/play.ts

@@ -198,6 +198,17 @@ export type PlayBindings = {
     /** Stop the run before a billed action would push total run credits above this cap. */
     maxCreditsPerRun?: number;
   };
+  /** Requested sandbox envelope; the server enforces the final allowed limits. */
+  runtime?: {
+    /** Duration such as `"90m"` or `"2h"`. */
+    timeout?: string;
+    /** Memory such as `"4GiB"`. */
+    memory?: string;
+    /** Whole vCPU count. */
+    cpu?: number;
+    /** Disk such as `"10GiB"`. */
+    disk?: string;
+  };
   /** Webhook trigger with optional HMAC signature verification. */
   webhook?: {
     hmac?: {
@@ -1193,6 +1204,8 @@ export type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = {
   bindings?: PlayBindings;
   /** Billing options. */
   billing?: PlayBindings['billing'];
+  /** Requested sandbox envelope; the server enforces the final allowed limits. */
+  runtime?: PlayBindings['runtime'];
   /** Runtime compatibility override. Omit for the current typed contract. */
   compatibility?: PlayBindings['compatibility'];
 };
@@ -1354,6 +1367,8 @@ export type DefinedPlay<TInput, TOutput extends PlayReturnObject> = ((
   DeeplineNamedPlay<TInput, TOutput> & {
     /** Optional trigger bindings (cron, webhook). */
     readonly bindings?: PlayBindings;
+    /** Requested sandbox envelope. */
+    readonly runtime?: PlayBindings['runtime'];
     /** Runtime compatibility explicitly selected by the author. */
     readonly compatibility?: PlayBindings['compatibility'];
     /** The play's name (same as `.name`). */
@@ -1366,6 +1381,7 @@ type PlayMetadata = {
   bindings?: PlayBindings;
   inputSchema?: Record<string, unknown>;
   billing?: PlayBindings['billing'];
+  runtime?: PlayBindings['runtime'];
   compatibility?: PlayBindings['compatibility'];
 };
 
@@ -2124,6 +2140,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
           description: maybeBindings?.description,
           inputSchema: undefined,
           billing: maybeBindings?.billing,
+          runtime: maybeBindings?.runtime,
           compatibility: maybeBindings?.compatibility,
         }
       : {
@@ -2133,6 +2150,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
           description: nameOrConfig.description,
           inputSchema: nameOrConfig.input.schema,
           billing: nameOrConfig.billing,
+          runtime: nameOrConfig.runtime ?? nameOrConfig.bindings?.runtime,
           compatibility:
             nameOrConfig.compatibility ?? nameOrConfig.bindings?.compatibility,
         };
@@ -2142,6 +2160,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
   const description = config.description?.trim();
   const billing = config.billing;
   const inputSchema = config.inputSchema;
+  const runtime = config.runtime;
   const compatibility = config.compatibility;
   if (typeof fn !== 'function') {
     throw new Error('definePlay(...) requires an async run function.');
@@ -2176,6 +2195,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
     ...(bindings ? { bindings } : {}),
     ...(inputSchema ? { inputSchema } : {}),
     ...(billing ? { billing } : {}),
+    ...(runtime ? { runtime } : {}),
     ...(compatibility ? { compatibility } : {}),
   };
   const play = fn as DefinedPlay<TInput, TOutput>;
@@ -2200,6 +2220,12 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
     configurable: false,
     writable: false,
   });
+  Object.defineProperty(play, 'runtime', {
+    value: runtime,
+    enumerable: true,
+    configurable: false,
+    writable: false,
+  });
 
   Object.defineProperty(play, 'compatibility', {
     value: compatibility,

package/dist/bundling-sources/sdk/src/release.ts

@@ -157,7 +157,7 @@ export const SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: '0.1.306',
+  version: '0.1.308',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -11,6 +11,7 @@ import type { PlayLiveEventSource } from './live-events';
 import type { PreloadedRuntimeDbSession } from './db-session';
 import type { PacingRule } from './governor/rate-state-backend';
 import type { GovernanceSnapshot } from './governor/governor';
+import type { PlaySandboxRuntimeLimits } from './sandbox-runtime-limits';
 import type { PlayRunInputPayload } from './play-input';
 import type { PlayRunFailureDetails } from './run-failure';
 import type { ToolExecutionErrorSchemaVersion } from '../tool-execution-error';
@@ -169,6 +170,8 @@ export interface PlayRunnerContextConfig {
    */
   runnerPushExecution?: RunnerPushExecutionConfig | null;
   governance?: GovernanceSnapshot | null;
+  /** Immutable resource envelope resolved at launch. */
+  sandboxRuntimeLimits?: PlaySandboxRuntimeLimits | null;
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-lifecycle.ts

