@drisp/cli 0.5.4 → 0.5.7

package/dist/athena-gateway.js

@@ -2241,7 +2241,7 @@ var cachedVersion = null;
 function readVersion() {
   if (cachedVersion !== null) return cachedVersion;
   try {
-    const injected = "0.5.4";
+    const injected = "0.5.7";
     if (typeof injected === "string" && injected.length > 0) {
       cachedVersion = injected;
       return cachedVersion;
@@ -2876,17 +2876,18 @@ var InboundQueue = class {
     const row = this.db.prepare("SELECT COUNT(*) as n FROM inbound_queue").get();
     return row.n;
   }
-  enqueue(inbound) {
+  enqueue(inbound, key) {
     if (this.size() >= this.maxEntries) {
       return { kind: "rejected", reason: "queue_full" };
     }
     const stmt = this.db.prepare(
       `INSERT INTO inbound_queue
-				(channel_id, account_id, idempotency_key, payload_json, created_at)
-			 VALUES (?, ?, ?, ?, ?)
+				(attachment_id, channel_id, account_id, idempotency_key, payload_json, created_at)
+			 VALUES (?, ?, ?, ?, ?, ?)
 			 ON CONFLICT(channel_id, account_id, idempotency_key) DO NOTHING`
     );
     const result = stmt.run(
+      key ?? null,
       inbound.location.channelId,
       inbound.location.accountId,
       inbound.idempotencyKey,
@@ -2898,12 +2899,17 @@ var InboundQueue = class {
     }
     return { kind: "queued", id: Number(result.lastInsertRowid) };
   }
-  /** Atomically read and remove all parked entries in FIFO order. */
-  drain() {
+  /** Atomically read and remove parked entries for one attachment slot. */
+  drain(key) {
     return this.db.transaction(() => {
-      const rows = this.db.prepare("SELECT id, payload_json FROM inbound_queue ORDER BY id ASC").all();
+      const rows = this.db.prepare(
+        `SELECT id, payload_json
+					   FROM inbound_queue
+					  WHERE attachment_id IS ?
+				   ORDER BY id ASC`
+      ).all(key ?? null);
       if (rows.length > 0) {
-        this.db.prepare("DELETE FROM inbound_queue").run();
+        this.db.prepare("DELETE FROM inbound_queue WHERE attachment_id IS ?").run(key ?? null);
       }
       return rows.map((r) => ({
         id: r.id,
@@ -3022,7 +3028,7 @@ var DispatchPipeline = class {
     const key = options.attachmentId;
     const current = this.bindingStore.getCurrentByAttachment(key);
     if (!current || !this.bindingStore.hasActiveBindingForAttachment(key)) {
-      const result = this.inboundQueue.enqueue(inbound);
+      const result = this.inboundQueue.enqueue(inbound, key);
       if (result.kind === "queued") {
         this.log?.(
           "info",
@@ -3207,9 +3213,9 @@ var DispatchPipeline = class {
   }
   drainPending(key) {
     const current = this.bindingStore.getCurrentByAttachment(key);
-    if (!current || !this.bindingStore.hasActiveBinding(current.runtimeId))
+    if (!current || !this.bindingStore.hasActiveBindingForAttachment(key))
       return;
-    const parked = this.inboundQueue.drain();
+    const parked = this.inboundQueue.drain(key);
     let dispatched = 0;
     let dropped = 0;
     for (const { inbound } of parked) {
@@ -3548,7 +3554,7 @@ function questionFingerprint(req) {
 import fs3 from "fs";
 import path3 from "path";
 import Database from "better-sqlite3";
-var GATEWAY_STATE_VERSION = 1;
+var GATEWAY_STATE_VERSION = 2;
 function openGatewayState(dbPath) {
   if (dbPath !== ":memory:") {
     fs3.mkdirSync(path3.dirname(dbPath), { recursive: true, mode: 448 });
@@ -3576,6 +3582,7 @@ function initGatewayStateSchema(db) {
 		-- same provider message from being parked twice if an adapter retries.
 		CREATE TABLE IF NOT EXISTS inbound_queue (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			attachment_id TEXT,
 			channel_id TEXT NOT NULL,
 			account_id TEXT NOT NULL,
 			idempotency_key TEXT NOT NULL,
@@ -3611,6 +3618,16 @@ function initGatewayStateSchema(db) {
     db.prepare("INSERT INTO schema_version (version) VALUES (?)").run(
       GATEWAY_STATE_VERSION
     );
+    return;
+  }
+  const inboundColumns = db.prepare("PRAGMA table_info(inbound_queue)").all();
+  if (!inboundColumns.some((column) => column.name === "attachment_id")) {
+    db.prepare("ALTER TABLE inbound_queue ADD COLUMN attachment_id TEXT").run();
+  }
+  if (existing.version < GATEWAY_STATE_VERSION) {
+    db.prepare("UPDATE schema_version SET version = ?").run(
+      GATEWAY_STATE_VERSION
+    );
   }
 }
 

package/dist/{chunk-QVXHUJPH.js → chunk-UKMVFGY2.js}

@@ -7700,6 +7700,8 @@ function generateNeutralTitle(event, g) {
       return truncate(
         `Cloud fn \u2717 ${event.data.function_name}: ${event.data.error_message}`
       );
+    case "artifacts.manifest":
+      return "Artifacts manifest";
   }
 }
 
