[tyffical]

Motivation

• Local execution has to work on Vite 6.4, 7 and 8. Jest covers 6.4 with this repo's Vite 6.4.3, but can't load the ESM-only Vite 7+.
• A fresh process per call, parallel calls and the sandbox need a check against the real dev server on each version, installed the way a customer gets it.
• Ticket: APPS-2961 Run local backend functions in parallel, with per-call realtime console logs.
• Stack order, merged bottom up:
  1. [APPS-2961] Update: require Vite 6.4 or later for the apps plugin #622
  2. [APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604
  3. [APPS-2961] Update: run each local backend function call in a fresh process #608
  4. [APPS-2961] Add: limit local call processes with Node's permission model #617
  5. [APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603
  6. This PR
  • Also on the parallel-calls PR, not on this one: [APPS-2945] Update: switch the apps plugin's static checks to the Node backend runtime #557, then [APPS-2945] Update: drop the in-process local execution guard in favor of Node's permission model #563 and [APPS-2945] Add: warn on process.env reads in backend functions #565.

Architecture

flowchart TD
    A["CI matrix leg (Vite N)"] -->|npm pack| B["datadog-vite-plugin.tgz"]
    A --> C["node --test local-execution.mjs"]
    C --> D["Temp project: vite@N + the tgz + @datadog/apps-backend, npm install"]
    B --> D
    D --> E["Real dev server with datadogVitePlugin, fake Datadog API via fetch"]
    E -->|"POST /__dd/executeAction"| G["Assertions on each response"]

Loading

• The suite runs the packed plugin's built entry by path, so it resolves vite from the temp project like a customer install.

Changes

6 changes across ci.yaml and local-execution.mjs

What changed	File
A matrix job, after the unit tests, packs the plugin and runs the suite on Vite 7.3.7 and 8.3.3.	ci.yaml
The job reuses the unit tests' build cache read-only, checks out without credentials and has read-only permissions.	ci.yaml
An Apps local execution result job gives the matrix one stable check name.	ci.yaml
A node:test suite installs the tgz with one exact Vite version in a temp project and drives a real dev server, with telemetry off.	local-execution.mjs
It checks fresh state per call, parallel calls, the permission model and prefixed logs.	local-execution.mjs
Every leg checks $.Source through @datadog/apps-backend.	local-execution.mjs

QA Instructions

• The suite passes on Vite 7.3.7 and 8.3.3 under Node 20.19.4 and Node 24.22.1, verified at 71953bda.

Check	Result	Evidence
Vite 7.3.7 and 8.3.3, Node 20.19.4	Pass	Every test passes; one import.meta.resolve warning per leg.
Vite 7.3.7 and 8.3.3, Node 24.22.1	Pass	Every test passes, no warnings.
No env vars set	Fails as intended	Error: Set DD_APPS_TEST_VITE_VERSION and DD_APPS_TEST_PLUGIN_TGZ.
Typecheck, lint, integrity	Pass	Exit 0, no file changes.
Apps unit tests	Pass

yarn typecheck:all && yarn lint && yarn cli integrity  # Expected: exit 0, no changes
TMPDIR=/private/tmp yarn test:unit packages/plugins/apps  # Expected: all pass
# From a checkout outside the temp dir, after yarn build:all:
cd packages/published/vite-plugin && npm pack --ignore-scripts --pack-destination /tmp/pack && cd -
mv /tmp/pack/datadog-vite-plugin-*.tgz /tmp/pack/datadog-vite-plugin.tgz
for v in 7.3.7 8.3.3; do
  DD_APPS_TEST_VITE_VERSION=$v DD_APPS_TEST_PLUGIN_TGZ=/tmp/pack/datadog-vite-plugin.tgz \
    node --test packages/tests/src/apps-vite-versions/local-execution.mjs
done  # Expected: each version passes; repeat under Node 24 with `volta run --node 24 -- node --test ...`
node --test packages/tests/src/apps-vite-versions/local-execution.mjs  # Expected: fails, asking for both env vars

Output for Vite 8.3.3 under Node 20.19.4

# [warn|vite|apps] Local execution on Node.js 20.19.4 can't provide `import.meta.resolve` inside the sandbox; production runs Node 24. Upgrade to Node 22.15+ to match it.
    ok 1 - module state is fresh per call, each in its own process
    ok 2 - concurrent calls run in parallel
    ok 3 - the sandbox refuses writes outside the temp dir and subprocesses, and allows temp writes
    ok 4 - $.Source resolves through @datadog/apps-backend
    ok 5 - console output reaches the dev server's terminal, prefixed with its call
ok 1 - Local execution on Vite 8.3.3
# pass 5
# fail 0

Blast Radius

• No feature flag: CI and test code only; the plugin is unchanged.
• Low risk: two extra CI legs of 21 to 29 seconds each, run after the unit tests beside the end-to-end shards.

