deepline 0.3.461 → 0.3.462

package/dist/bundling-sources/shared_libs/play-runtime/deployment/fly-registry.ts

@@ -1,4 +1,13 @@
 import { spawnSync } from 'node:child_process';
+import {
+  chmodSync,
+  lstatSync,
+  mkdtempSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
 
 const FLY_REGISTRY_COMMAND_TIMEOUT_MS = 30_000;
 const RUNTIME_IMAGE_MANIFEST_TIMEOUT_MS = 10_000;
@@ -33,7 +42,12 @@ function run(
   const spawnCommand: FlyRegistryCommandSpawn =
     spawnOverride ??
     ((executable, commandArgs, spawnOptions) =>
-      spawnSync(executable, [...commandArgs], spawnOptions));
+      spawnSync(executable, [...commandArgs], {
+        ...spawnOptions,
+        // Bun's default child environment can retain startup values; pass the
+        // current operation environment explicitly to every native command.
+        env: { ...process.env },
+      }));
   const result = spawnCommand(command, args, {
     encoding: 'utf8',
     killSignal: 'SIGKILL',
@@ -101,11 +115,9 @@ export const FLY_REGISTRY_AUTH_ATTEMPTS = 5;
 const FLY_REGISTRY_AUTH_RETRY_DELAY_MS = 1_500;
 
 /**
- * Authenticate the local docker client against the Fly registry. Concurrent
- * release tracks each run this; on macOS two simultaneous credential-store
- * writes race on the keychain item ("already exists", -25299) and one of
- * them fails even though the credentials are in place, so a failed attempt
- * is retried after a short pause instead of failing the track.
+ * Authenticate the native Docker client with bounded retries. Standalone
+ * callers retain their credential configuration; Preview image operations
+ * isolate their stores for the complete auth/read/publish lifecycle.
  */
 export function authenticateFlyRegistry(
   sleep: (ms: number) => void = sleepSync,
@@ -148,3 +160,95 @@ export function authenticateFlyRegistry(
 function sleepSync(ms: number): void {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+
+/**
+ * One synchronous image operation owns its registry credentials. No inherited
+ * Docker config or credential helper is read, copied, changed or restored.
+ * Native auth and every registry command in operation inherit this directory.
+ */
+export function withIsolatedFlyRegistryCredentialsSync<T>(
+  operation: () => T,
+  operationRoot?: string,
+): T {
+  // Standalone image tooling keeps its existing credential/config behavior.
+  // The prepared Preview gate supplies this already-owned private root and
+  // also removes it after every image track has stopped, including crashes.
+  if (!operationRoot) return operation();
+  const root = lstatSync(operationRoot);
+  if (
+    !isAbsolute(operationRoot) ||
+    !root.isDirectory() ||
+    root.isSymbolicLink() ||
+    (root.mode & 0o077) !== 0 ||
+    (process.getuid !== undefined && root.uid !== process.getuid())
+  ) {
+    throw new Error(
+      'Isolated registry credentials require an owned private operation directory.',
+    );
+  }
+  for (const name of ['DOCKER_CONTEXT', 'BUILDX_BUILDER']) {
+    if (process.env[name]) {
+      throw new Error(
+        `Isolated Preview registry commands do not support custom ${name}.`,
+      );
+    }
+  }
+  const inherited = process.env.DOCKER_CONFIG;
+  const inheritedAuth = process.env.DOCKER_AUTH_CONFIG;
+  const inheritedDirectory = inherited || join(homedir(), '.docker');
+  const directory = mkdtempSync(join(operationRoot, 'registry-'));
+  let failed = false;
+  let originalError: unknown;
+  try {
+    chmodSync(directory, 0o700);
+    writeFileSync(
+      join(directory, 'config.json'),
+      JSON.stringify({
+        // An actual auth-map entry prevents Docker's automatic native-helper
+        // discovery. An empty config alone can still select the shared keychain.
+        auths: { 'registry.fly.io': {} },
+        // Preserve the ordinary user plugin search path without copying auth,
+        // native-helper configuration, contexts, certificates or builder state.
+        cliPluginsExtraDirs: [join(inheritedDirectory, 'cli-plugins')],
+      }),
+      { mode: 0o600, flag: 'wx' },
+    );
+    process.env.DOCKER_CONFIG = directory;
+    delete process.env.DOCKER_AUTH_CONFIG;
+    // Require the CLI so Fly cannot fall back to writing ~/.docker/config.json.
+    // This also proves Buildx is discoverable with the isolated plugin config.
+    if (
+      !run('docker', ['buildx', 'version'], true, 10_000) ||
+      !run(
+        'docker',
+        ['buildx', 'imagetools', 'inspect', '--help'],
+        true,
+        10_000,
+      )
+    ) {
+      throw new Error(
+        'Runtime images require Docker Buildx in the isolated registry configuration.',
+      );
+    }
+    return operation();
+  } catch (error) {
+    failed = true;
+    originalError = error;
+    throw error;
+  } finally {
+    if (inherited === undefined) delete process.env.DOCKER_CONFIG;
+    else process.env.DOCKER_CONFIG = inherited;
+    if (inheritedAuth === undefined) delete process.env.DOCKER_AUTH_CONFIG;
+    else process.env.DOCKER_AUTH_CONFIG = inheritedAuth;
+    try {
+      rmSync(directory, { recursive: true, force: true });
+    } catch (cleanupError) {
+      if (failed)
+        throw new AggregateError(
+          [originalError, cleanupError],
+          'Registry operation and private credential cleanup failed.',
+        );
+      throw cleanupError;
+    }
+  }
+}

