deepline 0.1.307 → 0.1.309

package/dist/bundling-sources/sdk/src/play.ts

@@ -198,6 +198,17 @@ export type PlayBindings = {
     /** Stop the run before a billed action would push total run credits above this cap. */
     maxCreditsPerRun?: number;
   };
+  /** Requested sandbox envelope; the server enforces the final allowed limits. */
+  runtime?: {
+    /** Duration such as `"90m"` or `"2h"`. */
+    timeout?: string;
+    /** Memory such as `"4GiB"`. */
+    memory?: string;
+    /** Whole vCPU count. */
+    cpu?: number;
+    /** Disk such as `"10GiB"`. */
+    disk?: string;
+  };
   /** Webhook trigger with optional HMAC signature verification. */
   webhook?: {
     hmac?: {
@@ -1193,6 +1204,8 @@ export type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = {
   bindings?: PlayBindings;
   /** Billing options. */
   billing?: PlayBindings['billing'];
+  /** Requested sandbox envelope; the server enforces the final allowed limits. */
+  runtime?: PlayBindings['runtime'];
   /** Runtime compatibility override. Omit for the current typed contract. */
   compatibility?: PlayBindings['compatibility'];
 };
@@ -1354,6 +1367,8 @@ export type DefinedPlay<TInput, TOutput extends PlayReturnObject> = ((
   DeeplineNamedPlay<TInput, TOutput> & {
     /** Optional trigger bindings (cron, webhook). */
     readonly bindings?: PlayBindings;
+    /** Requested sandbox envelope. */
+    readonly runtime?: PlayBindings['runtime'];
     /** Runtime compatibility explicitly selected by the author. */
     readonly compatibility?: PlayBindings['compatibility'];
     /** The play's name (same as `.name`). */
@@ -1366,6 +1381,7 @@ type PlayMetadata = {
   bindings?: PlayBindings;
   inputSchema?: Record<string, unknown>;
   billing?: PlayBindings['billing'];
+  runtime?: PlayBindings['runtime'];
   compatibility?: PlayBindings['compatibility'];
 };
 
@@ -2124,6 +2140,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
           description: maybeBindings?.description,
           inputSchema: undefined,
           billing: maybeBindings?.billing,
+          runtime: maybeBindings?.runtime,
           compatibility: maybeBindings?.compatibility,
         }
       : {
@@ -2133,6 +2150,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
           description: nameOrConfig.description,
           inputSchema: nameOrConfig.input.schema,
           billing: nameOrConfig.billing,
+          runtime: nameOrConfig.runtime ?? nameOrConfig.bindings?.runtime,
           compatibility:
             nameOrConfig.compatibility ?? nameOrConfig.bindings?.compatibility,
         };
@@ -2142,6 +2160,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
   const description = config.description?.trim();
   const billing = config.billing;
   const inputSchema = config.inputSchema;
+  const runtime = config.runtime;
   const compatibility = config.compatibility;
   if (typeof fn !== 'function') {
     throw new Error('definePlay(...) requires an async run function.');
@@ -2176,6 +2195,7 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
     ...(bindings ? { bindings } : {}),
     ...(inputSchema ? { inputSchema } : {}),
     ...(billing ? { billing } : {}),
+    ...(runtime ? { runtime } : {}),
     ...(compatibility ? { compatibility } : {}),
   };
   const play = fn as DefinedPlay<TInput, TOutput>;
@@ -2200,6 +2220,12 @@ export function definePlay<TInput, TOutput extends PlayReturnObject>(
     configurable: false,
     writable: false,
   });
+  Object.defineProperty(play, 'runtime', {
+    value: runtime,
+    enumerable: true,
+    configurable: false,
+    writable: false,
+  });
 