@@ -5,20 +5,17 @@ import type {
 } from '@shared_libs/play-runtime/protocol';
 import { isIsolatedRuntimeSchedulerSchema } from '@shared_libs/play-runtime/runtime-scheduler-topology';
 import { PLAY_RUNNER_TIMEOUT_SECONDS } from '@shared_libs/play-runtime/runtime-constants';
+import { resolvePlaySandboxRuntimeLimits } from '@shared_libs/play-runtime/sandbox-runtime-limits';
 
 const DAYTONA_CREATE_TIMEOUT_SECONDS = 10;
 const DAYTONA_CREATE_RETRY_DELAYS_MS = [0, 500, 1_500] as const;
 // Explicit runner deadline + scheduler GC own the normal lifecycle. Daytona's
 // inactivity stop is a wider crash backstop measured from sandbox creation, so
 // setup time cannot consume the terminal-flush grace.
-const DAYTONA_AUTO_STOP_INTERVAL_MINUTES = Math.ceil(
-  PLAY_RUNNER_TIMEOUT_SECONDS / 60,
-);
 const DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES = 15;
 const DAYTONA_SANDBOX_LABEL_SOURCE = 'deepline-play-runner';
-// The sandbox must be created at its final resource boundary. Do not add a
-// resize call here: sandbox acquisition is launch-critical, and every extra
-// control-plane round trip raises cold-start latency.
+// Daytona's default image is the fast path. Non-standard resources are applied
+// during acquisition, before customer code and before the billing clock starts.
 export const DAYTONA_SANDBOX_CPU = 1;
 export const DAYTONA_SANDBOX_MEMORY_GIB = 1;
 export const DAYTONA_SANDBOX_DISK_GIB = 3;
@@ -176,6 +173,16 @@ async function createOneShotDaytonaSandbox(input: {
   orgId: string;
   context: DaytonaExecutionContext;
 }): Promise<DaytonaSandbox> {
+  const limits = resolvePlaySandboxRuntimeLimits(
+    input.context.sandboxRuntimeLimits
+      ? {
+          timeout: `${input.context.sandboxRuntimeLimits.timeoutSeconds / 60}m`,
+          memory: `${input.context.sandboxRuntimeLimits.memoryGiB}GiB`,
+          cpu: input.context.sandboxRuntimeLimits.cpu,
+          disk: `${input.context.sandboxRuntimeLimits.diskGiB}GiB`,
+        }
+      : null,
+  );
   const orgId = normalizeLabelValue(input.orgId);
   const workflowId = normalizeLabelValue(input.context.workflowId);
   const playId = normalizeLabelValue(input.context.playId);
@@ -203,7 +210,9 @@ async function createOneShotDaytonaSandbox(input: {
     {
       labels,
       ephemeral: true,
-      autoStopInterval: DAYTONA_AUTO_STOP_INTERVAL_MINUTES,
+      autoStopInterval: Math.ceil(
+        (limits.timeoutSeconds + PLAY_RUNNER_TIMEOUT_SECONDS - 30 * 60) / 60,
+      ),
       autoArchiveInterval: DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES,
       // A non-empty `networkAllowList` IS the "block all egress except these
       // CIDRs" control; Daytona rejects create when `networkBlockAll: true` is
@@ -277,6 +286,16 @@ async function acquireOneShotDaytonaSandbox(input: {
   emitStage: DaytonaStageEmitter;
   startedAt: number;
 }): Promise<AcquiredDaytonaSandbox> {
+  const limits = resolvePlaySandboxRuntimeLimits(
+    input.context.sandboxRuntimeLimits
+      ? {
+          timeout: `${input.context.sandboxRuntimeLimits.timeoutSeconds / 60}m`,
+          memory: `${input.context.sandboxRuntimeLimits.memoryGiB}GiB`,
+          cpu: input.context.sandboxRuntimeLimits.cpu,
+          disk: `${input.context.sandboxRuntimeLimits.diskGiB}GiB`,
+        }
+      : null,
+  );
   input.emitStage('create:start');
   const result = await createRetriedOneShotDaytonaSandbox(input);
   const granted = {
@@ -285,15 +304,51 @@ async function acquireOneShotDaytonaSandbox(input: {
     diskGiB: result.sandbox.disk,
     gpu: result.sandbox.gpu ?? 0,
   };
+  // Daytona's SDK only accepts resources when a custom image is supplied.
+  // We deliberately retain the provider's fast default image, then resize
+  // before any customer code or billing window begins.
+  if (
+    typeof result.sandbox.resize === 'function' &&
+    (granted.cpu !== limits.cpu ||
+      granted.memoryGiB !== limits.memoryGiB ||
+      granted.diskGiB !== limits.diskGiB)
+  ) {
+    try {
+      if (granted.diskGiB !== limits.diskGiB) {
+        await result.sandbox.stop(60);
+        await result.sandbox.resize({
+          cpu: limits.cpu,
+          memory: limits.memoryGiB,
+          disk: limits.diskGiB,
+        });
+        await result.sandbox.start(60);
+      } else {
+        await result.sandbox.resize({
+          cpu: limits.cpu,
+          memory: limits.memoryGiB,
+          disk: limits.diskGiB,
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return await rejectAcquiredSandbox(
+        result.sandbox,
+        `Daytona sandbox resize failed before execution: ${message}.`,
+      );
+    }
+    granted.cpu = result.sandbox.cpu;
+    granted.memoryGiB = result.sandbox.memory;
+    granted.diskGiB = result.sandbox.disk;
+  }
   if (
-    granted.cpu !== DAYTONA_SANDBOX_CPU ||
-    granted.memoryGiB !== DAYTONA_SANDBOX_MEMORY_GIB ||
-    granted.diskGiB !== DAYTONA_SANDBOX_DISK_GIB ||
+    granted.cpu !== limits.cpu ||
+    granted.memoryGiB !== limits.memoryGiB ||
+    granted.diskGiB !== limits.diskGiB ||
     granted.gpu !== DAYTONA_SANDBOX_GPU
   ) {
     await rejectAcquiredSandbox(
       result.sandbox,
-      `Daytona sandbox resource boundary mismatch: expected cpu=${DAYTONA_SANDBOX_CPU} memoryGiB=${DAYTONA_SANDBOX_MEMORY_GIB} diskGiB=${DAYTONA_SANDBOX_DISK_GIB} gpu=${DAYTONA_SANDBOX_GPU}, granted cpu=${granted.cpu} memoryGiB=${granted.memoryGiB} diskGiB=${granted.diskGiB} gpu=${granted.gpu}`,
+      `Daytona sandbox resource boundary mismatch: expected cpu=${limits.cpu} memoryGiB=${limits.memoryGiB} diskGiB=${limits.diskGiB} gpu=${DAYTONA_SANDBOX_GPU}, granted cpu=${granted.cpu} memoryGiB=${granted.memoryGiB} diskGiB=${granted.diskGiB} gpu=${granted.gpu}`,
     );
   }
   const configuredOrganizationId =

