@cat-factory/server 0.325.2 → 0.326.1

package/dist/agents/brief.js

@@ -0,0 +1,94 @@
+import { bugFixGuidanceFor, composeBlockSystemPrompt, standardsDeliveredAsFiles, standardsVerbosityFor, userPromptFor, } from '@cat-factory/agents';
+import { dispatchSystemPromptFor } from './promptOverrides.js';
+/**
+ * Compose the executor-independent half of a dispatch's instructions.
+ *
+ * `dispatch` carries the resolved checkout facts for the kinds whose own prompt names a branch.
+ * Both callers have one (a delegated executor gets a checkout too: its own), which is the
+ * difference between this and an inline caller, and it is why the parameter is required here
+ * rather than optional as it is on `userPromptFor`.
+ */
+export function composeAgentBriefCore(context, registry, dispatch) {
+    return {
+        roleSystemPrompt: composeRoleSystemPrompt(context, registry),
+        // `materialized: true` on BOTH paths: linked context renders as an index pointing at the
+        // `.cat-context/` files rather than folding their bodies into the prompt, because the files
+        // themselves travel beside it. A delegated executor that cannot materialise them has to fold
+        // the bodies into its own input instead: the brief carries both halves so either is possible,
+        // and rendering the index for one caller and the bodies for the other would mean the two
+        // executors were briefed differently on the same task.
+        userPrompt: userPromptFor(context, registry, { materialized: true, dispatch }),
+        contextFiles: [...(context.injectedContextFiles ?? [])],
+    };
+}
+/**
+ * The role prompt for one dispatch: the workspace's override (or the shipped track prompt), the
+ * block's resolved standards at this kind's verbosity, and its trait guidance.
+ *
+ * Its own exported function because two dispatch paths must produce the identical string from one
+ * context. It is the piece a workspace actually EDITS, so a drift here is the failure that matters
+ * most: the standards a team agreed on reaching one executor and not the other, with nothing
+ * anywhere reporting it.
+ */
+export function composeRoleSystemPrompt(context, registry) {
+    return composeBlockSystemPrompt(dispatchSystemPromptFor(context, registry), context.block, registry.standardsDelivery(context.agentKind), standardsDeliveredAsFiles(context.injectedContextFiles), standardsVerbosityFor(context.agentKind, registry));
+}
+/**
+ * Build the {@link DelegationBrief} for one delegated dispatch.
+ *
+ * `ownService` is FILLED IN rather than forwarded optionally: the brief's contract is a
+ * discriminated result, and an omitted one reads to a model exactly like a task whose product is
+ * obvious. A context that carries none genuinely does not know which system the work belongs to,
+ * and `not-under-a-service` is what says so.
+ */
+export function composeDelegationBrief(context, registry, args) {
+    const dispatch = {
+        baseBranch: args.target.branches.base,
+        // The executor checks out the work branch: a delegated step is a producer, and the branch every
+        // step of this run's pipeline shares is the one its change has to land on.
+        checkoutBranch: args.target.branches.work,
+        workBranch: args.target.branches.work,
+        // One repo. A delegated executor is handed one repository and one branch pair; the multi-repo
+        // fan-out is a property of OUR harness's sibling checkouts, and claiming it here would have a
+        // kind's prompt describe checkouts the external system never makes.
+        multiRepo: false,
+    };
+    const core = composeAgentBriefCore(context, registry, dispatch);
+    // Bug-fix guidance rides the brief for the same reason it rides a container coding dispatch: it
+    // is about the WORK (fix the reported defect, do not merely satisfy the reproduction test), not
+    // about the machine. Empty for every kind and every run that no `repro-test` preceded.
+    const bugFix = bugFixGuidanceFor(context);
+    return {
+        correlationKey: args.correlationKey,
+        workspaceId: args.workspaceId,
+        // The same value `task.id` carries, stated twice because the two are different contracts: this
+        // one is the LOOKUP KEY `deps.repoFiles` takes beside the workspace, and `task` is the work's
+        // identity as an executor records it. An executor keying its repository read off the identity
+        // is one rename away from a resolver that answers nothing.
+        blockId: args.blockId,
+        runId: args.runId,
+        stepIndex: args.stepIndex,
+        agentKind: context.agentKind,
+        task: {
+            id: args.blockId,
+            title: context.block.title,
+            description: context.block.description,
+            ...(args.target.trackerRef ? { trackerRef: args.target.trackerRef } : {}),
+        },
+        repo: args.target.repo,
+        branches: args.target.branches,
+        systemPrompt: bugFix ? `${core.roleSystemPrompt}\n\n${bugFix}` : core.roleSystemPrompt,
+        userPrompt: core.userPrompt,
+        contextFiles: core.contextFiles,
+        ownService: ownServiceFor(context),
+    };
+}
+/** The discriminated own-service answer, defaulting to the one that SAYS the platform does not know. */
+function ownServiceFor(context) {
+    return context.ownService ?? { stated: false, reason: 'not-under-a-service' };
+}
+/** Narrow a repo projection's stored provider to the union, defaulting to the pre-column value. */
+export function briefRepoProvider(provider) {
+    return provider ?? 'github';
+}
+//# sourceMappingURL=brief.js.map

