runline 0.28.1 → 0.30.0

package/dist/plugins/plaud/src/shared.js

@@ -0,0 +1,221 @@
+import { AuthError, downloadResource, OAuthGrantSchema, } from "runline";
+import * as t from "typebox";
+import { credentialRuntime } from "../../_shared/credentialAdapter.js";
+const BASE = "https://platform.plaud.ai/developer/api";
+/** Public client identifier and fixed callback published in Plaud's official CLI. */
+export const PLAUD_PUBLIC_CLIENT_ID = "client_f9e0b214-c11f-434b-8b95-c4497d1feb81";
+export const PLAUD_REDIRECT_URI = "http://localhost:8199/auth/callback";
+/** Third-party personal-recording API, NOT Plaud Embedded's partner-token API. */
+export const PLAUD_OAUTH = {
+    id: "plaud.oauth2",
+    provider: "plaud",
+    authorization: { url: "https://web.plaud.ai/platform/oauth" },
+    exchange: {
+        url: `${BASE}/oauth/third-party/access-token`,
+        clientAuthentication: "client_id_basic",
+        grantType: null,
+        sendState: true,
+        requirePkce: true,
+    },
+    refresh: {
+        url: `${BASE}/oauth/third-party/access-token/refresh`,
+        clientAuthentication: "none",
+        grantType: null,
+    },
+};
+export const PLAUD_CREDENTIAL = {
+    id: "plaud",
+    methods: {
+        oauth2: {
+            schema: t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false }),
+            authentication: {
+                kind: "oauth2",
+                grantField: "grant",
+                definition: PLAUD_OAUTH,
+                renewal: "refresh",
+            },
+            targets: {
+                api: { baseUrl: `${BASE}/open/third-party/`, methods: ["GET"] },
+            },
+            probe: {
+                target: "api",
+                path: "users/current",
+                method: "GET",
+                acceptedStatuses: [200],
+            },
+        },
+    },
+};
+export function plaudRuntime(ctx) {
+    return credentialRuntime(ctx, PLAUD_CREDENTIAL, "oauth2", (config) => [
+        config.clientId,
+    ]);
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new AuthError("invalid_response");
+    return value;
+}
+export async function request(ctx, path) {
+    const { binding, transport } = plaudRuntime(ctx);
+    const response = await transport.request(binding, { target: "api", path });
+    if (!response.ok)
+        throw new Error(`plaud: request failed (HTTP ${response.status})`);
+    try {
+        return object(await response.json());
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+}
+export async function recording(ctx, id) {
+    // Encoding protects separators/query injection; the transport also rejects traversal.
+    return request(ctx, `files/${encodeURIComponent(id)}`);
+}
+export async function list(ctx, page, pageSize) {
+    const result = await request(ctx, `files/?${new URLSearchParams({ page: String(page), page_size: String(pageSize) })}`);
+    if (!Array.isArray(result.data) || result.data.length > pageSize)
+        throw new AuthError("invalid_response");
+    const data = result.data.map(object);
+    return { ...result, data };
+}
+export function blocks(file, field) {
+    const value = file[field];
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value))
+        throw new AuthError("invalid_response");
+    return value.map(object);
+}
+/** Linked content is a separate, unauthenticated capability approved by host config. */
+export async function blockContent(ctx, block) {
+    if (!block)
+        return { status: "unavailable", content: null };
+    if (typeof block.data_content === "string" && block.data_content.length)
+        return { status: "available", content: block.data_content };
+    const link = block.data_link;
+    if (typeof link !== "string" || !link)
+        return { status: "unavailable", content: null };
+    const origins = ctx.connection.config.contentOrigins ?? [];
+    if (!Array.isArray(origins) ||
+        origins.some((origin) => {
+            if (typeof origin !== "string")
+                return true;
+            try {
+                const url = new URL(origin);
+                return url.protocol !== "https:" || url.origin !== origin;
+            }
+            catch {
+                return true;
+            }
+        }))
+        throw new AuthError("invalid_credentials");
+    let origin;
+    try {
+        const url = new URL(link);
+        if (url.protocol !== "https:" || url.username || url.password || url.hash)
+            throw new Error();
+        origin = url.origin;
+    }
+    catch {
+        throw new AuthError("request_not_allowed");
+    }
+    if (!origins.includes(origin))
+        return {
+            status: "link_requires_approval",
+            content: null,
+            contentUrl: link,
+        };
+    const response = await downloadResource(link, {
+        allowedOrigins: [...origins],
+        fetch: globalThis.fetch,
+        maxResponseBytes: 8 * 1024 * 1024,
+    });
+    if (!response.ok)
+        throw new Error(`plaud: content download failed (HTTP ${response.status})`);
+    const content = await response.text();
+    return {
+        status: content ? "available" : "unavailable",
+        content: content || null,
+    };
+}
+function utcDay(value) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(value))
+        return undefined;
+    const ms = Date.parse(`${value}T00:00:00.000Z`);
+    return Number.isFinite(ms) &&
+        new Date(ms).toISOString().slice(0, 10) === value
+        ? ms
+        : undefined;
+}
+/** Timezone-less timestamps are UTC; invalid calendar days/times are not normalized. */
+function timestamp(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const match = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?)?$/i.exec(value.trim());
+    if (!match)
+        return undefined;
+    const [, day, hour, minute, second = "00", fraction = "", zone = "Z"] = match;
+    const midnight = utcDay(day);
+    if (midnight === undefined || hour === undefined)
+        return midnight;
+    if (Number(hour) > 23 || Number(minute) > 59 || Number(second) > 59)
+        return undefined;
+    const result = Date.parse(`${day}T${hour}:${minute}:${second}${fraction}${zone}`);
+    return Number.isFinite(result) ? result : undefined;
+}
+export function dateBoundary(value, end) {
+    if (value === undefined)
+        return undefined;
+    const ms = utcDay(value);
+    if (ms === undefined)
+        throw new Error("plaud: invalid date; use YYYY-MM-DD");
+    return ms + (end ? 86_400_000 - 1 : 0);
+}
+export async function scan(ctx, options) {
+    if (options.from !== undefined &&
+        options.to !== undefined &&
+        options.from > options.to)
+        throw new Error("plaud: from must not be after to");
+    const recordings = [];
+    const seen = new Set();
+    const query = options.query?.toLowerCase();
+    let scanned = 0;
+    let pagesScanned = 0;
+    for (let page = 1; page <= options.maxPages; page++) {
+        const result = await list(ctx, page, 100);
+        pagesScanned++;
+        for (let index = 0; index < result.data.length; index++) {
+            const file = result.data[index];
+            scanned++;
+            if (typeof file.id !== "string" || !file.id)
+                throw new AuthError("invalid_response");
+            if (seen.has(file.id))
+                continue;
+            seen.add(file.id);
+            if (query &&
+                !(typeof file.name === "string" &&
+                    file.name.toLowerCase().includes(query)))
+                continue;
+            if (options.from !== undefined || options.to !== undefined) {
+                const created = timestamp(file.created_at);
+                if (created === undefined ||
+                    (options.from !== undefined && created < options.from) ||
+                    (options.to !== undefined && created > options.to))
+                    continue;
+            }
+            recordings.push(file);
+            if (recordings.length >= options.limit)
+                return {
+                    recordings,
+                    scanned,
+                    pagesScanned,
+                    truncated: index < result.data.length - 1 || result.data.length === 100,
+                };
+        }
+        if (result.data.length < 100)
+            return { recordings, scanned, pagesScanned, truncated: false };
+    }
+    // Do not claim exhaustive results or assume provider ordering beyond the scanned pages.
+    return { recordings, scanned, pagesScanned, truncated: true };
+}

