@defrex/autobuild 0.11.0 → 0.12.0

package/packages/core/src/cli/connect.ts

@@ -0,0 +1,261 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import { access, readFile, rename, unlink, writeFile } from 'node:fs/promises'
+import { constants } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { parse } from 'smol-toml'
+import {
+  normalizeConnectionRepository,
+  normalizeServiceURL,
+  type ConnectionStarted,
+  type ConnectionOutcome,
+} from '../connection'
+import type { Exec } from '../ports/workspace/git-worktree'
+import { resolveMainRepo } from './repo-state'
+import { ProjectCredentials } from './project-credentials'
+
+interface ConnectOptions {
+  cwd: string
+  env: Record<string, string | undefined>
+  exec: Exec
+  print: (message: string) => void
+  signal?: AbortSignal
+  fetch?: (input: string, init?: RequestInit) => Promise<Response>
+  browser?: (url: string) => Promise<void>
+  sleep?: (ms: number) => Promise<void>
+  now?: () => number
+}
+function requireOperator(env: ConnectOptions['env']) {
+  if (
+    ['AB_BUILD', 'AB_PHASE', 'AB_SESSION', 'AB_HARVEST', 'AB_REPO'].some(
+      (key) => env[key] !== undefined,
+    )
+  )
+    throw new Error('connect and disconnect are unavailable inside build or harvest sessions')
+}
+async function project(opts: ConnectOptions) {
+  requireOperator(opts.env)
+  const checkout = await resolveMainRepo(opts.cwd, opts.exec)
+  const remote = await opts.exec(['git', 'remote', 'get-url', 'origin'], { cwd: checkout })
+  if (remote.exitCode !== 0 || !remote.stdout.trim())
+    throw new Error('A network origin remote is required; add an origin before running ab connect')
+  const repo = normalizeConnectionRepository(remote.stdout.trim())
+  const path = join(checkout, 'autobuild.toml')
+  const text = await readFile(path, 'utf8')
+  const table = parse(text)
+  const store = table.store as { url?: unknown } | undefined
+  if (store && (typeof store !== 'object' || Array.isArray(store)))
+    throw new Error('Invalid [store] configuration')
+  const service = store?.url === undefined ? undefined : normalizeServiceURL(String(store.url))
+  return { checkout, repo, path, text, table, service }
+}
+async function request(
+  opts: ConnectOptions,
+  service: string,
+  path: string,
+  body?: unknown,
+  token?: string,
+) {
+  const response = await (opts.fetch ?? fetch)(`${service}/connect/v1/${path}`, {
+    method: body === undefined ? 'GET' : 'POST',
+    headers: {
+      'content-type': 'application/json',
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    signal: AbortSignal.timeout(15000),
+    redirect: 'error',
+  })
+  return response
+}
+async function revoke(opts: ConnectOptions, service: string, token: string) {
+  const response = await request(opts, service, 'revoke', {}, token)
+  if (!response.ok && response.status !== 401)
+    throw new Error('Remote revocation failed; retry ab disconnect when the service is reachable')
+}
+async function atomicConfig(path: string, before: string, after: string) {
+  const temporary = `${path}.${randomUUID()}.tmp`
+  try {
+    await writeFile(temporary, after, { flag: 'wx' })
+    if ((await readFile(path, 'utf8')) !== before)
+      throw new Error('autobuild.toml changed during connection; retry ab connect')
+    await rename(temporary, path)
+  } finally {
+    await unlink(temporary).catch(() => {})
+  }
+}
+export async function abConnect(raw: string | undefined, opts: ConnectOptions): Promise<void> {
+  const p = await project(opts)
+  const credentials = new ProjectCredentials(opts.env)
+  if (raw === undefined) {
+    if (!p.service) {
+      opts.print(
+        `Project: ${p.repo}\nService: unconfigured\nCredential: missing; run ab connect <url>`,
+      )
+      return
+    }
+    const entry = credentials.load(p.service, p.repo)
+    let status = 'missing; run ab connect'
+    if (entry) {
+      try {
+        const response = await request(opts, p.service, 'status', undefined, entry.token)
+        if (response.ok) {
+          const body = (await response.json()) as {
+            repo?: string
+            credentialId?: string
+            accepted?: boolean
+          }
+          if (body.repo !== p.repo || body.credentialId !== entry.id || body.accepted !== true)
+            throw new Error('Invalid status response')
+        }
+        status = response.ok
+          ? 'accepted'
+          : response.status === 401 || response.status === 403
+            ? 'rejected; run ab connect'
+            : 'unreachable'
+      } catch {
+        status = 'unreachable'
+      }
+    }
+    opts.print(`Service: ${p.service}\nProject: ${p.repo}\nCredential: ${status}`)
+    return
+  }
+  const service = normalizeServiceURL(raw)
+  if (p.service && p.service !== service)
+    throw new Error(
+      'Configured [store] url differs; update it explicitly before connecting to another service',
+    )
+  await access(p.path, constants.W_OK)
+  await access(dirname(p.path), constants.W_OK)
+  const previous = credentials.load(service, p.repo)
+  const id = randomBytes(16).toString('hex'),
+    secret = randomBytes(32).toString('hex')
+  const token = `abp_1_${id}_${secret}`
+  const response = await request(opts, service, 'requests', {