package/dist/bundling-sources/shared_libs/play-runtime/durable-receipt-execution.ts

@@ -11,6 +11,7 @@ import {
   percentile,
   runtimeJsonByteLength,
   type RuntimeMemoryLedgerHandle,
+  type RuntimeMemoryLedgerCategory,
 } from './memory-ledger';
 import type {
   RuntimeMemoryOccupancy,
@@ -97,6 +98,10 @@ export type RuntimeReceiptHydrationGateSnapshot = {
   bytesAdmitted: number;
   /** Bytes turns reported actually holding, replacing their reservation. */
   bytesMeasured: number;
+  /** Turns with a successful first byte settlement, including zero bytes. */
+  measuredTurns: number;
+  /** Largest first successful settlement, not an admission estimate. */
+  bytesMeasuredMax: number;
   /** Admission attempts the byte budget refused. */
   holds: number;
   /** Collections taken to answer a hold before it was declared. */
@@ -129,6 +134,8 @@ export type RuntimeReceiptHydrationTurn = {
    * ledger stops carrying an estimate the moment a measurement exists.
    */
   settleBytes(bytes: number): void;
+  /** Opt-in cooperative scheduling after measured text, before expanding it. */
+  waitForCooperativeWork?(signal?: AbortSignal): void | Promise<void>;
   /** Drop the reservation. Idempotent. */
   release(): void;
 };
@@ -208,6 +215,10 @@ export function createRuntimeReceiptHydrationGate(input: {
   occupancy: RuntimeMemoryOccupancyReader;
   /** Registers this lane's reservations on the runtime byte ledger. */
   reserve: (bytes: number) => RuntimeMemoryLedgerHandle;
+  /** Must match the category registered by reserve; omitted keeps hydration compatibility. */
+  reservationCategory?: RuntimeMemoryLedgerCategory;
+  /** Process-local measured-work handoff; omitted preserves existing scheduling. */
+  cooperativeYieldBytes?: number;
   /**
    * Re-examines the queue while turns wait, so headroom freed by work outside
    * this lane (a row settling, a body released) reaches a waiter without
@@ -221,6 +232,16 @@ export function createRuntimeReceiptHydrationGate(input: {
   now?: () => number;
 }): RuntimeReceiptHydrationGate {
   const occupancyReader = input.occupancy;
+  const reservationCategory = input.reservationCategory ?? 'hydrationReadBack';
+  const cooperativeYieldBytes = input.cooperativeYieldBytes ?? null;
+  if (
+    cooperativeYieldBytes !== null &&
+    (!Number.isSafeInteger(cooperativeYieldBytes) || cooperativeYieldBytes <= 0)
+  ) {
+    throw new RangeError(
+      'Cooperative byte-work budget must be a positive safe integer.',
+    );
+  }
   const now = input.now ?? Date.now;
   const probeIntervalMs = Math.max(
     1,
@@ -252,6 +273,7 @@ export function createRuntimeReceiptHydrationGate(input: {
   let bytesHeldPeak = 0;
   let bytesAdmitted = 0;
   let bytesMeasured = 0;
+  let bytesMeasuredMax = 0;
   let holds = 0;
   let holdCollections = 0;
   let progressAdmissions = 0;
@@ -285,6 +307,50 @@ export function createRuntimeReceiptHydrationGate(input: {
   };
   const waiters: HydrationWaiter[] = [];
   let timer: ReturnType<typeof setInterval> | null = null;
+  let cooperativeWorkBytes = 0;
+  let cooperativeTimer: ReturnType<typeof setTimeout> | null = null;
+  let cooperativeWait: Promise<void> | null = null;
+  let finishCooperativeWait: ((error?: Error) => void) | null = null;
+
+  function waitForCooperativeBudget(
+    bytes: number,
+    isPending: () => boolean,
+  ): void | Promise<void> {
+    if (!isPending()) return;
+    if (closed) throw new RuntimeReceiptHydrationGateClosedError();
+    if (cooperativeYieldBytes === null) return;
+    if (cooperativeWait !== null) {
+      // A callback is not permission for every ready decoder. Recheck each
+      // measured body in arrival order before its caller can expand JSON.
+      return cooperativeWait.then(() =>
+        waitForCooperativeBudget(bytes, isPending),
+      );
+    }
+    if (
+      cooperativeWorkBytes > 0 &&
+      bytes > cooperativeYieldBytes - cooperativeWorkBytes
+    ) {
+      cooperativeWait = new Promise<void>((resolve, reject) => {
+        finishCooperativeWait = (error) => (error ? reject(error) : resolve());
+        cooperativeTimer = setTimeout(() => {
+          cooperativeTimer = null;
+          cooperativeWorkBytes = 0;
+          cooperativeWait = null;
+          const finish = finishCooperativeWait;
+          finishCooperativeWait = null;
+          finish?.();
+        }, 0);
+      });
+      return cooperativeWait.then(() =>
+        waitForCooperativeBudget(bytes, isPending),
+      );
+    }
+    // Threshold state only: a single legal oversized body retains progress.
+    cooperativeWorkBytes = Math.min(
+      cooperativeYieldBytes,
+      cooperativeWorkBytes + bytes,
+    );
+  }
 