   Object.defineProperty(play, 'compatibility', {
     value: compatibility,

package/dist/bundling-sources/sdk/src/release.ts

@@ -157,7 +157,7 @@ export const SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: '0.1.307',
+  version: '0.1.309',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -8810,7 +8810,12 @@ export class PlayContextImpl {
     const executeSuffix = requestsDurableInvocationFence
       ? 'execute-fenced-v1'
       : 'execute';
-    const url = `${this.#options.baseUrl}/api/v2/integrations/${encodeURIComponent(toolId)}/${executeSuffix}`;
+    // Keep receipts, runner heartbeats, terminals, sheets, and runtime control
+    // on baseUrl (the receipt gateway). Only the potentially long-lived
+    // provider request may use the separately managed execution relay.
+    const executionBaseUrl =
+      this.#options.executionGatewayBaseUrl?.trim() || this.#options.baseUrl;
+    const url = `${executionBaseUrl.replace(/\/$/, '')}/api/v2/integrations/${encodeURIComponent(toolId)}/${executeSuffix}`;
     const toolErrorSchemaVersion = this.currentToolErrorSchemaVersion;
     const timeoutMs = resolveToolRuntimeTimeoutMs(toolId, options?.timeoutMs);
     const provider = toolId.split(/[._]/)[0]?.trim() || 'provider';

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -522,6 +522,13 @@ export interface ContextOptions {
   /** Short-lived HMAC-signed internal token for tool callbacks. Required for cloud execution. */
   executorToken?: string;
   baseUrl?: string;
+  /**
+   * Optional long-lived integration transport. Runtime control, receipts, and
+   * runner terminals continue to use baseUrl; only provider execute requests
+   * use this origin. This lets production rotate the receipt gateway without
+   * terminating an in-flight provider request.
+   */
+  executionGatewayBaseUrl?: string | null;
   /**
    * The integration base URL persists each keyed execute response before
    * exposing it. Only runtime adapters that route through that gateway may

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -11,6 +11,7 @@ import type { PlayLiveEventSource } from './live-events';
 import type { PreloadedRuntimeDbSession } from './db-session';
 import type { PacingRule } from './governor/rate-state-backend';
 import type { GovernanceSnapshot } from './governor/governor';
+import type { PlaySandboxRuntimeLimits } from './sandbox-runtime-limits';
 import type { PlayRunInputPayload } from './play-input';
 import type { PlayRunFailureDetails } from './run-failure';
 import type { ToolExecutionErrorSchemaVersion } from '../tool-execution-error';
@@ -169,6 +170,8 @@ export interface PlayRunnerContextConfig {
    */
   runnerPushExecution?: RunnerPushExecutionConfig | null;
   governance?: GovernanceSnapshot | null;
+  /** Immutable resource envelope resolved at launch. */
+  sandboxRuntimeLimits?: PlaySandboxRuntimeLimits | null;
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-lifecycle.ts

@@ -5,20 +5,17 @@ import type {
 } from '@shared_libs/play-runtime/protocol';
 import { isIsolatedRuntimeSchedulerSchema } from '@shared_libs/play-runtime/runtime-scheduler-topology';
 import { PLAY_RUNNER_TIMEOUT_SECONDS } from '@shared_libs/play-runtime/runtime-constants';
+import { resolvePlaySandboxRuntimeLimits } from '@shared_libs/play-runtime/sandbox-runtime-limits';
 
