runline 0.9.0 → 0.11.0

package/dist/plugins/steel/src/sessions.js

@@ -0,0 +1,119 @@
+import * as t from "typebox";
+import { LIST_INPUT_SCHEMA, SESSION_OPTIONS_SCHEMA, api, apiKey, compactRecord } from "./shared.js";
+export function registerSessionActions(rl) {
+    rl.registerAction("session.create", {
+        description: "Create a Steel browser session. Returns session id, websocketUrl/CDP URL, debug/viewer URLs, and profile metadata when present.",
+        inputSchema: t.Object(SESSION_OPTIONS_SCHEMA),
+        async execute(input, ctx) {
+            return api(ctx, "/v1/sessions", { method: "POST", body: compactRecord((input ?? {})) });
+        },
+    });
+    rl.registerAction("session.list", {
+        description: "List Steel sessions.",
+        inputSchema: t.Object(LIST_INPUT_SCHEMA),
+        async execute(input, ctx) {
+            return api(ctx, "/v1/sessions", { query: (input ?? {}) });
+        },
+    });
+    rl.registerAction("session.get", {
+        description: "Get a Steel session by ID.",
+        inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
+        async execute(input, ctx) {
+            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}`);
+        },
+    });
+    rl.registerAction("session.release", {
+        description: "Release a Steel session when work is done.",
+        inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
+        async execute(input, ctx) {
+            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/release`, { method: "POST" });
+        },
+    });
+    rl.registerAction("session.releaseAll", {
+        description: "Release all live Steel sessions for the organization by listing sessions and releasing each live session individually.",
+        inputSchema: t.Object({}),
+        async execute(_input, ctx) {
+            const listed = await api(ctx, "/v1/sessions");
+            const sessions = Array.isArray(listed.sessions) ? listed.sessions : [];
+            const live = sessions.filter((session) => session.status === "live" || session.status === "LIVE");
+            const released = [];
+            const failed = [];
+            for (const session of live) {
+                const id = String(session.id);
+                try {
+                    released.push({ id, result: await api(ctx, `/v1/sessions/${encodeURIComponent(id)}/release`, { method: "POST" }) });
+                }
+                catch (error) {
+                    failed.push({ id, error: String(error.message ?? error) });
+                }
+            }
+            return { released, failed, count: released.length };
+        },
+    });
+    rl.registerAction("session.context", {
+        description: "Capture cookies/localStorage context from a live session. Treat output as sensitive auth material.",
+        inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
+        async execute(input, ctx) {
+            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/context`);
+        },
+    });
+    rl.registerAction("session.traces", {
+        description: "Fetch the Agent Traces timeline for a Steel session. Supports optional ISO startTime/endTime filters.",
+        inputSchema: t.Object({
+            id: t.String({ description: "Session ID" }),
+            startTime: t.Optional(t.String({ description: "ISO timestamp lower bound" })),
+            endTime: t.Optional(t.String({ description: "ISO timestamp upper bound" })),
+        }),
+        async execute(input, ctx) {
+            const { id, ...query } = input;
+            return api(ctx, `/v1/sessions/${encodeURIComponent(String(id))}/agent-traces`, { query });
+        },
+    });
+    rl.registerAction("session.computer", {
+        description: "Execute a Steel computer-use action against a live session. Useful for model-native computer-use loops; pass actions such as take_screenshot, click_mouse, type_text, press_key, scroll, or drag_mouse.",
+        inputSchema: t.Object({
+            id: t.String({ description: "Session ID" }),
+            action: t.String({ description: "Steel computer action, e.g. take_screenshot, click_mouse, type_text, press_key, scroll, drag_mouse" }),
+            button: t.Optional(t.String({ description: "Mouse button for click actions" })),
+            coordinates: t.Optional(t.Array(t.Number(), { description: "[x, y] pixel coordinates" })),
+            text: t.Optional(t.String({ description: "Text for type_text or key for press_key" })),
+            keys: t.Optional(t.Array(t.String(), { description: "Keys for keyboard actions when supported" })),
+            deltaX: t.Optional(t.Number({ description: "Horizontal scroll delta" })),
+            deltaY: t.Optional(t.Number({ description: "Vertical scroll delta" })),
+            path: t.Optional(t.Array(t.Any(), { description: "Drag path points when supported" })),
+            screenshot: t.Optional(t.Boolean({ description: "Return a screenshot after the action" })),
+        }),
+        async execute(input, ctx) {
+            const { id, deltaX, deltaY, ...body } = input;
+            const payload = compactRecord({ ...body, delta_x: deltaX, delta_y: deltaY });
+            return api(ctx, `/v1/sessions/${encodeURIComponent(String(id))}/computer`, { method: "POST", body: payload });
+        },
+    });
+    rl.registerAction("session.events", {
