deepline 0.3.65 → 0.3.67

package/dist/bundling-sources/sdk/src/client.ts

@@ -748,6 +748,8 @@ export type MonitorListEntry = {
   monitor_key?: string;
   status?: string;
   tool?: string;
+  /** Generic provider-authored event category for this deployed monitor. */
+  type?: string;
   name?: string;
   configured?: boolean;
   active?: boolean;

package/dist/bundling-sources/sdk/src/release.ts

@@ -199,7 +199,7 @@ export const SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: '0.3.65',
+  version: '0.3.67',
   updateSummary:
     'Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.',
   packageCapabilities: {

package/dist/bundling-sources/sdk/src/types.ts

@@ -915,6 +915,8 @@ export interface PlayRunListItem {
   startTime?: string | null;
   /** Unix epoch milliseconds when the run started, returned by normalized V2 run summaries. */
   startedAt?: number | string | null;
+  /** Unix epoch milliseconds when the run was created. */
+  createdAt?: number | string | null;
   /** ISO 8601 timestamp when the run finished. */
   closeTime?: string | null;
   /** Unix epoch milliseconds when the run finished, returned by normalized V2 run summaries. */

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -194,6 +194,10 @@ import {
   type PlayAuthoringRunScope,
   type PlayAuthoringRuntimeContext,
 } from '../plays/authoring-contract';
+import {
+  formatCtxFetchHttpFailureDiagnostic,
+  tagLogProvenance,
+} from './log-provenance';
 import {
   DURABLE_RECEIPT_WAIT_DELAY_MS,
   DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS,
@@ -451,6 +455,10 @@ const DEFAULT_TOOL_RUNTIME_TIMEOUT_MS = 15 * 60 * 1000 + 30_000;
 const FETCH_TRANSPORT_MAX_ATTEMPTS =
   RUNTIME_RELIABILITY_POLICY.egress.fetchMaxAttempts;
 const FETCH_TRANSPORT_RETRY_DELAY_MS = 100;
+// Diagnostic logs are retained in the context until terminalization. Keep a
+// representative, deduplicated set so row-heavy continued failures cannot turn
+// customer-safe observability into unbounded runner memory or log traffic.
+const MAX_CTX_FETCH_HTTP_FAILURE_DIAGNOSTICS = 16;
 const CTX_FETCH_HEADERS_TIMEOUT_MS =
   RUNTIME_RELIABILITY_POLICY.egress.fetchHeadersTimeoutMs;
 const CTX_FETCH_BODY_TIMEOUT_MS =
@@ -2087,6 +2095,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   #options: ContextOptions;
   private readonly executionScope: RunExecutionScope;
   private logBuffer: string[] = [];
+  private readonly ctxFetchHttpFailureDiagnosticIdentities = new Set<string>();
   private checkpoint: PlayCheckpoint;
   private readonly durableCallCacheEpochMs: number;
   /**
@@ -10160,6 +10169,58 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     if (this.#options.verbose) console.log(line);
   }
 
