@cat-factory/executor-harness 1.31.10 → 1.31.12

package/dist/frontend-infra.js

@@ -59,6 +59,9 @@ function guardProcess(child, label, logger) {
 export async function standUpFrontend(dir, infra, signal, onActivity, logger = log) {
     const startedAt = Date.now();
     const processes = [];
+    // The frontend app's directory: the checkout root, or a monorepo subdirectory when the config
+    // named one. install/build/serve run here and `outputDir`/`mockMappingsPath` are relative to it.
+    const workDir = infra.directory ? join(dir, infra.directory) : dir;
     // Keep the run's inactivity watchdog fed while the (activity-silent) install → build → serve
     // stand-up runs. A real frontend's `install` + `build` can exceed the harness inactivity
     // window (default 10 min, JOB_INACTIVITY_MS) — and unlike the Pi phase this stand-up emits
@@ -96,7 +99,7 @@ export async function standUpFrontend(dir, infra, signal, onActivity, logger = l
         const install = installCommand(infra);
         logger.info('agent(frontend): installing', { command: install.join(' ') });
         const installed = await exec(install[0], install.slice(1), {
-            cwd: dir,
+            cwd: workDir,
             signal,
             timeout: 8 * 60_000,
             maxBuffer: 16 * 1024 * 1024,
@@ -107,7 +110,7 @@ export async function standUpFrontend(dir, infra, signal, onActivity, logger = l
         const buildScript = infra.buildScript ?? DEFAULTS.buildScript;
         logger.info('agent(frontend): building', { buildScript });
         const built = await exec(pm, ['run', buildScript], {
-            cwd: dir,
+            cwd: workDir,
             signal,
             timeout: 12 * 60_000,
             maxBuffer: 16 * 1024 * 1024,
@@ -128,7 +131,7 @@ export async function standUpFrontend(dir, infra, signal, onActivity, logger = l
                     'is only served in static mode; relying on the forwarded env instead', { outputDir });
             }
             const shim = `window.env = ${JSON.stringify(infra.env)};\n`;
-            await writeFile(join(dir, outputDir, 'env.js'), shim, 'utf8').catch((err) => {
+            await writeFile(join(workDir, outputDir, 'env.js'), shim, 'utf8').catch((err) => {
                 // Best-effort, but no longer silent: a missing/renamed output dir would drop the shim
                 // and the app would read no URLs, so surface it in the log for diagnosis.
                 logger.warn('agent(frontend): could not write runtime env shim', {
@@ -139,9 +142,9 @@ export async function standUpFrontend(dir, infra, signal, onActivity, logger = l
         }
         // 3) WireMock for the mocked upstreams. Seeded from the FE repo's mappings dir when present;
         // otherwise it still binds the port (unmatched requests 404, gentler than ECONNREFUSED).
-        processes.push(await startWireMock(dir, infra, wiremockPort, logger));
+        processes.push(await startWireMock(workDir, infra, wiremockPort, logger));
         // 4) Serve the built app.
-        processes.push(startServe(dir, infra, servePort, outputDir, logger));
+        processes.push(startServe(workDir, infra, servePort, outputDir, logger));
         // 5) Health-check the served app AND WireMock before handing off, concurrently (WireMock is
         // a JVM that cold-starts slower than the static server). A dead WireMock would otherwise let
         // the agent start and hit ECONNREFUSED on the app's first mocked-upstream call.

package/dist/job.js

@@ -81,7 +81,7 @@ function parseHarnessAuth(o) {
  * `..` segment) — the agent's cwd is built from this, so a hostile value must never
  * point outside the cloned repo.
  */
-function sanitizeServiceDirectory(value) {
+function sanitizeServiceDirectory(value, field = 'repo.serviceDirectory') {
     if (typeof value !== 'string')
         return undefined;
     const normalized = value
@@ -94,7 +94,7 @@ function sanitizeServiceDirectory(value) {
     if (segments.length === 0)
         return undefined;
     if (segments.some((s) => s === '..')) {
-        throw new Error("Invalid job: 'repo.serviceDirectory' must be a path inside the repo");
+        throw new Error(`Invalid job: '${field}' must be a path inside the repo`);
     }
     return segments.join('/');
 }
@@ -301,8 +301,13 @@ function parseFrontendInfraSpec(o) {
     }
     const servePort = port(o.servePort);
     const wiremockPort = port(o.wiremockPort);
+    // The app's monorepo subdirectory becomes the install/build/serve cwd, so it goes through the
+    // same escape-guard as `repo.serviceDirectory` — strip slashes and reject any `..` segment so a
+    // hostile value can't point the stand-up outside the cloned repo.
+    const directory = sanitizeServiceDirectory(o.directory, 'frontend.directory');
     return {
         kind: 'frontend',
+        ...(directory ? { directory } : {}),
         ...(packageManager ? { packageManager } : {}),
         ...(typeof o.install === 'string' && o.install ? { install: o.install } : {}),
         ...(typeof o.buildScript === 'string' && o.buildScript ? { buildScript: o.buildScript } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/executor-harness",
-  "version": "1.31.10",
+  "version": "1.31.12",
   "description": "Container payload: a thin TypeScript wrapper that runs the Pi coding agent against a cloned repo and opens a PR. Runs in the Cloudflare Container (and, in local native mode, as a host process); carries no secrets.",
   "repository": {
     "type": "git",
@@ -26,8 +26,8 @@
     "hono": "^4.12.27",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
-    "@cat-factory/server": "0.66.6",
-    "@cat-factory/spend": "0.10.71"
+    "@cat-factory/spend": "0.10.73",
+    "@cat-factory/server": "0.67.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/frontend-infra.ts