+        description: "Fetch legacy recorded session events for replay tooling.",
+        inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
+        async execute(input, ctx) {
+            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/events`);
+        },
+    });
+    rl.registerAction("session.hls", {
+        description: "Fetch the HLS playlist for a recorded headful Steel session.",
+        inputSchema: t.Object({ id: t.String({ description: "Session ID" }) }),
+        async execute(input, ctx) {
+            return api(ctx, `/v1/sessions/${encodeURIComponent(input.id)}/hls`);
+        },
+    });
+    rl.registerAction("session.cdpUrl", {
+        description: "Build a Playwright/Puppeteer CDP URL for a Steel session using the configured API key.",
+        inputSchema: t.Object({ id: t.String({ description: "Session ID" }), websocketUrl: t.Optional(t.String({ description: "Optional websocketUrl returned by session.create. If omitted, uses wss://connect.steel.dev with sessionId." })) }),
+        async execute(input, ctx) {
+            const { id, websocketUrl } = input;
+            const key = encodeURIComponent(apiKey(ctx));
+            if (websocketUrl) {
+                const sep = websocketUrl.includes("?") ? "&" : "?";
+                return { cdpUrl: `${websocketUrl}${sep}apiKey=${key}` };
+            }
+            return { cdpUrl: `wss://connect.steel.dev?apiKey=${key}&sessionId=${encodeURIComponent(id)}` };
+        },
+    });
+}

package/dist/plugins/steel/src/shared.js

@@ -0,0 +1,72 @@
+import * as t from "typebox";
+const BASE_URL = "https://api.steel.dev";
+export function apiKey(ctx) {
+    return ctx.connection.config.apiKey;
+}
+export async function api(ctx, path, options = {}) {
+    const url = new URL(path, BASE_URL);
+    for (const [key, value] of Object.entries(options.query ?? {})) {
+        if (value === undefined || value === null || value === "")
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                url.searchParams.append(key, String(item));
+        }
+        else {
+            url.searchParams.set(key, String(value));
+        }
+    }
+    const headers = {
+        "steel-api-key": apiKey(ctx),
+        ...(options.headers ?? {}),
+    };
+    let body;
+    if (options.body !== undefined) {
+        if (options.body instanceof FormData) {
+            body = options.body;
+        }
+        else {
+            headers["Content-Type"] = "application/json";
+            body = JSON.stringify(options.body);
+        }
+    }
+    const res = await fetch(url.toString(), {
+        method: options.method ?? "GET",
+        headers,
+        body,
+    });
+    const text = await res.text();
+    if (!res.ok)
+        throw new Error(`Steel API error ${res.status}: ${text || res.statusText}`);
+    if (!text)
+        return {};
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json") || text.startsWith("{") || text.startsWith("["))
+        return JSON.parse(text);
+    return text;
+}
+export function compactRecord(input) {
+    return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined && value !== null));
+}
+export const LIST_INPUT_SCHEMA = {
+    limit: t.Optional(t.Number({ description: "Maximum number of results when supported" })),
+    cursor: t.Optional(t.String({ description: "Pagination cursor when supported" })),
+};
+export const SESSION_OPTIONS_SCHEMA = {
+    timeout: t.Optional(t.Number({ description: "Session hard timeout in milliseconds" })),
+    inactivityTimeout: t.Optional(t.Number({ description: "Release after this many milliseconds of inactivity" })),
+    useProxy: t.Optional(t.Any({ description: "true for Steel managed proxy, or proxy config object" })),
+    solveCaptcha: t.Optional(t.Boolean({ description: "Enable CAPTCHA detection/solving" })),
+    region: t.Optional(t.String({ description: "Steel region, e.g. lax or iad" })),
+    namespace: t.Optional(t.String({ description: "Credential namespace to use for this session" })),
+    userAgent: t.Optional(t.String({ description: "Custom browser user agent" })),
+    dimensions: t.Optional(t.Any({ description: "Viewport dimensions, e.g. { width: 1280, height: 768 }" })),
+    stealthConfig: t.Optional(t.Any({ description: "Steel stealth configuration, e.g. { autoCaptchaSolving: false }" })),
+    deviceConfig: t.Optional(t.Any({ description: "Device config, e.g. { device: 'mobile' }" })),
+    profileId: t.Optional(t.String({ description: "Profile ID to load" })),
+    persistProfile: t.Optional(t.Boolean({ description: "Persist profile changes on release" })),
+    credentials: t.Optional(t.Any({ description: "Credentials injection options, or {} to enable defaults" })),
+    extensionIds: t.Optional(t.Array(t.String(), { description: "Extension IDs to attach, or ['all_ext']" })),
+    sessionContext: t.Optional(t.Any({ description: "Captured session context to restore" })),
+    isSelenium: t.Optional(t.Boolean({ description: "Provision a Selenium-compatible session" })),
+};

package/dist/tests/helpers/engine-harness.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/helpers/engine-harness.js

@@ -0,0 +1,236 @@
+// Test harness for engine robustness scenarios (large payloads, OOM,
+// timeouts, crashes). Runs one named scenario in this process and prints a
+// JSON report to stdout. Tests spawn this file so that a hard process
+// abort or exit kills the harness, not the test runner.