 const DAYTONA_CREATE_TIMEOUT_SECONDS = 10;
 const DAYTONA_CREATE_RETRY_DELAYS_MS = [0, 500, 1_500] as const;
 // Explicit runner deadline + scheduler GC own the normal lifecycle. Daytona's
 // inactivity stop is a wider crash backstop measured from sandbox creation, so
 // setup time cannot consume the terminal-flush grace.
-const DAYTONA_AUTO_STOP_INTERVAL_MINUTES = Math.ceil(
-  PLAY_RUNNER_TIMEOUT_SECONDS / 60,
-);
 const DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES = 15;
 const DAYTONA_SANDBOX_LABEL_SOURCE = 'deepline-play-runner';
-// The sandbox must be created at its final resource boundary. Do not add a
-// resize call here: sandbox acquisition is launch-critical, and every extra
-// control-plane round trip raises cold-start latency.
+// Daytona's default image is the fast path. Non-standard resources are applied
+// during acquisition, before customer code and before the billing clock starts.
 export const DAYTONA_SANDBOX_CPU = 1;
 export const DAYTONA_SANDBOX_MEMORY_GIB = 1;
 export const DAYTONA_SANDBOX_DISK_GIB = 3;
@@ -176,6 +173,16 @@ async function createOneShotDaytonaSandbox(input: {
   orgId: string;
   context: DaytonaExecutionContext;
 }): Promise<DaytonaSandbox> {
+  const limits = resolvePlaySandboxRuntimeLimits(
+    input.context.sandboxRuntimeLimits
+      ? {
+          timeout: `${input.context.sandboxRuntimeLimits.timeoutSeconds / 60}m`,
+          memory: `${input.context.sandboxRuntimeLimits.memoryGiB}GiB`,
+          cpu: input.context.sandboxRuntimeLimits.cpu,
+          disk: `${input.context.sandboxRuntimeLimits.diskGiB}GiB`,
+        }
+      : null,
+  );
   const orgId = normalizeLabelValue(input.orgId);
   const workflowId = normalizeLabelValue(input.context.workflowId);
   const playId = normalizeLabelValue(input.context.playId);
@@ -203,7 +210,9 @@ async function createOneShotDaytonaSandbox(input: {
     {
       labels,
       ephemeral: true,
-      autoStopInterval: DAYTONA_AUTO_STOP_INTERVAL_MINUTES,
+      autoStopInterval: Math.ceil(
+        (limits.timeoutSeconds + PLAY_RUNNER_TIMEOUT_SECONDS - 30 * 60) / 60,
+      ),
       autoArchiveInterval: DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES,
       // A non-empty `networkAllowList` IS the "block all egress except these
       // CIDRs" control; Daytona rejects create when `networkBlockAll: true` is
@@ -277,6 +286,16 @@ async function acquireOneShotDaytonaSandbox(input: {
   emitStage: DaytonaStageEmitter;
   startedAt: number;
 }): Promise<AcquiredDaytonaSandbox> {
+  const limits = resolvePlaySandboxRuntimeLimits(
+    input.context.sandboxRuntimeLimits
+      ? {
+          timeout: `${input.context.sandboxRuntimeLimits.timeoutSeconds / 60}m`,
+          memory: `${input.context.sandboxRuntimeLimits.memoryGiB}GiB`,
+          cpu: input.context.sandboxRuntimeLimits.cpu,
+          disk: `${input.context.sandboxRuntimeLimits.diskGiB}GiB`,
+        }
+      : null,
+  );
   input.emitStage('create:start');
   const result = await createRetriedOneShotDaytonaSandbox(input);
   const granted = {
@@ -285,15 +304,51 @@ async function acquireOneShotDaytonaSandbox(input: {
     diskGiB: result.sandbox.disk,
     gpu: result.sandbox.gpu ?? 0,
   };
+  // Daytona's SDK only accepts resources when a custom image is supplied.
+  // We deliberately retain the provider's fast default image, then resize
+  // before any customer code or billing window begins.
+  if (
+    typeof result.sandbox.resize === 'function' &&
+    (granted.cpu !== limits.cpu ||
+      granted.memoryGiB !== limits.memoryGiB ||
+      granted.diskGiB !== limits.diskGiB)
+  ) {
+    try {
+      if (granted.diskGiB !== limits.diskGiB) {
+        await result.sandbox.stop(60);
+        await result.sandbox.resize({
+          cpu: limits.cpu,
+          memory: limits.memoryGiB,
+          disk: limits.diskGiB,
+        });
+        await result.sandbox.start(60);
+      } else {
+        await result.sandbox.resize({
+          cpu: limits.cpu,
+          memory: limits.memoryGiB,
+          disk: limits.diskGiB,
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return await rejectAcquiredSandbox(
+        result.sandbox,
+        `Daytona sandbox resize failed before execution: ${message}.`,
+      );
+    }
+    granted.cpu = result.sandbox.cpu;
+    granted.memoryGiB = result.sandbox.memory;
+    granted.diskGiB = result.sandbox.disk;
+  }
   if (
-    granted.cpu !== DAYTONA_SANDBOX_CPU ||
-    granted.memoryGiB !== DAYTONA_SANDBOX_MEMORY_GIB ||
-    granted.diskGiB !== DAYTONA_SANDBOX_DISK_GIB ||
+    granted.cpu !== limits.cpu ||
+    granted.memoryGiB !== limits.memoryGiB ||
+    granted.diskGiB !== limits.diskGiB ||
     granted.gpu !== DAYTONA_SANDBOX_GPU
   ) {
     await rejectAcquiredSandbox(
       result.sandbox,
-      `Daytona sandbox resource boundary mismatch: expected cpu=${DAYTONA_SANDBOX_CPU} memoryGiB=${DAYTONA_SANDBOX_MEMORY_GIB} diskGiB=${DAYTONA_SANDBOX_DISK_GIB} gpu=${DAYTONA_SANDBOX_GPU}, granted cpu=${granted.cpu} memoryGiB=${granted.memoryGiB} diskGiB=${granted.diskGiB} gpu=${granted.gpu}`,
+      `Daytona sandbox resource boundary mismatch: expected cpu=${limits.cpu} memoryGiB=${limits.memoryGiB} diskGiB=${limits.diskGiB} gpu=${DAYTONA_SANDBOX_GPU}, granted cpu=${granted.cpu} memoryGiB=${granted.memoryGiB} diskGiB=${granted.diskGiB} gpu=${granted.gpu}`,
     );
   }
   const configuredOrganizationId =