+  /**
+   * Emit a runtime-authored diagnostic through the same durable log path as
+   * ctx.log without changing the customer-authored log wire format.
+   */
+  private runtimeDiagnosticLog(message: string): void {
+    assertNoSecretTaint(message, 'runtime diagnostic log');
+    const line = tagLogProvenance(
+      'diagnostic',
+      `[${new Date().toISOString()}] ${this.secretRedactor.redactRegisteredSecrets(message)}`,
+    );
+    this.logBuffer.push(line);
+    this.#options.onLog?.(line);
+    if (this.#options.verbose) console.log(line);
+  }
+
+  /** A URL safe to persist in a customer-visible run log (origin only). */
+  private ctxFetchDiagnosticUrl(url: string): string {
+    try {
+      const parsed = new URL(url);
+      return parsed.origin;
+    } catch {
+      // ctx.fetch already parses its URL before this helper is reachable.
+      return '[invalid-url]';
+    }
+  }
+
+  private logCtxFetchHttpFailure(input: {
+    key: string;
+    method: string;
+    url: string;
+    httpStatus: number;
+  }): void {
+    const url = this.ctxFetchDiagnosticUrl(input.url);
+    const identity = `${input.key}\u0000${input.method}\u0000${url}\u0000${input.httpStatus}`;
+    if (
+      this.ctxFetchHttpFailureDiagnosticIdentities.has(identity) ||
+      this.ctxFetchHttpFailureDiagnosticIdentities.size >=
+        MAX_CTX_FETCH_HTTP_FAILURE_DIAGNOSTICS
+    ) {
+      return;
+    }
+    this.ctxFetchHttpFailureDiagnosticIdentities.add(identity);
+    this.runtimeDiagnosticLog(
+      formatCtxFetchHttpFailureDiagnostic({
+        key: input.key,
+        method: input.method,
+        url,
+        http_status: input.httpStatus,
+      }),
+    );
+  }
+
   async sleep(ms: number): Promise<void> {
     this.assertInlineChildContract('suspending_child');
     const delayMs =
@@ -10212,6 +10273,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
     const url = input.toString();
     const parsedUrl = new URL(url);
+    const method = (init.method ?? 'GET').toUpperCase();
     const urlContainsResolvedSecret =
       this.secretRedactor.containsRegisteredSecret(url, {
         includeEncoded: true,
@@ -10303,6 +10365,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         staleAfterSeconds: options?.staleAfterSeconds,
         transient: options?.transient === true,
         onRecovered: (output) => {
+          if (!output.ok) {
+            this.logCtxFetchHttpFailure({
+              key: normalizedKey,
+              method,
+              url: output.url || url,
+              httpStatus: output.status,
+            });
+          }
           if (!output.ok && this.currentAuthoringContractEdition >= 5) {
             throw new CtxFetchHttpError(output);
           }
@@ -10314,7 +10384,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             this.currentAuthoringContractEdition >= 5
           ),
         execute: async ({ retainExternalCallSlot }) => {
-          const method = (init.method ?? 'GET').toUpperCase();
           const secretHeaders = await this.resolveSecretAuth(secretAuth);
           const headers: Record<string, string> = {
             ...normalizeFetchHeaders(init.headers),
@@ -10349,6 +10418,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             'output' in existing
           ) {
             this.log(`ctx.fetch(${url}): recovered response from checkpoint`);
+            const checkpointOutput = existing.output as PlayFetchResponse;
+            if (!checkpointOutput.ok) {
+              this.logCtxFetchHttpFailure({
+                key: normalizedKey,
+                method,
+                url: checkpointOutput.url || url,
+                httpStatus: checkpointOutput.status,
+              });
+            }
             if (this.durableDirectToolResultsBackedByReceipts) {
               // The outer durable receipt is the replay authority in hosted
               // runtimes. A legacy checkpoint fetch may seed that receipt
@@ -10356,7 +10434,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               // cache for the lifetime of a large map.
               delete this.checkpoint.resolvedBoundaries?.[boundaryId];
             }
-            return existing.output as PlayFetchResponse;
+            return checkpointOutput;
           }
 
           if (!['GET', 'HEAD', 'OPTIONS'].includes(method)) {
@@ -10496,6 +10574,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               json: this.secretRedactor.redactKnownSecrets(rawJson),
             };
 
+            if (!output.ok) {
+              this.logCtxFetchHttpFailure({
+                key: normalizedKey,
+                method,
+                url: output.url || url,
+                httpStatus: output.status,
+              });
+            }
+
             // Edition 5 adopts normal fetch semantics: a non-2xx response is
             // a failed durable operation. Throw before checkpoint/receipt
             // completion so the failure is never cached. Editions 1–4 retain

package/dist/bundling-sources/shared_libs/play-runtime/log-provenance.ts

@@ -125,6 +125,85 @@ export function tagLogProvenance(
   return `${PROVENANCE_PREFIX}${provenance}${PROVENANCE_SENTINEL}${line}`;
 }
 
