veryfront 0.1.74 → 0.1.76

package/src/src/server/handlers/request/internal-tasks-list.handler.ts

@@ -0,0 +1,103 @@
+import * as dntShim from "../../../../_dnt.shims.js";
+import { PRIORITY_MEDIUM_API } from "../../../utils/constants/index.js";
+import { ZodError } from "zod";
+import {
+  type ControlPlaneTasksListRequest,
+  ControlPlaneTasksListRequestSchema,
+  defaultRuntimeTaskDiscoveryDeps,
+  listRuntimeTasks,
+  type RuntimeTaskDiscoveryDeps,
+} from "../../../task/control-plane.js";
+import {
+  ControlPlaneRequestError,
+  verifyControlPlaneRequest,
+} from "../../../internal-agents/control-plane-auth.js";
+import {
+  INTERNAL_AGENT_CONTROL_PLANE_MAX_BODY_BYTES,
+  InternalAgentRequestBodyTooLargeError,
+  readInternalAgentRequestBody,
+} from "../../../internal-agents/request-body.js";
+import { BaseHandler } from "../response/base.js";
+import type { HandlerContext, HandlerMetadata, HandlerPriority, HandlerResult } from "../types.js";
+
+export class InternalTasksListHandler extends BaseHandler {
+  metadata: HandlerMetadata = {
+    name: "InternalTasksListHandler",
+    priority: PRIORITY_MEDIUM_API as HandlerPriority,
+    patterns: [{ pattern: "/internal/tasks/list", exact: true, method: "POST" }],
+  };
+
+  constructor(
+    private readonly deps: RuntimeTaskDiscoveryDeps = defaultRuntimeTaskDiscoveryDeps,
+  ) {
+    super();
+  }
+
+  async handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult> {
+    if (!this.shouldHandle(req, ctx)) {
+      return this.continue();
+    }
+
+    return this.withProxyContext(ctx, async () => {
+      const builder = this.createResponseBuilder(ctx)
+        .withCORS(req, ctx.securityConfig?.cors)
+        .withSecurity(ctx.securityConfig ?? undefined, req);
+
+      try {
+        const rawBody = await readInternalAgentRequestBody(
+          req,
+          INTERNAL_AGENT_CONTROL_PLANE_MAX_BODY_BYTES,
+        );
+        const payload: ControlPlaneTasksListRequest = ControlPlaneTasksListRequestSchema.parse(
+          JSON.parse(rawBody),
+        );
+        const claims = await verifyControlPlaneRequest(req, ctx, rawBody, {
+          expectedSubject: payload.requestId,
+          expectedSurface: payload.surface,
+        });
+
+        if (
+          payload.projectId !== claims.project_id ||
+          (ctx.projectId !== undefined && payload.projectId !== ctx.projectId)
+        ) {
+          this.logWarn("Internal tasks list request body did not match signed claims", {
+            projectSlug: ctx.projectSlug,
+            projectId: ctx.projectId,
+            requestId: payload.requestId,
+            signedRequestId: claims.sub,
+            surface: payload.surface,
+            signedSurface: claims.surface,
+          });
+          return this.respond(builder.json({ error: "Invalid control-plane signature" }, 401));
+        }
+
+        const response = await listRuntimeTasks(ctx, this.deps);
+        return this.respond(builder.json(response, 200));
+      } catch (error) {
+        if (error instanceof InternalAgentRequestBodyTooLargeError) {
+          return this.respond(builder.json({ error: error.message }, error.status));
+        }
+
+        if (error instanceof ControlPlaneRequestError) {
+          this.logWarn("Internal tasks list signature verification failed", {
+            error: error.message,
+            projectSlug: ctx.projectSlug,
+            projectId: ctx.projectId,
+          });
+          return this.respond(builder.json({ error: error.message }, error.status));
+        }
+
+        if (error instanceof SyntaxError || error instanceof ZodError) {
+          this.logWarn("Internal tasks list request validation failed", {
+            error: error instanceof Error ? error.message : String(error),
+            projectSlug: ctx.projectSlug,
+            projectId: ctx.projectId,
+          });
+          return this.respond(builder.json({ error: "Invalid internal tasks request" }, 400));
+        }
+
+        throw error;
+      }
+    });
+  }
+}

package/src/src/server/project-env/storage.ts

@@ -38,6 +38,15 @@ export function isProjectEnvActive(): boolean {
   return projectEnvStorage.getStore() !== undefined;
 }
 