@@ -11665,6 +11667,7 @@ async function runExec(options) {
   let mappedFinalMessage = null;
   let adapterSessionId = null;
   let activeRunId = null;
+  let beforeTerminalCompletionRan = false;
   let store;
   try {
     store = sessionStoreFactory({
@@ -11787,6 +11790,57 @@ async function runExec(options) {
       feedEvents
     });
   }
+  const runBeforeTerminalCompletion = async () => {
+    if (beforeTerminalCompletionRan || latch.hasFailure() || !options.beforeTerminalCompletion) {
+      return;
+    }
+    beforeTerminalCompletionRan = true;
+    const resolved = resolveFinalMessage({
+      streamMessage: streamFinalMessage,
+      mappedMessage: mappedFinalMessage
+    });
+    const provisionalResult = {
+      success: true,
+      exitCode: EXEC_EXIT_CODE.SUCCESS,
+      athenaSessionId: options.ephemeral ? null : athenaSessionId,
+      adapterSessionId,
+      finalMessage: resolved.message,
+      tokens: cumulativeTokens,
+      durationMs: Math.max(0, now() - startTs)
+    };
+    try {
+      const feedEvents = await options.beforeTerminalCompletion({
+        result: provisionalResult,
+        runId: activeRunId
+      });
+      if (feedEvents && feedEvents.length > 0) {
+        publishFeedEvents(feedEvents);
+      }
+    } catch (error) {
+      latch.register({
+        kind: "output",
+        message: `Artifact upload failed: ${error instanceof Error ? error.message : String(error)}`
+      });
+    }
+  };
+  const writeLastMessageBeforeTerminalCompletion = async () => {
+    if (latch.hasFailure() || !options.outputLastMessagePath) return;
+    const resolved = resolveFinalMessage({
+      streamMessage: streamFinalMessage,
+      mappedMessage: mappedFinalMessage
+    });
+    try {
+      await output.writeLastMessage(
+        options.outputLastMessagePath,
+        resolved.message
+      );
+    } catch (error) {
+      latch.register({
+        kind: "output",
+        message: `Failed writing --output-last-message: ${error instanceof Error ? error.message : String(error)}`
+      });
+    }
+  };
   const unsubscribeEvent = runtime.onEvent((runtimeEvent) => {
     adapterSessionId = runtimeEvent.sessionId;
     if (runtimeEvent.sessionId && activeRunId && !linkedAdapterSessions.has(runtimeEvent.sessionId)) {
@@ -11956,6 +12010,8 @@ async function runExec(options) {
     if (dashboardDecisionTimer) {
       clearInterval(dashboardDecisionTimer);
     }
+    await writeLastMessageBeforeTerminalCompletion();
+    await runBeforeTerminalCompletion();
     await sessionController.kill();
     unsubscribeEvent();
     unsubscribeDecision();
@@ -11974,19 +12030,6 @@ async function runExec(options) {
     output.warn(warning);
     output.emitJsonEvent("exec.warning", { message: warning });
   }
-  if (!latch.hasFailure() && options.outputLastMessagePath) {
-    try {
-      await output.writeLastMessage(
-        options.outputLastMessagePath,
-        resolvedFinalMessage.message
-      );
-    } catch (error) {
-      latch.register({
-        kind: "output",
-        message: `Failed writing --output-last-message: ${error instanceof Error ? error.message : String(error)}`
-      });
-    }
-  }
   const failure = latch.current();
   const exitCode = exitCodeFromFailure(failure);
   const success = exitCode === EXEC_EXIT_CODE.SUCCESS;
@@ -12586,6 +12629,370 @@ async function createRemoteRunEventPublisher({
   };
 }
 