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-payload-transport.ts

@@ -120,7 +120,11 @@ function nodeMaterializePayloadCommand(input: {
  * Exported (with the builder) for the unit test that executes the script
  * against a real local HTTP server.
  */
-export function buildDaytonaCrashTerminalPusherSource(): string {
+export function buildDaytonaCrashTerminalPusherSource(
+  runtimeLimitSeconds = STANDARD_PLAY_RUNTIME_LIMIT_SECONDS,
+): string {
+  const runtimeLimitMessage = `The play reached its configured ${runtimeLimitSeconds} second runtime limit and was stopped.`;
+  const runtimeLimitDetail = `${runtimeLimitMessage} Completed row state was preserved; run a smaller batch or continue from the persisted rows.`;
   return `
 const fs = require('node:fs');
 const configPath = process.argv[2];
@@ -264,7 +268,7 @@ async function main() {
   const sandboxOom =
     sandboxKilled && (outputHasExplicitOomSignature() || cgroupOomKillObserved());
   const synthesizedError = runtimeLimitExceeded
-    ? 'RUNTIME_LIMIT_EXCEEDED: The play reached its 30 minute runtime limit and was stopped.'
+    ? 'RUNTIME_LIMIT_EXCEEDED: ' + ${JSON.stringify(runtimeLimitMessage)}
     : sandboxOom
       ? 'RUNTIME_SANDBOX_OOM: ' + ${JSON.stringify(RUNTIME_SANDBOX_OOM_MESSAGE)}
       : sandboxKilled
@@ -280,7 +284,7 @@ async function main() {
       ? [{
           code: 'RUNTIME_LIMIT_EXCEEDED',
           phase: 'runtime',
-          message: 'The play reached its 30 minute runtime limit and was stopped. Completed row state was preserved; run a smaller batch or continue from the persisted rows.',
+          message: ${JSON.stringify(runtimeLimitDetail)},
           retryable: false,
           cause: synthesizedError,
         }]
@@ -366,11 +370,12 @@ function remoteRuntimeContextForDaytona(
     context.executionGatewayBaseUrl?.trim() || gatewayBaseUrl;
   return {
     ...context,
-    // Receipt ownership and runner terminal publication must stay on the Fly
-    // receipt gateway. Production execution calls go to the separate relay,
-    // keeping a blue/green receipt-gateway deploy out of long provider calls.
-    // Protected preview apps intentionally fall back to the combined gateway.
-    baseUrl: executionGatewayBaseUrl,
+    // The generic runtime transport owns receipts, runner terminal publication,
+    // heartbeats, sheets, and runtime control, so it must stay on the receipt
+    // gateway. Only ctx.tools.execute selects executionGatewayBaseUrl below.
+    // Otherwise a receipt gateway rollout silently moves all durable control
+    // traffic to the relay and can leave a run parked after its sandbox starts.
+    baseUrl: gatewayBaseUrl,
     executionGatewayBaseUrl,
     receiptGatewayBaseUrl: gatewayBaseUrl,
     // The execution relay owns the Postgres-backed invocation fence even though
@@ -498,6 +503,9 @@ export async function stageDaytonaRunnerPayload(input: {
     materializedFiles: remoteMaterializedFiles,
     context: remoteRuntimeContextForDaytona(input.config.context),
   };
+  const runtimeLimitSeconds =
+    input.config.context.sandboxRuntimeLimits?.timeoutSeconds ??
+    STANDARD_PLAY_RUNTIME_LIMIT_SECONDS;
 
