@assemblyline-agents/cli 2.0.0 → 3.1.0

package/dist/deploy-lifecycle.js

@@ -1,25 +1,74 @@
+/** Run provider cleanup without hiding a completed or failed deploy outcome. */
+export async function executeDeployCleanup(input) {
+    if (!input.publisher.cleanup)
+        return undefined;
+    try {
+        return await input.publisher.cleanup(input.artifact, input.plan) ?? undefined;
+    }
+    catch {
+        return {
+            target: input.publisher.target,
+            status: "degraded",
+            warning: "Provider cleanup did not complete. The deployment outcome is unchanged; rerun deploy cleanup through the next deployment attempt."
+        };
+    }
+}
 /** Execute the provider lifecycle in the one supported hosted-deploy order. */
 export async function executeDeployLifecycle(input) {
     const lifecycle = {};
+    input.onProgress?.("preflight");
     const preflight = await input.publisher.preflight?.(input.artifact, input.plan);
     if (preflight)
         lifecycle.preflight = preflight;
-    const preparation = await input.publisher.prepare?.(input.artifact, input.plan);
-    if (preparation)
-        lifecycle.preparation = preparation;
-    await input.syncSecrets();
-    const migrationStatus = input.publisher.runMigrations
-        ? await input.publisher.runMigrations(input.artifact, input.plan, input.migrationRequest)
-        : await input.runFallbackMigrations();
-    const providerReceipt = input.activate === false
-        ? {
-            ...(preparation ?? {}),
-            target: input.publisher.target,
-            status: "prepared",
-            environment: input.plan.environment,
-            agentRevision: input.plan.agentRevision
+    let sandboxEnvironment;
+    let preparation;
+    let migrationStatus = "none";
+    let providerReceipt;
+    try {
+        if (input.reconcileSandboxEnvironment) {
+            input.onProgress?.("sandbox-environment");
+            sandboxEnvironment = await input.reconcileSandboxEnvironment();
+        }
+        input.onProgress?.("prepare");
+        preparation = await input.publisher.prepare?.(input.artifact, input.plan);
+        if (preparation)
+            lifecycle.preparation = preparation;
+        input.onProgress?.("secrets");
+        await input.syncSecrets();
+        input.onProgress?.("migrations");
+        migrationStatus = input.publisher.runMigrations
+            ? await input.publisher.runMigrations(input.artifact, input.plan, input.migrationRequest)
+            : await input.runFallbackMigrations();
+        if (input.activate !== false)
+            input.onProgress?.("activate");
+        providerReceipt = input.activate === false
+            ? {
+                ...(preparation ?? {}),
+                target: input.publisher.target,
+                status: "prepared",
+                environment: input.plan.environment,
+                agentRevision: input.plan.agentRevision
+            }
+            : await (input.publisher.activate ?? input.publisher.publish).call(input.publisher, input.artifact, input.plan);
+    }
+    catch (error) {
+        if (input.publisher.cleanup) {
+            input.onProgress?.("cleanup");
+            await executeDeployCleanup(input);
         }
-        : await (input.publisher.activate ?? input.publisher.publish).call(input.publisher, input.artifact, input.plan);
-    return { providerReceipt, migrationStatus, lifecycle };
+        throw error;
+    }
+    if (input.publisher.cleanup) {
+        input.onProgress?.("cleanup");
+        const cleanup = await executeDeployCleanup(input);
+        if (cleanup)
+            lifecycle.cleanup = cleanup;
+    }
+    return {
+        providerReceipt,
+        migrationStatus,
+        lifecycle,
+        ...(sandboxEnvironment ? { sandboxEnvironment } : {})
+    };
 }
 //# sourceMappingURL=deploy-lifecycle.js.map