+// src/app/dashboard/artifactCapture.ts
+import { execFile } from "child_process";
+import crypto3 from "crypto";
+import fs21 from "fs/promises";
+import path19 from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+function parseArtifactUploadSpec(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const obj = value;
+  const hasArtifactUpload = Object.hasOwn(obj, "artifactUpload");
+  const hasArtifacts = Object.hasOwn(obj, "artifacts");
+  if (!hasArtifactUpload && !hasArtifacts) return null;
+  const candidate = hasArtifactUpload ? obj["artifactUpload"] : obj["artifacts"];
+  if (typeof candidate !== "object" || candidate === null) {
+    throw new Error("artifact upload spec must be an object");
+  }
+  const spec = candidate;
+  const bucket = spec["bucket"];
+  const prefix = spec["prefix"];
+  const normalizedPrefix = typeof prefix === "string" ? prefix.replace(/^\/+|\/+$/g, "") : null;
+  const accessToken = spec["accessToken"] ?? (typeof spec["credentials"] === "object" && spec["credentials"] !== null ? spec["credentials"]["accessToken"] : void 0);
+  if (typeof bucket !== "string" || bucket.length === 0 || !normalizedPrefix || typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error(
+      "artifact upload spec must include bucket, prefix, and accessToken"
+    );
+  }
+  return {
+    bucket,
+    prefix: normalizedPrefix,
+    accessToken,
+    includeIgnored: stringArray(spec["includeIgnored"]),
+    hardDeny: [...DEFAULT_HARD_DENY, ...stringArray(spec["hardDeny"])]
+  };
+}
+async function captureAndUploadArtifacts(input) {
+  const now = input.now ?? Date.now;
+  const uploadObject = input.uploadObject ?? uploadGcsObject;
+  const payloads = await collectArtifactPayloads({
+    projectDir: input.projectDir,
+    includeIgnored: input.spec.includeIgnored,
+    hardDeny: input.spec.hardDeny
+  });
+  const entries = [];
+  for (const [idx, payload] of payloads.entries()) {
+    const id = `${String(idx + 1).padStart(4, "0")}-${safeObjectSegment(
+      payload.kind
+    )}`;
+    const object = joinObjectName(
+      input.spec.prefix,
+      "payloads",
+      `${id}-${safeObjectSegment(payload.path)}`
+    );
+    await uploadObject({
+      bucket: input.spec.bucket,
+      objectName: object,
+      body: payload.bytes,
+      contentType: contentTypeFor(payload.path),
+      accessToken: input.spec.accessToken
+    });
+    entries.push({
+      id,
+      kind: payload.kind,
+      path: payload.path,
+      object,
+      size: payload.bytes.byteLength,
+      sha256: sha256(payload.bytes)
+    });
+  }
+  const manifestObject = joinObjectName(input.spec.prefix, "manifest.json");
+  const manifest = {
+    version: 1,
+    runId: input.runId,
+    athenaSessionId: input.result.athenaSessionId,
+    adapterSessionId: input.result.adapterSessionId,
+    createdAt: new Date(now()).toISOString(),
+    entries,
+    objects: {
+      bucket: input.spec.bucket,
+      prefix: input.spec.prefix,
+      manifest: manifestObject
+    }
+  };
+  await uploadObject({
+    bucket: input.spec.bucket,
+    objectName: manifestObject,
+    body: Buffer.from(`${JSON.stringify(manifest, null, 2)}
+`),
+    contentType: "application/json",
+    accessToken: input.spec.accessToken
+  });
+  return {
+    manifest,
+    feedEvent: makeArtifactManifestFeedEvent({
+      manifest,
+      result: input.result,
+      runId: input.runId,
+      ts: now()
+    })
+  };
+}
+async function collectArtifactPayloads(input) {
+  const hardDeny = input.hardDeny ?? DEFAULT_HARD_DENY;
+  const payloads = [];
+  if (!await isGitWorkspace(input.projectDir)) {
+    return payloads;
+  }
+  const trackedDiff = await gitDiffForAllowedPaths({
+    projectDir: input.projectDir,
+    nameArgs: ["diff", "--name-only", "-z", "--"],
+    diffArgs: ["diff", "--binary", "--"],
+    hardDeny
+  });
+  if (trackedDiff.length > 0) {
+    payloads.push({
+      kind: "tracked_diff",
+      path: "git/tracked.diff",
+      bytes: Buffer.from(trackedDiff)
+    });
+  }
+  const stagedDiff = await gitDiffForAllowedPaths({
+    projectDir: input.projectDir,
+    nameArgs: ["diff", "--name-only", "-z", "--cached", "--"],
+    diffArgs: ["diff", "--binary", "--cached", "--"],
+    hardDeny
+  });
+  if (stagedDiff.length > 0) {
+    payloads.push({
+      kind: "staged_diff",
+      path: "git/staged.diff",
+      bytes: Buffer.from(stagedDiff)
+    });
+  }
+  const upstream = await gitMaybe(input.projectDir, [
+    "rev-parse",
+    "--abbrev-ref",
+    "--symbolic-full-name",
+    "@{u}"
+  ]);
+  if (upstream.trim().length > 0) {
+    const range = `${upstream.trim()}..HEAD`;
+    const commits = await gitDiffForAllowedPaths({
+      projectDir: input.projectDir,
+      nameArgs: ["diff", "--name-only", "-z", range, "--"],
+      diffArgs: ["format-patch", "--stdout", range, "--"],
+      hardDeny
+    });
+    if (commits.length > 0) {
+      payloads.push({
+        kind: "unpushed_commits",
+        path: "git/unpushed.patch",
+        bytes: Buffer.from(commits)
+      });
+    }
+  }
+  const untracked = splitNul(
+    await git(input.projectDir, [
+      "ls-files",
+      "--others",
+      "--exclude-standard",
+      "-z"
+    ])
+  );
+  for (const rel of untracked) {
+    if (!isAllowedRelativePath(rel, hardDeny)) continue;
+    const bytes = await readWorkspaceFile(input.projectDir, rel);
+    if (!bytes) continue;
+    payloads.push({
+      kind: "untracked_file",
+      path: rel,
+      bytes
+    });
+  }
+  for (const rel of input.includeIgnored ?? []) {
+    if (!isAllowedRelativePath(rel, hardDeny)) continue;
+    if (!await isIgnored(input.projectDir, rel)) continue;
+    const bytes = await readWorkspaceFile(input.projectDir, rel);
+    if (!bytes) continue;
+    payloads.push({
+      kind: "included_ignored_file",
+      path: rel,
+      bytes
+    });
+  }
+  return payloads;
+}
+async function readWorkspaceFile(projectDir, rel) {
+  const absolute = path19.resolve(projectDir, rel);
+  const workspaceRoot = await fs21.realpath(projectDir);
+  let stat;
+  try {
+    stat = await fs21.lstat(absolute);
+  } catch {
+    return null;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) return null;
+  const real = await fs21.realpath(absolute);
+  const relativeToRoot = path19.relative(workspaceRoot, real);
+  if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path19.sep}`) || path19.isAbsolute(relativeToRoot)) {
+    return null;
+  }
+  return fs21.readFile(absolute);
+}
+async function gitDiffForAllowedPaths(input) {
+  const paths = splitNul(await git(input.projectDir, input.nameArgs)).filter(
+    (rel) => isAllowedRelativePath(rel, input.hardDeny)
+  );
+  if (paths.length === 0) return "";
+  return git(input.projectDir, [...input.diffArgs, ...paths]);
+}