+//
+// Usage: bun run engine-harness.ts <scenario>
+import { createHash } from "node:crypto";
+import { DEFAULT_CONFIG } from "../../config/types.js";
+import { ExecutionEngine } from "../../core/engine.js";
+import { createPluginAPI } from "../../plugin/api.js";
+import { PluginRegistry } from "../../plugin/registry.js";
+const BLOB_MB = 8;
+// ~8MB of raw bytes → ~10.7MB base64
+const base64 = Buffer.alloc(BLOB_MB * 1024 * 1024, 0xab).toString("base64");
+const base64Sha = createHash("sha256").update(base64).digest("hex");
+// Captures what the host-side actions actually received, so tests can
+// verify that data crossing the execution boundary arrives byte-identical.
+const received = {};
+function makeFilesPlugin() {
+    const { api, resolve } = createPluginAPI("test");
+    api.setName("files");
+    api.setVersion("0.0.0");
+    api.registerAction("getAttachment", {
+        description: "Returns a large base64 payload",
+        async execute() {
+            await new Promise((r) => setTimeout(r, 5));
+            return { filename: "msa.pdf", data: base64 };
+        },
+    });
+    api.registerAction("upload", {
+        description: "Accepts a large base64 payload",
+        async execute(input) {
+            await new Promise((r) => setTimeout(r, 5));
+            const { data } = input;
+            received.uploadSha =
+                typeof data === "string"
+                    ? createHash("sha256").update(data).digest("hex")
+                    : `not-a-string:${typeof data}`;
+            received.uploadBytes = typeof data === "string" ? data.length : -1;
+            return { id: "file_123", bytes: received.uploadBytes };
+        },
+    });
+    api.registerAction("send", {
+        description: "Accepts a large attachment",
+        async execute(input) {
+            await new Promise((r) => setTimeout(r, 5));
+            const { attachment } = input;
+            received.sendBytes =
+                typeof attachment === "string" ? attachment.length : -1;
+            return { messageId: "msg_456", bytes: received.sendBytes };
+        },
+    });
+    api.registerAction("append", {
+        description: "Small side effect",
+        async execute() {
+            await new Promise((r) => setTimeout(r, 5));
+            return { updatedRows: 1 };
+        },
+    });
+    api.registerAction("slow", {
+        description: "Sleeps for the given ms, then returns",
+        async execute(input) {
+            const { ms } = input;
+            await new Promise((r) => setTimeout(r, ms));
+            return { waited: ms };
+        },
+    });
+    api.registerAction("circular", {
+        description: "Returns a non-JSON-serializable (circular) value",
+        async execute() {
+            const obj = { name: "loop" };
+            obj.self = obj;
+            return obj;
+        },
+    });
+    return resolve();
+}
+function makeEngine(memoryMb = 64, timeoutMs = 30_000) {
+    const registry = new PluginRegistry();
+    registry.register(makeFilesPlugin());
+    return new ExecutionEngine(registry, {
+        ...DEFAULT_CONFIG,
+        timeoutMs,
+        memoryLimitBytes: memoryMb * 1024 * 1024,
+    });
+}
+const scenarios = {
+    // The agent's original failure: multi-step chain with a large payload,
+    // default 64MB memory limit. Must complete cleanly.
+    async "chain-default"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      const up = await files.upload({ name: att.filename, data: att.data });
+      const sent = await files.send({ to: "x@y.z", attachment: att.data });
+      const row = await files.append({ values: [["Triple-A MSA", "May"]] });
+      return { up, sent, row };
+    `);
+        return { error: out.error ?? null, result: out.result, received };
+    },
+    // Integrity: the bytes the upload action receives must be byte-identical
+    // to what getAttachment produced.