package/dist/deploy-lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-lifecycle.js","sourceRoot":"","sources":["../src/deploy-lifecycle.ts"],"names":[],"mappings":"AAcA,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAQ5C;IACC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,SAAS;QAAE,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,WAAW;QAAE,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;IACrD,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IAC1B,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC,aAAa;QACnD,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC;QACzF,CAAC,CAAC,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK;QAC9C,CAAC,CAAC;YACE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACtB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;YAC9B,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;YACnC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa;SACxC;QACH,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAC9D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,IAAI,CACX,CAAC;IACN,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"deploy-lifecycle.js","sourceRoot":"","sources":["../src/deploy-lifecycle.ts"],"names":[],"mappings":"AAyBA,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;YAC9B,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,mIAAmI;SAC7I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAU5C;IACC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,SAAS;QAAE,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/C,IAAI,kBAA4D,CAAC;IACjE,IAAI,WAAiC,CAAC;IACtC,IAAI,eAAe,GAAG,MAAM,CAAC;IAC7B,IAAI,eAA8B,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,2BAA2B,EAAE,CAAC;YACtC,KAAK,CAAC,UAAU,EAAE,CAAC,qBAAqB,CAAC,CAAC;YAC1C,kBAAkB,GAAG,MAAM,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,WAAW,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,WAAW;YAAE,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC;QACrD,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1B,KAAK,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC;QACjC,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC,aAAa;YAC7C,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC;YACzF,CAAC,CAAC,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;YAAE,KAAK,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7D,eAAe,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK;YACxC,CAAC,CAAC;gBACE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;gBACtB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;gBAC9B,MAAM,EAAE,UAAU;gBAClB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;gBACnC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa;aACxC;YACH,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAC9D,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,IAAI,CACX,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC5B,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC5B,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,OAAO;YAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,eAAe;QACf,eAAe;QACf,SAAS;QACT,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/deploy.d.ts

@@ -1,4 +1,5 @@
-import { type DeploymentPlan } from "@assemblyline-agents/compiler";
+import { type BuildArtifact, type DeploymentPlan } from "@assemblyline-agents/compiler";
+import type { SandboxEnvironmentResolution } from "@assemblyline-agents/core";
 import { type ParsedArgs } from "./args.js";
 export { parseEnvSecrets } from "./project-env.js";
 export declare function runDeployCommand(agentRoot: string, parsed: ParsedArgs): Promise<void>;
@@ -7,6 +8,13 @@ export declare function splitDeploySecrets(secrets: Record<string, string>, plan
     runtimeSecrets: Record<string, string>;
     localDeployKeys: string[];
 };
+/**
+ * Reuse a sandbox artifact proven by a successful receipt when its provider and
+ * content fingerprint are unchanged. Runtime credentials stay on the host;
+ * only the provider-safe artifact reference crosses deploys.
+ */
+export declare function reusableSandboxEnvironmentResolution(artifact: Pick<BuildArtifact, "root" | "manifest">, environmentName: string): SandboxEnvironmentResolution | undefined;
+export declare function sandboxPassthroughEnv(env: NodeJS.ProcessEnv, names: string[]): Record<string, string>;
 export declare function runCommand(commandName: string, args: string[], options?: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;