+async function uploadGcsObject(input) {
+  const url = new URL(
+    `https://storage.googleapis.com/upload/storage/v1/b/${encodeURIComponent(
+      input.bucket
+    )}/o`
+  );
+  url.searchParams.set("uploadType", "media");
+  url.searchParams.set("name", input.objectName);
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${input.accessToken}`,
+      "content-type": input.contentType
+    },
+    body: input.body.buffer.slice(
+      input.body.byteOffset,
+      input.body.byteOffset + input.body.byteLength
+    )
+  });
+  if (!response.ok) {
+    throw new Error(
+      `GCS upload ${input.objectName} failed with HTTP ${response.status}`
+    );
+  }
+}
+function makeArtifactManifestFeedEvent(input) {
+  return {
+    event_id: `${input.runId}:artifacts-manifest`,
+    seq: 0,
+    ts: input.ts,
+    session_id: input.result.athenaSessionId ?? input.runId,
+    run_id: input.runId,
+    kind: "artifacts.manifest",
+    level: "info",
+    actor_id: "system",
+    title: "Artifacts manifest",
+    data: { manifest: input.manifest }
+  };
+}
+async function git(cwd, args) {
+  const result = await execFileAsync("git", args, {
+    cwd,
+    encoding: "buffer",
+    maxBuffer: 50 * 1024 * 1024
+  });
+  return result.stdout.toString("utf8");
+}
+async function gitMaybe(cwd, args) {
+  try {
+    return await git(cwd, args);
+  } catch {
+    return "";
+  }
+}
+async function isGitWorkspace(cwd) {
+  return (await gitMaybe(cwd, ["rev-parse", "--is-inside-work-tree"])).trim() === "true";
+}
+async function isIgnored(cwd, rel) {
+  try {
+    await execFileAsync("git", ["check-ignore", "--quiet", "--", rel], { cwd });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function splitNul(value) {
+  return value.split("\0").filter(Boolean);
+}
+function stringArray(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+var DEFAULT_HARD_DENY = [
+  ".git",
+  ".git/**",
+  ".env",
+  ".env.*",
+  "**/.env",
+  "**/.env.*",
+  ".ssh",
+  ".ssh/**"
+];
+function isAllowedRelativePath(rel, hardDeny) {
+  if (path19.isAbsolute(rel) || rel.includes("\0")) return false;
+  const normalized = path19.posix.normalize(rel.replaceAll(path19.sep, "/"));
+  if (normalized === ".." || normalized.startsWith("../")) return false;
+  return !hardDeny.some((pattern) => matchesDenyPattern(normalized, pattern));
+}
+function matchesDenyPattern(rel, pattern) {
+  const normalized = pattern.replaceAll(path19.sep, "/");
+  if (normalized.includes("*") || normalized.includes("?")) {
+    return globToRegExp(normalized).test(rel);
+  }
+  if (normalized.endsWith("/**")) {
+    const prefix = normalized.slice(0, -3);
+    return rel === prefix || rel.startsWith(`${prefix}/`);
+  }
+  if (normalized.startsWith("**/")) {
+    const suffix = normalized.slice(3);
+    return rel === suffix || rel.endsWith(`/${suffix}`);
+  }
+  if (normalized.endsWith(".*")) {
+    const prefix = normalized.slice(0, -1);
+    return rel.startsWith(prefix);
+  }
+  return rel === normalized;
+}
+function globToRegExp(pattern) {
+  let source = "^";
+  for (let i = 0; i < pattern.length; i += 1) {
+    const char = pattern[i];
+    const next = pattern[i + 1];
+    if (char === "*") {
+      if (next === "*") {
+        const after = pattern[i + 2];
+        if (after === "/") {
+          source += "(?:.*/)?";
+          i += 2;
+        } else {
+          source += ".*";
+          i += 1;
+        }
+      } else {
+        source += "[^/]*";
+      }
+    } else if (char === "?") {
+      source += "[^/]";
+    } else {
+      source += escapeRegExp(char);
+    }
+  }
+  source += "$";
+  return new RegExp(source);
+}
+function escapeRegExp(value) {
+  return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+}
+function sha256(bytes) {
+  return crypto3.createHash("sha256").update(bytes).digest("hex");
+}
+function joinObjectName(...parts) {
+  return parts.map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+}
+function safeObjectSegment(value) {
+  const safe = value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return safe.length > 0 ? safe.slice(0, 160) : "artifact";
+}
+function contentTypeFor(filePath) {
+  if (filePath.endsWith(".json")) return "application/json";
+  if (filePath.endsWith(".diff") || filePath.endsWith(".patch")) {
+    return "text/x-diff";
+  }
+  return "application/octet-stream";
+}
+
 // src/app/dashboard/remoteRunExecutor.ts
 var DEFAULT_MARKETPLACE_SLUG = "lespaceman/athena-workflow-marketplace";
 function parseRemoteRunSpec(value) {
@@ -12704,7 +13111,7 @@ function mergeRunSpecEnvIntoWorkflow(workflow, env) {
 async function executeRemoteAssignment({
   frame,
   client,
-  projectDir: fallbackProjectDir = process.cwd(),
+  projectDir,
   log = () => {
   },
   runExecFn = runExec,
@@ -12717,6 +13124,8 @@ async function executeRemoteAssignment({
   resolveWorkflowInstallFn = resolveWorkflowInstall,
   installWorkflowFromSourceFn = installWorkflowFromSource,
   readGlobalConfigFn = readGlobalConfig,
+  uploadArtifactObjectFn,
+  dashboardFeedPublisher,
   runStreamConnectTimeoutMs = 5e3
 }) {
   const lastTerminalFailureMessage = { current: null };
@@ -12746,7 +13155,15 @@ async function executeRemoteAssignment({
       send("error", { message: "remote assignment missing prompt" });
       return;
     }
-    const projectDir = spec.projectDir ?? fallbackProjectDir;
+    let artifactUploadSpec;
+    try {
+      artifactUploadSpec = parseArtifactUploadSpec(frame.runSpec);
+    } catch (err) {
+      send("error", {
+        message: err instanceof Error ? err.message : String(err)
+      });
+      return;
+    }
     let runtimeConfig;
     try {
       const workflowOverride = ensureRemoteWorkflowInstalled({
@@ -12832,7 +13249,22 @@ async function executeRemoteAssignment({
         signal: abortSignal,
         stdout,
         stderr,
-        ...decisionInbox ? { dashboardDecisionInbox: decisionInbox } : {}
+        ...decisionInbox ? { dashboardDecisionInbox: decisionInbox } : {},
+        ...dashboardFeedPublisher ? { dashboardFeedPublisher } : {},
+        ...artifactUploadSpec ? {
+          beforeTerminalCompletion: async ({ result: result2, runId }) => {
+            const artifactRunId = runId ?? frame.runId;
+            const { feedEvent } = await captureAndUploadArtifacts({
+              spec: artifactUploadSpec,
+              projectDir,
+              runId: artifactRunId,
+              result: result2,
+              now,
+              ...uploadArtifactObjectFn ? { uploadObject: uploadArtifactObjectFn } : {}
+            });
+            return [feedEvent];
+          }
+        } : {}
       });
       const failedCompletion = deferredFailedCompletion.current;
       if (failedCompletion) {
@@ -12877,19 +13309,19 @@ async function executeRemoteAssignment({
 }
 