+    async integrity() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      await files.upload({ name: att.filename, data: att.data });
+      return "done";
+    `);
+        return {
+            error: out.error ?? null,
+            expectedSha: base64Sha,
+            expectedBytes: base64.length,
+            received,
+        };
+    },
+    // Ergonomics: inside the sandbox a large payload is a plain string the
+    // agent can measure, slice, and pass around — no tokens, no proxies.
+    async "string-surface"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      const d = att.data;
+      return { type: typeof d, bytes: d.length, head: d.slice(0, 8) };
+    `);
+        return {
+            error: out.error ?? null,
+            result: out.result,
+            expectedBytes: base64.length,
+            expectedHead: base64.slice(0, 8),
+        };
+    },
+    // A large value in the final return reaches the host caller intact.
+    async "final-result-large"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      return { data: att.data };
+    `);
+        const data = out.result?.data;
+        return {
+            error: out.error ?? null,
+            resultBytes: typeof data === "string" ? data.length : -1,
+            resultSha: typeof data === "string"
+                ? createHash("sha256").update(data).digest("hex")
+                : null,
+            expectedSha: base64Sha,
+            expectedBytes: base64.length,
+        };
+    },
+    // An action still in flight when the run times out must not crash the
+    // host when its result arrives after the worker is gone — no unhandled
+    // rejections, no uncaught exceptions, clean timeout error.
+    async "timeout-inflight-action"() {
+        const unhandled = [];
+        process.on("unhandledRejection", (e) => unhandled.push(String(e)));
+        process.on("uncaughtException", (e) => unhandled.push(String(e)));
+        const engine = makeEngine(64, 150);
+        const out = await engine.execute(`
+      await files.slow({ ms: 1000 });
+      return "unreachable";
+    `);
+        // let the in-flight action resolve against the dead worker
+        await new Promise((r) => setTimeout(r, 1200));
+        return { error: out.error ?? null, unhandled };
+    },
+    // An action returning a non-JSON-serializable value must surface as a
+    // clean per-call error inside the sandbox — catchable by agent code —
+    // not a hang or a crash.
+    async "circular-result"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      try {
+        await files.circular({});
+        return { caught: false };
+      } catch (e) {
+        return { caught: true, message: e.message };
+      }
+    `);
+        return { error: out.error ?? null, result: out.result };
+    },
+    // Two executes on the same engine running concurrently must not
+    // interfere — separate workers, separate logs, correct results.
+    async concurrent() {
+        const engine = makeEngine(64);
+        const [a, b] = await Promise.all([
+            engine.execute(`console.log("run-a"); const r = await files.slow({ ms: 50 }); return { tag: "a", waited: r.waited };`),
+            engine.execute(`console.log("run-b"); const r = await files.slow({ ms: 30 }); return { tag: "b", waited: r.waited };`),
+        ]);
+        return {
+            aError: a.error ?? null,
+            bError: b.error ?? null,
+            aResult: a.result,
+            bResult: b.result,
+            aLogs: a.logs,
+            bLogs: b.logs,
+        };
+    },
+    // Agent code killing its own worker (it has the full runtime, so it can)
+    // must fail soft with a descriptive error and leave the engine usable.
+    async "worker-suicide"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`process.exit(7);`);
+        const after = await engine.execute("return 1 + 1");
+        return {
+            error: out.error ?? null,
+            afterError: after.error ?? null,
+            afterResult: after.result,
+        };
+    },
+    // Sandbox code that genuinely exhausts the memory limit must fail soft:
+    // a clean error returned from execute(), no process abort, and the engine
+    // must remain usable for a subsequent run.
+    async "sandbox-oom"() {
+        const engine = makeEngine(32);
+        const out = await engine.execute(`
+      const hog = [];
+      while (true) hog.push(new Array(1e6).fill(1));
+    `);
+        const after = await engine.execute("return 1 + 1");
+        return {
+            error: out.error ?? null,
+            afterError: after.error ?? null,
+            afterResult: after.result,
+        };
+    },
+};
+const name = process.argv[2];
+const scenario = scenarios[name];
+if (!scenario) {
+    console.error(`Unknown scenario: ${name}`);
+    process.exit(2);
+}
+const report = await scenario();
+console.log(JSON.stringify(report));
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Code mode for agents — turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",
@@ -62,12 +62,19 @@
     "minisearch": "^7.2.0",
     "typescript": "^5.8.0"
   },
+  "peerDependencies": {
+    "playwright": "^1.57.0"
+  },
+  "peerDependenciesMeta": {
+    "playwright": {
+      "optional": true
+    }
+  },
   "dependencies": {
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "jiti": "^2.7.0",
     "proper-lockfile": "^4.1.2",
-    "quickjs-emscripten": "^0.32.0",
     "rrule": "^2.8.1",
     "typebox": "^1.1.35"
   }