   const recordPerKeySample = (bytesPerKey: number): void => {
     sampledTurns += 1;
@@ -323,17 +389,9 @@ export function createRuntimeReceiptHydrationGate(input: {
       ? Math.max(1, Math.ceil(waiter.receiptKeys * priceKey(occupancy)))
       : Math.max(1, waiter.expectedBytes);
 
-  /**
-   * Live bytes per ledger byte for what this lane actually registers.
-   *
-   * The lane's reservations land on `hydrationReadBack`, so that is the
-   * category whose factor converts them. The process-wide mix-weighted factor
-   * is a different question's answer: a run whose ledger is mostly decoded
-   * provider bodies reports ~3x, and pricing a receipt read at 3x its wire
-   * size holds turns against headroom the read was never going to occupy.
-   */
-  const hydrationFactor = (occupancy: RuntimeMemoryOccupancy): number =>
-    occupancy.categoryFactors.hydrationReadBack;
+  /** Convert expected bytes at the factor of this lane's actual reservation. */
+  const reservationFactor = (occupancy: RuntimeMemoryOccupancy): number =>
+    occupancy.categoryFactors[reservationCategory];
 
   const stopTimer = (): void => {
     if (timer === null) return;
@@ -380,6 +438,10 @@ export function createRuntimeReceiptHydrationGate(input: {
     let entryBytes = reservedBytes;
     let settled = false;
     let released = false;
+    let measuredWorkBytes: number | null = null;
+    let workWait: Promise<void> | null = null;
+    let workAccounted = false;
+    let cancelWorkWait: ((error: unknown) => void) | null = null;
     waiter.resolve({
       settleBytes(bytes) {
         if (released || settled) return;
@@ -390,10 +452,12 @@ export function createRuntimeReceiptHydrationGate(input: {
         }
         settled = true;
         const measuredBytes = Math.ceil(bytes);
+        measuredWorkBytes = measuredBytes;
         handle.update(measuredBytes);
         bytesHeld = Math.max(0, bytesHeld - entryBytes + measuredBytes);
         bytesHeldPeak = Math.max(bytesHeldPeak, bytesHeld);
         bytesMeasured += measuredBytes;
+        bytesMeasuredMax = Math.max(bytesMeasuredMax, measuredBytes);
         source.bytesMeasured += measuredBytes;
         entryBytes = measuredBytes;
         recordPerKeySample(
@@ -403,9 +467,51 @@ export function createRuntimeReceiptHydrationGate(input: {
         // headroom; hand it to whoever is waiting rather than to the clock.
         admitWaiters();
       },
+      waitForCooperativeWork(signal) {
+        if (cooperativeYieldBytes === null) return;
+        if (workWait !== null) return workWait;
+        if (workAccounted) return;
+        if (released || closed)
+          return Promise.reject(new RuntimeReceiptHydrationGateClosedError());
+        if (signal?.aborted)
+          return Promise.reject(hydrationAbortReason(signal));
+        if (measuredWorkBytes === null) {
+          return Promise.reject(
+            new Error('Cooperative body work requires settled bytes.'),
+          );
+        }
+        let pending = true;
+        const wait = waitForCooperativeBudget(measuredWorkBytes, () => pending);
+        if (!wait) {
+          // Preserve the healthy thin path: no promise, callback or new await.
+          workAccounted = true;
+          return;
+        }
+        workWait = new Promise<void>((resolve, reject) => {
+          const finish = (ok: boolean, error?: unknown) => {
+            if (!pending) return;
+            pending = false;
+            signal?.removeEventListener('abort', onAbort);
+            cancelWorkWait = null;
+            if (ok) {
+              workAccounted = true;
+              resolve();
+            } else reject(error);
+          };
+          const onAbort = () => finish(false, hydrationAbortReason(signal!));