+    repo: p.repo,
+    credentialId: id,
+    digest: createHash('sha256').update(secret).digest('hex'),
+  })
+  if (!response.ok)
+    throw new Error('Could not start connection approval; verify the web-enabled service URL')
+  const started = (await response.json()) as ConnectionStarted
+  if (
+    !/^[a-f0-9]{32}$/.test(started.id) ||
+    !/^[a-f0-9]{64}$/.test(started.capability) ||
+    !/^[A-F0-9]{10}$/.test(started.code) ||
+    !Number.isFinite(Date.parse(started.expiresAt))
+  )
+    throw new Error('Invalid connection response')
+  const verification = `${service}/connect?code=${started.code}`
+  opts.print(`Approve project ${p.repo}\nOpen ${verification}\nCode: ${started.code}`)
+  try {
+    if (opts.browser) await opts.browser(verification)
+    else {
+      const command =
+        process.platform === 'darwin'
+          ? ['open', verification]
+          : process.platform === 'win32'
+            ? ['rundll32', 'url.dll,FileProtocolHandler', verification]
+            : ['xdg-open', verification]
+      const child = Bun.spawn(command, { stdout: 'ignore', stderr: 'ignore' })
+      child.unref()
+    }
+  } catch {
+    opts.print('Browser could not be opened. Use the URL and code on another device.')
+  }
+  const capability = { id: started.id, capability: started.capability }
+  const now = opts.now ?? Date.now
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)))
+  const interval = Math.max(5, Math.min(30, started.interval || 5)) * 1000
+  let approved = false
+  let configChanged = false
+  let saved = false
+  try {
+    let outcome: ConnectionOutcome | undefined
+    while (!opts.signal?.aborted && now() <= Date.parse(started.expiresAt) + interval) {
+      await sleep(interval)
+      const polled = await request(opts, service, 'poll', capability)
+      if (polled.status === 429) continue
+      if (!polled.ok) throw new Error('Approval polling failed; retry ab connect')
+      outcome = (await polled.json()) as ConnectionOutcome
+      if (outcome.status !== 'pending') break
+    }
+    if (!outcome || outcome.status === 'pending' || opts.signal?.aborted) {
+      const cancelled = await request(opts, service, 'cancel', capability)
+      if (!cancelled.ok)
+        throw new Error(
+          'Could not confirm cancellation; use the owner credential list to check this connection',
+        )
+      opts.print(
+        opts.signal?.aborted
+          ? 'Connection cancelled; local configuration unchanged.'
+          : 'Connection timed out; local configuration unchanged.',
+      )
+      return
+    }
+    if (outcome.status !== 'approved') {
+      opts.print(`Connection ${outcome.status}; local configuration unchanged.`)
+      return
+    }
+    approved = true
+    if (outcome.repo !== p.repo || outcome.credentialId !== id)
+      throw new Error('Approval identity mismatch')
+    if (!p.service) {
+      // Dotted root key also supports an existing empty [store] table after it.
+      const after = `store.url = ${JSON.stringify(service)}\n${p.text}`
+      const parsed = parse(after)
+      if ((parsed.store as { url?: string })?.url !== service)
+        throw new Error('Cannot safely update [store] url; add it manually and retry')
+      await atomicConfig(p.path, p.text, after)
+      configChanged = true
+    }
+    credentials.save({ service, repo: p.repo, id, token })
+    saved = true
+    if (previous) {
+      try {
+        await revoke(opts, service, previous.token)
+      } catch {
+        opts.print(
+          `Connected, but the previous credential ${previous.id} could not be revoked; revoke it using the service administrative tools.`,
+        )
+      }
+    }
+    opts.print(`Connected ${p.repo} to ${service}.`)
+    if (configChanged) opts.print(`Updated ${p.path}; review and commit this non-secret setting.`)
+  } catch (error) {
+    if (!saved) {
+      try {
+        const cancelled = await request(opts, service, 'cancel', capability)
+        if (!cancelled.ok) throw new Error()
+      } catch {
+        opts.print(
+          `Could not confirm remote cleanup for credential ${id}; check the service administrative credential list.`,
+        )
+      }
+      if (configChanged) {
+        try {
+          await atomicConfig(p.path, `store.url = ${JSON.stringify(service)}\n${p.text}`, p.text)
+        } catch {
+          opts.print('Restore [store] url manually if needed; configuration changed concurrently.')
+        }
+      }
+    }
+    throw new Error(
+      approved
+        ? 'Connection could not be saved; previous credential retained. Repair local storage and run ab connect again.'
+        : (error as Error).message,
+    )
+  }
+}
+export async function abDisconnect(opts: ConnectOptions): Promise<void> {
+  const p = await project(opts)
+  if (!p.service) throw new Error('No configured service')
+  const credentials = new ProjectCredentials(opts.env)
+  const entry = credentials.load(p.service, p.repo)
+  if (!entry) {
+    opts.print('No stored credential; project configuration and service data retained.')
+    return
+  }
+  await revoke(opts, p.service, entry.token)
+  credentials.remove(p.service, p.repo)
+  opts.print('Disconnected; project registration, data, and [store] url retained.')
+}