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-payload-transport.ts

@@ -120,7 +120,11 @@ function nodeMaterializePayloadCommand(input: {
  * Exported (with the builder) for the unit test that executes the script
  * against a real local HTTP server.
  */
-export function buildDaytonaCrashTerminalPusherSource(): string {
+export function buildDaytonaCrashTerminalPusherSource(
+  runtimeLimitSeconds = STANDARD_PLAY_RUNTIME_LIMIT_SECONDS,
+): string {
+  const runtimeLimitMessage = `The play reached its configured ${runtimeLimitSeconds} second runtime limit and was stopped.`;
+  const runtimeLimitDetail = `${runtimeLimitMessage} Completed row state was preserved; run a smaller batch or continue from the persisted rows.`;
   return `
 const fs = require('node:fs');
 const configPath = process.argv[2];
@@ -264,7 +268,7 @@ async function main() {
   const sandboxOom =
     sandboxKilled && (outputHasExplicitOomSignature() || cgroupOomKillObserved());
   const synthesizedError = runtimeLimitExceeded
-    ? 'RUNTIME_LIMIT_EXCEEDED: The play reached its 30 minute runtime limit and was stopped.'
+    ? 'RUNTIME_LIMIT_EXCEEDED: ' + ${JSON.stringify(runtimeLimitMessage)}
     : sandboxOom
       ? 'RUNTIME_SANDBOX_OOM: ' + ${JSON.stringify(RUNTIME_SANDBOX_OOM_MESSAGE)}
       : sandboxKilled
@@ -280,7 +284,7 @@ async function main() {
       ? [{
           code: 'RUNTIME_LIMIT_EXCEEDED',
           phase: 'runtime',
-          message: 'The play reached its 30 minute runtime limit and was stopped. Completed row state was preserved; run a smaller batch or continue from the persisted rows.',
+          message: ${JSON.stringify(runtimeLimitDetail)},
           retryable: false,
           cause: synthesizedError,
         }]
@@ -498,6 +502,9 @@ export async function stageDaytonaRunnerPayload(input: {
     materializedFiles: remoteMaterializedFiles,
     context: remoteRuntimeContextForDaytona(input.config.context),
   };
+  const runtimeLimitSeconds =
+    input.config.context.sandboxRuntimeLimits?.timeoutSeconds ??
+    STANDARD_PLAY_RUNTIME_LIMIT_SECONDS;
 
