runline 0.34.0 → 0.35.0

package/dist/plugins/microsoftCalendar/src/index.js

@@ -1,4 +1,4 @@
-import { graphRequest, microsoftCredential, microsoftSetupHelp, userBase, } from "../../_shared/microsoftAuth.js";
+import { graphRequest, microsoftCredential, microsoftOAuth, userBase, } from "../../_shared/microsoftAuth.js";
 const NAME = "microsoftCalendar";
 const SCOPES = ["https://graph.microsoft.com/Calendars.Read"];
 export default function microsoftCalendar(rl) {
@@ -42,12 +42,7 @@ export default function microsoftCalendar(rl) {
             description: "App-only only: target user UPN",
         },
     });
-    rl.setOAuth({
-        authUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
-        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        scopes: [...SCOPES, "offline_access"],
-        setupHelp: microsoftSetupHelp("Calendars.Read"),
-    });
+    rl.setOAuth(microsoftOAuth(SCOPES, "Calendars.Read"));
     rl.registerAction("calendar.list", {
         access: "read",
         description: "List calendar events in a date range. Returns [{id,subject,start,end,location,organizer,attendees}].",

package/dist/plugins/microsoftFiles/src/index.js

@@ -1,5 +1,6 @@
+import { standardBase64 } from "../../_shared/base64.js";
 import { jsonAnswer, pathSegment, pathSegments, requestFailed, } from "../../_shared/credentials.js";
-import { graphRequest, graphResponse, microsoftCredential, microsoftDownload, microsoftDriveBase, microsoftSetupHelp, } from "../../_shared/microsoftAuth.js";
+import { graphRequest, graphResponse, microsoftCredential, microsoftDownload, microsoftDriveBase, microsoftOAuth, } from "../../_shared/microsoftAuth.js";
 const NAME = "microsoftFiles";
 const SCOPES = [
     "https://graph.microsoft.com/Files.ReadWrite.All",
@@ -65,12 +66,7 @@ export default function microsoftFiles(rl) {
             description: "Optional explicit drive id (overrides site/user)",
         },
     });
-    rl.setOAuth({
-        authUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
-        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        scopes: [...SCOPES, "offline_access"],
-        setupHelp: microsoftSetupHelp("Files.ReadWrite.All, Sites.ReadWrite.All"),
-    });
+    rl.setOAuth(microsoftOAuth(SCOPES, "Files.ReadWrite.All, Sites.ReadWrite.All"));
     rl.registerAction("files.search", {
         access: "read",
         description: "Search the drive for files/folders by text. Returns [{id,name,size,lastModifiedDateTime,webUrl,folder?}].",
@@ -150,7 +146,10 @@ export default function microsoftFiles(rl) {
         },
         async execute(input, ctx) {
             const { path, base64 } = input;
-            const bytes = Buffer.from(base64, "base64");
+            const content = standardBase64(base64);
+            if (content === undefined)
+                throw new Error(`${NAME}: base64 is not valid base64`);
+            const bytes = Buffer.from(content, "base64");
             const res = await binaryFetch(ctx, "PUT", `${driveBase(ctx)}/root:/${pathSegments(path)}:/content`, bytes);
             if (!res.ok)
                 throw requestFailed(NAME, res.status);

package/dist/plugins/microsoftMail/src/index.js

@@ -1,4 +1,4 @@
-import { graphRequest, microsoftCredential, microsoftSetupHelp, userBase, } from "../../_shared/microsoftAuth.js";
+import { graphRequest, microsoftCredential, microsoftOAuth, userBase, } from "../../_shared/microsoftAuth.js";
 const NAME = "microsoftMail";
 const SCOPES = [
     "https://graph.microsoft.com/Mail.Send",
@@ -60,12 +60,7 @@ export default function microsoftMail(rl) {
             description: "App-only only: target mailbox UPN (e.g. agent@contoso.com)",
         },
     });
-    rl.setOAuth({
-        authUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
-        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        scopes: [...SCOPES, "offline_access"],
-        setupHelp: microsoftSetupHelp("Mail.Send, Mail.ReadWrite, Mail.Read"),
-    });
+    rl.setOAuth(microsoftOAuth(SCOPES, "Mail.Send, Mail.ReadWrite, Mail.Read"));
     rl.registerAction("mail.send", {
         access: "write",
         description: "Send an email as the connected mailbox. Returns {success}. Get user approval before sending external mail.",

package/dist/plugins/openai/src/index.js

@@ -218,7 +218,7 @@ export default function openai(rl) {
             if (p.quality)
                 form.append("quality", p.quality);
             for (const path of paths) {
-                const img = readImageInput(path, "openai");
+                const img = await readImageInput(path, "openai");
                 form.append("image[]", new Blob([img.bytes], { type: img.mimeType }), img.fileName);
             }
             const { body: formBytes, contentType } = await multipartBody(form);

