@evalops/maestro 0.10.8 → 0.10.11

package/dist/server/handlers/health.js

@@ -1,11 +1,57 @@
-import { isDatabaseConfigured, isDbAvailable, testConnection, } from "../../db/client.js";
+import { stat } from "node:fs/promises";
+import { isDatabaseConfigured, testConnection } from "../../db/client.js";
+import { CRITICAL_DATABASE_TABLES, checkCriticalTables, } from "../../db/health.js";
 import { sendJson } from "../server-utils.js";
-export async function handleReadyz(req, res, cors) {
-    const result = await runHealthChecks();
+export async function handleReadyz(req, res, cors, hostedRunner) {
+    const result = await runHealthChecks({ hostedRunner });
     const httpStatus = result.status === "unhealthy" ? 503 : 200;
     sendJson(res, httpStatus, result, cors, req);
 }
-export async function runHealthChecks() {
+export async function checkHostedRunnerReadiness(hostedRunner) {
+    const base = {
+        runnerSessionId: hostedRunner.runnerSessionId,
+        ownerInstanceId: hostedRunner.ownerInstanceId,
+        workspaceRoot: hostedRunner.workspaceRoot,
+        ...(hostedRunner.snapshotRoot
+            ? { snapshotRoot: hostedRunner.snapshotRoot }
+            : {}),
+        workspaceId: hostedRunner.workspaceId,
+        agentRunId: hostedRunner.agentRunId,
+        maestroSessionId: hostedRunner.activeMaestroSessionId ??
+            hostedRunner.configuredMaestroSessionId,
+        ...(hostedRunner.lastDrain
+            ? { lastDrain: { ...hostedRunner.lastDrain } }
+            : {}),
+    };
+    if (hostedRunner.draining) {
+        return {
+            ...base,
+            status: "draining",
+        };
+    }
+    try {
+        const stats = await stat(hostedRunner.workspaceRoot);
+        if (!stats.isDirectory()) {
+            return {
+                ...base,
+                status: "unavailable",
+                error: "workspace root is not a directory",
+            };
+        }
+        return {
+            ...base,
+            status: "ready",
+        };
+    }
+    catch (error) {
+        return {
+            ...base,
+            status: "unavailable",
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export async function runHealthChecks(options = {}) {
     const checks = {
         database: { status: "unconfigured" },
     };
@@ -15,22 +61,50 @@ export async function runHealthChecks() {
         checks.database.status = "unconfigured";
         // unconfigured is acceptable - some deployments don't use enterprise features
     }
-    else if (!isDbAvailable()) {
-        checks.database.status = "down";
-        overallStatus = "degraded";
-    }
     else {
         const start = performance.now();
         const connected = await testConnection();
         checks.database.latencyMs = Math.round(performance.now() - start);
         if (connected) {
             checks.database.status = "up";
+            try {
+                const tableChecks = await checkCriticalTables();
+                const missing = tableChecks.flatMap((table) => {
+                    if (!table.exists)
+                        return [table.name];
+                    return (table.missingColumns ?? []).map((column) => `${table.name}.${column}`);
+                });
+                checks.database.criticalTables = {
+                    status: missing.length > 0 ? "missing" : "ok",
+                    checked: tableChecks.map((table) => table.name),
+                    missing,
+                };
+                if (missing.length > 0) {
+                    overallStatus = "unhealthy";
+                }
+            }
+            catch (error) {
+                checks.database.criticalTables = {
+                    status: "error",
+                    checked: [...CRITICAL_DATABASE_TABLES],
+                    missing: [...CRITICAL_DATABASE_TABLES],
+                    error: error instanceof Error ? error.message : String(error),
+                };
+                overallStatus = "unhealthy";
+            }
         }
         else {
             checks.database.status = "down";
             overallStatus = "degraded";
         }
     }
+    if (options.hostedRunner) {
+        const hostedRunnerCheck = await checkHostedRunnerReadiness(options.hostedRunner);
+        checks.hostedRunner = hostedRunnerCheck;
+        if (hostedRunnerCheck.status !== "ready") {
+            overallStatus = "unhealthy";
+        }
+    }
     return {
         status: overallStatus,
         checks,