+/**
+ * Get a snapshot of the current project env overlay.
+ * Returns undefined if no overlay is active.
+ * Used to forward env vars to isolated workers in proxy mode.
+ */
+export function getProjectEnvSnapshot(): Record<string, string> | undefined {
+  return projectEnvStorage.getStore();
+}
+
 // Register on globalThis so process.ts can access without circular imports.
 // process.ts is low-level (platform/compat), project-env is high-level (server/).
 (dntShim.dntGlobalThis as Record<string, unknown>).__vfProjectEnvGetter = getProjectEnv;

package/src/src/server/runtime-handler/index.ts

@@ -55,6 +55,7 @@ import { MarkdownPreviewHandler } from "../handlers/preview/markdown-preview.han
 import { OpenAPIHandler } from "../handlers/request/openapi.handler.js";
 import { OpenAPIDocsHandler } from "../handlers/request/openapi-docs.handler.js";
 import { InternalAgentsListHandler } from "../handlers/request/internal-agents-list.handler.js";
+import { InternalTasksListHandler } from "../handlers/request/internal-tasks-list.handler.js";
 import { AgentStreamHandler } from "../handlers/request/agent-stream.handler.js";
 import { AgentRunResumeHandler } from "../handlers/request/agent-run-resume.handler.js";
 import { AgentRunCancelHandler } from "../handlers/request/agent-run-cancel.handler.js";
@@ -131,6 +132,7 @@ export const HANDLER_NAMES = [
   "OpenAPIHandler",
   "OpenAPIDocsHandler",
   "InternalAgentsListHandler",
+  "InternalTasksListHandler",
   "AgentStreamHandler",
   "AgentRunResumeHandler",
   "AgentRunCancelHandler",
@@ -185,6 +187,7 @@ const handlerFactories: Record<
   OpenAPIHandler: () => new OpenAPIHandler(),
   OpenAPIDocsHandler: () => new OpenAPIDocsHandler(),
   InternalAgentsListHandler: () => new InternalAgentsListHandler(),
+  InternalTasksListHandler: () => new InternalTasksListHandler(),
   AgentStreamHandler: () => new AgentStreamHandler(),
   AgentRunResumeHandler: () => new AgentRunResumeHandler(),
   AgentRunCancelHandler: () => new AgentRunCancelHandler(),

package/src/src/server/runtime-handler/project-isolation.ts

@@ -1,6 +1,10 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { serverLogger } from "../../utils/index.js";
 import { getEnvNumber, unrefTimer } from "../../platform/compat/process.js";
+import {
+  getWorkerPool,
+  isWorkerIsolationEnabled,
+} from "../../security/sandbox/worker-pool.js";
 
 const logger = serverLogger.component("project-isolation");
 
@@ -156,6 +160,46 @@ export class ProjectIsolationManager {
     });
   }
 
+  /**
+   * Record a worker crash for a project. This counts as a failure
+   * toward the circuit breaker threshold and evicts the worker.
+   */
+  recordWorkerCrash(projectSlug: string | undefined): void {
+    if (!projectSlug) return;
+
+    const state = this.getOrCreateState(projectSlug);
+    const now = Date.now();
+    state.failures.push(now);
+
+    state.failures = state.failures.filter(
+      (t) => now - t < this.config.failureWindowMs,
+    );
+
+    logger.warn("Worker crash recorded", {
+      projectSlug,
+      recentFailures: state.failures.length,
+    });
+
+    // Evict the crashed worker from the pool
+    if (isWorkerIsolationEnabled()) {
+      try {
+        getWorkerPool().evictWorker(projectSlug);
+      } catch {
+        // Pool may not be initialized
+      }
+    }
+
+    if (state.failures.length < this.config.circuitBreakerThreshold) return;
+
+    state.circuitOpenedAt = now;
+    logger.error("Circuit opened due to worker crashes", {
+      projectSlug,
+      recentFailures: state.failures.length,
+      threshold: this.config.circuitBreakerThreshold,
+      resetAfterMs: this.config.circuitResetTimeMs,
+    });
+  }
+
   getStats(): Record<
     string,
     {
@@ -193,6 +237,15 @@ export class ProjectIsolationManager {
   shutdown(): void {
     if (this.cleanupInterval) clearInterval(this.cleanupInterval);
     this.projects.clear();
+
+    // Shut down the worker pool if isolation is enabled
+    if (isWorkerIsolationEnabled()) {
+      try {
+        getWorkerPool().shutdown();
+      } catch {
+        // Pool may not be initialized
+      }
+    }
   }
 }
 