package/dist/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAIA,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,+BAA+B,CAAC;AAgBvC,OAAO,EAAqD,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAO/F,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqF3F;AA2HD,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,cAAc,GACnB;IAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBvE;AAwKD,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B/D;AAcD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAG5D"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAQV,4BAA4B,EAC7B,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EAAqD,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAmB/F,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAkG3F;AAwKD,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,cAAc,GACnB;IAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBvE;AAqPD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,CAAC,EAClD,eAAe,EAAE,MAAM,GACtB,4BAA4B,GAAG,SAAS,CA0B1C;AAUD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWrG;AA4DD,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B/D;AAeD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAG5D"}

package/dist/deploy.js

@@ -3,15 +3,18 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { buildAgent, compileAgent, planDeployment } from "@assemblyline-agents/compiler";
-import { sanitizeDeployName } from "@assemblyline-agents/core";
-import { installSignalHandlers, listenNodeRuntime, resolveProvider } from "@assemblyline-agents/node";
+import { adapterProviderMetadata, isSensitiveSandboxEnvName, sanitizeDeployName } from "@assemblyline-agents/core";
+import { installSignalHandlers, listenNodeRuntime, resolveProvider, resolveSecretsEnv } from "@assemblyline-agents/node";
 import { FileStateAdapter, LocalBlobAdapter, LocalSandboxAdapter, AssemblyLineRuntime, loadRuntimeBundle } from "@assemblyline-agents/runtime";
 import { booleanFlag, buildOptions, numberFlag, stringFlag } from "./args.js";
 import { printIssues } from "./help.js";
 import { missingPackageFixLines } from "./init.js";
+import { checkChannelInstallations } from "./channels.js";
+import { wireConnectionEvents } from "./connections.js";
 import { resolveDeployDefinition, resolveDeployEnvironment } from "./deploy-definition.js";
-import { executeDeployLifecycle } from "./deploy-lifecycle.js";
+import { executeDeployCleanup, executeDeployLifecycle } from "./deploy-lifecycle.js";
 import { loadProjectEnv, readEnvSecretsFile } from "./project-env.js";
+import { prepareReleaseSnapshot, releaseSnapshotForReceipt, withReleaseSnapshot, } from "./release-history.js";
 export { parseEnvSecrets } from "./project-env.js";
 export async function runDeployCommand(agentRoot, parsed) {
     loadProjectEnv(agentRoot);
@@ -26,20 +29,25 @@ export async function runDeployCommand(agentRoot, parsed) {
         const manifest = compileAgent({ root: agentRoot });
         deployOptions.environment = resolveDeployEnvironment(manifest, parsed);
         printIssues(manifest.validation.issues.filter((issue) => issue.code === "provider-package-unresolved"), { agentRoot });
-        const plan = planDeployment(manifest, deployOptions);
+        const plan = planDeployment(manifest, { ...deployOptions, env: await resolveDeploySecretsEnv(manifest, agentRoot) });
         const definition = resolveDeployDefinition(manifest, plan.target, parsed);
-        plan.missingRequirements = await effectiveMissingRequirements(plan, definition);
+        plan.missingRequirements = await effectiveMissingRequirements(plan, definition, manifest);
         printDeployWarnings(plan);
         console.log(JSON.stringify(plan, null, 2));
         return;
     }
-    const artifact = buildAgent(buildOptions(parsed, agentRoot));
+    const artifact = await buildAgent(buildOptions(parsed, agentRoot));
     deployOptions.environment = resolveDeployEnvironment(artifact.manifest, parsed);
-    const plan = planDeployment(artifact.manifest, deployOptions);
+    const deployEnv = await resolveDeploySecretsEnv(artifact.manifest, agentRoot);
+    const plan = planDeployment(artifact.manifest, { ...deployOptions, env: deployEnv });
+    const controlOnlyOperation = ["activate", "rollback", "ingress-only", "destroy"]
+        .some((flag) => booleanFlag(parsed, flag));
+    if (!controlOnlyOperation)
+        await preflightChannelInstallations(artifact);
     const definition = resolveDeployDefinition(artifact.manifest, plan.target, parsed);
     const effectivePlan = {
         ...plan,
-        missingRequirements: await effectiveMissingRequirements(plan, definition),
+        missingRequirements: await effectiveMissingRequirements(plan, definition, artifact.manifest, reusableSandboxEnvironmentResolution(artifact, plan.environment)),