package/dist/plugins/salesforce/src/shared.js

@@ -1,3 +1,4 @@
+import { requestOAuth2Token } from "runline";
 export const DEFAULT_API_VERSION = "v59.0";
 export function config(ctx) {
     return ctx.connection.config;
@@ -37,40 +38,24 @@ export async function getSession(ctx) {
     const loginUrl = validateInstanceUrl(requireString(c.loginUrl ?? c.instanceUrl, "loginUrl or instanceUrl"));
     const clientId = requireString(c.clientId, "clientId");
     const clientSecret = requireString(c.clientSecret, "clientSecret");
-    const body = new URLSearchParams();
-    body.set("grant_type", "client_credentials");
-    body.set("client_id", clientId);
-    body.set("client_secret", clientSecret);
-    const res = await fetch(`${loginUrl}/services/oauth2/token`, {
-        method: "POST",
-        headers: {
-            Accept: "application/json",
-            "Content-Type": "application/x-www-form-urlencoded",
+    const tokens = await requestOAuth2Token({
+        url: `${loginUrl}/services/oauth2/token`,
+        clientAuthentication: "client_secret_post",
+        response: {
+            metadata: {
+                instanceUrl: "instance_url",
+                id: "id",
+                issuedAt: "issued_at",
+            },
         },
-        body,
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = text ? JSON.parse(text) : {};
-    }
-    catch {
-        data = { raw: text };
-    }
-    if (!res.ok) {
-        const err = typeof data.error === "string" ? data.error : res.status;
-        const description = typeof data.error_description === "string"
-            ? `: ${data.error_description}`
-            : "";
-        throw new Error(`Salesforce token error ${err}${description}`);
-    }
+    }, { grant_type: "client_credentials" }, { clientId, clientSecret });
     return {
-        instanceUrl: validateInstanceUrl(requireString(data.instance_url, "token response instance_url")),
-        accessToken: requireString(data.access_token, "token response access_token"),
-        tokenType: typeof data.token_type === "string" ? data.token_type : "Bearer",
-        scope: typeof data.scope === "string" ? data.scope : undefined,
-        id: typeof data.id === "string" ? data.id : undefined,
-        issuedAt: typeof data.issued_at === "string" ? data.issued_at : undefined,
+        instanceUrl: validateInstanceUrl(requireString(tokens.metadata?.instanceUrl, "token response instance_url")),
+        accessToken: tokens.accessToken,
+        tokenType: tokens.tokenType ?? "Bearer",
+        scope: tokens.scope,
+        id: tokens.metadata?.id,
+        issuedAt: tokens.metadata?.issuedAt,
     };
 }
 export async function api(ctx, method, endpoint, body, qs, session = getSession(ctx)) {

