Repository navigation
Add Cloud code-run quotas: monthly cap + per-org concurrency - #1492
Merged
Merged
Conversation
Cloud is multi-tenant, so the per-run limits (deadline, memory, tool-call cap, output size) are not enough: one tenant could run code without bound or saturate the shared runner. Add two per-workspace quotas, enforced at the single run chokepoint before handing to the runner. - Monthly run cap, authoritative from the code_runs table so it holds with or without Redis: trial 100, Starter 500, Team 5,000, Enterprise unlimited (a contract may override via features.maxCodeRunsPerMonth). A card-backed trial gets the Team quotas (reuses effectiveCodeModePlan). - Per-org concurrency cap, best-effort via the existing Redis (incr/decr with a safety TTL), skipped when Redis is down: trial/Starter 1, Team 3, Enterprise 10. - Cloud only: self-hosted is single-tenant and not metered by runs, so the guard is a no-op there. Over a quota, the run is refused with a clear message and nothing executes. No schema change (uses the existing code_runs table and Redis); no DynamicMcpTools constructor change (reuses its injected prisma/redis/deployment/licenseGuard).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1491. The last code-side gap before enabling code mode on Cloud (see the activation plan and PRs #1447 / #1490).
Why
Cloud shares one runner between tenants. The per-run limits (deadline, memory, tool-call cap, output size) bound a single run but not a tenant's volume or burst, so one workspace could run code without bound or saturate the shared runner for everyone. This adds two per-workspace quotas.
What
Enforced at the single run chokepoint in
DynamicMcpTools.executeCodeToolandexecuteInlineCode, before the run is handed to the runner. Over a quota the run is refused with a clear message (QuotaExceeded) and nothing executes.code_runstable, so it holds with or without Redis: trial 100, Starter 500, Team 5,000, Business 5,000, Enterprise unlimited. A contract can override with the licence featuremaxCodeRunsPerMonth.effectiveCodeModePlan).Cloud + self-hosted
isCloudgate), unchanged behaviour.How (no schema, no ctor change)
license/code-run-quotas.ts(new): pure cap tables +monthlyCodeRunCapForPlan,concurrentCodeRunCapForPlan,startOfUtcMonth.license/license-guard.service.ts:codeModePlanForOrg()exposes the effective plan (card-trial -> team).mcp-server/dynamic-mcp-tools.ts:acquireCodeRunLease()/releaseInflight(), wired around the executor call. Reuses the already-injectedprisma/redisService/deployment/licenseGuard— no constructor change, so no test construction churn.code_runstable and Redis: no Prisma/schema change.Tests / checks (packages/backend)
npx tsc --noEmit— clean;npx eslinton the touched files — clean.npx jest --maxWorkers=4 src/license dynamic-mcp-tools— 394 pass (adds quota unit tests + enforcement tests: monthly cap, concurrency cap + counter release, inline path, self-hosted no-op).npx jest --maxWorkers=4 mcp-endpoint code-tool— 71 pass.node scripts/generate-llms-txt.mjs --check— clean.Not in this PR (operational, out of repo per AGENTS)
Deploying the runner on Cloud (
CODE_RUNNER_URL) and the pre-GA pen test — tracked in the activation plan. A global runner pool/queue is a possible follow-up to the per-org concurrency cap.