package/src/src/server/shared/renderer/memory/pressure.ts

@@ -59,3 +59,11 @@ export function shouldRejectDueToMemory(): boolean {
   rendererLog.warn("Rejecting request - memory critical", { heapUsedPercent });
   return true;
 }
+
+/**
+ * Get current memory pressure level for use by the worker pool
+ * to decide whether to evict idle workers.
+ */
+export function getMemoryPressureLevel(): MemoryPressureLevel {
+  return getMemoryPressure().level;
+}

package/src/src/task/control-plane.ts

@@ -0,0 +1,76 @@
+import { ControlPlaneSurfaceSchema } from "../channels/control-plane.js";
+import type { HandlerContext } from "../types/index.js";
+import { z } from "zod";
+import { discoverTasks, type TaskDiscoveryOptions } from "./discovery.js";
+
+export const ControlPlaneTasksListRequestSchema = z.object({
+  requestId: z.string().min(1),
+  projectId: z.string().min(1),
+  surface: ControlPlaneSurfaceSchema,
+});
+
+const JsonSchemaRecordSchema = z.record(z.unknown());
+
+export const RuntimeTaskSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().nullable(),
+  target: z.string().min(1),
+  sourcePath: z.string().min(1),
+  inputSchema: JsonSchemaRecordSchema.nullable(),
+  outputSchema: JsonSchemaRecordSchema.nullable(),
+  schedulable: z.boolean(),
+});
+
+export const RuntimeTaskListResponseSchema = z.object({
+  tasks: z.array(RuntimeTaskSchema),
+});
+
+export type ControlPlaneTasksListRequest = z.infer<typeof ControlPlaneTasksListRequestSchema>;
+export type RuntimeTask = z.infer<typeof RuntimeTaskSchema>;
+export type RuntimeTaskListResponse = z.infer<typeof RuntimeTaskListResponseSchema>;
+
+export interface RuntimeTaskDiscoveryDeps {
+  discoverTasks: (options: TaskDiscoveryOptions) => ReturnType<typeof discoverTasks>;
+}
+
+export const defaultRuntimeTaskDiscoveryDeps: RuntimeTaskDiscoveryDeps = {
+  discoverTasks,
+};
+
+function normalizeJsonSchema(value: unknown): Record<string, unknown> | null {
+  if (value == null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+
+  return value as Record<string, unknown>;
+}
+
+export async function listRuntimeTasks(
+  ctx: HandlerContext,
+  deps: RuntimeTaskDiscoveryDeps = defaultRuntimeTaskDiscoveryDeps,
+): Promise<RuntimeTaskListResponse> {
+  const discovery = await deps.discoverTasks({
+    projectDir: ctx.projectDir,
+    adapter: ctx.adapter,
+    config: ctx.config,
+    debug: ctx.debug ?? false,
+  });
+
+  const tasks = discovery.tasks
+    .map((task) =>
+      RuntimeTaskSchema.parse({
+        id: task.id,
+        name: task.name,
+        description: task.definition.description ?? null,
+        target: `task:${task.id}`,
+        sourcePath: task.filePath,
+        inputSchema: normalizeJsonSchema(task.definition.inputSchema),
+        outputSchema: normalizeJsonSchema(task.definition.outputSchema),
+        schedulable: task.definition.schedulable ?? true,
+      })
+    )
+    .sort((left, right) => left.name.localeCompare(right.name));
+
+  return RuntimeTaskListResponseSchema.parse({ tasks });
+}

package/src/src/task/types.ts

@@ -26,6 +26,12 @@ export interface TaskDefinition {
   name?: string;
   /** Task description */
   description?: string;
+  /** Optional JSON-schema-like input contract surfaced in APIs/UIs */
+  inputSchema?: Record<string, unknown>;
+  /** Optional JSON-schema-like output contract surfaced in APIs/UIs */
+  outputSchema?: Record<string, unknown>;
+  /** Whether this task can be scheduled via cron jobs */
+  schedulable?: boolean;
   /** The function to execute */
   run: (ctx: TaskContext) => Promise<unknown> | unknown;
 }