 // src/infra/config/attachmentMirror.ts
-import crypto3 from "crypto";
-import fs21 from "fs";
+import crypto4 from "crypto";
+import fs22 from "fs";
 import os12 from "os";
-import path19 from "path";
+import path20 from "path";
 function attachmentMirrorPath(env = process.env) {
   const home = env["HOME"] ?? os12.homedir();
-  return path19.join(home, ".config", "athena", "attachments.json");
+  return path20.join(home, ".config", "athena", "attachments.json");
 }
 function readAttachmentMirror(env = process.env) {
   const file = attachmentMirrorPath(env);
   let raw;
   try {
-    raw = fs21.readFileSync(file, "utf-8");
+    raw = fs22.readFileSync(file, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -12913,29 +13345,29 @@ function readAttachmentMirror(env = process.env) {
 function writeAttachmentMirror(mirror, env = process.env) {
   const validated = parseAttachmentMirror(mirror);
   const file = attachmentMirrorPath(env);
-  const dir = path19.dirname(file);
-  fs21.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${file}.${process.pid}.${crypto3.randomBytes(4).toString("hex")}.tmp`;
-  const fd = fs21.openSync(tmp, "w", 384);
+  const dir = path20.dirname(file);
+  fs22.mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${file}.${process.pid}.${crypto4.randomBytes(4).toString("hex")}.tmp`;
+  const fd = fs22.openSync(tmp, "w", 384);
   try {
-    fs21.writeSync(fd, JSON.stringify(validated, null, 2) + "\n");
-    fs21.fsyncSync(fd);
+    fs22.writeSync(fd, JSON.stringify(validated, null, 2) + "\n");
+    fs22.fsyncSync(fd);
   } finally {
-    fs21.closeSync(fd);
+    fs22.closeSync(fd);
   }
   try {
-    fs21.renameSync(tmp, file);
+    fs22.renameSync(tmp, file);
   } catch (err) {
     try {
-      fs21.unlinkSync(tmp);
+      fs22.unlinkSync(tmp);
     } catch {
     }
     throw err;
   }
   if (process.platform !== "win32") {
     try {
-      fs21.chmodSync(dir, 448);
-      fs21.chmodSync(file, 384);
+      fs22.chmodSync(dir, 448);
+      fs22.chmodSync(file, 384);
     } catch {
     }
   }
@@ -12943,7 +13375,7 @@ function writeAttachmentMirror(mirror, env = process.env) {
 function removeAttachmentMirror(env = process.env) {
   const file = attachmentMirrorPath(env);
   try {
-    fs21.unlinkSync(file);
+    fs22.unlinkSync(file);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -13209,6 +13641,7 @@ function createDashboardPairedExecution(options) {
   });
   const maxConcurrentRuns = options.maxConcurrentRuns ?? DEFAULT_MAX_CONCURRENT_RUNS;
   const runHistoryLimit = options.runHistoryLimit ?? DEFAULT_RUN_HISTORY_LIMIT;
+  const pairedFeedPublisher = options.pairedFeedPublisher;
   const now = options.now ?? (() => Date.now());
   let completedRuns = 0;
   const active = /* @__PURE__ */ new Map();
@@ -13248,7 +13681,7 @@ function createDashboardPairedExecution(options) {
     entry.record.status = "cancelled";
     entry.controller.abort();
   }
-  function handleAssignment(frame) {
+  function handleAssignment(frame, input = {}) {
     if (active.has(frame.runId)) {
       const rejection = {
         reason: "duplicate",
@@ -13279,10 +13712,11 @@ function createDashboardPairedExecution(options) {
     const promise = executor({
       frame,
       client,
-      projectDir,
+      projectDir: input.projectDir ?? projectDir,
       log,
       abortSignal: controller.signal,
-      decisionInbox
+      decisionInbox,
+      ...pairedFeedPublisher ? { dashboardFeedPublisher: pairedFeedPublisher } : {}
     }).then(() => {
       if (record.status === "running") record.status = "completed";
     }).catch((err) => {
@@ -13323,8 +13757,8 @@ function createDashboardPairedExecution(options) {
       }
       return false;
     },
-    admitAssignment(frame) {
-      return handleAssignment(frame);
+    admitAssignment(frame, input) {
+      return handleAssignment(frame, input);
     },
     rejectAssignment,
     snapshot() {
@@ -13352,10 +13786,125 @@ function createDashboardPairedExecution(options) {
   };
 }
 