+          cancelWorkWait = (error) => finish(false, error);
+          signal?.addEventListener('abort', onAbort, { once: true });
+          void wait.then(
+            () => finish(true),
+            (error: unknown) => finish(false, error),
+          );
+        });
+        return workWait;
+      },
       release() {
         if (released) return;
         released = true;
+        cancelWorkWait?.(new RuntimeReceiptHydrationGateClosedError());
         handle.release();
         bytesHeld = Math.max(0, bytesHeld - entryBytes);
         entryBytes = 0;
@@ -444,7 +550,7 @@ export function createRuntimeReceiptHydrationGate(input: {
       perKeyBytes = Math.ceil(reservedBytes / Math.max(1, waiter.receiptKeys));
       headroomBytes = occupancy.headroomBytes;
       if (
-        reservedBytes * hydrationFactor(occupancy) <=
+        reservedBytes * reservationFactor(occupancy) <=
         occupancy.headroomBytes
       ) {
         admit(waiter, reservedBytes);
@@ -462,7 +568,7 @@ export function createRuntimeReceiptHydrationGate(input: {
         );
         headroomBytes = occupancy.headroomBytes;
         if (
-          reservedBytes * hydrationFactor(occupancy) <=
+          reservedBytes * reservationFactor(occupancy) <=
           occupancy.headroomBytes
         ) {
           admit(waiter, reservedBytes);
@@ -560,6 +666,8 @@ export function createRuntimeReceiptHydrationGate(input: {
       bytesHeldPeak,
       bytesAdmitted,
       bytesMeasured,
+      measuredTurns: sampledTurns,
+      bytesMeasuredMax,
       holds,
       holdCollections,
       progressAdmissions,
@@ -580,6 +688,12 @@ export function createRuntimeReceiptHydrationGate(input: {
     close() {
       closed = true;
       stopTimer();
+      if (cooperativeTimer !== null) clearTimeout(cooperativeTimer);
+      cooperativeTimer = null;
+      cooperativeWait = null;
+      const finish = finishCooperativeWait;
+      finishCooperativeWait = null;
+      finish?.(new RuntimeReceiptHydrationGateClosedError());
       // A closed lane will never admit again. Stranding queued turns on an
       // unsettleable promise is the wait this contract forbids.
       const stranded = waiters.splice(0, waiters.length);

package/dist/bundling-sources/shared_libs/play-runtime/execution-capabilities.ts

@@ -35,6 +35,7 @@ export const RUNTIME_EXECUTION_CAPABILITIES = [
   'billing.write',
   'egress.fetch',
   'secret.resolve',
+  'page.write',
 ] as const;
 
 export type RuntimeExecutionCapability =
@@ -90,9 +91,21 @@ export type RuntimeAuthorityDescriptor = {
   capabilities: RuntimeExecutionCapability[];
 };
 
+/**
+ * Readers reject a token naming a capability they do not know, and the release
+ * canary mints with a new app against the deployed gateway. So a new capability
+ * ships known-but-withheld here, and joins the defaults only once every reader
+ * that verifies these tokens has deployed it. `page.write` is withheld until
+ * then; Play page writes fail closed (PAGES_UNAVAILABLE) meanwhile.
+ */
+const WITHHELD_FROM_DEFAULT_CAPABILITIES = new Set<RuntimeExecutionCapability>([
+  'run.ledger.project',
+  'page.write',
+]);
+
 export const DEFAULT_RUNTIME_EXECUTION_CAPABILITIES = [
   ...RUNTIME_EXECUTION_CAPABILITIES.filter(
-    (capability) => capability !== 'run.ledger.project',
+    (capability) => !WITHHELD_FROM_DEFAULT_CAPABILITIES.has(capability),
   ),
 ] as const satisfies readonly RuntimeExecutionCapability[];
 

package/dist/bundling-sources/shared_libs/play-runtime/fixture-behavior.ts

@@ -62,8 +62,14 @@ export type FixtureReplayBundle = {
   bundleId: string;
   manifestSha256: string;
   syntheticFallbackToolIds?: string[];
+  /** Opt-in response selection by seed + semantic payload, independent of run/org identities. */
+  selectionSeed?: string;
 };
 