   const envelopeUpload = input.bundlePromise.then((bundle) =>
     timedDaytonaUpload({
@@ -511,7 +519,8 @@ export async function stageDaytonaRunnerPayload(input: {
         artifactBundledCode: compactedArtifact.bundledCode,
         artifactSourceMap: input.config.artifact.sourceMap,
         config: remoteConfig,
-        crashPusherCode: buildDaytonaCrashTerminalPusherSource(),
+        crashPusherCode:
+          buildDaytonaCrashTerminalPusherSource(runtimeLimitSeconds),
       }),
     }),
   );
@@ -542,7 +551,7 @@ export async function stageDaytonaRunnerPayload(input: {
     shellQuote(configPath),
     shellQuote(runtimeStartedPath),
     shellQuote(runtimeCompletedPath),
-    String(STANDARD_PLAY_RUNTIME_LIMIT_SECONDS * 1_000),
+    String(runtimeLimitSeconds * 1_000),
     String(PLAY_RUNNER_STARTUP_GRACE_SECONDS * 1_000),
     String(PLAY_RUNNER_TERMINAL_GRACE_SECONDS * 1_000),
     shellQuote(runtimeLimitMarkerPath),

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -744,6 +744,9 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
     const bundlePromise = preparedExecution.bundlePromise;
     const sandboxLifecycle = preparedExecution.sandboxLifecycle;
     const startedAt = sandboxLifecycle.startedAt;
+    const executionTimeoutSeconds =
+      config.context.sandboxRuntimeLimits?.timeoutSeconds ??
+      STANDARD_PLAY_RUNTIME_LIMIT_SECONDS;
     const runtimeTiming: PlayRunnerRuntimeTiming = { backend: 'daytona' };
     const sandboxCleanup = createDaytonaSandboxCleanupManager();
     const withCleanup = (result: PlayRunnerResult): PlayRunnerResult => {
@@ -794,6 +797,10 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
           daytonaOrganizationId: acquired.daytonaOrganizationId,
           billingStartedAt: acquired.billingStartedAt,
           billingEndedAt,
+          maxBillingDurationSeconds:
+            (config.context.sandboxRuntimeLimits?.timeoutSeconds ??
+              STANDARD_PLAY_RUNTIME_LIMIT_SECONDS) +
+            PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
           cpu: typeof sandbox.cpu === 'number' ? sandbox.cpu : null,
           memoryGiB: typeof sandbox.memory === 'number' ? sandbox.memory : null,
           diskGiB: typeof sandbox.disk === 'number' ? sandbox.disk : null,
@@ -976,7 +983,7 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
 
           emitDaytonaStage(callbacks, config.context, 'execute:start', {
             sandboxId: sandbox.id,
-            timeoutSeconds: DAYTONA_EXECUTE_TIMEOUT_SECONDS,
+            timeoutSeconds: executionTimeoutSeconds,
             mode: 'session_detached',
           });
           // Push execution (B2-final, park-and-wake): start the runner command
@@ -1012,7 +1019,7 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
             sessionId: start.sessionId,
             cmdId: start.cmdId,
             runnerAttempt,
-            ceilingSeconds: DAYTONA_EXECUTE_TIMEOUT_SECONDS,
+            ceilingSeconds: executionTimeoutSeconds,
             terminalGraceSeconds: PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
             outputPath: stagedPayload.outputPath,
             exitCodePath: stagedPayload.exitCodePath,
@@ -1031,7 +1038,9 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
               exitCodePath: stagedPayload.exitCodePath,
               runtimeCompletedPath: stagedPayload.runtimeCompletedPath,
               startedAtMs: Date.now(),
-              ceilingMs: DAYTONA_DETACHED_CEILING_SECONDS * 1_000,
+              ceilingMs:
+                (executionTimeoutSeconds + PLAY_RUNNER_TERMINAL_GRACE_SECONDS) *
+                1_000,
             },
             logs: [],
             stats: {},