package/packages/core/src/cli/dashboard/model.ts

@@ -116,11 +116,9 @@ export interface PipelineStep {
   /** Absent ⇒ the step has never run in the current spec scope ⇒ no time is
    * shown (AC 6). The renderer composes the elapsed segment from this. */
   timing?: StepTiming
-  /** Display-only, like `qualifier`, and never consulted for routing: the
-   * parked merge step's no-consent explanation — why nothing will happen
-   * without operator action, and which control unblocks it. Attached when the
-   * build is current at merge with effective auto-merge off; the terminal
-   * row/detail and the web row/detail render the same words. */
+  /** Display-only policy skip reason or parked merge explanation. The shared
+   * row/detail renderers use this wrapping prose segment for longer reasons;
+   * it is never consulted for routing. */
   reason?: string
 }
 
@@ -752,6 +750,7 @@ export function projectBuildFromFacts(
           : stepResults.some((r) => r.outcome === 'skipped')
             ? 'skipped'
             : undefined,
+        reason: stepResults.find((r) => r.skipCause === 'post-reconcile-policy')?.reason,
         count,
         timing: timingFor(intervals, phase, cycleSince, frozenNow),
       }),

package/packages/core/src/cli/dispatch.ts

@@ -1,3 +1,8 @@
+import { RemoteBuildStore } from '../store/remote/client'
+import { delegateCredential } from '../store/remote/credentials'
+import { isRemoteStoreRef } from './repo-state'
+import { projectToken } from './project-credentials'
+import { settleSummaryRequests } from './pr-summary-publication'
 import { readDispatcherLiveness, StandbyIdentityResolver } from './dispatcher-liveness'
 import { formatDispatcherIdentity } from '../kernel/dispatcher-liveness'
 /**
@@ -182,18 +187,6 @@ export { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT } from '../store/retention'
 // Local uses within this module.
 import { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT as _effectiveConfigKind } from '../store/retention'
 