package/dist/sdk.d.ts

@@ -1,9 +1,13 @@
-import { type ActionInvocation, type ExecuteResult } from "./core/engine.js";
+import type { ConnectionProvider } from "./connections/types.js";
+import { type EngineHooks, type ExecuteResult } from "./core/engine.js";
 import type { PluginFunction } from "./plugin/api.js";
 import type { ActionAccess, ConnectionConfig, InputSchema, PluginDef } from "./plugin/types.js";
 export interface RunlineOptions {
     plugins?: Array<PluginDef | PluginFunction>;
+    /** Initial process-local connections. No environment lookup or disk writes. */
     connections?: ConnectionConfig[];
+    /** Host-owned credentials; mutually exclusive with initial connections. */
+    connectionProvider?: ConnectionProvider;
     timeoutMs?: number;
     memoryLimitBytes?: number;
     /**
@@ -19,7 +23,7 @@ export interface RunlineOptions {
      * never breaks a run. Not part of `RunlineConfig` on purpose —
      * config round-trips through JSON (`fromProject`), functions do not.
      */
-    onAction?: (info: ActionInvocation) => void;
+    onAction?: EngineHooks["onAction"];
 }
 export interface RunlineExecuteOptions {
     timeoutMs?: number;
@@ -30,10 +34,11 @@ export interface RunlineExecuteOptions {
 export declare class Runline {
     private _registry;
     private _config;
+    private readonly _connectionProvider;
+    private readonly _memoryConnections?;
     /**
      * One engine per Runline instance, so its pooled worker survives across
-     * `execute()` calls. Constructing an engine per call would spawn (and
-     * leak) a fresh worker every time — the exact bug pooling exists to fix.
+     * `execute()` calls and avoids per-execution thread allocation.
      */
     private _engine;
     private readonly _onAction;
@@ -65,7 +70,10 @@ export declare class Runline {
         actions: string[];
         connectionConfigSchema?: PluginDef["connectionConfigSchema"];
     }>;
-    /** Return all connections currently configured. */
+    /**
+     * Snapshot of process-local connections. Host-managed providers are not
+     * enumerated: their accounts can be caller-scoped and must be listed by the host.
+     */
     connections(): ConnectionConfig[];
     /**
      * Load runline from a project directory.