+// src/app/dashboard/remoteWorkspaceResolver.ts
+import fs23 from "fs";
+import os13 from "os";
+import path21 from "path";
+function resolveRemoteWorkspace(frame, options = {}) {
+  const spec = parseRemoteRunSpec(frame.runSpec);
+  if (!spec) {
+    return {
+      kind: "rejected",
+      rejection: {
+        reason: "workspace_unresolved",
+        message: "remote assignment missing prompt"
+      }
+    };
+  }
+  if (spec.projectDir) {
+    return validateProjectDir(spec.projectDir, options.env);
+  }
+  const sessionId = spec.athenaSessionId ?? spec.sessionId;
+  const runnerId = frame.runnerId ?? "legacy";
+  const deploymentSlug = deploymentSlugFromUrl(options.dashboardUrl);
+  const stateDir = daemonStatePaths(options.env).dir;
+  const projectDir = sessionId ? path21.join(
+    stateDir,
+    "remote-workspaces",
+    deploymentSlug,
+    sanitizePathSegment(runnerId),
+    "sessions",
+    sanitizePathSegment(sessionId)
+  ) : path21.join(
+    stateDir,
+    "remote-workspaces",
+    deploymentSlug,
+    sanitizePathSegment(runnerId),
+    "runs",
+    sanitizePathSegment(frame.runId)
+  );
+  try {
+    fs23.mkdirSync(projectDir, { recursive: true, mode: 448 });
+    if (process.platform !== "win32") {
+      try {
+        fs23.chmodSync(projectDir, 448);
+      } catch {
+      }
+    }
+  } catch (err) {
+    return {
+      kind: "rejected",
+      rejection: {
+        reason: "workspace_unresolved",
+        message: `failed to create remote workspace: ${err instanceof Error ? err.message : String(err)}`
+      }
+    };
+  }
+  return validateProjectDir(projectDir, options.env);
+}
+function validateProjectDir(projectDir, env = process.env) {
+  const resolved = path21.resolve(projectDir);
+  if (!path21.isAbsolute(projectDir)) {
+    return {
+      kind: "rejected",
+      rejection: {
+        reason: "workspace_invalid",
+        message: `remote workspace must be an absolute path: ${projectDir}`
+      }
+    };
+  }
+  const home = path21.resolve(env["HOME"] ?? os13.homedir());
+  if (resolved === home) {
+    return {
+      kind: "rejected",
+      rejection: {
+        reason: "workspace_invalid",
+        message: "remote workspace cannot be the user home directory"
+      }
+    };
+  }
+  let stat;
+  try {
+    stat = fs23.statSync(resolved);
+  } catch {
+    return {
+      kind: "rejected",
+      rejection: {
+        reason: "workspace_invalid",
+        message: `remote workspace does not exist: ${resolved}`
+      }
+    };
+  }
+  if (!stat.isDirectory()) {
+    return {
+      kind: "rejected",
+      rejection: {
+        reason: "workspace_invalid",
+        message: `remote workspace is not a directory: ${resolved}`
+      }
+    };
+  }
+  return { kind: "resolved", projectDir: resolved };
+}
+function deploymentSlugFromUrl(dashboardUrl) {
+  if (!dashboardUrl) return "unknown-dashboard";
+  try {
+    const url = new URL(dashboardUrl);
+    return sanitizePathSegment(url.host);
+  } catch {
+    return sanitizePathSegment(dashboardUrl);
+  }
+}
+function sanitizePathSegment(value) {
+  const cleaned = value.trim().replaceAll(/[^a-zA-Z0-9._-]+/g, "-").replaceAll(/^-+|-+$/g, "");
+  return cleaned.length > 0 ? cleaned : "unknown";
+}
+
 // src/app/dashboard/dashboardAssignmentIntake.ts
 function createDashboardAssignmentIntake(options) {
   const log = options.log ?? (() => {
   });
+  const resolveWorkspace = options.resolveWorkspace ?? ((frame) => resolveRemoteWorkspace(frame));
   const pending = [];
   let ready = false;
   function handle(frame) {
@@ -13371,7 +13920,18 @@ function createDashboardAssignmentIntake(options) {
       });
       return;
     }
-    const outcome = options.execution.admitAssignment(frame);
+    const workspace = resolveWorkspace(frame);
+    if (workspace.kind === "rejected") {
+      options.execution.rejectAssignment(frame.runId, workspace.rejection);
+      options.client.sendAssignmentRejected({
+        runId: frame.runId,
+        ...workspace.rejection
+      });
+      return;
+    }
+    const outcome = options.execution.admitAssignment(frame, {
+      projectDir: workspace.projectDir
+    });
     if (outcome.kind === "accepted") {
       options.client.sendAssignmentAccepted(frame.runId);
       return;
@@ -13487,6 +14047,7 @@ async function runDashboardRuntimeDaemon(options = {}) {
     executor,
     projectDir,
     decisionInbox,
+    pairedFeedPublisher,
     log,
     maxConcurrentRuns,
     now,
@@ -13511,7 +14072,8 @@ async function runDashboardRuntimeDaemon(options = {}) {
       }
     },
     execution: pairedExecution,
-    log
+    log,
+    resolveWorkspace: (frame) => resolveRemoteWorkspace(frame, { dashboardUrl: currentDashboardUrl })
   });
   function nextReconnectDelay() {
     if (reconnectDelays.length === 0) return 0;
@@ -13659,9 +14221,9 @@ async function runDashboardRuntimeDaemon(options = {}) {
       next.close("attachment reconciliation failed");
       throw err;
     }
-    assignmentIntake.markReady();
     currentInstanceId = token.instanceId;
     currentDashboardUrl = config.dashboardUrl;
+    assignmentIntake.markReady();
     reconnectAttempt = 0;
     scheduleRefresh(token.expiresInSec);
     pairedFeedPublisher.attachTransport(next);
@@ -13729,18 +14291,18 @@ async function runDashboardRuntimeDaemon(options = {}) {
 }
 