-/** JSON encoding in the config schema's declarative input shape. Parsed Config
- * has normalized `{steps, stepConfigs}` sections; flattening named step tables
- * lets the frontend validate the artifact with the same strict configSchema. */
-function effectiveConfigContent(config: Config): string {
-  const { verify, finalize, ...root } = config
-  return JSON.stringify({
-    ...root,
-    verify: { steps: verify.steps, ...verify.stepConfigs },
-    finalize: { steps: finalize.steps, ...finalize.stepConfigs },
-  })
-}
-
 /** The pre-build naming prompt. Its output is only a proposal: dispatcher.ts
  * owns strict validation, timeout/failure fallback, and store-wide uniqueness. */
 export function slugNamingPrompt(spec: string): string {
@@ -212,7 +205,7 @@ export function slugNamingPrompt(spec: string): string {
 function definedEnv(env: Record<string, string | undefined>): Record<string, string> {
   const defined: Record<string, string> = {}
   for (const [key, value] of Object.entries(env)) {
-    if (value !== undefined) defined[key] = value
+    if (value !== undefined && key !== 'AB_TOKEN') defined[key] = value
   }
   return defined
 }
@@ -264,6 +257,7 @@ interface ResumePrompt {
 /** The real adapters the loop drives — resolved by `wire` (default: the
  * production ports; tests inject fakes). */
 export interface DispatchWiring {
+  credentialIssuer?: typeof delegateCredential
   store: BuildStore
   tickets: TicketSource
   forge: Forge
@@ -282,7 +276,7 @@ export interface DispatchWiring {
    * same store as `store`, so an agent's `ab` commands write where the
    * dispatcher reads. */
   storeRef: string
-  /** Scoped token for a remote store (D8, `AB_TOKEN`); passed to sessions. */
+  /** Private parent authority for remote exchange; never passed to execution. */
   token?: string
   ids: IdSource
   uuids: UuidSource
@@ -2231,7 +2225,7 @@ class DispatchLoop {
     }
 
     const { store, tickets, runtimes, ids, uuids, clock, storeRef, token } = this.wiring
-    const runner = new HarvestRunner({
+    const harvestDeps = {
       store,
       tickets,
       config: this.currentConfig().config,
@@ -2246,16 +2240,66 @@ class DispatchLoop {
       ...(this.repoLeaseHolder !== undefined ? { leaseHolder: this.repoLeaseHolder } : {}),
       sessionEnv: {
         AB_STORE: storeRef,
-        ...(token !== undefined ? { AB_TOKEN: token } : {}),
       },
       opts: {
         maxRecoveryAttempts: this.maxHarvestRecoveryAttempts,
       },
-    })
+    }
 
     let tracked: Promise<void>
-    tracked = runner
-      .run()
+    tracked = (async () => {
+      if (!/^https?:/i.test(storeRef)) return new HarvestRunner(harvestDeps).run()
+      const prepared = await new HarvestRunner(harvestDeps).run(true)
+      if (prepared.outcome !== 'prepared') return prepared
+      await this.repoView.appendRepo(this.repoIdentity, {
+        actor: DISPATCHER,
+        type: 'harvest.execution.authorized',
+        payload: {
+          execution: harvestDeps.instance,
+          run: prepared.run,
+          launch: prepared.launch,
+          leaseHolder: this.repoLeaseHolder ?? harvestDeps.instance,
+        },
+      })
+      const scoped = await (this.wiring.credentialIssuer ?? delegateCredential)(storeRef, token, {
+        kind: 'harvest-runner',
+        execution: harvestDeps.instance,
+        repo: this.repoIdentity,
+        id: prepared.run,
+        leaseHolder: this.repoLeaseHolder ?? harvestDeps.instance,
+      })
+      const runnerStore = new RemoteBuildStore({ url: storeRef, token: scoped })
+      try {
+        const runnerTickets =
+          harvestDeps.config.tickets.source === 'hosted'
+            ? await createTicketSource(
+                harvestDeps.config.tickets,
+                { ...this.opts.env, AB_STORE: storeRef, AB_TOKEN: scoped },
+                this.opts.targetRepo,
+                resolveRepoStatePaths({
+                  repo: this.repoIdentity,
+                  checkout: this.opts.targetRepo,
+                  storeRef,
+                }).localStateRoot,
+                this.wiring.plugins,
+              )
+            : harvestDeps.tickets
+        return await new HarvestRunner({
+          ...harvestDeps,
+          store: runnerStore,
+          tickets: runnerTickets,
+          preparedRun: { run: prepared.run },
+          sessionEnv: { AB_STORE: storeRef, AB_TOKEN: scoped },
+        }).run()
+      } finally {
+        await runnerStore.appendRepo(this.repoIdentity, {
+          actor: DISPATCHER,
+          type: 'harvest.execution.ended',
+          payload: { execution: harvestDeps.instance, run: prepared.run },
+        })
+        await runnerStore.close()
+      }
+    })()
       .then((result) => {
         this.recordHarvestResult(result)
         if (
@@ -2299,6 +2343,24 @@ class DispatchLoop {
    * contract: provisioning takes minutes and must never stall a tick; the
    * single-flight guard covers the whole span. Every failure is contained
    * and retried on a later threshold tick. */
+  private async prepareHarvest(instance: string): Promise<HarvestRunnerResult> {
+    return new HarvestRunner({
+      store: this.wiring.store,
+      tickets: this.wiring.tickets,
+      config: this.currentConfig().config,
+      getConfig: () => this.currentConfig().config,
+      runtimes: this.wiring.runtimes,
+      repo: this.repoIdentity,
+      workspacePath: this.opts.targetRepo,
+      ids: this.wiring.ids,
+      uuids: this.wiring.uuids,
+      clock: this.wiring.clock,
+      instance,
+      ...(this.repoLeaseHolder ? { leaseHolder: this.repoLeaseHolder } : {}),
+      opts: { maxRecoveryAttempts: this.maxHarvestRecoveryAttempts },
+    }).run(true)
+  }
+
   private async launchHostedHarvest(
     harvestExecution: HarvestExecution,
     execution: string,
@@ -2349,13 +2411,44 @@ class DispatchLoop {
         if (pressure.trigger === undefined) return
       }
 
