feat(convex): add Daytona Convex component (@daytona/convex)

.github/workflows/ci.yml

@@ -27,6 +27,7 @@ jobs:
       pi: ${{ steps.filter.outputs.pi }}
       opencode: ${{ steps.filter.outputs.opencode }}
       pydantic_ai: ${{ steps.filter.outputs.pydantic_ai }}
+      convex: ${{ steps.filter.outputs.convex }}
     steps:
       - uses: actions/checkout@v4
       - uses: dorny/paths-filter@v3
@@ -45,6 +46,8 @@ jobs:
               - 'packages/opencode-plugin/**'
             pydantic_ai:
               - 'packages/pydantic-ai-daytona/**'
+            convex:
+              - 'packages/convex/**'
 
   adk:
     needs: changes
@@ -208,14 +211,44 @@ jobs:
       # NOTE: live tests (tests/integration_tests, real Daytona sandboxes) run via
       # the separate integration workflow, not per-PR CI.
 
+  convex:
+    needs: changes
+    if: needs.changes.outputs.convex == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "lts/*"
+      - name: Detect package
+        id: guard
+        run: |
+          test -f packages/convex/package.json && echo "ready=true" >> "$GITHUB_OUTPUT" || echo "ready=false" >> "$GITHUB_OUTPUT"
+      - name: Install
+        if: steps.guard.outputs.ready == 'true'
+        working-directory: packages/convex
+        run: npm ci
+      - name: Typecheck
+        if: steps.guard.outputs.ready == 'true'
+        working-directory: packages/convex
+        run: npm run typecheck
+      - name: Build
+        if: steps.guard.outputs.ready == 'true'
+        working-directory: packages/convex
+        run: npm run build
+      - name: Unit tests (offline, mocked Daytona API)
+        if: steps.guard.outputs.ready == 'true'
+        working-directory: packages/convex
+        run: npm test
+
   # Single, stable status check to require in branch protection.
   # It ALWAYS runs (if: always()) and fails only if a relevant job failed or
   # was cancelled. A "skipped" job (a package this PR didn't touch) is fine —
   # so requiring just this one check never wedges a PR, while still blocking
   # merges when a touched package's lint/test/build fails.
   ci-success:
     name: ci-success
-    needs: [changes, adk, langchain, n8n, pi, opencode, pydantic-ai]
+    needs: [changes, adk, langchain, n8n, pi, opencode, pydantic-ai, convex]
     if: always()
     runs-on: ubuntu-latest
     steps:

.github/workflows/integration.yml

@@ -32,6 +32,7 @@ on:
         options:
           - all
           - adk
+          - convex
           - langchain
           - n8n
           - pi
@@ -64,6 +65,7 @@ jobs:
       pull-requests: read
     outputs:
       adk: ${{ steps.decide.outputs.adk }}
+      convex: ${{ steps.decide.outputs.convex }}
       langchain: ${{ steps.decide.outputs.langchain }}
       n8n: ${{ steps.decide.outputs.n8n }}
       pi: ${{ steps.decide.outputs.pi }}
@@ -77,6 +79,8 @@ jobs:
           filters: |
             adk:
               - 'packages/adk-plugin/**'
+            convex:
+              - 'packages/convex/**'
             langchain:
               - 'packages/langchain-data-analysis/**'
             n8n:
@@ -93,6 +97,7 @@ jobs:
           # Fork = the PR's source branch lives in a different repo than ours.
           IS_FORK: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.pull_request.head.repo.full_name != github.repository }}
           CH_ADK: ${{ steps.filter.outputs.adk }}
+          CH_CONVEX: ${{ steps.filter.outputs.convex }}
           CH_LANGCHAIN: ${{ steps.filter.outputs.langchain }}
           CH_N8N: ${{ steps.filter.outputs.n8n }}
           CH_PI: ${{ steps.filter.outputs.pi }}
@@ -120,6 +125,7 @@ jobs:
           }
           {
             echo "adk=$(decide adk "${CH_ADK:-false}")"
+            echo "convex=$(decide convex "${CH_CONVEX:-false}")"
             echo "langchain=$(decide langchain "${CH_LANGCHAIN:-false}")"
             echo "n8n=$(decide n8n "${CH_N8N:-false}")"
             echo "pi=$(decide pi "${CH_PI:-false}")"
@@ -162,6 +168,38 @@ jobs:
           DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
         run: pytest
 