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/local-process.ts

@@ -20,10 +20,7 @@ import {
   recordComputeBillingItemViaAppRuntime,
   type WorkerRuntimeApiContext,
 } from '@shared_libs/play-runtime/app-runtime-api';
-import {
-  STANDARD_PLAY_RUNTIME_LIMIT_LABEL,
-  STANDARD_PLAY_RUNTIME_LIMIT_SECONDS,
-} from '@shared_libs/play-runtime/runtime-constants';
+import { STANDARD_PLAY_RUNTIME_LIMIT_SECONDS } from '@shared_libs/play-runtime/runtime-constants';
 
 interface CommandExecutionResult {
   exitCode: number;
@@ -44,7 +41,9 @@ const LOCAL_PROCESS_COMPUTE_MEMORY_GIB = 1;
 const LOCAL_PROCESS_COMPUTE_DISK_GIB = 3;
 export const LOCAL_PROCESS_CANCEL_GRACE_MS = 2_000;
 const LOCAL_PROCESS_CANCELLED_ERROR = 'Local play runner cancelled';
-const STANDARD_PLAY_RUNTIME_LIMIT_ERROR = `Based on this plan, max runtime is ${STANDARD_PLAY_RUNTIME_LIMIT_LABEL}. Use smaller batches; ask for runtime.`;
+function localProcessRuntimeLimitError(runtimeLimitSeconds: number): string {
+  return `Configured max runtime is ${runtimeLimitSeconds} seconds. Use smaller batches or increase runtime.timeout.`;
+}
 
 export const LOCAL_PROCESS_COMPUTE_PROFILE = {
   source: LOCAL_PROCESS_COMPUTE_SOURCE,
@@ -192,16 +191,28 @@ async function runCommand(
   });
 }
 
-async function runCommandWithStandardRuntimeLimit(
+export function resolveLocalProcessRuntimeLimitSeconds(
+  context: PlayRunnerExecutionConfig['context'],
+): number {
+  return (
+    context.sandboxRuntimeLimits?.timeoutSeconds ??
+    STANDARD_PLAY_RUNTIME_LIMIT_SECONDS
+  );
+}
+
+async function runCommandWithRuntimeLimit(
   command: string,
   args: string[],
+  runtimeLimitSeconds: number,
   options?: SpawnOptionsWithoutStdio,
   callbacks?: StreamedCommandCallbacks,
 ): Promise<CommandExecutionResult> {
   const runtimeLimitController = new AbortController();
   const runtimeDeadlineTimer = setTimeout(() => {
-    runtimeLimitController.abort(STANDARD_PLAY_RUNTIME_LIMIT_ERROR);
-  }, STANDARD_PLAY_RUNTIME_LIMIT_SECONDS * 1000);
+    runtimeLimitController.abort(
+      localProcessRuntimeLimitError(runtimeLimitSeconds),
+    );
+  }, runtimeLimitSeconds * 1000);
   runtimeDeadlineTimer.unref?.();
 
   const onExternalCancel = () => {
@@ -413,9 +424,10 @@ export const localProcessPlayRunnerBackend: PlayRunnerBackend = {
               },
             },
             async (span) => {
-              const result = await runCommandWithStandardRuntimeLimit(
+              const result = await runCommandWithRuntimeLimit(
                 'node',
                 [runnerPath, configPath],
+                resolveLocalProcessRuntimeLimitSeconds(config.context),
                 {
                   cwd: workspaceRoot,
                   env: {