package/dist/agents/brief.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brief.js","sourceRoot":"","sources":["../../src/agents/brief.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAmC9D;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAwB,EACxB,QAA2B,EAC3B,QAA8B;IAE9B,OAAO;QACL,gBAAgB,EAAE,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC5D,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,yFAAyF;QACzF,uDAAuD;QACvD,UAAU,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC9E,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;KACxD,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAwB,EACxB,QAA2B;IAE3B,OAAO,wBAAwB,CAC7B,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC1C,OAAO,CAAC,KAAK,EACb,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,EAC7C,yBAAyB,CAAC,OAAO,CAAC,oBAAoB,CAAC,EACvD,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CACnD,CAAA;AACH,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,QAA2B,EAC3B,IAOC;IAED,MAAM,QAAQ,GAAyB;QACrC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QACrC,gGAAgG;QAChG,2EAA2E;QAC3E,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QACzC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QACrC,8FAA8F;QAC9F,8FAA8F;QAC9F,oEAAoE;QACpE,SAAS,EAAE,KAAK;KACjB,CAAA;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC/D,gGAAgG;IAChG,gGAAgG;IAChG,uFAAuF;IACvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACzC,OAAO;QACL,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,+FAA+F;QAC/F,8FAA8F;QAC9F,8FAA8F;QAC9F,2DAA2D;QAC3D,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,OAAO;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;YAC1B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E;QACD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAC9B,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,gBAAgB,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACtF,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC;KACnC,CAAA;AACH,CAAC;AAED,wGAAwG;AACxG,SAAS,aAAa,CAAC,OAAwB;IAC7C,OAAO,OAAO,CAAC,UAAU,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;AAC/E,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,QAAiC;IACjE,OAAO,QAAQ,IAAI,QAAQ,CAAA;AAC7B,CAAC"}

package/dist/agents/containerJobAddressing.d.ts

@@ -1,25 +1,6 @@
 import type { AgentJobHandle, RunnerImageVariant, RunnerJobRef } from '@cat-factory/kernel';
 import type { AgentKindRegistry } from '@cat-factory/agents';
-/**
- * The harness job id for one dispatch: the run (execution) id, the agent kind, and — past the
- * first job of that kind in the run — the `dispatchEpoch`. A run executes a sequence of steps that
- * all share the one per-run container, so each job needs an id that is UNIQUE WITHIN THE RUN: the
- * harness keys its per-kind job registries by it, and two jobs sharing an id alias there (the bug
- * where an `architect` /explore poll read back the `spec-writer`'s /spec result). The run itself is
- * addressed separately by the execution id (the {@link RunnerJobRef.runId}).
- *
- * The epoch is what makes that uniqueness total, because the engine dispatches one kind more than
- * once per run in two ways: a step RE-dispatched (a Tester re-test after a fixer round, a gate's
- * helper retry, a companion's rework round, an eviction recovery) and the same helper kind
- * escalated off DIFFERENT steps (`fixer` serves four gates). The harness re-attaches to an EXISTING
- * job id rather than re-running (replay idempotency), and a container-reusing transport — a warm
- * local pool, a self-hosted runner pool — keeps that registry alive across rounds, since reclaiming
- * a pooled member does NOT destroy it. So a reused id replays a completed job: the Tester that
- * appeared to "pass regardless" and never re-tested, an eviction recovery landing back on the job
- * whose runner just died. `dispatchEpochFor` counts the run's prior dispatches of the kind, so the
- * id names the n-th job of that kind and the run's first keeps the unsuffixed shape.
- */
-export declare function stepJobId(executionId: string, agentKind: string, dispatchEpoch?: number): string;
+export { stepJobId } from '@cat-factory/kernel';
 /** The provider slug from a handle's `provider:model` string (fallback when the handle omits `provider`). */
 export declare function providerOf(model: string | undefined): string;
 /**