         canPublish: false
     };
     effectivePlan.canPublish = !effectivePlan.dryRun && effectivePlan.missingRequirements.length === 0;
@@ -82,6 +90,7 @@ export async function runDeployCommand(agentRoot, parsed) {
                 state: new FileStateAdapter(resolve(artifact.root, "deploy-state.json")),
                 blob: new LocalBlobAdapter(resolve(artifact.root, "blobs")),
                 sandbox: new LocalSandboxAdapter(resolve(artifact.root, "sandbox")),
+                env: deployEnv,
                 devMode: true,
                 port: numberFlag(parsed, "port") ?? 0
             });
@@ -97,7 +106,41 @@ export async function runDeployCommand(agentRoot, parsed) {
         console.log(`Local deploy prepared for revision ${effectivePlan.agentRevision}. Run assembly-line serve to keep it online.`);
         return;
     }
-    await runProviderDeploy(artifact, effectivePlan, definition, parsed, agentRoot);
+    const release = !booleanFlag(parsed, "destroy") && !booleanFlag(parsed, "ingress-only")
+        ? prepareReleaseSnapshot(agentRoot, artifact.manifest)
+        : undefined;
+    await runProviderDeploy(artifact, effectivePlan, definition, parsed, agentRoot, release, deployEnv);
+}
+/**
+ * The env view deploy planning and secret sync work from: the process
+ * environment overlaid with the gateway's secrets store when one is
+ * configured, so declared secrets held only in the store still satisfy
+ * preflight and reach `--sync-secrets` without per-agent `.env` copies.
+ */
+async function resolveDeploySecretsEnv(manifest, agentRoot) {
+    return resolveSecretsEnv({
+        manifest,
+        env: process.env,
+        artifactRoot: agentRoot,
+        providerRoot: fileURLToPath(new URL("..", import.meta.url)),
+        devMode: false
+    });
+}
+async function preflightChannelInstallations(artifact) {
+    const checks = await checkChannelInstallations(artifact.manifest, process.env, fetch);
+    for (const check of checks) {
+        const workspace = check.workspace ? ` (${check.workspace})` : "";
+        if (check.skipped) {
+            console.warn(`Channel preflight skipped for ${check.provider}${workspace}: ${check.detail}`);
+            continue;
+        }
+        if (!check.ok)
+            throw new Error(`Channel preflight failed for ${check.provider}${workspace}: ${check.detail}`);
+        console.log(`Channel preflight passed for ${check.provider}${workspace}.`);
+        if (check.missingOptionalScopes.length > 0) {
+            console.warn(`Optional ${check.provider} scopes not granted: ${check.missingOptionalScopes.join(", ")}.`);
+        }
+    }
 }
 /**
  * The canonical receipt is per environment (`deployments/<environment>.json`).
@@ -131,13 +174,16 @@ function assertDestroyAllowed(plan, parsed) {
         throw new Error(`Refusing to destroy the default environment "${plan.environment}" without --force. Alternate environments (--env <name>) are presumed disposable; the default one is not.`);
     }
 }
-async function effectiveMissingRequirements(plan, definition) {
+async function effectiveMissingRequirements(plan, definition, manifest, reusableSandboxEnvironment) {
     let missing = plan.missingRequirements;
     // VPS runtime credentials are validated from the remote 0600 secret file
     // after optional sync. This allows repeat deploys without copying secrets
     // from the VPS back onto the operator machine.
     if (plan.target === "vps" && !plan.dryRun) {
-        missing = missing.filter((requirement) => requirement.kind !== "env");
+        const sandboxKind = manifest.gateway.sandbox?.kind ?? "local";
+        const provisioningEnv = new Set(adapterProviderMetadata(sandboxKind, "sandbox")?.sandboxEnvironment?.provisioningEnv ?? []);
+        missing = missing.filter((requirement) => requirement.kind !== "env"
+            || (provisioningEnv.has(requirement.name) && !reusableSandboxEnvironment));
     }
     if (plan.target === "railway" && missing.some((requirement) => requirement.name === "RAILWAY_TOKEN")) {
         const railwayBin = stringOption(definition, "railwayBin") ?? "railway";
@@ -185,7 +231,7 @@ function printDeployWarnings(plan) {
  * is set and the publisher supports it. Reads `--secrets-from <path>` or the
  * project `.env`. Logs key names only — never values.