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/types.ts

@@ -17,6 +17,8 @@ export type PlayRunnerRuntimeResource = {
   daytonaOrganizationId?: string;
   billingStartedAt: number;
   billingEndedAt?: number | null;
+  /** Customer liability ceiling for this physical sandbox. */
+  maxBillingDurationSeconds?: number | null;
   terminalReason?: RuntimeResourceTerminalReason | null;
   terminalAt?: number | null;
   cpu?: number | null;

package/dist/bundling-sources/shared_libs/play-runtime/runtime-constants.ts

@@ -1,3 +1,5 @@
+import { MAX_PLAY_SANDBOX_RUNTIME_LIMITS } from './sandbox-runtime-limits';
+
 /** Maximum active user-code runtime for a standard play, in seconds. */
 export const STANDARD_PLAY_RUNTIME_LIMIT_SECONDS = 30 * 60;
 export const STANDARD_PLAY_RUNTIME_LIMIT_LABEL = '30 minutes';
@@ -22,7 +24,9 @@ export const PLAY_RUNNER_STARTUP_GRACE_SECONDS = 4 * 60;
 export const PLAY_RUNNER_TIMEOUT_SECONDS = 40 * 60;
 
 /** TTL for workflow executor tokens, in seconds. */
-export const WORKFLOW_EXECUTOR_TOKEN_TTL_SECONDS = PLAY_RUNNER_TIMEOUT_SECONDS;
+export const WORKFLOW_EXECUTOR_TOKEN_TTL_SECONDS =
+  MAX_PLAY_SANDBOX_RUNTIME_LIMITS.timeoutSeconds +
+  (PLAY_RUNNER_TIMEOUT_SECONDS - STANDARD_PLAY_RUNTIME_LIMIT_SECONDS);
 
 /**
  * Absurd run-claim lease window, in seconds. The scheduler expires a claim whose

package/dist/bundling-sources/shared_libs/play-runtime/sandbox-compute-usage.ts

@@ -22,6 +22,7 @@ export function resolveDaytonaRuntimeComputeItems(input: {
       cpu: number | null;
       memoryGiB: number | null;
       diskGiB: number | null;
+      maxBillingDurationSeconds: number | null;
     }
   >();
   const items: ComputeBillingItem[] = [];
@@ -38,6 +39,9 @@ export function resolveDaytonaRuntimeComputeItems(input: {
     const billingStartedAt = finiteNonNegative(value.billingStartedAt);
     if (billingStartedAt === null) continue;
     const billingEndedAt = finiteNonNegative(value.billingEndedAt);
+    const maxBillingDurationSeconds = finiteNonNegative(
+      value.maxBillingDurationSeconds,
+    );
     const existing = resourcesBySandboxId.get(sandboxId);
     resourcesBySandboxId.set(sandboxId, {
       startedAt: Math.min(
@@ -46,16 +50,27 @@ export function resolveDaytonaRuntimeComputeItems(input: {
       ),
       endedAt:
         billingEndedAt === null
-          ? existing?.endedAt ?? null
+          ? (existing?.endedAt ?? null)
           : Math.max(existing?.endedAt ?? billingEndedAt, billingEndedAt),
       cpu: finiteNonNegative(value.cpu) ?? existing?.cpu ?? null,
       memoryGiB:
         finiteNonNegative(value.memoryGiB) ?? existing?.memoryGiB ?? null,
       diskGiB: finiteNonNegative(value.diskGiB) ?? existing?.diskGiB ?? null,
+      maxBillingDurationSeconds:
+        maxBillingDurationSeconds ??
+        existing?.maxBillingDurationSeconds ??
+        null,
     });
   }
   for (const [sandboxId, resource] of resourcesBySandboxId) {
-    const endedAt = resource.endedAt ?? input.endedAt;
+    const observedEndedAt = resource.endedAt ?? input.endedAt;
+    const endedAt =
+      resource.maxBillingDurationSeconds === null
+        ? observedEndedAt
+        : Math.min(
+            observedEndedAt,
+            resource.startedAt + resource.maxBillingDurationSeconds * 1_000,
+          );
     items.push(
       resolveDaytonaSandboxComputeItem({
         itemId: `daytona:${sandboxId}`,