package/dist/agents/containerJobAddressing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"containerJobAddressing.d.ts","sourceRoot":"","sources":["../../src/agents/containerJobAddressing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAW5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,SAAI,GAAG,MAAM,CAG3F;AAED,6GAA6G;AAC7G,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,iBAAiB,GAC1B,kBAAkB,GAAG,SAAS,CAEhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,QAAQ,EAAE,iBAAiB,GAC1B,CAAC,kBAAkB,GAAG,SAAS,CAAC,EAAE,CAOpC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,YAAY,CAO9F"}
+{"version":3,"file":"containerJobAddressing.d.ts","sourceRoot":"","sources":["../../src/agents/containerJobAddressing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAe5D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,6GAA6G;AAC7G,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,iBAAiB,GAC1B,kBAAkB,GAAG,SAAS,CAEhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,QAAQ,EAAE,iBAAiB,GAC1B,CAAC,kBAAkB,GAAG,SAAS,CAAC,EAAE,CAOpC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,YAAY,CAO9F"}

package/dist/agents/containerJobAddressing.js

@@ -6,29 +6,11 @@
 // context or the job handle, which is what lets the dispatch site and the poll site derive the
 // same answer with nothing carried between them: the poll runs in another process after a
 // durable replay and rebuilds the handle from the persisted step alone.
-/**
- * The harness job id for one dispatch: the run (execution) id, the agent kind, and — past the
- * first job of that kind in the run — the `dispatchEpoch`. A run executes a sequence of steps that
- * all share the one per-run container, so each job needs an id that is UNIQUE WITHIN THE RUN: the
- * harness keys its per-kind job registries by it, and two jobs sharing an id alias there (the bug
- * where an `architect` /explore poll read back the `spec-writer`'s /spec result). The run itself is
- * addressed separately by the execution id (the {@link RunnerJobRef.runId}).
- *
- * The epoch is what makes that uniqueness total, because the engine dispatches one kind more than
- * once per run in two ways: a step RE-dispatched (a Tester re-test after a fixer round, a gate's
- * helper retry, a companion's rework round, an eviction recovery) and the same helper kind
- * escalated off DIFFERENT steps (`fixer` serves four gates). The harness re-attaches to an EXISTING
- * job id rather than re-running (replay idempotency), and a container-reusing transport — a warm
- * local pool, a self-hosted runner pool — keeps that registry alive across rounds, since reclaiming
- * a pooled member does NOT destroy it. So a reused id replays a completed job: the Tester that
- * appeared to "pass regardless" and never re-tested, an eviction recovery landing back on the job
- * whose runner just died. `dispatchEpochFor` counts the run's prior dispatches of the kind, so the
- * id names the n-th job of that kind and the run's first keeps the unsuffixed shape.
- */
-export function stepJobId(executionId, agentKind, dispatchEpoch = 0) {
-    const base = `${executionId}-${agentKind}`;
-    return dispatchEpoch > 0 ? `${base}-${dispatchEpoch}` : base;
-}
+// The per-dispatch job id itself lives in KERNEL (`stepJobId`), because the engine now mints the
+// same string as a delegated step's correlation key and had to be able to commit it before any
+// executor is called. Re-exported here so every existing importer keeps resolving it from the
+// module that addresses container jobs.
+export { stepJobId } from '@cat-factory/kernel';
 /** The provider slug from a handle's `provider:model` string (fallback when the handle omits `provider`). */
 export function providerOf(model) {
     if (!model)

package/dist/agents/containerJobAddressing.js.map

@@ -1 +1 @@
-{"version":3,"file":"containerJobAddressing.js","sourceRoot":"","sources":["../../src/agents/containerJobAddressing.ts"],"names":[],"mappings":"AAGA,8FAA8F;AAC9F,wFAAwF;AACxF,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,+FAA+F;AAC/F,0FAA0F;AAC1F,wEAAwE;AAExE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB,EAAE,SAAiB,EAAE,aAAa,GAAG,CAAC;IACjF,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAA;IAC1C,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9D,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAClD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA6B,EAC7B,QAA2B;IAE3B,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA6B,EAC7B,QAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiC,CAAC,SAAS,CAAC,CAAC,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC7C,IAAI,KAAK,IAAI,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,QAA2B;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACzD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"containerJobAddressing.js","sourceRoot":"","sources":["../../src/agents/containerJobAddressing.ts"],"names":[],"mappings":"AAGA,8FAA8F;AAC9F,wFAAwF;AACxF,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,+FAA+F;AAC/F,0FAA0F;AAC1F,wEAAwE;AAExE,iGAAiG;AACjG,+FAA+F;AAC/F,8FAA8F;AAC9F,wCAAwC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAClD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA6B,EAC7B,QAA2B;IAE3B,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA6B,EAC7B,QAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiC,CAAC,SAAS,CAAC,CAAC,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC7C,IAAI,KAAK,IAAI,KAAK,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,QAA2B;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACzD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAA;AACH,CAAC"}