package/dist/plugins/recraft/src/index.js

@@ -154,7 +154,7 @@ export default function recraft(rl) {
             if (typeof p.prompt !== "string" || p.prompt.length === 0) {
                 throw new Error("recraft: prompt is required");
             }
-            const img = readImageInput(p.imagePath, "recraft");
+            const img = await readImageInput(p.imagePath, "recraft");
             const form = new FormData();
             form.append("image", new Blob([img.bytes], { type: img.mimeType }), img.fileName);
             form.append("prompt", p.prompt);

package/dist/plugins/replicate/src/index.js

@@ -224,7 +224,7 @@ export default function replicate(rl) {
             if (typeof p.prompt !== "string" || p.prompt.length === 0) {
                 throw new Error("replicate: prompt is required");
             }
-            const img = readImageInput(p.imagePath, "replicate");
+            const img = await readImageInput(p.imagePath, "replicate");
             const model = p.model ?? "black-forest-labs/flux-kontext-pro";
             const imageKey = p.imageInputKey ?? "input_image";
             const { images, failures } = await runPrediction({

package/dist/plugins/shiftObjects/src/objects.js

@@ -84,7 +84,7 @@ export function registerObjectActions(rl) {
                     metadata: fields.metadata,
                 }),
             });
-            await putThroughGrant(created.upload, fields.path, contentType, sizeBytes, "Object upload");
+            await putThroughGrant(created.upload, fields.path, contentType, "Object upload");
             return request(ctx, `${OBJECTS_BASE}/objects/${pathSegment(created.object.id)}/complete`, { method: "POST" });
         },
     });

package/dist/plugins/shiftOcr/src/index.js

@@ -1,6 +1,6 @@
-import { readFile } from "node:fs/promises";
 import { basename, extname } from "node:path";
 import * as t from "typebox";
+import { readLocalFile } from "../../_shared/localFile.js";
 import { pathSegment, STRICT_OBJECT, } from "../../_shared/shiftCloud.js";
 import { putThroughGrant, SIGNED_UPLOAD_MAX_BYTES, statUploadFile, } from "../../_shared/shiftUpload.js";
 import { request, shiftOcrCredential } from "./credentials.js";
@@ -44,7 +44,12 @@ async function documentFromPath(ctx, path) {
     const mediaType = (imageType ?? documentType);
     const sizeBytes = await statUploadFile(path, SIGNED_UPLOAD_MAX_BYTES);
     if (sizeBytes <= MAX_INLINE_BYTES) {
-        const url = `data:${mediaType};base64,${(await readFile(path)).toString("base64")}`;
+        const bytes = await readLocalFile(path, {
+            subject: "File",
+            maxBytes: MAX_INLINE_BYTES,
+            oversize: "File grew past the inline limit while reading; retry",
+        });
+        const url = `data:${mediaType};base64,${bytes.toString("base64")}`;
         return imageType
             ? { type: "image", url }
             : { type: "document", url, name: basename(path) };
@@ -59,7 +64,7 @@ async function documentFromPath(ctx, path) {
             filename: basename(path),
         }),
     });
-    await putThroughGrant(created.upload, path, mediaType, sizeBytes);
+    await putThroughGrant(created.upload, path, mediaType);
     await request(ctx, `/v1/services/objects/objects/${pathSegment(created.object.id)}/complete`, { method: "POST" });
     return { type: "object", objectId: created.object.id };
 }

package/dist/plugins/shiftTranscription/src/transcription.js

@@ -48,7 +48,7 @@ export function registerTranscriptionActions(rl) {
                     sizeBytes,
                 }),
             });
-            await putThroughGrant(created.upload, fields.path, contentType, sizeBytes, "Media upload");
+            await putThroughGrant(created.upload, fields.path, contentType, "Media upload");
             await request(ctx, `/v1/services/transcription/assets/${pathSegment(created.asset.id)}/complete`, { method: "POST" });
             const job = await request(ctx, "/v1/services/transcription/jobs", {
                 method: "POST",

package/dist/plugins/together/src/index.js

@@ -139,7 +139,7 @@ export default function together(rl) {
             if (typeof p.prompt !== "string" || p.prompt.length === 0) {
                 throw new Error("together: prompt is required");
             }
-            const img = readImageInput(p.imagePath, "together");
+            const img = await readImageInput(p.imagePath, "together");
             const model = p.model ?? "black-forest-labs/FLUX.1-kontext-pro";
             const data = await generate(ctx, {
                 model,