package/src/src/transforms/pipeline/stages/ssr-vf-modules/path-resolver.ts

@@ -20,6 +20,7 @@ import {
 export async function tryReadWithExtensions(
   fs: ReturnType<typeof createFileSystem>,
   basePath: string,
+  existsFn: (path: string) => Promise<boolean> = exists,
 ): Promise<{ sourcePath: string; content: string } | null> {
   // Try all extensions, including .src versions for embedded sources
   const allExtensions = [
@@ -30,7 +31,7 @@ export async function tryReadWithExtensions(
   for (const ext of allExtensions) {
     const sourcePath = basePath + ext;
     try {
-      if (await exists(sourcePath)) {
+      if (await existsFn(sourcePath)) {
         const content = await fs.readTextFile(sourcePath);
         return { sourcePath, content };
       }
@@ -47,6 +48,7 @@ export async function tryReadWithExtensions(
 export async function resolveFrameworkFile(
   vfModulePath: string,
   fs: ReturnType<typeof createFileSystem>,
+  existsFn: (path: string) => Promise<boolean> = exists,
 ): Promise<{ sourcePath: string; content: string } | null> {
   const pathWithoutPrefix = vfModulePath
     .replace(/^\/_vf_modules\//, "")
@@ -78,7 +80,7 @@ export async function resolveFrameworkFile(
       fullPath: pathWithPrefixDir,
     });
 
-    const withPrefix = await tryReadWithExtensions(fs, pathWithPrefixDir);
+    const withPrefix = await tryReadWithExtensions(fs, pathWithPrefixDir, existsFn);
     if (withPrefix) {
       logger.debug(`${LOG_PREFIX} Found with prefix`, { sourcePath: withPrefix.sourcePath });
       return withPrefix;
@@ -93,7 +95,7 @@ export async function resolveFrameworkFile(
       fullPath: pathWithoutPrefixDir,
     });
 
-    const withoutPrefix = await tryReadWithExtensions(fs, pathWithoutPrefixDir);
+    const withoutPrefix = await tryReadWithExtensions(fs, pathWithoutPrefixDir, existsFn);
     if (withoutPrefix) {
       logger.debug(`${LOG_PREFIX} Found without prefix`, { sourcePath: withoutPrefix.sourcePath });
       return withoutPrefix;
@@ -118,7 +120,10 @@ export async function resolveFrameworkFile(
  * then falls back to regular src/. This matches resolveFrameworkFile's behavior
  * and ensures consistent path resolution for cycle detection.
  */
-export async function resolveVeryfrontSourcePath(specifier: string): Promise<string | null> {
+export async function resolveVeryfrontSourcePath(
+  specifier: string,
+  existsFn: (path: string) => Promise<boolean> = exists,
+): Promise<string | null> {
   if (!specifier.startsWith("#veryfront/")) return null;
 
   const mappedTarget = resolveInternalModuleTarget(specifier);
@@ -143,13 +148,13 @@ export async function resolveVeryfrontSourcePath(specifier: string): Promise<str
       // Try exact path with .src suffix first (for embedded sources)
       try {
         const srcPath = basePath + ".src";
-        if (await exists(srcPath)) return srcPath;
+        if (await existsFn(srcPath)) return srcPath;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
       // Try exact path
       try {
-        if (await exists(basePath)) return basePath;
+        if (await existsFn(basePath)) return basePath;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
@@ -166,7 +171,7 @@ export async function resolveVeryfrontSourcePath(specifier: string): Promise<str
     for (const ext of allExtensions) {
       const pathWithExt = basePath + ext;
       try {
-        if (await exists(pathWithExt)) return pathWithExt;
+        if (await existsFn(pathWithExt)) return pathWithExt;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
@@ -176,7 +181,7 @@ export async function resolveVeryfrontSourcePath(specifier: string): Promise<str
     for (const ext of allExtensions) {
       const indexPath = join(basePath, "index" + ext);
       try {
-        if (await exists(indexPath)) return indexPath;
+        if (await existsFn(indexPath)) return indexPath;
       } catch (_) {
         /* expected: file may not exist at this path */
       }
@@ -197,6 +202,7 @@ export async function resolveRelativeFrameworkImport(
   specifier: string,
   fromSourcePath: string,
   _fs: ReturnType<typeof createFileSystem>,
+  existsFn: (path: string) => Promise<boolean> = exists,
 ): Promise<string | null> {
   const fromDir = fromSourcePath.substring(0, fromSourcePath.lastIndexOf("/"));
   const parts = fromDir.split("/").filter(Boolean);
@@ -219,7 +225,7 @@ export async function resolveRelativeFrameworkImport(
   if (/\.(tsx?|jsx?|mjs)$/.test(specifier)) {
     // Try exact path first
     try {
-      if (await exists(basePath)) return basePath;
+      if (await existsFn(basePath)) return basePath;
     } catch (_) {
       /* expected: file may not exist at this path */
     }
@@ -227,7 +233,7 @@ export async function resolveRelativeFrameworkImport(
     // Try with .src suffix for embedded sources
     try {
       const srcPath = basePath + ".src";
-      if (await exists(srcPath)) return srcPath;
+      if (await existsFn(srcPath)) return srcPath;
     } catch (_) {
       /* expected: file may not exist at this path */
     }
@@ -245,7 +251,7 @@ export async function resolveRelativeFrameworkImport(
   for (const ext of allExtensions) {
     const pathWithExt = basePath + ext;
     try {
-      if (await exists(pathWithExt)) return pathWithExt;
+      if (await existsFn(pathWithExt)) return pathWithExt;
     } catch (_) {
       /* expected: file may not exist at this path */
     }
@@ -255,7 +261,7 @@ export async function resolveRelativeFrameworkImport(
   for (const ext of allExtensions) {
     const indexPath = join(basePath, "index" + ext);
     try {
-      if (await exists(indexPath)) return indexPath;
+      if (await existsFn(indexPath)) return indexPath;
     } catch (_) {
       /* expected: file may not exist at this path */
     }