package/dist/agents/delegatedExecutorHost.d.ts

@@ -0,0 +1,90 @@
+import type { AgentContextRecorder, Clock, DelegatedExecutorRegistry, DelegatedFetch, Logger, ResolveRunRepoContext, TaskRepository, ToolSecretResolver, UrlSafetyPolicy } from '@cat-factory/kernel';
+import type { AgentKindRegistry } from '@cat-factory/agents';
+import { DelegatedAgentExecutor } from './DelegatedAgentExecutor.js';
+import type { ResolveRepoOrigin, ResolveRepoTarget } from './repoTargeting.js';
+/** What a facade supplies to stand the delegated arm up. */
+export interface DelegatedExecutorHostOptions {
+    delegatedExecutorRegistry: DelegatedExecutorRegistry;
+    agentKindRegistry: AgentKindRegistry;
+    resolveRepoTarget: ResolveRepoTarget;
+    /**
+     * Where a repo is reached: the clone URL plus the VCS provider.
+     *
+     * REQUIRED, for the reason `urlSafetyPolicy` below is: optional, the Worker facade simply did
+     * not pass it, and every delegated brief on that facade named a `https://github.com/...` clone
+     * URL, including for repositories on the deployment's own GitLab. A facade with nothing to
+     * resolve passes `githubRepoOrigin` by name.
+     */
+    resolveRepoOrigin: ResolveRepoOrigin;
+    /**
+     * The engine's checkout-free repo binding, re-used as the `repoFiles` an executor may stage its
+     * own context layer through, and as what the engine creates a `platform-creates` work branch
+     * with. The SAME seam a registered kind's pre/post-ops run over, rather than a second binding:
+     * an executor writing `.cat-context/` onto the work branch and a preOp writing it are the same
+     * operation, and two bindings would be two caches and two head memos.
+     *
+     * Absent ⇒ this deployment configured no VCS provider. NOT asserted here even though a
+     * `platform-creates` registration needs it: this function runs inside the Worker's per-request
+     * container build, so a throw turns a delegated-only misconfiguration into a 500 on every
+     * unrelated endpoint, including the settings the operator would go and look at. The dispatch
+     * that actually needs the branch refuses instead, by name and with translated copy
+     * (`delegated_work_branch_unprepared`).
+     */
+    resolveRunRepoContext?: ResolveRunRepoContext;
+    taskRepository?: TaskRepository;
+    resolveToolSecrets?: ToolSecretResolver;
+    agentContextObservability?: AgentContextRecorder;
+    /**
+     * The deployment's outbound-URL policy. The SAME one the notification-webhook sender is held to,
+     * because an executor is an outbound HTTP surface the deployment configured and a second set of
+     * SSRF rules is a set nobody maintains.
+     *
+     * REQUIRED, though its value may be `undefined` (which means the strict public-https default).
+     * Optional, it was declared here, declared on the kernel port, documented on both, and passed by
+     * neither facade: every registered executor was built with an SSRF control that existed only in
+     * the types. A required field makes forgetting it a typecheck failure instead.
+     *
+     * It is ENFORCED here rather than handed to each executor, by wrapping the fetch they are all
+     * built over (see {@link policyCheckedFetch}). An executor is deployment-authored code, and a
+     * control every author has to remember to apply is the same control that existed only in the
+     * types.
+     */
+    urlSafetyPolicy: UrlSafetyPolicy | undefined;
+    /** The runtime's fetch. Defaults to the global one, which both runtimes provide. */
+    fetchImpl?: DelegatedFetch;
+    logger: Logger;
+    clock: Clock;
+}
+/**
+ * Build the delegated arm for the composite executor.
+ *
+ * Built UNCONDITIONALLY, even when the registry is empty. The alternative (a null arm when
+ * nothing is registered) reads as an optimisation and is a trap: a MOTHERSHIP-MODE node resolves
+ * its agent kinds from the mothership and its own registry can be a build behind, so "this process
+ * registers none" is not the same fact as "this run has no delegated step". With the arm always
+ * present, such a step is refused by name (`delegated_executor_unwired`, naming what IS
+ * registered) instead of a bare "no delegated executor wired" from the composite.
+ */
+export declare function buildDelegatedAgentExecutor(options: DelegatedExecutorHostOptions): DelegatedAgentExecutor;
+/**
+ * How long one executor call may take, redirects included, before it is abandoned.
+ *
+ * A delegated executor's own calls are API requests (dispatch, poll, cancel), not the external
+ * WORK, whose hours are bounded by the poll policy instead. Without a deadline a hung endpoint
+ * holds `DelegatedAgentExecutor.pollJob` open for ever, which on Node ties up a pg-boss worker and
+ * on the Worker burns the invocation: the ordinary shape of an outage, and the reason the
+ * notification-webhook sender sets one against this same `safeFetch`. A caller that passes its own
+ * `signal` keeps it.
+ */
+export declare const DELEGATED_REQUEST_TIMEOUT_MS = 30000;
+/**
+ * How much of one response body an executor may read.
+ *
+ * The third protection `safe-fetch` exists for, and the one a wrapper that only re-validates hops
+ * leaves off. An executor is deployment-authored code reading a system's JSON, and a broken or
+ * hostile endpoint answering hundreds of megabytes would otherwise be buffered whole in the
+ * isolate. Generous against the real payloads (a page of Actions runs is a few hundred KB) and
+ * fatal well before an OOM.
+ */
+export declare const DELEGATED_RESPONSE_MAX_BYTES: number;
+//# sourceMappingURL=delegatedExecutorHost.d.ts.map