+/**
+ * A customer-safe record of a `ctx.fetch` response that reached the server but
+ * was not successful. Its URL is destination-origin-only; it deliberately
+ * omits paths, query strings, request/response bodies, headers, receipt ids,
+ * and row identity: all of those can contain customer data or credentials.
+ * This one stable shape is shared by the
+ * runtime (emission), finalization (terminal warning), and CLI/tests
+ * (inspection), rather than each layer trying to infer an HTTP failure from
+ * arbitrary user logs.
+ */
+export type CtxFetchHttpFailureDiagnostic = {
+  key: string;
+  method: string;
+  url: string;
+  http_status: number;
+};
+
+/** Guard terminal-transport diagnostics before they reach customer surfaces. */
+export function isCtxFetchHttpFailureDiagnostic(
+  value: unknown,
+): value is CtxFetchHttpFailureDiagnostic {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return false;
+  }
+  const record = value as Record<string, unknown>;
+  return (
+    typeof record.key === 'string' &&
+    typeof record.method === 'string' &&
+    typeof record.url === 'string' &&
+    typeof record.http_status === 'number' &&
+    Number.isInteger(record.http_status)
+  );
+}
+
+export const CTX_FETCH_HTTP_FAILURE_LOG_PREFIX =
+  '[runtime.ctx_fetch_http_failure]';
+
+/** Format the canonical durable log line for an observed non-2xx ctx.fetch. */
+export function formatCtxFetchHttpFailureDiagnostic(
+  diagnostic: CtxFetchHttpFailureDiagnostic,
+): string {
+  return `${CTX_FETCH_HTTP_FAILURE_LOG_PREFIX} ${JSON.stringify(diagnostic)}`;
+}
+
+/**
+ * Parse only runtime-authored, canonical ctx.fetch diagnostics. Untagged
+ * legacy/user lines are never interpreted as evidence, even if they happen to
+ * contain the same words.
+ */
+export function parseCtxFetchHttpFailureDiagnostic(
+  rawLine: string,
+): CtxFetchHttpFailureDiagnostic | null {
+  const tagged = readProvenanceTag(rawLine);
+  if (tagged.provenance !== 'diagnostic') return null;
+  const index = tagged.line.indexOf(CTX_FETCH_HTTP_FAILURE_LOG_PREFIX);
+  if (index === -1) return null;
+  const json = tagged.line
+    .slice(index + CTX_FETCH_HTTP_FAILURE_LOG_PREFIX.length)
+    .trim();
+  try {
+    const parsed: unknown = JSON.parse(json);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return null;
+    }
+    const record = parsed as Record<string, unknown>;
+    if (!isCtxFetchHttpFailureDiagnostic(record)) {
+      return null;
+    }
+    return {
+      key: record.key,
+      method: record.method,
+      url: record.url,
+      http_status: record.http_status,
+    };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Read a structural provenance tag off a line, if present, and return the tag
  * plus the original untagged line. Returns `null` provenance when untagged.
@@ -141,9 +220,7 @@ export function readProvenanceTag(line: string): {
     return { provenance: null, line };
   }
   const candidate = line.slice(PROVENANCE_PREFIX.length, end);
-  const provenance = LOG_PROVENANCE_CLASSES.includes(
-    candidate as LogProvenance,
-  )
+  const provenance = LOG_PROVENANCE_CLASSES.includes(candidate as LogProvenance)
     ? (candidate as LogProvenance)
     : null;
   return { provenance, line: line.slice(end + 1) };

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -17,6 +17,7 @@ import type { PlayRunFailureDetails } from './run-failure';
 import type { ToolExecutionErrorSchemaVersion } from '../plays/tool-execution-error';
 import type { ToolResponseContract } from '../plays/tool-response-contract';
 import type { FixtureBehavior } from './fixture-behavior';
+import type { CtxFetchHttpFailureDiagnostic } from './log-provenance';
 
 export type PlayRunnerRateStateBackendConfig =
   | {
@@ -307,6 +308,8 @@ export type PlayRunnerResult =
       status: 'completed';
       output: unknown;
       outputWarnings?: PlayRunOutputWarning[];
+      /** Customer-safe runtime observations that must survive bounded log tails. */
+      runtimeDiagnostics?: CtxFetchHttpFailureDiagnostic[];
       outputRowCount?: number;
       logs: string[];
       stats: Record<string, unknown>;