package/src/src/utils/index.ts

@@ -3,7 +3,16 @@
  * (breakpoints, timeouts, HTTP codes), hashing, memoization, and feature flags.
  *
  * @module utils
+ *
+ * @example Structured logging
+ * ```ts
+ * import { serverLogger } from "veryfront/utils";
+ *
+ * serverLogger.info("Booting server", { project_id: "proj_123" });
+ * ```
  */
+import "../../_dnt.polyfills.js";
+
 
 export {
   type GlobalWithBun,
@@ -17,11 +26,13 @@ export {
 export {
   agentLogger,
   bundlerLogger,
+  createJobUserLogger,
   logger,
   refreshLoggerConfig,
   rendererLogger,
   serverLogger,
 } from "./logger/index.js";
+export type { Logger } from "./logger/index.js";
 
 export {
   BREAKPOINT_LG,

package/src/src/utils/logger/index.ts

@@ -12,6 +12,7 @@ export {
   agentLogger,
   bundlerLogger,
   cliLogger,
+  createJobUserLogger,
   createRequestLogger,
   getBaseLogger,
   getDefaultLevel,

package/src/src/utils/logger/logger.ts

@@ -60,6 +60,12 @@ export interface LogEntry {
   release_id?: string;
   branch_id?: string;
   branch_name?: string;
+  job_id?: string;
+  batch_id?: string;
+  job_target?: string;
+  task?: string;
+  event_kind?: string;
+  user_visible?: string;
   // Duration for timed operations
   /** @deprecated Use `duration_ms` instead. Kept for Grafana dashboard transition. Planned removal after Grafana dashboard migration is complete. */
   durationMs?: number;
@@ -314,6 +320,12 @@ class ConsoleLogger implements Logger {
     extractToEntryField(entry, mergedContext, "release_id", (v) => String(v));
     extractToEntryField(entry, mergedContext, "branch_id", (v) => String(v));
     extractToEntryField(entry, mergedContext, "branch_name", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "job_id", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "batch_id", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "job_target", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "task", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "event_kind", (v) => String(v));
+    extractToEntryField(entry, mergedContext, "user_visible", (v) => String(v));
     extractToEntryField(entry, mergedContext, "duration_ms", (v) => Number(v));
 
     // Emit snake_case aliases for camelCase fields (transition period)
@@ -568,3 +580,25 @@ export function createRequestLogger(
 ): Logger {
   return baseLogger.child(requestContext);
 }
+
+export function createJobUserLogger(
+  baseLogger: Logger,
+  jobContext: {
+    projectId: string;
+    jobId: string;
+    task: string;
+    batchId?: string | null;
+    jobTarget?: string | null;
+    eventKind?: string;
+  },
+): Logger {
+  return baseLogger.child({
+    project_id: jobContext.projectId,
+    job_id: jobContext.jobId,
+    ...(jobContext.batchId ? { batch_id: jobContext.batchId } : {}),
+    ...(jobContext.jobTarget ? { job_target: jobContext.jobTarget } : {}),
+    task: jobContext.task,
+    event_kind: jobContext.eventKind ?? "job_user_log",
+    user_visible: "true",
+  });
+}