+export function isFixtureReplaySelectionSeed(value: unknown): value is string {
+  return typeof value === 'string' && /^[A-Za-z0-9._:-]{1,128}$/.test(value);
+}
+
 export type FixtureBehaviorV3 = {
   version: typeof FIXTURE_BEHAVIOR_REPLAY_VERSION;
   responseSamples: FixtureResponseSample[];
@@ -519,7 +525,8 @@ export function validateFixtureBehavior(
         (key) =>
           key !== 'bundleId' &&
           key !== 'manifestSha256' &&
-          key !== 'syntheticFallbackToolIds',
+          key !== 'syntheticFallbackToolIds' &&
+          key !== 'selectionSeed',
       );
       if (replayUnknownKeys.length > 0) {
         return {
@@ -530,6 +537,16 @@ export function validateFixtureBehavior(
         };
       }
       const digestPattern = /^[a-f0-9]{64}$/;
+      if (
+        replay.selectionSeed !== undefined &&
+        !isFixtureReplaySelectionSeed(replay.selectionSeed)
+      ) {
+        return {
+          ok: false,
+          error:
+            'fixtureBehavior.replayBundle.selectionSeed must contain 1-128 letters, digits, dots, underscores, colons or hyphens.',
+        };
+      }
       if (
         typeof replay.bundleId !== 'string' ||
         !digestPattern.test(replay.bundleId)
@@ -585,6 +602,9 @@ export function validateFixtureBehavior(
         bundleId: replay.bundleId,
         manifestSha256: replay.manifestSha256,
         ...(syntheticFallbackToolIds ? { syntheticFallbackToolIds } : {}),
+        ...(replay.selectionSeed !== undefined
+          ? { selectionSeed: replay.selectionSeed as string }
+          : {}),
       };
     }
     if (record.version === FIXTURE_BEHAVIOR_REPLAY_VERSION) {
@@ -778,6 +798,29 @@ export type FixtureExecuteBoundaryCounts = {
   unprovenResponses: number;
 };
 
+/** Fixture-only evidence; no provider payload, identity, or resource path. */
+export type FixtureReplaySelectionWitness = {
+  kind: 'retained_response' | 'synthetic_fallback' | 'unproven';
+  toolId: string;
+  selectionKeySha256: string | null;
+  responseStatus: 'completed' | 'no_result' | null;
+  normalizedResponseSha256: string | null;
+  normalizedResponseBytes: number | null;
+  bundleId: string;
+  manifestSha256: string;
+  sampleIndex: number | null;
+  sampleKeySha256: string | null;
+  sampleSha256: string | null;
+  compressedBytes: number | null;
+  uncompressedBytes: number | null;
+  unprovenReason:
+    | 'missing_selection'
+    | 'multiple_selections'
+    | 'streaming'
+    | 'async_boundary'
+    | null;
+};
+
 export const FIXTURE_EXECUTE_BOUNDARY_COUNTER_KINDS = {
   started: 'boundary_started',
   finished: 'boundary_finished',
@@ -798,6 +841,7 @@ export function fixtureRunCallCounterKey(input: {
     | 'duplicate_success_members'
     | 'unproven_successes'
     | 'quota_attempts'
+    | 'replay_selections'
     | 'boundary_started'
     | 'boundary_finished'
     | 'boundary_expected_failures'
@@ -834,6 +878,18 @@ export function fixtureQuotaAttemptKey(input: {
   return `${fixtureRunCallCounterKey({ ...input, kind: 'quota_attempts' })}:attempt:${input.ordinal}`;
 }
 
+/** Every successful fixture boundary owns a slot, including repeated inputs. */
+export function fixtureReplaySelectionWitnessKey(input: {
+  orgId: string;
+  runId: string;
+  shard: number;
+  ordinal: number;
+}): string {
+  if (!Number.isSafeInteger(input.ordinal) || input.ordinal < 1)
+    throw new Error('Fixture replay witness requires a positive safe ordinal.');
+  return `${fixtureRunCallCounterKey({ ...input, kind: 'replay_selections' })}:selection:${input.ordinal}`;
+}
+
 export function fixtureRunCallCounterShard(
   durableCallReceiptKey: string,
 ): number {