-      handle = await harvestExecution.start({
-        storeRef,
-        repo,
-        instance: execution,
-        baseBranch: this.currentConfig().config.baseBranch,
-        ...(this.repoLeaseHolder !== undefined ? { leaseHolder: this.repoLeaseHolder } : {}),
+      const prepared = await this.prepareHarvest(execution)
+      if (prepared.outcome !== 'prepared') return
+      await this.repoView.appendRepo(repo, {
+        actor: DISPATCHER,
+        type: 'harvest.execution.authorized',
+        payload: {
+          execution,
+          run: prepared.run,
+          launch: prepared.launch,
+          leaseHolder: this.repoLeaseHolder ?? execution,
+        },
       })
+      const launchAuth = /^https?:/i.test(storeRef)
+        ? {
+            token: await (this.wiring.credentialIssuer ?? delegateCredential)(
+              storeRef,
+              this.wiring.token,
+              {
+                kind: 'harvest-runner',
+                execution,
+                repo,
+                id: prepared.run,
+                leaseHolder: this.repoLeaseHolder ?? execution,
+              },
+            ),
+          }
+        : undefined
+      handle = await harvestExecution.start(
+        {
+          preparedRun: { run: prepared.run },
+          storeRef,
+          repo,
+          instance: execution,
+          baseBranch: this.currentConfig().config.baseBranch,
+          ...(this.repoLeaseHolder !== undefined ? { leaseHolder: this.repoLeaseHolder } : {}),
+        },
+        launchAuth,
+      )
       const identity = handle.identity
       if (
         identity === undefined ||
@@ -2628,7 +2721,7 @@ class DispatchLoop {
     return null
   }
 
-  private async settlePendingPublication(slug: string): Promise<void> {
+  private async settlePendingPublication(slug: string, reservation?: string): Promise<void> {
     // The guest appended through its own handle; settle against fresh state.
     await this.repoView.refreshBuild(slug)
     await settleWorkspacePublication(
@@ -2645,6 +2738,16 @@ class DispatchLoop {
       },
       slug,
     )
+    await settleSummaryRequests({
+      store: this.repoView,
+      forge: this.wiring.forge,
+      slug,
+      workspacePath: this.opts.targetRepo,
+      storeRef: this.wiring.storeRef,
+      clock: this.wiring.clock,
+      holder: `summary:${this.runId}`,
+      ...(reservation === undefined ? {} : { reservation }),
+    })
   }
 