   const envelopeUpload = input.bundlePromise.then((bundle) =>
     timedDaytonaUpload({
@@ -511,7 +518,8 @@ export async function stageDaytonaRunnerPayload(input: {
         artifactBundledCode: compactedArtifact.bundledCode,
         artifactSourceMap: input.config.artifact.sourceMap,
         config: remoteConfig,
-        crashPusherCode: buildDaytonaCrashTerminalPusherSource(),
+        crashPusherCode:
+          buildDaytonaCrashTerminalPusherSource(runtimeLimitSeconds),
       }),
     }),
   );
@@ -542,7 +550,7 @@ export async function stageDaytonaRunnerPayload(input: {
     shellQuote(configPath),
     shellQuote(runtimeStartedPath),
     shellQuote(runtimeCompletedPath),
-    String(STANDARD_PLAY_RUNTIME_LIMIT_SECONDS * 1_000),
+    String(runtimeLimitSeconds * 1_000),
     String(PLAY_RUNNER_STARTUP_GRACE_SECONDS * 1_000),
     String(PLAY_RUNNER_TERMINAL_GRACE_SECONDS * 1_000),
     shellQuote(runtimeLimitMarkerPath),

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -744,6 +744,9 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
     const bundlePromise = preparedExecution.bundlePromise;
     const sandboxLifecycle = preparedExecution.sandboxLifecycle;
     const startedAt = sandboxLifecycle.startedAt;
+    const executionTimeoutSeconds =
+      config.context.sandboxRuntimeLimits?.timeoutSeconds ??
+      STANDARD_PLAY_RUNTIME_LIMIT_SECONDS;
     const runtimeTiming: PlayRunnerRuntimeTiming = { backend: 'daytona' };
     const sandboxCleanup = createDaytonaSandboxCleanupManager();
     const withCleanup = (result: PlayRunnerResult): PlayRunnerResult => {
@@ -794,6 +797,10 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
           daytonaOrganizationId: acquired.daytonaOrganizationId,
           billingStartedAt: acquired.billingStartedAt,
           billingEndedAt,
+          maxBillingDurationSeconds:
+            (config.context.sandboxRuntimeLimits?.timeoutSeconds ??
+              STANDARD_PLAY_RUNTIME_LIMIT_SECONDS) +
+            PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
           cpu: typeof sandbox.cpu === 'number' ? sandbox.cpu : null,
           memoryGiB: typeof sandbox.memory === 'number' ? sandbox.memory : null,
           diskGiB: typeof sandbox.disk === 'number' ? sandbox.disk : null,
@@ -976,7 +983,7 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
 
           emitDaytonaStage(callbacks, config.context, 'execute:start', {
             sandboxId: sandbox.id,
-            timeoutSeconds: DAYTONA_EXECUTE_TIMEOUT_SECONDS,
+            timeoutSeconds: executionTimeoutSeconds,
             mode: 'session_detached',
           });
           // Push execution (B2-final, park-and-wake): start the runner command
@@ -1012,7 +1019,7 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
             sessionId: start.sessionId,
             cmdId: start.cmdId,
             runnerAttempt,
-            ceilingSeconds: DAYTONA_EXECUTE_TIMEOUT_SECONDS,
+            ceilingSeconds: executionTimeoutSeconds,
             terminalGraceSeconds: PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
             outputPath: stagedPayload.outputPath,
             exitCodePath: stagedPayload.exitCodePath,
@@ -1031,7 +1038,9 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
               exitCodePath: stagedPayload.exitCodePath,
               runtimeCompletedPath: stagedPayload.runtimeCompletedPath,
               startedAtMs: Date.now(),
-              ceilingMs: DAYTONA_DETACHED_CEILING_SECONDS * 1_000,
+              ceilingMs:
+                (executionTimeoutSeconds + PLAY_RUNNER_TERMINAL_GRACE_SECONDS) *
+                1_000,
             },
             logs: [],
             stats: {},