 // src/infra/daemon/pidLock.ts
-import fs22 from "fs";
+import fs24 from "fs";
 function acquirePidLock(pidPath) {
   const ownPid = process.pid;
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const fd = fs22.openSync(pidPath, "wx", 384);
+      const fd = fs24.openSync(pidPath, "wx", 384);
       try {
-        fs22.writeSync(fd, `${ownPid}
+        fs24.writeSync(fd, `${ownPid}
 `);
-        fs22.fsyncSync(fd);
+        fs24.fsyncSync(fd);
       } finally {
-        fs22.closeSync(fd);
+        fs24.closeSync(fd);
       }
       return makeHandle(pidPath, ownPid);
     } catch (err) {
@@ -13754,7 +14316,7 @@ function acquirePidLock(pidPath) {
     }
     if (existing.state === "stale") {
       try {
-        fs22.unlinkSync(pidPath);
+        fs24.unlinkSync(pidPath);
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
       }
@@ -13768,7 +14330,7 @@ function acquirePidLock(pidPath) {
 function readPidLock(pidPath) {
   let raw;
   try {
-    raw = fs22.readFileSync(pidPath, "utf-8");
+    raw = fs24.readFileSync(pidPath, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { state: "absent" };
@@ -13792,9 +14354,9 @@ function makeHandle(pidPath, pid) {
       if (released) return;
       released = true;
       try {
-        const raw = fs22.readFileSync(pidPath, "utf-8").trim();
+        const raw = fs24.readFileSync(pidPath, "utf-8").trim();
         if (raw === String(pid)) {
-          fs22.unlinkSync(pidPath);
+          fs24.unlinkSync(pidPath);
         }
       } catch (err) {
         if (err.code !== "ENOENT") {
@@ -13820,7 +14382,7 @@ function isProcessAlive(pid) {
 }
 