   private async recordInfrastructureFailure(input: {
@@ -2736,13 +2839,25 @@ class DispatchLoop {
       // A prior publication acknowledgement may have been lost after its push
       // reached the durable branch. Reconcile that fact before a replacement
       // runner can rerun the phase and create a non-fast-forward successor.
-      await this.settlePendingPublication(slug)
-      const handle = await owning.execution.start({
-        slug,
-        storeRef: this.wiring.storeRef,
-        instance,
-        workspaceRef,
-      })
+      await this.settlePendingPublication(slug, instance)
+      const launchAuth = /^https?:/i.test(this.wiring.storeRef)
+        ? {
+            token: await (this.wiring.credentialIssuer ?? delegateCredential)(
+              this.wiring.storeRef,
+              this.wiring.token,
+              { kind: 'build-runner', id: slug },
+            ),
+          }
+        : undefined
+      const handle = await owning.execution.start(
+        {
+          slug,
+          storeRef: this.wiring.storeRef,
+          instance,
+          workspaceRef,
+        },
+        launchAuth,
+      )
       active.handle = handle
       const identity = handle.identity ?? {
         provider: owning.name,
@@ -3694,16 +3809,21 @@ function acceptableOriginModeStore(storeRef: string): boolean {
  * names the operator's own machine (local development, integration harnesses).
  * Requirements are validated here so a misconfigured origin-mode launch fails
  * before any side effect. */
-async function resolveOriginModeState(opts: DispatchOpts): Promise<RepoStatePaths> {
+async function resolveOriginModeState(
+  opts: DispatchOpts,
+  configStore?: string,
+): Promise<RepoStatePaths> {
   const identity = normalizeGitRemoteUrl(opts.repository!)
-  const selectedStore = opts.storeRef ?? opts.env.AB_STORE
+  const selectedStore = opts.storeRef?.trim() || opts.env.AB_STORE?.trim() || configStore
   if (selectedStore === undefined || !acceptableOriginModeStore(selectedStore)) {
     throw new Error(
       'origin-mode dispatch requires an HTTPS BuildStore — set AB_STORE (or --store) to the hosted Store URL',
     )
   }
-  if (opts.env.AB_TOKEN === undefined || opts.env.AB_TOKEN === '') {
-    throw new Error('origin-mode dispatch requires AB_TOKEN for the remote Store')
+  if (!projectToken(selectedStore, identity, opts.env)) {
+    throw new Error(
+      'origin-mode dispatch requires a project credential; run ab connect or set AB_TOKEN',
+    )
   }
   // Checkout-less hosts (serverless functions, sandboxes) have no gh CLI and
   // no keyring, and the only workspace provider origin mode can run —
@@ -3721,6 +3841,7 @@ async function resolveOriginModeState(opts: DispatchOpts): Promise<RepoStatePath
   await mkdir(scratch, { recursive: true })
   return resolveRepoStatePaths({
     repo: identity,
+    configStore,
     checkout: scratch,
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
     ...(opts.env.AB_STORE !== undefined ? { envStore: opts.env.AB_STORE } : {}),
@@ -3743,9 +3864,23 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   if (opts.wire !== undefined && opts.nonStoreWire !== undefined) {
     throw new Error('dispatch wire and nonStoreWire are mutually exclusive')
   }
+  const explicitOriginStore = opts.storeRef?.trim() || opts.env.AB_STORE?.trim()
+  if (
+    opts.repository !== undefined &&
+    explicitOriginStore &&
+    !acceptableOriginModeStore(explicitOriginStore)
+  ) {
+    throw new Error(
+      'origin-mode dispatch requires an HTTPS BuildStore — set AB_STORE (or --store) to the hosted Store URL',
+    )
+  }
+  const originConfig =
+    opts.repository !== undefined
+      ? await fetchOriginModeConfig(opts, opts.originConfigTransport)
+      : undefined
   const state =
     opts.repository !== undefined
-      ? await resolveOriginModeState(opts)
+      ? await resolveOriginModeState(opts, originConfig?.config.store?.url)
       : await resolveRepoState({
           targetRepo: opts.targetRepo,
           exec: opts.exec,
@@ -3759,6 +3894,13 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   const resolvedOpts: DispatchOpts = {
     ...opts,
     targetRepo: state.checkout,
+    env: {
+      ...opts.env,
+      AB_STORE: state.storeRef,
+      ...(isRemoteStoreRef(state.storeRef)
+        ? { AB_TOKEN: projectToken(state.storeRef, state.repo, opts.env) }
+        : {}),
+    },
     storeRef: state.storeRef,
     repo: opts.repo ?? state.repo,
   }
@@ -3816,7 +3958,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   if (opts.repository !== undefined) {
     // Origin mode startup config: the base branch's autobuild.toml, fetched
     // through the forge (default branch first — baseBranch itself is config).
-    const fetched = await fetchOriginModeConfig(opts, opts.originConfigTransport)
+    const fetched = originConfig!
     configContent = fetched.content
     config = fetched.config
     if (config.forge !== 'github') {
@@ -3930,7 +4072,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
           },
           {
             kind: _effectiveConfigKind,
-            content: effectiveConfigContent(effectiveConfig),
+            content: effectiveBuildConfigContent(effectiveConfig),
             metadata: { run: runId, effectiveChanged },
           },
         ],
@@ -3995,7 +4137,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
     [
       {
         kind: _effectiveConfigKind,
-        content: effectiveConfigContent(config),
+        content: effectiveBuildConfigContent(config),
         metadata: { run: runId, revision: 0 },
       },
     ],