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/local-process.ts

@@ -20,10 +20,7 @@ import {
   recordComputeBillingItemViaAppRuntime,
   type WorkerRuntimeApiContext,
 } from '@shared_libs/play-runtime/app-runtime-api';
-import {
-  STANDARD_PLAY_RUNTIME_LIMIT_LABEL,
-  STANDARD_PLAY_RUNTIME_LIMIT_SECONDS,
-} from '@shared_libs/play-runtime/runtime-constants';
+import { STANDARD_PLAY_RUNTIME_LIMIT_SECONDS } from '@shared_libs/play-runtime/runtime-constants';
 
 interface CommandExecutionResult {
   exitCode: number;
@@ -44,7 +41,9 @@ const LOCAL_PROCESS_COMPUTE_MEMORY_GIB = 1;
 const LOCAL_PROCESS_COMPUTE_DISK_GIB = 3;
 export const LOCAL_PROCESS_CANCEL_GRACE_MS = 2_000;
 const LOCAL_PROCESS_CANCELLED_ERROR = 'Local play runner cancelled';
-const STANDARD_PLAY_RUNTIME_LIMIT_ERROR = `Based on this plan, max runtime is ${STANDARD_PLAY_RUNTIME_LIMIT_LABEL}. Use smaller batches; ask for runtime.`;
+function localProcessRuntimeLimitError(runtimeLimitSeconds: number): string {
+  return `Configured max runtime is ${runtimeLimitSeconds} seconds. Use smaller batches or increase runtime.timeout.`;
+}
 
 export const LOCAL_PROCESS_COMPUTE_PROFILE = {
   source: LOCAL_PROCESS_COMPUTE_SOURCE,
@@ -192,16 +191,28 @@ async function runCommand(
   });
 }
 
-async function runCommandWithStandardRuntimeLimit(
+export function resolveLocalProcessRuntimeLimitSeconds(
+  context: PlayRunnerExecutionConfig['context'],
+): number {
+  return (
+    context.sandboxRuntimeLimits?.timeoutSeconds ??
+    STANDARD_PLAY_RUNTIME_LIMIT_SECONDS
+  );
+}
+
+async function runCommandWithRuntimeLimit(
   command: string,
   args: string[],
+  runtimeLimitSeconds: number,
   options?: SpawnOptionsWithoutStdio,
   callbacks?: StreamedCommandCallbacks,
 ): Promise<CommandExecutionResult> {
   const runtimeLimitController = new AbortController();
   const runtimeDeadlineTimer = setTimeout(() => {
-    runtimeLimitController.abort(STANDARD_PLAY_RUNTIME_LIMIT_ERROR);
-  }, STANDARD_PLAY_RUNTIME_LIMIT_SECONDS * 1000);
+    runtimeLimitController.abort(
+      localProcessRuntimeLimitError(runtimeLimitSeconds),
+    );
+  }, runtimeLimitSeconds * 1000);
   runtimeDeadlineTimer.unref?.();
 
   const onExternalCancel = () => {
@@ -413,9 +424,10 @@ export const localProcessPlayRunnerBackend: PlayRunnerBackend = {
               },
             },
             async (span) => {
-              const result = await runCommandWithStandardRuntimeLimit(
+              const result = await runCommandWithRuntimeLimit(
                 'node',
                 [runnerPath, configPath],
+                resolveLocalProcessRuntimeLimitSeconds(config.context),
                 {
                   cwd: workspaceRoot,
                   env: {

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/types.ts

@@ -17,6 +17,8 @@ export type PlayRunnerRuntimeResource = {
   daytonaOrganizationId?: string;
   billingStartedAt: number;
   billingEndedAt?: number | null;
+  /** Customer liability ceiling for this physical sandbox. */
+  maxBillingDurationSeconds?: number | null;
   terminalReason?: RuntimeResourceTerminalReason | null;
   terminalAt?: number | null;
   cpu?: number | null;