 // src/infra/daemon/udsIpc.ts
-import fs23 from "fs";
+import fs25 from "fs";
 import net2 from "net";
 
 // src/infra/daemon/udsFrameCodec.ts
@@ -13865,7 +14427,7 @@ async function startUdsServer(socketPath, handler, log) {
   });
   if (process.platform !== "win32") {
     try {
-      fs23.chmodSync(socketPath, 384);
+      fs25.chmodSync(socketPath, 384);
     } catch {
     }
   }
@@ -13875,7 +14437,7 @@ async function startUdsServer(socketPath, handler, log) {
         server.close(() => resolve());
       });
       try {
-        fs23.unlinkSync(socketPath);
+        fs25.unlinkSync(socketPath);
       } catch (err) {
         if (err.code !== "ENOENT") {
         }
@@ -13993,7 +14555,7 @@ async function sendUdsRequest(socketPath, request, options = {}) {
 async function unlinkStaleSocket(socketPath) {
   let stat;
   try {
-    stat = fs23.statSync(socketPath);
+    stat = fs25.statSync(socketPath);
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -14020,7 +14582,7 @@ async function unlinkStaleSocket(socketPath) {
       `uds path ${socketPath} is in use by another process; aborting`
     );
   }
-  fs23.unlinkSync(socketPath);
+  fs25.unlinkSync(socketPath);
 }
 
 export {
@@ -14098,4 +14660,4 @@ export {
   startUdsServer,
   sendUdsRequest
 };
-//# sourceMappingURL=chunk-QVXHUJPH.js.map
+//# sourceMappingURL=chunk-UKMVFGY2.js.map

package/dist/cli.js

@@ -74,7 +74,7 @@ import {
   writeAttachmentMirror,
   writeGatewayClientConfig,
   wsClientOptionsForEndpoint
-} from "./chunk-QVXHUJPH.js";
+} from "./chunk-UKMVFGY2.js";
 import {
   generateId as generateId2
 } from "./chunk-BTKQ67RE.js";
@@ -5910,6 +5910,13 @@ var gatewayFunctionCompleted = defaultRenderer(
 var gatewayFunctionFailed = defaultRenderer(
   (event) => `fn ${event.data.reason}: ${event.data.function_name} \u2014 ${event.data.error_message}`
 );
+var artifactsManifest = defaultRenderer(
+  (event) => {
+    const manifest = event.data.manifest;
+    const count = Array.isArray(manifest.entries) ? manifest.entries.length : 0;
+    return `artifacts manifest (${count} item${count === 1 ? "" : "s"})`;
+  }
+);
 var RENDERERS = {
   "session.start": sessionStart,
   "session.end": sessionEnd,
@@ -5968,7 +5975,8 @@ var RENDERERS = {
   "channel.chat.outbound": channelChatOutbound,
   "gateway.function.invoked": gatewayFunctionInvoked,
   "gateway.function.completed": gatewayFunctionCompleted,
-  "gateway.function.failed": gatewayFunctionFailed
+  "gateway.function.failed": gatewayFunctionFailed,
+  "artifacts.manifest": artifactsManifest
 };
 function rendererFor(event) {
   return RENDERERS[event.kind];
@@ -6814,6 +6822,7 @@ function resolveEventToolColumn(event) {
     case "gateway.function.invoked":
     case "gateway.function.completed":
     case "gateway.function.failed":
+    case "artifacts.manifest":
       return "";
   }
 }
@@ -8548,7 +8557,8 @@ function renderDetailLines(event, width, pairedPostEvent, theme = darkTheme) {
     case "channel.chat.outbound":
     case "gateway.function.invoked":
     case "gateway.function.completed":
-    case "gateway.function.failed": {
+    case "gateway.function.failed":
+    case "artifacts.manifest": {
       const header = buildCompactHeader(event, width, { theme });
       const json = JSON.stringify(event.raw ?? event.data, null, 2);
       const content = highlightCode(json, cw, "json");
@@ -15695,7 +15705,7 @@ var cachedVersion = null;
 function readPackageVersion() {
   if (cachedVersion !== null) return cachedVersion;
   try {
-    const injected = "0.5.4";
+    const injected = "0.5.7";
     if (typeof injected === "string" && injected.length > 0) {
       cachedVersion = injected;
       return cachedVersion;

package/dist/dashboard-daemon.js

@@ -3,7 +3,7 @@ import {
   ensureDaemonStateDir,
   runDashboardRuntimeDaemon,
   startUdsServer
-} from "./chunk-QVXHUJPH.js";
+} from "./chunk-UKMVFGY2.js";
 import "./chunk-BTKQ67RE.js";
 import {
   readDashboardClientConfig,

package/package.json

@@ -17,7 +17,7 @@
 		"hooks",
 		"dashboard"
 	],
-	"version": "0.5.4",
+	"version": "0.5.7",
 	"license": "MIT",
 	"bin": {
 		"athena": "dist/cli.js",