package/dist/agents/delegatedExecutorHost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegatedExecutorHost.d.ts","sourceRoot":"","sources":["../../src/agents/delegatedExecutorHost.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,KAAK,EAEL,yBAAyB,EACzB,cAAc,EAEd,MAAM,EACN,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAQ5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAW9E,4DAA4D;AAC5D,MAAM,WAAW,4BAA4B;IAC3C,yBAAyB,EAAE,yBAAyB,CAAA;IACpD,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;;OAOG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,yBAAyB,CAAC,EAAE,oBAAoB,CAAA;IAChD;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE,eAAe,GAAG,SAAS,CAAA;IAC5C,oFAAoF;IACpF,SAAS,CAAC,EAAE,cAAc,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,sBAAsB,CA4BxB;AAYD;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,QAAkB,CAAA"}

package/dist/agents/delegatedExecutorHost.js

@@ -0,0 +1,124 @@
+import { UnavailableError } from '@cat-factory/kernel';
+import { assertSafePublicUrl, readCappedText, safeFetch, DEFAULT_MAX_REDIRECTS, } from '@cat-factory/integrations';
+import { DelegatedAgentExecutor } from './DelegatedAgentExecutor.js';
+/**
+ * Build the delegated arm for the composite executor.
+ *
+ * Built UNCONDITIONALLY, even when the registry is empty. The alternative (a null arm when
+ * nothing is registered) reads as an optimisation and is a trap: a MOTHERSHIP-MODE node resolves
+ * its agent kinds from the mothership and its own registry can be a build behind, so "this process
+ * registers none" is not the same fact as "this run has no delegated step". With the arm always
+ * present, such a step is refused by name (`delegated_executor_unwired`, naming what IS
+ * registered) instead of a bare "no delegated executor wired" from the composite.
+ */
+export function buildDelegatedAgentExecutor(options) {
+    const resolveRepoFiles = options.resolveRunRepoContext
+        ? repoFilesResolver(options.resolveRunRepoContext)
+        : undefined;
+    const executorDeps = {
+        logger: options.logger.child({ component: 'delegatedExecutor' }),
+        clock: options.clock,
+        fetchImpl: policyCheckedFetch(options.fetchImpl ?? globalThis.fetch, options.urlSafetyPolicy),
+        ...(resolveRepoFiles ? { repoFiles: resolveRepoFiles } : {}),
+    };
+    return new DelegatedAgentExecutor({
+        ...(resolveRepoFiles ? { resolveRepoFiles } : {}),
+        delegatedExecutorRegistry: options.delegatedExecutorRegistry,
+        agentKindRegistry: options.agentKindRegistry,
+        resolveRepoTarget: options.resolveRepoTarget,
+        resolveRepoOrigin: options.resolveRepoOrigin,
+        ...(options.taskRepository ? { taskRepository: options.taskRepository } : {}),
+        ...(options.resolveToolSecrets ? { resolveToolSecrets: options.resolveToolSecrets } : {}),
+        ...(options.agentContextObservability
+            ? { agentContextObservability: options.agentContextObservability }
+            : {}),
+        executorDeps,
+        logger: options.logger,
+        clock: options.clock,
+    });
+}
+/** Project the engine's run-repo binding down to the narrower shape an executor is handed. */
+function repoFilesResolver(resolveRunRepoContext) {
+    return async ({ workspaceId, blockId }) => {
+        const bound = await resolveRunRepoContext(workspaceId, blockId);
+        return bound?.repo ?? null;
+    };
+}
+/**
+ * How long one executor call may take, redirects included, before it is abandoned.
+ *
+ * A delegated executor's own calls are API requests (dispatch, poll, cancel), not the external
+ * WORK, whose hours are bounded by the poll policy instead. Without a deadline a hung endpoint
+ * holds `DelegatedAgentExecutor.pollJob` open for ever, which on Node ties up a pg-boss worker and
+ * on the Worker burns the invocation: the ordinary shape of an outage, and the reason the
+ * notification-webhook sender sets one against this same `safeFetch`. A caller that passes its own
+ * `signal` keeps it.
+ */
+export const DELEGATED_REQUEST_TIMEOUT_MS = 30_000;
+/**
+ * How much of one response body an executor may read.
+ *
+ * The third protection `safe-fetch` exists for, and the one a wrapper that only re-validates hops
+ * leaves off. An executor is deployment-authored code reading a system's JSON, and a broken or
+ * hostile endpoint answering hundreds of megabytes would otherwise be buffered whole in the
+ * isolate. Generous against the real payloads (a page of Actions runs is a few hundred KB) and
+ * fatal well before an OOM.
+ */
+export const DELEGATED_RESPONSE_MAX_BYTES = 4 * 1024 * 1024;
+/**
+ * The fetch every registered executor is built over: the runtime's own, held to the deployment's
+ * outbound-URL policy on the first URL AND on every redirect hop, given a deadline, and capped on
+ * the way back.
+ *
+ * The SAME guard the notification-webhook sender uses, through the same `safeFetch`, because an