package/dist/plugins/xai/src/index.js

@@ -119,7 +119,7 @@ export default function xai(rl) {
             if (typeof p.prompt !== "string" || p.prompt.length === 0) {
                 throw new Error("xai: prompt is required");
             }
-            const img = readImageInput(p.imagePath, "xai");
+            const img = await readImageInput(p.imagePath, "xai");
             const model = p.model ?? EDIT_MODEL;
             const data = (await credentialJson(ctx, xaiCredential, "xai", {
                 target: "api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Code mode for agents \u2014 turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",
@@ -32,6 +32,7 @@
     "prepublishOnly": "bun run build",
     "dev": "bun run src/main.ts",
     "test": "bun test src/tests",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.test.json",
     "format": "bunx @biomejs/biome format --write src/",
     "lint": "bunx @biomejs/biome lint src/",
     "check": "bunx @biomejs/biome check src/"

package/dist/tests/helpers/engine-harness.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/tests/helpers/engine-harness.js

@@ -1,236 +0,0 @@
-// Test harness for engine robustness scenarios (large payloads, OOM,
-// timeouts, crashes). Runs one named scenario in this process and prints a
-// JSON report to stdout. Tests spawn this file so that a hard process
-// abort or exit kills the harness, not the test runner.
-//
-// Usage: bun run engine-harness.ts <scenario>
-import { createHash } from "node:crypto";
-import { DEFAULT_CONFIG } from "../../config/types.js";
-import { ExecutionEngine } from "../../core/engine.js";
-import { createPluginAPI } from "../../plugin/api.js";
-import { PluginRegistry } from "../../plugin/registry.js";
-const BLOB_MB = 8;
-// ~8MB of raw bytes → ~10.7MB base64
-const base64 = Buffer.alloc(BLOB_MB * 1024 * 1024, 0xab).toString("base64");
-const base64Sha = createHash("sha256").update(base64).digest("hex");
-// Captures what the host-side actions actually received, so tests can
-// verify that data crossing the execution boundary arrives byte-identical.
-const received = {};
-function makeFilesPlugin() {
-    const { api, resolve } = createPluginAPI("test");
-    api.setName("files");
-    api.setVersion("0.0.0");
-    api.registerAction("getAttachment", {
-        description: "Returns a large base64 payload",
-        async execute() {
-            await new Promise((r) => setTimeout(r, 5));
-            return { filename: "msa.pdf", data: base64 };
-        },
-    });
-    api.registerAction("upload", {
-        description: "Accepts a large base64 payload",
-        async execute(input) {
-            await new Promise((r) => setTimeout(r, 5));
-            const { data } = input;
-            received.uploadSha =
-                typeof data === "string"
-                    ? createHash("sha256").update(data).digest("hex")
-                    : `not-a-string:${typeof data}`;
-            received.uploadBytes = typeof data === "string" ? data.length : -1;
-            return { id: "file_123", bytes: received.uploadBytes };
-        },
-    });
-    api.registerAction("send", {
-        description: "Accepts a large attachment",
-        async execute(input) {
-            await new Promise((r) => setTimeout(r, 5));
-            const { attachment } = input;
-            received.sendBytes =
-                typeof attachment === "string" ? attachment.length : -1;
-            return { messageId: "msg_456", bytes: received.sendBytes };
-        },
-    });
-    api.registerAction("append", {
-        description: "Small side effect",
-        async execute() {
-            await new Promise((r) => setTimeout(r, 5));
-            return { updatedRows: 1 };
-        },
-    });
-    api.registerAction("slow", {
-        description: "Sleeps for the given ms, then returns",
-        async execute(input) {
-            const { ms } = input;
-            await new Promise((r) => setTimeout(r, ms));
-            return { waited: ms };
-        },
-    });
-    api.registerAction("circular", {
-        description: "Returns a non-JSON-serializable (circular) value",
-        async execute() {
-            const obj = { name: "loop" };
-            obj.self = obj;
-            return obj;
-        },
-    });
-    return resolve();
-}
-function makeEngine(memoryMb = 64, timeoutMs = 30_000) {
-    const registry = new PluginRegistry();
-    registry.register(makeFilesPlugin());
-    return new ExecutionEngine(registry, {
-        ...DEFAULT_CONFIG,
-        timeoutMs,
-        memoryLimitBytes: memoryMb * 1024 * 1024,
-    });
-}
-const scenarios = {
-    // The agent's original failure: multi-step chain with a large payload,
-    // default 64MB memory limit. Must complete cleanly.
-    async "chain-default"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      const up = await files.upload({ name: att.filename, data: att.data });
-      const sent = await files.send({ to: "x@y.z", attachment: att.data });
-      const row = await files.append({ values: [["Triple-A MSA", "May"]] });
-      return { up, sent, row };