package/dist/sdk.js

@@ -1,6 +1,9 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { loadConfigFrom } from "./config/loader.js";
 import { DEFAULT_CONFIG } from "./config/types.js";
+import { FileConnectionProvider } from "./connections/file.js";
+import { MemoryConnectionProvider } from "./connections/memory.js";
 import { ExecutionEngine, } from "./core/engine.js";
 import { resolvePluginExport } from "./plugin/api.js";
 import { discoverPlugins } from "./plugin/loader.js";
@@ -8,22 +11,33 @@ import { PluginRegistry } from "./plugin/registry.js";
 export class Runline {
     _registry;
     _config;
+    _connectionProvider;
+    _memoryConnections;
     /**
      * One engine per Runline instance, so its pooled worker survives across
-     * `execute()` calls. Constructing an engine per call would spawn (and
-     * leak) a fresh worker every time — the exact bug pooling exists to fix.
+     * `execute()` calls and avoids per-execution thread allocation.
      */
     _engine = null;
     _onAction;
     constructor(options) {
         this._registry = new PluginRegistry();
         this._onAction = options.onAction;
+        if (options.connectionProvider && options.connections) {
+            throw new Error("Pass connections or connectionProvider, not both");
+        }
+        if (options.connectionProvider) {
+            this._connectionProvider = options.connectionProvider;
+        }
+        else {
+            this._memoryConnections = new MemoryConnectionProvider(options.connections);
+            this._connectionProvider = this._memoryConnections;
+        }
         for (const pluginOrFn of options.plugins ?? []) {
             const plugin = resolvePluginExport(pluginOrFn, "unknown");
             this._registry.register(plugin);
         }
         this._config = {
-            connections: options.connections ?? [],
+            connections: [],
             timeoutMs: options.timeoutMs ?? DEFAULT_CONFIG.timeoutMs,
             memoryLimitBytes: options.memoryLimitBytes ?? DEFAULT_CONFIG.memoryLimitBytes,
             ...(options.maxRunsPerWorker !== undefined
@@ -35,6 +49,7 @@ export class Runline {
         if (!this._engine) {
             this._engine = new ExecutionEngine(this._registry, this._config, {
                 onAction: this._onAction,
+                connectionProvider: this._connectionProvider,
             });
         }
         return this._engine;
@@ -58,15 +73,14 @@ export class Runline {
     /** Register an additional plugin after creation. */
     addPlugin(pluginOrFn, connections) {
         const plugin = resolvePluginExport(pluginOrFn, "unknown");
-        this._registry.register(plugin);
         if (connections) {
-            this._config = {
-                ...this._config,
-                connections: [...this._config.connections, ...connections],
-            };
+            if (!this._memoryConnections) {
+                throw new Error("Configure connections through the host connection provider");
+            }
+            this._memoryConnections.add(connections);
         }
-        // The pooled worker baked in the old plugin surface and the engine holds
-        // the old config object: both are stale now.
+        this._registry.register(plugin);
+        // Rebuild the worker's action surface; connection custody survives disposal.
         this.dispose();
     }
     /** List all available actions across all plugins. */
@@ -88,9 +102,12 @@ export class Runline {
             connectionConfigSchema: p.connectionConfigSchema,
         }));
     }
-    /** Return all connections currently configured. */
+    /**
+     * Snapshot of process-local connections. Host-managed providers are not
+     * enumerated: their accounts can be caller-scoped and must be listed by the host.
+     */
     connections() {
-        return [...this._config.connections];
+        return this._memoryConnections?.list() ?? [];
     }
     /**
      * Load runline from a project directory.
@@ -118,16 +135,17 @@ export class Runline {
         const configDir = findRunlineDir(dir);
         if (!configDir)
             return null;
-        const config = loadConfigFrom(configDir);
+        const config = loadConfigFrom(join(configDir, "config.json"));
         const builtinAllowlist = new Set(config.connections.map((c) => c.plugin));
         const plugins = await discoverPlugins(configDir, {
             builtinAllowlist,
             builtinDir: options.builtinDir,
         });
         const rl = new Runline({
-            connections: config.connections,
+            connectionProvider: new FileConnectionProvider(join(configDir, "config.json")),
             timeoutMs: config.timeoutMs,
             memoryLimitBytes: config.memoryLimitBytes,
+            maxRunsPerWorker: config.maxRunsPerWorker,
         });
         for (const plugin of plugins) {
             rl._registry.register(plugin);
@@ -136,7 +154,7 @@ export class Runline {
     }
 }
 function findRunlineDir(from) {
-    let dir = from;
+    let dir = resolve(from);
     while (true) {
         if (existsSync(join(dir, ".runline")))
             return join(dir, ".runline");
@@ -147,15 +165,3 @@ function findRunlineDir(from) {
     }
     return null;
 }
-function loadConfigFrom(configDir) {
-    const configPath = join(configDir, "config.json");
-    if (!existsSync(configPath))
-        return { ...DEFAULT_CONFIG };
-    try {
-        const raw = JSON.parse(readFileSync(configPath, "utf-8"));
-        return { ...DEFAULT_CONFIG, ...raw };
-    }
-    catch {
-        return { ...DEFAULT_CONFIG };
-    }
-}

package/dist/utils/observer.d.ts

@@ -0,0 +1,2 @@
+/** Observers cannot fail an operation, whether they throw or reject asynchronously. */
+export declare function notifyObserver<T>(observer: ((event: T) => void | Promise<void>) | undefined, event: T): void;

package/dist/utils/observer.js

@@ -0,0 +1,11 @@
+/** Observers cannot fail an operation, whether they throw or reject asynchronously. */
+export function notifyObserver(observer, event) {
+    if (!observer)
+        return;
+    try {
+        void Promise.resolve(observer(event)).catch(() => { });
+    }
+    catch {
+        // Operational success does not depend on observability.
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.28.1",
+  "version": "0.30.0",
   "description": "Code mode for agents \u2014 turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",