  */
-async function syncDeploySecretsIfRequested(publisher, plan, parsed, agentRoot) {
+async function syncDeploySecretsIfRequested(publisher, plan, parsed, agentRoot, deployEnv) {
     if (!booleanFlag(parsed, "sync-secrets"))
         return;
     if (!publisher.syncSecrets) {
@@ -200,7 +246,7 @@ async function syncDeploySecretsIfRequested(publisher, plan, parsed, agentRoot)
     const fileSecrets = existsSync(secretsPath)
         ? readEnvSecretsFile(secretsPath)
         : {};
-    const secrets = withDeclaredRuntimeEnv(fileSecrets, plan, process.env);
+    const secrets = withDeclaredRuntimeEnv(fileSecrets, plan, deployEnv);
     const { runtimeSecrets, localDeployKeys } = splitDeploySecrets(secrets, plan);
     if (localDeployKeys.length > 0) {
         console.log(`Kept ${localDeployKeys.length} deploy credential(s) local: ${localDeployKeys.join(", ")}`);
@@ -259,7 +305,7 @@ async function railwayCliAuthenticated(railwayBin) {
  * Every non-local target resolves through the open provider registry. Built-in
  * flags only normalize provider options; publishing follows this single path.
  */
-async function runProviderDeploy(artifact, plan, definition, parsed, agentRoot) {
+async function runProviderDeploy(artifact, plan, definition, parsed, agentRoot, release, deployEnv) {
     if (parsed.flags["domains-only"] !== undefined) {
         throw new Error("--domains-only was removed. Use --ingress-only.");
     }
@@ -290,9 +336,12 @@ async function runProviderDeploy(artifact, plan, definition, parsed, agentRoot)
     if (booleanFlag(parsed, "activate")) {
         if (!publisher.activate)
             throw new Error(`Deploy target ${plan.target} does not support separate activation.`);
+        const activate = publisher.activate;
         await publisher.preflight?.(artifact, plan);
-        const receipt = await publisher.activate(artifact, plan);
+        const providerReceipt = await deployActionWithCleanup(publisher, artifact, plan, () => activate.call(publisher, artifact, plan));
+        const receipt = withReleaseSnapshot(providerReceipt, releaseSnapshotForReceipt(release, providerReceipt, true));
         writeDeployReceipt(artifact.root, plan, receipt);
+        await wireDeployedConnectionEvents(artifact.manifest, receipt);
         console.log(`${deployTargetLabel(plan.target)} prepared release activated.`);
         console.log(JSON.stringify(receipt, null, 2));
         return;
@@ -300,9 +349,12 @@ async function runProviderDeploy(artifact, plan, definition, parsed, agentRoot)
     if (booleanFlag(parsed, "rollback")) {
         if (!publisher.rollback)
             throw new Error(`Deploy target ${plan.target} does not support rollback.`);
+        const rollback = publisher.rollback;
         await publisher.preflight?.(artifact, plan);
-        const receipt = await publisher.rollback(artifact, plan);
+        const providerReceipt = await deployActionWithCleanup(publisher, artifact, plan, () => rollback.call(publisher, artifact, plan));
+        const receipt = withReleaseSnapshot(providerReceipt, releaseSnapshotForReceipt(release, providerReceipt, true));
         writeDeployReceipt(artifact.root, plan, receipt);
+        await wireDeployedConnectionEvents(artifact.manifest, receipt);
         console.log(`${deployTargetLabel(plan.target)} release rolled back.`);
         console.log(JSON.stringify(receipt, null, 2));
         return;
@@ -310,37 +362,195 @@ async function runProviderDeploy(artifact, plan, definition, parsed, agentRoot)
     if (booleanFlag(parsed, "ingress-only")) {
         if (!publisher.reconcileIngress)
             throw new Error(`Deploy target ${plan.target} does not support ingress reconciliation.`);