-    `);
-        return { error: out.error ?? null, result: out.result, received };
-    },
-    // Integrity: the bytes the upload action receives must be byte-identical
-    // to what getAttachment produced.
-    async integrity() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      await files.upload({ name: att.filename, data: att.data });
-      return "done";
-    `);
-        return {
-            error: out.error ?? null,
-            expectedSha: base64Sha,
-            expectedBytes: base64.length,
-            received,
-        };
-    },
-    // Ergonomics: inside the sandbox a large payload is a plain string the
-    // agent can measure, slice, and pass around — no tokens, no proxies.
-    async "string-surface"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      const d = att.data;
-      return { type: typeof d, bytes: d.length, head: d.slice(0, 8) };
-    `);
-        return {
-            error: out.error ?? null,
-            result: out.result,
-            expectedBytes: base64.length,
-            expectedHead: base64.slice(0, 8),
-        };
-    },
-    // A large value in the final return reaches the host caller intact.
-    async "final-result-large"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      return { data: att.data };
-    `);
-        const data = out.result?.data;
-        return {
-            error: out.error ?? null,
-            resultBytes: typeof data === "string" ? data.length : -1,
-            resultSha: typeof data === "string"
-                ? createHash("sha256").update(data).digest("hex")
-                : null,
-            expectedSha: base64Sha,
-            expectedBytes: base64.length,
-        };
-    },
-    // An action still in flight when the run times out must not crash the
-    // host when its result arrives after the worker is gone — no unhandled
-    // rejections, no uncaught exceptions, clean timeout error.
-    async "timeout-inflight-action"() {
-        const unhandled = [];
-        process.on("unhandledRejection", (e) => unhandled.push(String(e)));
-        process.on("uncaughtException", (e) => unhandled.push(String(e)));
-        const engine = makeEngine(64, 150);
-        const out = await engine.execute(`
-      await files.slow({ ms: 1000 });
-      return "unreachable";
-    `);
-        // let the in-flight action resolve against the dead worker
-        await new Promise((r) => setTimeout(r, 1200));
-        return { error: out.error ?? null, unhandled };
-    },
-    // An action returning a non-JSON-serializable value must surface as a
-    // clean per-call error inside the sandbox — catchable by agent code —
-    // not a hang or a crash.
-    async "circular-result"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      try {
-        await files.circular({});
-        return { caught: false };
-      } catch (e) {
-        return { caught: true, message: e.message };
-      }
-    `);
-        return { error: out.error ?? null, result: out.result };
-    },
-    // Two executes on the same engine running concurrently must not
-    // interfere — separate workers, separate logs, correct results.
-    async concurrent() {
-        const engine = makeEngine(64);
-        const [a, b] = await Promise.all([
-            engine.execute(`console.log("run-a"); const r = await files.slow({ ms: 50 }); return { tag: "a", waited: r.waited };`),
-            engine.execute(`console.log("run-b"); const r = await files.slow({ ms: 30 }); return { tag: "b", waited: r.waited };`),
-        ]);
-        return {
-            aError: a.error ?? null,
-            bError: b.error ?? null,
-            aResult: a.result,
-            bResult: b.result,
-            aLogs: a.logs,
-            bLogs: b.logs,
-        };
-    },
-    // Agent code killing its own worker (it has the full runtime, so it can)
-    // must fail soft with a descriptive error and leave the engine usable.
-    async "worker-suicide"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`process.exit(7);`);
-        const after = await engine.execute("return 1 + 1");
-        return {
-            error: out.error ?? null,
-            afterError: after.error ?? null,
-            afterResult: after.result,
-        };
-    },
-    // Sandbox code that genuinely exhausts the memory limit must fail soft:
-    // a clean error returned from execute(), no process abort, and the engine
-    // must remain usable for a subsequent run.
-    async "sandbox-oom"() {
-        const engine = makeEngine(32);
-        const out = await engine.execute(`
-      const hog = [];
-      while (true) hog.push(new Array(1e6).fill(1));
-    `);
-        const after = await engine.execute("return 1 + 1");
-        return {
-            error: out.error ?? null,
-            afterError: after.error ?? null,
-            afterResult: after.result,
-        };
-    },
-};
-const name = process.argv[2];
-const scenario = scenarios[name];
-if (!scenario) {
-    console.error(`Unknown scenario: ${name}`);
-    process.exit(2);
-}
-const report = await scenario();
-console.log(JSON.stringify(report));
-process.exit(0);