@@ -83,6 +83,9 @@ export async function standUpFrontend(
 ): Promise<FrontendStandUp> {
   const startedAt = Date.now()
   const processes: ChildProcess[] = []
+  // The frontend app's directory: the checkout root, or a monorepo subdirectory when the config
+  // named one. install/build/serve run here and `outputDir`/`mockMappingsPath` are relative to it.
+  const workDir = infra.directory ? join(dir, infra.directory) : dir
   // Keep the run's inactivity watchdog fed while the (activity-silent) install → build → serve
   // stand-up runs. A real frontend's `install` + `build` can exceed the harness inactivity
   // window (default 10 min, JOB_INACTIVITY_MS) — and unlike the Pi phase this stand-up emits
@@ -121,7 +124,7 @@ export async function standUpFrontend(
     const install = installCommand(infra)
     logger.info('agent(frontend): installing', { command: install.join(' ') })
     const installed = await exec(install[0]!, install.slice(1), {
-      cwd: dir,
+      cwd: workDir,
       signal,
       timeout: 8 * 60_000,
       maxBuffer: 16 * 1024 * 1024,
@@ -133,7 +136,7 @@ export async function standUpFrontend(
     const buildScript = infra.buildScript ?? DEFAULTS.buildScript
     logger.info('agent(frontend): building', { buildScript })
     const built = await exec(pm, ['run', buildScript], {
-      cwd: dir,
+      cwd: workDir,
       signal,
       timeout: 12 * 60_000,
       maxBuffer: 16 * 1024 * 1024,
@@ -158,7 +161,7 @@ export async function standUpFrontend(
         )
       }
       const shim = `window.env = ${JSON.stringify(infra.env)};\n`
-      await writeFile(join(dir, outputDir, 'env.js'), shim, 'utf8').catch((err) => {
+      await writeFile(join(workDir, outputDir, 'env.js'), shim, 'utf8').catch((err) => {
         // Best-effort, but no longer silent: a missing/renamed output dir would drop the shim
         // and the app would read no URLs, so surface it in the log for diagnosis.
         logger.warn('agent(frontend): could not write runtime env shim', {
@@ -170,10 +173,10 @@ export async function standUpFrontend(
 
     // 3) WireMock for the mocked upstreams. Seeded from the FE repo's mappings dir when present;
     // otherwise it still binds the port (unmatched requests 404, gentler than ECONNREFUSED).
-    processes.push(await startWireMock(dir, infra, wiremockPort, logger))
+    processes.push(await startWireMock(workDir, infra, wiremockPort, logger))
 
     // 4) Serve the built app.
-    processes.push(startServe(dir, infra, servePort, outputDir, logger))
+    processes.push(startServe(workDir, infra, servePort, outputDir, logger))
 
     // 5) Health-check the served app AND WireMock before handing off, concurrently (WireMock is
     // a JVM that cold-starts slower than the static server). A dead WireMock would otherwise let

package/src/job.ts

@@ -146,7 +146,10 @@ function parseHarnessAuth(o: Record<string, unknown>): HarnessAuthFields {
  * `..` segment) — the agent's cwd is built from this, so a hostile value must never
  * point outside the cloned repo.
  */
-function sanitizeServiceDirectory(value: unknown): string | undefined {
+function sanitizeServiceDirectory(
+  value: unknown,
+  field = 'repo.serviceDirectory',
+): string | undefined {
   if (typeof value !== 'string') return undefined
   const normalized = value
     .trim()
@@ -156,7 +159,7 @@ function sanitizeServiceDirectory(value: unknown): string | undefined {
   const segments = normalized.split('/').filter((s) => s !== '' && s !== '.')
   if (segments.length === 0) return undefined
   if (segments.some((s) => s === '..')) {
-    throw new Error("Invalid job: 'repo.serviceDirectory' must be a path inside the repo")
+    throw new Error(`Invalid job: '${field}' must be a path inside the repo`)
   }
   return segments.join('/')
 }
@@ -290,6 +293,12 @@ export interface ServiceInfraSpec {
  */
 export interface FrontendInfraSpec {
   kind: 'frontend'
+  /**
+   * The frontend app's subdirectory within the checkout (a monorepo frontend). Absent ⇒ the
+   * checkout root. When set, install/build/serve run there and `outputDir`/`wiremockMappingsPath`
+   * are resolved relative to it.
+   */
+  directory?: string
   /** Package manager for install/build. Default `pnpm`. */
   packageManager?: 'pnpm' | 'npm' | 'yarn'
   /** Explicit install command, overriding the one derived from `packageManager`. */
@@ -659,8 +668,13 @@ function parseFrontendInfraSpec(o: Record<string, unknown>): FrontendInfraSpec {
   }
   const servePort = port(o.servePort)
   const wiremockPort = port(o.wiremockPort)
+  // The app's monorepo subdirectory becomes the install/build/serve cwd, so it goes through the
+  // same escape-guard as `repo.serviceDirectory` — strip slashes and reject any `..` segment so a
+  // hostile value can't point the stand-up outside the cloned repo.
+  const directory = sanitizeServiceDirectory(o.directory, 'frontend.directory')
   return {
     kind: 'frontend',
+    ...(directory ? { directory } : {}),
     ...(packageManager ? { packageManager } : {}),
     ...(typeof o.install === 'string' && o.install ? { install: o.install } : {}),
     ...(typeof o.buildScript === 'string' && o.buildScript ? { buildScript: o.buildScript } : {}),