+  convex:
+    needs: changes
+    if: needs.changes.outputs.convex == 'true'
+    runs-on: ubuntu-latest
+    environment: integration-tests
+    timeout-minutes: 30
+    steps:
+      # Fork lane checks out the PR head (see the adk job note).
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || '' }}
+          # Fork-lane opt-in + credential hygiene — see the adk job for rationale.
+          allow-unsafe-pr-checkout: ${{ github.event_name == 'pull_request_target' }}
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "lts/*"
+      - name: Install
+        working-directory: packages/convex
+        run: npm ci
+      - name: Build
+        working-directory: packages/convex
+        run: npm run build
+      # Boots an anonymous LOCAL Convex deployment (no Convex account), deploys
+      # the example app with the component installed, and drives it end to end
+      # against real Daytona sandboxes via `convex run`.
+      - name: Live E2E (local Convex deployment + real Daytona)
+        working-directory: packages/convex
+        env:
+          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+        run: npm run test:live
+
   langchain:
     needs: changes
     if: needs.changes.outputs.langchain == 'true'
@@ -313,7 +351,7 @@ jobs:
   # required checks treat as satisfied, so the owning lane's verdict governs.
   integration-success:
     name: integration-success
-    needs: [changes, adk, langchain, n8n, pi, pydantic-ai]
+    needs: [changes, adk, convex, langchain, n8n, pi, pydantic-ai]
     if: >-
       always() && (
         github.event_name == 'workflow_dispatch' ||

.github/workflows/release.yml

@@ -53,6 +53,8 @@ jobs:
       opencode_tag: ${{ steps.release.outputs['packages/opencode-plugin--tag_name'] }}
       pydantic_ai_released: ${{ steps.release.outputs['packages/pydantic-ai-daytona--release_created'] }}
       pydantic_ai_tag: ${{ steps.release.outputs['packages/pydantic-ai-daytona--tag_name'] }}
+      convex_released: ${{ steps.release.outputs['packages/convex--release_created'] }}
+      convex_tag: ${{ steps.release.outputs['packages/convex--tag_name'] }}
     steps:
       - uses: googleapis/release-please-action@v4
         id: release
@@ -205,6 +207,33 @@ jobs:
           npm run build --if-present
           npm publish --provenance --access public
 
+  # ---- npm: @daytona/convex (Convex component) ----------------------------
+  publish-convex:
+    needs: release-please
+    if: needs.release-please.outputs.convex_released == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # OIDC -> npm Trusted Publishing + provenance
+      contents: read
+    # See publish-n8n for the npm environment contract (repo Settings + npm).
+    environment: npm
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "lts/*"
+          registry-url: "https://registry.npmjs.org"
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+      # `npm run build` compiles src/ (including the committed component
+      # _generated code) to dist/ — no Convex deployment needed at build time.
+      - name: Install, build, publish
+        working-directory: packages/convex
+        run: |
+          npm ci
+          npm run build
+          npm publish --provenance --access public
+
   # ---- npm: @daytona/opencode (OpenCode plugin) ---------------------------
   publish-opencode:
     needs: release-please

.release-please-manifest.json

@@ -4,5 +4,6 @@
   "packages/n8n-nodes-daytona": "0.1.3",
   "packages/pi-extension": "0.191.1",
   "packages/opencode-plugin": "0.193.0",
-  "packages/pydantic-ai-daytona": "0.1.0"
+  "packages/pydantic-ai-daytona": "0.1.0",
+  "packages/convex": "0.0.0"
 }

README.md

@@ -10,6 +10,7 @@ Packages published to **a package registry** live in [`packages/`](packages/):
 |---|---|
 | [`adk-plugin`](packages/adk-plugin) — Google ADK plugin | PyPI · [`daytona-adk`](https://pypi.org/project/daytona-adk/) |
 | [`langchain-data-analysis`](packages/langchain-data-analysis) — LangChain data-analysis tool | PyPI · [`langchain-daytona-data-analysis`](https://pypi.org/project/langchain-daytona-data-analysis/) |
+| [`convex`](packages/convex) — Convex sandbox component | npm · [`@daytona/convex`](https://www.npmjs.com/package/@daytona/convex) |
 | [`n8n-nodes-daytona`](packages/n8n-nodes-daytona) — n8n community node | npm · [`@daytona/n8n-nodes-daytona`](https://www.npmjs.com/package/@daytona/n8n-nodes-daytona) |
 | [`pi-extension`](packages/pi-extension) — Pi coding-agent extension | npm · [`@daytona/pi`](https://www.npmjs.com/package/@daytona/pi) |
 | [`opencode-plugin`](packages/opencode-plugin) — OpenCode plugin | npm · [`@daytona/opencode`](https://www.npmjs.com/package/@daytona/opencode) |

packages/convex/.gitignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+*.tsbuildinfo
+*.tgz
+*.log
+.env.local