package/dist/bundling-sources/shared_libs/play-runtime/sandbox-runtime-limits.ts

@@ -0,0 +1,102 @@
+export type PlaySandboxRuntimeLimits = {
+  timeoutSeconds: number;
+  memoryGiB: number;
+  cpu: number;
+  diskGiB: number;
+};
+
+export const STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS: PlaySandboxRuntimeLimits = {
+  timeoutSeconds: 30 * 60,
+  memoryGiB: 1,
+  cpu: 1,
+  diskGiB: 3,
+};
+
+// Product-wide ceilings. Organisation entitlements may lower these, but a
+// customer-authored Play can never ask Daytona for an unbounded resource.
+export const MAX_PLAY_SANDBOX_RUNTIME_LIMITS: PlaySandboxRuntimeLimits = {
+  timeoutSeconds: 4 * 60 * 60,
+  memoryGiB: 16,
+  cpu: 4,
+  diskGiB: 50,
+};
+
+export type PlaySandboxRuntimeDeclaration = {
+  timeout?: string;
+  memory?: string;
+  cpu?: number;
+  disk?: string;
+};
+
+function parsePositiveInteger(value: string, unit: string): number | null {
+  const match = new RegExp(`^(\\d+)\\s*${unit}$`, 'i').exec(value.trim());
+  if (!match) return null;
+  const parsed = Number(match[1]);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+}
+
+function parseTimeout(value: string): number | null {
+  const match = /^(\d+)\s*([mh])$/i.exec(value.trim());
+  if (!match) return null;
+  const amount = Number(match[1]);
+  if (!Number.isSafeInteger(amount) || amount <= 0) return null;
+  return amount * (match[2].toLowerCase() === 'h' ? 3600 : 60);
+}
+
+export function resolvePlaySandboxRuntimeLimits(
+  declaration: PlaySandboxRuntimeDeclaration | null | undefined,
+): PlaySandboxRuntimeLimits {
+  const base = STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS;
+  if (!declaration) return { ...base };
+  const timeoutSeconds = declaration.timeout
+    ? parseTimeout(declaration.timeout)
+    : base.timeoutSeconds;
+  const memoryGiB = declaration.memory
+    ? parsePositiveInteger(declaration.memory, 'GiB')
+    : base.memoryGiB;
+  const diskGiB = declaration.disk
+    ? parsePositiveInteger(declaration.disk, 'GiB')
+    : base.diskGiB;
+  const cpu = declaration.cpu ?? base.cpu;
+  if (
+    timeoutSeconds === null ||
+    memoryGiB === null ||
+    diskGiB === null ||
+    !Number.isSafeInteger(cpu) ||
+    cpu <= 0
+  ) {
+    throw new Error(
+      'Invalid runtime sandbox declaration. Use timeout like "90m" or "2h", memory/disk like "4GiB", and a positive integer cpu.',
+    );
+  }
+  const resolved = { timeoutSeconds, memoryGiB, cpu, diskGiB };
+  for (const key of ['memoryGiB', 'cpu', 'diskGiB'] as const) {
+    if (resolved[key] < base[key]) {
+      throw new Error(
+        `Requested runtime ${key}=${resolved[key]} is below the supported minimum ${base[key]}.`,
+      );
+    }
+  }
+  for (const key of Object.keys(
+    resolved,
+  ) as (keyof PlaySandboxRuntimeLimits)[]) {
+    if (resolved[key] > MAX_PLAY_SANDBOX_RUNTIME_LIMITS[key]) {
+      throw new Error(
+        `Requested runtime ${key}=${resolved[key]} exceeds this organisation's maximum ${MAX_PLAY_SANDBOX_RUNTIME_LIMITS[key]}.`,
+      );
+    }
+  }
+  return resolved;
+}
+
+export function hasNonStandardPlaySandboxRuntimeLimits(
+  value: PlaySandboxRuntimeLimits,
+): boolean {
+  return Object.keys(value).some(
+    (key) =>
+      value[key as keyof PlaySandboxRuntimeLimits] !==
+      STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS[
+        key as keyof PlaySandboxRuntimeLimits
+      ],
+  );
+}