+        const reconcileIngress = publisher.reconcileIngress;
         await publisher.preflight?.(artifact, plan);
-        const receipt = await publisher.reconcileIngress(artifact, plan);
+        const receipt = await deployActionWithCleanup(publisher, artifact, plan, () => reconcileIngress.call(publisher, artifact, plan));
         writeDeployReceipt(artifact.root, plan, receipt);
         console.log(`${deployTargetLabel(plan.target)} ingress reconciled.`);
         console.log(JSON.stringify(receipt, null, 2));
         return;
     }
     const prepareOnly = booleanFlag(parsed, "prepare-only");
+    const reconcileSandboxEnvironment = sandboxEnvironmentReconciler(artifact, reusableSandboxEnvironmentResolution(artifact, plan.environment));
     console.log(`${prepareOnly ? "Preparing" : "Publishing"} Assembly Line revision ${plan.agentRevision} with ${plan.target}.`);
     const migrationRequest = configuredMigrationRequest(artifact, parsed);
-    const { providerReceipt, migrationStatus, lifecycle } = await executeDeployLifecycle({
+    const progressStages = [
+        "preflight",
+        ...(reconcileSandboxEnvironment ? ["sandbox-environment"] : []),
+        "prepare",
+        "secrets",
+        "migrations",
+        ...(!prepareOnly ? ["activate"] : []),
+        ...(publisher.cleanup ? ["cleanup"] : [])
+    ];
+    const progressLabels = {
+        preflight: "Checking provider and host",
+        "sandbox-environment": "Reconciling sandbox environment",
+        prepare: "Uploading artifact and preparing runtime image",
+        secrets: "Reconciling runtime secrets",
+        migrations: "Running migrations",
+        activate: "Activating and health-checking the release",
+        cleanup: "Cleaning managed deployment artifacts"
+    };
+    const { providerReceipt, migrationStatus, lifecycle, sandboxEnvironment } = await executeDeployLifecycle({
         publisher,
         artifact,
         plan,
         migrationRequest,
         activate: !prepareOnly,
-        syncSecrets: () => syncDeploySecretsIfRequested(publisher, plan, parsed, agentRoot),
-        runFallbackMigrations: () => runConfiguredMigrations(artifact, plan, migrationRequest)
+        ...(reconcileSandboxEnvironment ? { reconcileSandboxEnvironment } : {}),
+        syncSecrets: () => syncDeploySecretsIfRequested(publisher, plan, parsed, agentRoot, deployEnv),
+        runFallbackMigrations: () => runConfiguredMigrations(artifact, plan, migrationRequest),
+        onProgress: (stage) => {
+            const index = progressStages.indexOf(stage);
+            if (index >= 0)
+                console.log(`[${index + 1}/${progressStages.length}] ${progressLabels[stage]}`);
+        }
     });
-    const receipt = {
+    const providerLifecycleReceipt = {
         ...providerReceipt,
         migrationStatus,
+        ...(sandboxEnvironment ? { sandboxEnvironment } : {}),
         ...(Object.keys(lifecycle).length > 0 ? { lifecycle } : {})
     };
+    const receipt = withReleaseSnapshot(providerLifecycleReceipt, releaseSnapshotForReceipt(release, providerLifecycleReceipt, !prepareOnly));
     writeDeployReceipt(artifact.root, plan, receipt);
+    if (!prepareOnly)
+        await wireDeployedConnectionEvents(artifact.manifest, receipt);
     console.log(`${deployTargetLabel(plan.target)} deploy ${prepareOnly ? "prepared" : "completed"}.`);
     if (artifact.manifest.deploymentRequirements?.remoteExecution) {
         console.log(`Codex CLI and persistent credential storage are provisioned. Run \`assembly-line auth codex <agentRoot> --target ${plan.target} --env ${plan.environment}${prepareOnly ? " --prepared" : ""}\` to complete device authentication; OAuth tokens are not deployment secrets.`);