+ * executor is the same kind of surface: an operator-supplied base URL, a credential-bearing
+ * request, and a receiver free to answer 302. Re-validating each hop is the part a plain
+ * scheme check at registration cannot do, and `safeFetch` additionally strips the body and the
+ * credential headers when a hop crosses origins.
+ *
+ * All THREE of that module's protections are applied here rather than two, and for the reason the
+ * policy itself is enforced here: an executor is deployment-authored code, and a control every
+ * author has to remember to apply is a control that exists only in the types.
+ *
+ * A refused URL throws `ValidationError` out of the executor's own call, which its error path
+ * reports like any other refusal from its system.
+ */
+function policyCheckedFetch(fetchImpl, policy) {
+    const assertSafe = (url) => assertSafePublicUrl(url, {
+        subject: 'Delegated executor',
+        label: 'endpoint',
+        ...(policy ? { policy } : {}),
+    });
+    const makeError = (status, message) => new UnavailableError(`A delegated executor's request could not be completed: ${message}`, 'delegated_executor_failed', { status });
+    return async (url, init) => {
+        const response = await safeFetch(url, {
+            ...(init ?? {}),
+            // The caller's own deadline wins where it set one; otherwise the deployment's. The port
+            // declares `signal` as `unknown` (kernel compiles against no runtime's globals), so the
+            // narrowing happens here, where a real `RequestInit` is being built.
+            signal: init?.signal ??
+                AbortSignal.timeout(DELEGATED_REQUEST_TIMEOUT_MS),
+        }, assertSafe, makeError, DEFAULT_MAX_REDIRECTS, fetchImpl);
+        return cappedResponse(response, makeError);
+    };
+}
+/**
+ * The response an executor sees: the real one's status and headers, with the two body readers
+ * routed through the running byte cap.
+ *
+ * A wrapper rather than a rule each executor applies, because the port hands them only `text()`
+ * and `json()` and neither can be bounded from the outside. The cap THROWS rather than truncating,
+ * which is right on this path: a body that overran is not a smaller body, and a JSON reader handed
+ * a prefix would parse a fault as a malformed payload.
+ */
+function cappedResponse(response, makeError) {
+    const read = () => readCappedText(response, DELEGATED_RESPONSE_MAX_BYTES, makeError);
+    return {
+        ok: response.ok,
+        status: response.status,
+        headers: response.headers,
+        text: read,
+        json: async () => JSON.parse(await read()),
+    };
+}
+//# sourceMappingURL=delegatedExecutorHost.js.map

package/dist/agents/delegatedExecutorHost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegatedExecutorHost.js","sourceRoot":"","sources":["../../src/agents/delegatedExecutorHost.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAkEpE;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,MAAM,gBAAgB,GAAG,OAAO,CAAC,qBAAqB;QACpD,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAClD,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,YAAY,GAA0B;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;QAChE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,kBAAkB,CAC3B,OAAO,CAAC,SAAS,IAAK,UAAU,CAAC,KAAmC,EACpE,OAAO,CAAC,eAAe,CACxB;QACD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAA;IACD,OAAO,IAAI,sBAAsB,CAAC;QAChC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;QAC5D,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,yBAAyB;YACnC,CAAC,CAAC,EAAE,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAA;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,iBAAiB,CACxB,qBAA4C;IAE5C,OAAO,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC/D,OAAO,KAAK,EAAE,IAAI,IAAI,IAAI,CAAA;IAC5B,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAA;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,kBAAkB,CACzB,SAAyB,EACzB,MAAmC;IAEnC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CACjC,mBAAmB,CAAC,GAAG,EAAE;QACvB,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,UAAU;QACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAA;IACJ,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CACpD,IAAI,gBAAgB,CAClB,0DAA0D,OAAO,EAAE,EACnE,2BAA2B,EAC3B,EAAE,MAAM,EAAE,CACX,CAAA;IACH,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,EACH;YACE,GAAI,CAAC,IAAI,IAAI,EAAE,CAAqC;YACpD,wFAAwF;YACxF,wFAAwF;YACxF,qEAAqE;YACrE,MAAM,EACH,IAAI,EAAE,MAAkC;gBACzC,WAAW,CAAC,OAAO,CAAC,4BAA4B,CAAC;SACpD,EACD,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,SAAoC,CACrC,CAAA;QACD,OAAO,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC5C,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,QAAkB,EAClB,SAAqD;IAErD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,4BAA4B,EAAE,SAAS,CAAC,CAAA;IACpF,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAY;KACtD,CAAA;AACH,CAAC"}