Out of Scope / Follow-ups

5 items deferred

Item	Status	Next step
The suite loads the plugin's built entry by path, so the published exports map isn't covered.	Deliberate	Cover it with a pack that applies publishConfig.
The temp project's npm install isn't locked.	Accepted	The job is read-only, has no credentials and skips install scripts.
The matrix runs only after the unit tests pass, to reuse their build.	Accepted	Give the build its own job if matrix signal is needed when unit tests fail.
The suite doesn't probe worker threads; the Jest suite does.	Deferred	Add a worker probe.
Apps local execution isn't a required check on master, so a red leg doesn't block merging.	Deferred	Add it to the master ruleset's required checks once this merges.

Documentation

• APPS-2961 Run local backend functions in parallel, with per-call realtime console logs
• Vite Environment API for runtimes
• Node.js test runner

🤖 Generated with Claude Code

[github-actions]

Live Debugger Runtime Benchmark

SDK-loaded dormant-probe runtime overhead, measured against an uninstrumented bundle in the same browser session.

Browser	Workload	Quality	Per-call overhead upper
chrome	Hot	clean	<= 2.58 ns
chrome	Tiny	clean	<= 0.01 ns
firefox	Hot	clean	<= 9.92 ns
firefox	Tiny	clean	<= 0.03 ns
safari	Hot	clean	<= 5.50 ns
safari	Tiny	clean	<= 0.46 ns

What do the Tiny and Hot workloads represent?

Browser Debugger SDK: 7.16.2 · built 2026-10-27 · S3 ETag 872de873

Full diagnostics

browser  workload  quality  per-call overhead upper  overhead upper          95% CI        A/A diag        block CI  acf(1)   baseline  instrumented                         samples
-------  --------  -------  -----------------------  --------------  --------------  --------------  --------------  ------  ---------  ------------  ------------------------------
chrome   Hot       clean                 <= 2.58 ns        <= 5.19%   2.54..2.58 ns  -0.03..0.00 ns   2.54..2.58 ns   -0.02  52.590 ms     55.277 ms   102 (trim 20%, outliers 5.9%)
chrome   Tiny      clean                 <= 0.01 ns        <= 0.18%  -0.03..0.01 ns  -0.03..0.02 ns  -0.03..0.01 ns   -0.02  54.772 ms     54.703 ms  102 (trim 20%, outliers 16.7%)
firefox  Hot       clean                 <= 9.92 ns       <= 39.46%   9.90..9.92 ns  -0.01..0.01 ns   9.90..9.92 ns   -0.07  39.540 ms     55.120 ms   102 (trim 20%, outliers 8.8%)
firefox  Tiny      clean                 <= 0.03 ns        <= 0.18%   0.01..0.03 ns  -0.01..0.00 ns   0.01..0.03 ns   -0.02  59.320 ms     59.380 ms   102 (trim 20%, outliers 9.8%)
safari   Hot       clean                 <= 5.50 ns       <= 21.96%   5.48..5.50 ns  -0.00..0.01 ns   5.48..5.50 ns    0.36  45.260 ms     55.180 ms   102 (trim 20%, outliers 3.9%)
safari   Tiny      clean                 <= 0.46 ns       <= 12.28%   0.44..0.46 ns  -0.00..0.00 ns   0.44..0.46 ns    0.27  51.420 ms     57.600 ms   102 (trim 20%, outliers 3.9%)

Raw samples are in the live-debugger-runtime-bench-results artifact.

[tyffical]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T18:48:10.289942Z	676e2ce	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

No blocking issues were identified in the CI configuration or test suite, and production code is unchanged.

No open issues 🎉

What changed in this PR

Adds real-install CI coverage for Apps local backend execution across Vite 5–8, complementing Jest coverage without changing production code.

Changes:

• Adds five Vite matrix legs and a stable aggregate status check.
• Adds integration tests for execution state, concurrency, sandbox restrictions, runtime context, and logs.

File	Description
packages/​tests/​src/​apps-vite-versions/​local-execution.mjs	Tests the packed plugin against fresh Vite installs.
.github/​workflows/​ci.yaml	Runs the version matrix using cached builds and read-only permissions.

_{Review effort: Balanced}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 1797661c4d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tyffical]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-28 17:28:39 UTC ℹ️ Start processing command /merge

---

2026-10-28 17:28:42 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2m (p90).

---

2026-10-28 17:30:10 UTC ℹ️ MergeQueue: This merge request was merged