     }
     console.log(JSON.stringify(receipt, null, 2));
 }
+async function deployActionWithCleanup(publisher, artifact, plan, action) {
+    try {
+        const receipt = await action();
+        const cleanup = await executeDeployCleanup({ publisher, artifact, plan });
+        return cleanup ? { ...receipt, cleanup } : receipt;
+    }
+    catch (error) {
+        await executeDeployCleanup({ publisher, artifact, plan });
+        throw error;
+    }
+}
+async function wireDeployedConnectionEvents(manifest, receipt) {
+    if (!manifest.connections.some((connection) => connection.events?.enabled))
+        return;
+    const deploymentUrl = receiptField(receipt, "deploymentUrl");
+    if (!deploymentUrl) {
+        console.warn("Connection events were not wired because the deploy target did not return a public deployment URL. Run `assembly-line connections wire <agentRoot> --url <publicUrl>` after ingress is available.");
+        return;
+    }
+    const result = await wireConnectionEvents({
+        baseUrl: deploymentUrl,
+        ...(process.env.ASSEMBLY_LINE_ADMIN_TOKEN ? { token: process.env.ASSEMBLY_LINE_ADMIN_TOKEN } : {}),
+        force: false
+    });
+    console.log("Connection event subscriptions reconciled.");
+    console.log(JSON.stringify(result, null, 2));
+}
+function receiptField(receipt, name) {
+    if (!receipt || typeof receipt !== "object" || Array.isArray(receipt))
+        return undefined;
+    const value = receipt[name];
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function sandboxEnvironmentReconciler(artifact, reusableResolution) {
+    const definition = artifact.manifest.gateway.sandbox;
+    if (!definition || definition.kind === "local")
+        return undefined;
+    const sandbox = artifact.manifest.sandboxes.find((candidate) => candidate.adapter === definition.kind && candidate.environment);
+    const environment = sandbox?.environment;
+    if (!sandbox || !environment)
+        return undefined;
+    if (reusableResolution)
+        return async () => reusableResolution;
+    return async () => {
+        const passthroughEnv = sandboxPassthroughEnv(process.env, sandbox.env);
+        const provider = await resolveProvider("sandbox", definition, {
+            env: process.env,
+            fetch,
+            manifest: artifact.manifest,
+            artifactRoot: artifact.root,
+            providerRoot: fileURLToPath(new URL("..", import.meta.url)),
+            devMode: false
+        }, {
+            ...(sandbox.image ? { image: sandbox.image } : {}),
+            environment,
+            ...(Object.keys(passthroughEnv).length > 0 ? { env: passthroughEnv } : {}),
+            ...(sandbox.workingDirectory ? { workingDirectory: sandbox.workingDirectory } : {}),
+            agentId: artifact.manifest.agent.id ?? artifact.manifest.agent.name ?? "agent",
+            sandboxName: sandbox.name
+        });
+        if (!provider.ensureEnvironment) {
+            throw new Error(`Sandbox provider ${definition.kind} cannot reconcile the compiled environment for ${sandbox.name}.`);
+        }
+        return provider.ensureEnvironment({
+            agentId: artifact.manifest.agent.id ?? artifact.manifest.agent.name ?? "agent",
+            sandboxName: sandbox.name,
+            adapter: definition.kind,
+            artifactRoot: artifact.root,
+            environment
+        });
+    };
+}
+/**
+ * Reuse a sandbox artifact proven by a successful receipt when its provider and
+ * content fingerprint are unchanged. Runtime credentials stay on the host;
+ * only the provider-safe artifact reference crosses deploys.