package/dist/agents/delegationCredentials.d.ts

@@ -0,0 +1,20 @@
+import type { DelegatedExecutorDefinition, Logger, ToolSecretResolver } from '@cat-factory/kernel';
+export interface ResolveDelegationCredentialsInput {
+    definition: DelegatedExecutorDefinition;
+    workspaceId: string;
+    /** The block, so a per-service credential store can scope its lookup. */
+    blockId?: string;
+    /** Facade-wired; absent ⇒ an empty bag, which the executor's own system reports as a refusal. */
+    resolveToolSecrets?: ToolSecretResolver;
+    logger?: Logger;
+}
+/**
+ * Resolve every credential a registered executor declared, keyed by the name the executor reads.
+ *
+ * Never throws and never fails a dispatch. An unresolvable key simply is not in the bag, and the
+ * executor's own call then fails against its own system with that system's own message, which is
+ * strictly more useful than a platform-side refusal that names a key the operator has to go and
+ * map back to a vendor. The WARN below is what makes the gap visible either way.
+ */
+export declare function resolveDelegationCredentials(input: ResolveDelegationCredentialsInput): Promise<Record<string, string>>;
+//# sourceMappingURL=delegationCredentials.d.ts.map

package/dist/agents/delegationCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationCredentials.d.ts","sourceRoot":"","sources":["../../src/agents/delegationCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAiClG,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,2BAA2B,CAAA;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsDjC"}

package/dist/agents/delegationCredentials.js

@@ -0,0 +1,63 @@
+import { noopLogger, runBestEffort } from '@cat-factory/kernel';
+import { credentialInjectionName, isReservedPlatformEnvKey, reservedEnvKeyMessage, } from '@cat-factory/contracts';
+/**
+ * Resolve every credential a registered executor declared, keyed by the name the executor reads.
+ *
+ * Never throws and never fails a dispatch. An unresolvable key simply is not in the bag, and the
+ * executor's own call then fails against its own system with that system's own message, which is
+ * strictly more useful than a platform-side refusal that names a key the operator has to go and
+ * map back to a vendor. The WARN below is what makes the gap visible either way.
+ */
+export async function resolveDelegationCredentials(input) {
+    const declared = input.definition.credentials ?? [];
+    const resolver = input.resolveToolSecrets;
+    if (declared.length === 0 || !resolver)
+        return {};
+    const log = input.logger ?? noopLogger;
+    const admissible = declared.filter((credential) => {
+        if (!isReservedPlatformEnvKey(credential.key))
+            return true;
+        // WARN rather than the `debug` an optional missing key gets: this is never a deployment's
+        // stated normal, and its fix is a declaration rather than a variable to set.
+        log.warn('delegated executor declares a reserved credential key; withholding it', {
+            executor: input.definition.id,
+            credentialKey: credential.key,
+            detail: reservedEnvKeyMessage(credential.key),
+        });
+        return false;
+    });
+    if (admissible.length === 0)
+        return {};
+    const resolved = await runBestEffort(log, 'resolve delegated executor credentials', () => resolver.resolve({
+        workspaceId: input.workspaceId,
+        ...(input.blockId ? { blockId: input.blockId } : {}),
+        subject: { kind: 'delegated-executor', id: input.definition.id },
+        // Distinct LOOKUP keys: one stored value delivered under two names is an allowed
+        // declaration, and asking for the same key twice in one call is not.
+        keys: [...new Set(admissible.map((credential) => credential.key))].map((key) => ({ key })),
+    }), { executor: input.definition.id });
+    const bag = {};
+    for (const credential of admissible) {
+        const value = resolved?.[credential.key];
+        // The bag is keyed by the name the EXECUTOR reads (`envName` when it declared one, else the
+        // lookup key), the same fallback every other capability applies, so a declaration that renames
+        // a key for a vendor's SDK reads the same here as it does in a container.
+        if (value) {
+            bag[credentialInjectionName(credential)] = value;
+            continue;
+        }
+        if (credential.required === false) {
+            log.debug('optional delegated credential did not resolve; calling without it', {
+                executor: input.definition.id,
+                credentialKey: credential.key,
+            });
+            continue;
+        }
+        log.warn('delegated credential did not resolve; the executor is called without it', {
+            executor: input.definition.id,
+            credentialKey: credential.key,
+        });
+    }
+    return bag;
+}
+//# sourceMappingURL=delegationCredentials.js.map

