Documentation
¶
Overview ¶
Package scriptdraft executes a managed script's draft under the identity of the person asking for it.
It introduces no authority. The run opens an in-memory MCP session carrying the caller's own identity, so every platform call it makes is authenticated, authorized, rate limited, and audited exactly as the same call typed by that person directly would be: there is nothing reachable through a draft run that its caller could not already reach by calling the tools themselves. What it adds is the loop — real interpreter errors, real rows, real shapes — so a script is finished before it is saved as the version that runs.
It is deliberately NOT a way around the execution gate: it persists nothing (platform.export previews), it runs under tighter limits than a platform run will, and it persists nothing a run would.
The package exists because there are two surfaces that ask for a draft run — the manage_script tool an agent calls and the editor its owner works in (#1364) — and exactly one of them may decide what a draft run is. The identity is the caller's in both cases; the difference between them is only where that identity was read from.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrBusy = errors.New("too many draft runs are already executing; try again in a moment")
ErrBusy marks a draft refused because this replica is already running as many as it will. It is a sentinel so an HTTP surface can answer 503 with a retry rather than reporting the platform as broken.
var ErrNoIdentity = errors.New("a draft run needs an authenticated caller to run as")
ErrNoIdentity marks a draft request carrying nobody to run as. A draft has no identity of its own, so there is nothing to fall back to.
Functions ¶
This section is empty.
Types ¶
type Identity ¶
type Identity struct {
UserID string
Email string
Roles []string
AuthType string
Claims map[string]any
}
Identity is the person a draft executes as. It is copied from a caller the platform has already authenticated — never synthesized here — which is what makes the no-new-authority property structural rather than a promise.
type Outcome ¶
type Outcome struct {
// RunID identifies the run, and is also the session id every audit row the
// run produced carries.
RunID string
// Result is the engine's record of the execution, present even when the
// script failed.
Result *scriptrun.Result
// Err is the script's own failure — a Starlark error, a refused host call,
// or a limit — and nil when it succeeded.
Err error
}
Outcome is what one draft execution did. Failure is a normal outcome and is carried here rather than returned as an error: a failed draft's log is the whole reason to have run it.
type Request ¶
type Request struct {
// Source is the Starlark to execute. It is passed explicitly rather than
// read from a record because the editor's whole purpose is running an edit
// that has not been saved.
Source string
// Name labels the script in tracebacks.
Name string
// Params is the already-bound parameter set. Binding is the domain's
// (script.BindParams) and happens before a Runner is involved, so a draft
// and a platform run bind by one rule.
Params map[string]any
Identity Identity
}
Request is one draft execution: the code, what to call it, and the values it binds.
type Runner ¶
type Runner struct {
// contains filtered or unexported fields
}
Runner executes drafts against an assembled MCP server.
func New ¶
func New(server *mcp.Server, destinations []script.Destination) *Runner
New builds a Runner over the assembled server. destinations is the deployment's configured bucket destination set, resolved by a draft exactly as a platform run resolves it, so a destination a real run would refuse fails while the author is iterating. A nil server yields a Runner that refuses every request, which is the honest shape for a deployment with no server to run against.
Source Files