+ */
+export function reusableSandboxEnvironmentResolution(artifact, environmentName) {
+    const definition = artifact.manifest.gateway.sandbox;
+    if (!definition || definition.kind === "local")
+        return undefined;
+    const sandbox = artifact.manifest.sandboxes.find((candidate) => candidate.adapter === definition.kind && candidate.environment);
+    const fingerprint = sandbox?.environment?.fingerprint;
+    if (!fingerprint)
+        return undefined;
+    const candidates = [
+        environmentReceiptPath(artifact.root, environmentName),
+        resolve(artifact.root, "deployment.json")
+    ];
+    for (const path of candidates) {
+        try {
+            const receipt = JSON.parse(readFileSync(path, "utf8"));
+            if (receipt.status !== "published" || receipt.environment !== environmentName)
+                continue;
+            const resolution = receipt.sandboxEnvironment;
+            if (!isSandboxEnvironmentResolution(resolution))
+                continue;
+            if (resolution.provider !== definition.kind || resolution.fingerprint !== fingerprint)
+                continue;
+            return { ...resolution, action: "reused" };
+        }
+        catch {
+            // Missing, stale, or malformed receipts are not reuse evidence.
+        }
+    }
+    return undefined;
+}
+function isSandboxEnvironmentResolution(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return ["provider", "artifactKind", "fingerprint", "artifactId", "runtimeReference"]
+        .every((key) => typeof record[key] === "string" && record[key].length > 0)
+        && ["reused", "built", "external"].includes(String(record.action));
+}
+export function sandboxPassthroughEnv(env, names) {
+    const values = {};
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined)
+            values[name] = value;
+    }
+    const sensitive = Object.keys(values).filter(isSensitiveSandboxEnvName);
+    if (sensitive.length > 0) {
+        throw new Error(`Refusing host/control-plane secrets in global sandbox env: ${sensitive.join(", ")}.`);
+    }
+    return values;
+}
 function deployTargetLabel(target) {
     if (target === "railway")
         return "Railway";
@@ -358,7 +568,7 @@ function stringOption(definition, name) {
 }
 function configuredMigrationRequest(artifact, parsed) {
     const entries = migrationEntriesForArtifact(artifact);
-    const command = stringFlag(parsed, "migration-command") ?? process.env.OPENEVE_MIGRATION_COMMAND;
+    const command = stringFlag(parsed, "migration-command") ?? process.env.ASSEMBLY_LINE_MIGRATION_COMMAND;
     if (entries.length > 0 && !command) {
         throw new Error("Migration files are present, but no migration runner was configured. Pass --migration-command or set ASSEMBLY_LINE_MIGRATION_COMMAND.");
     }
@@ -375,18 +585,12 @@ async function runConfiguredMigrations(artifact, plan, request) {
     console.log(`Running ${entries.length} migration file(s) with ${commandName}.`);
     const result = await runCommand(commandName, [], {
         cwd: artifact.root,
-        // Both spellings, permanently (the env-alias mirror never soaks out) so
-        // migration runners written against either prefix keep working.
         env: {
             ...process.env,
             ASSEMBLY_LINE_ARTIFACT_ROOT: artifact.root,
             ASSEMBLY_LINE_AGENT_REVISION: plan.agentRevision,
             ASSEMBLY_LINE_DEPLOY_ENV: plan.environment,
-            ASSEMBLY_LINE_MIGRATION_FILES: JSON.stringify(entries),
-            OPENEVE_ARTIFACT_ROOT: artifact.root,
-            OPENEVE_AGENT_REVISION: plan.agentRevision,
-            OPENEVE_DEPLOY_ENV: plan.environment,
-            OPENEVE_MIGRATION_FILES: JSON.stringify(entries)
+            ASSEMBLY_LINE_MIGRATION_FILES: JSON.stringify(entries)
         }
     });
     if (result.exitCode !== 0) {
@@ -441,6 +645,7 @@ function localDeployReceipt(artifact, plan, status, deploymentUrl) {
         status,
         environment: plan.environment,
         agentRevision: plan.agentRevision,
+        buildRevision: plan.buildRevision ?? plan.agentRevision,
         artifactRoot: artifact.root,
         deploymentUrl,
         completedAt: new Date().toISOString()