package/dist/agents/delegationCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationCredentials.js","sourceRoot":"","sources":["../../src/agents/delegationCredentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAqC/B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAwC;IAExC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,CAAA;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,CAAA;IACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QAChD,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1D,0FAA0F;QAC1F,6EAA6E;QAC7E,GAAG,CAAC,IAAI,CAAC,uEAAuE,EAAE;YAChF,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;YAC7B,aAAa,EAAE,UAAU,CAAC,GAAG;YAC7B,MAAM,EAAE,qBAAqB,CAAC,UAAU,CAAC,GAAG,CAAC;SAC9C,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,GAAG,EACH,wCAAwC,EACxC,GAAG,EAAE,CACH,QAAQ,CAAC,OAAO,CAAC;QACf,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE;QAChE,iFAAiF;QACjF,qEAAqE;QACrE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;KAC3F,CAAC,EACJ,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAClC,CAAA;IACD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACxC,4FAA4F;QAC5F,+FAA+F;QAC/F,0EAA0E;QAC1E,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,GAAG,KAAK,CAAA;YAChD,SAAQ;QACV,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,CAAC,mEAAmE,EAAE;gBAC7E,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;gBAC7B,aAAa,EAAE,UAAU,CAAC,GAAG;aAC9B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE;YAClF,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;YAC7B,aAAa,EAAE,UAAU,CAAC,GAAG;SAC9B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/agents/delegationWorkBranch.d.ts

@@ -0,0 +1,31 @@
+import { type DelegatedRepoFilesResolver, type DelegationBrief, type Logger } from '@cat-factory/kernel';
+/** What {@link ensureDelegatedWorkBranch} needs, as bound callbacks rather than a container. */
+export interface DelegationWorkBranchDeps {
+    /** Absent ⇒ this deployment configured no VCS provider, which is its own refusal below. */
+    resolveRepoFiles: DelegatedRepoFilesResolver | undefined;
+    logger: Logger;
+}
+/** One request to prepare a branch: whose dispatch it is for, and who may create it. */
+export interface DelegationWorkBranchRequest {
+    executorId: string;
+    /**
+     * Whether the task named this branch itself (an apriori WORKING branch) rather than the engine
+     * deriving `cat-factory/<blockId>`. The platform never CREATES one of those: a run whose user
+     * picked an existing feature branch and found an empty one instead cannot tell that from the
+     * run ignoring their choice. Probed and refused when absent, exactly as the container path
+     * refuses it (`ContainerAgentExecutor.resolveWorkBranchReady`).
+     */
+    apriori: boolean;
+}
+/**
+ * Make sure the brief's work branch exists before the executor is called, creating it at the base
+ * branch's head when the platform is the one allowed to.
+ *
+ * IDEMPOTENT by construction, which both durable drivers require: a replayed dispatch re-reads the
+ * head and finds the ref it made last time. The concurrent case is settled by CONTENT rather than
+ * by parsing a provider's refusal, because the two providers answer a lost create differently (a
+ * GitHub 422, a GitLab 400) and a failing create is indistinguishable from a losing one by status
+ * alone: re-read the ref, and let the write's own error propagate when it genuinely is not there.
+ */
+export declare function ensureDelegatedWorkBranch(deps: DelegationWorkBranchDeps, brief: DelegationBrief, request: DelegationWorkBranchRequest): Promise<void>;
+//# sourceMappingURL=delegationWorkBranch.d.ts.map

package/dist/agents/delegationWorkBranch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegationWorkBranch.d.ts","sourceRoot":"","sources":["../../src/agents/delegationWorkBranch.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,MAAM,EAEZ,MAAM,qBAAqB,CAAA;AAyB5B,gGAAgG;AAChG,MAAM,WAAW,wBAAwB;IACvC,2FAA2F;IAC3F,gBAAgB,EAAE,0BAA0B,GAAG,SAAS,CAAA;IACxD,MAAM,EAAE,MAAM,CAAA;CACf;AAED,wFAAwF;AACxF,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,wBAAwB,EAC9B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CA8Cf"}