package/dist/server/handlers/health.js.map

@@ -1 +1 @@
-{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/server/handlers/health.ts"],"names":[],"mappings":"AACA,OAAO,EACN,oBAAoB,EACpB,aAAa,EACb,cAAc,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAa9C,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACpC,MAAM,MAAM,GAAgC;QAC3C,QAAQ,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;KACpC,CAAC;IAEF,IAAI,aAAa,GAAgC,SAAS,CAAC;IAE3D,iBAAiB;IACjB,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC;QACxC,8EAA8E;IAC/E,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QAChC,aAAa,GAAG,UAAU,CAAC;IAC5B,CAAC;SAAM,CAAC;QACP,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAElE,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;QAC/B,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YAChC,aAAa,GAAG,UAAU,CAAC;QAC5B,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,aAAa;QACrB,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport {\n\tisDatabaseConfigured,\n\tisDbAvailable,\n\ttestConnection,\n} from \"../../db/client.js\";\nimport { sendJson } from \"../server-utils.js\";\n\nexport interface HealthCheckResult {\n\tstatus: \"healthy\" | \"degraded\" | \"unhealthy\";\n\tchecks: {\n\t\tdatabase: {\n\t\t\tstatus: \"up\" | \"down\" | \"unconfigured\";\n\t\t\tlatencyMs?: number;\n\t\t};\n\t};\n\ttimestamp: number;\n}\n\nexport async function handleReadyz(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst result = await runHealthChecks();\n\n\tconst httpStatus = result.status === \"unhealthy\" ? 503 : 200;\n\tsendJson(res, httpStatus, result, cors, req);\n}\n\nexport async function runHealthChecks(): Promise<HealthCheckResult> {\n\tconst checks: HealthCheckResult[\"checks\"] = {\n\t\tdatabase: { status: \"unconfigured\" },\n\t};\n\n\tlet overallStatus: HealthCheckResult[\"status\"] = \"healthy\";\n\n\t// Database check\n\tif (!isDatabaseConfigured()) {\n\t\tchecks.database.status = \"unconfigured\";\n\t\t// unconfigured is acceptable - some deployments don't use enterprise features\n\t} else if (!isDbAvailable()) {\n\t\tchecks.database.status = \"down\";\n\t\toverallStatus = \"degraded\";\n\t} else {\n\t\tconst start = performance.now();\n\t\tconst connected = await testConnection();\n\t\tchecks.database.latencyMs = Math.round(performance.now() - start);\n\n\t\tif (connected) {\n\t\t\tchecks.database.status = \"up\";\n\t\t} else {\n\t\t\tchecks.database.status = \"down\";\n\t\t\toverallStatus = \"degraded\";\n\t\t}\n\t}\n\n\treturn {\n\t\tstatus: overallStatus,\n\t\tchecks,\n\t\ttimestamp: Date.now(),\n\t};\n}\n"]}
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/server/handlers/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACN,wBAAwB,EACxB,mBAAmB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAyC9C,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,YAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,YAAiC;IAEjC,MAAM,IAAI,GAAG;QACZ,eAAe,EAAE,YAAY,CAAC,eAAe;QAC7C,eAAe,EAAE,YAAY,CAAC,eAAe;QAC7C,aAAa,EAAE,YAAY,CAAC,aAAa;QACzC,GAAG,CAAC,YAAY,CAAC,YAAY;YAC5B,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACN,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,gBAAgB,EACf,YAAY,CAAC,sBAAsB;YACnC,YAAY,CAAC,0BAA0B;QACxC,GAAG,CAAC,YAAY,CAAC,SAAS;YACzB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IACF,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACN,GAAG,IAAI;YACP,MAAM,EAAE,UAAU;SAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1B,OAAO;gBACN,GAAG,IAAI;gBACP,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,mCAAmC;aAC1C,CAAC;QACH,CAAC;QACD,OAAO;YACN,GAAG,IAAI;YACP,MAAM,EAAE,OAAO;SACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,GAAG,IAAI;YACP,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,UAEI,EAAE;IAEN,MAAM,MAAM,GAAgC;QAC3C,QAAQ,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;KACpC,CAAC;IAEF,IAAI,aAAa,GAAgC,SAAS,CAAC;IAE3D,iBAAiB;IACjB,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC;QACxC,8EAA8E;IAC/E,CAAC;SAAM,CAAC;QACP,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAElE,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC;gBACJ,MAAM,WAAW,GAAG,MAAM,mBAAmB,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC7C,IAAI,CAAC,KAAK,CAAC,MAAM;wBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACvC,OAAO,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CACtC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,CACrC,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,QAAQ,CAAC,cAAc,GAAG;oBAChC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;oBAC7C,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;oBAC/C,OAAO;iBACP,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,aAAa,GAAG,WAAW,CAAC;gBAC7B,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,QAAQ,CAAC,cAAc,GAAG;oBAChC,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE,CAAC,GAAG,wBAAwB,CAAC;oBACtC,OAAO,EAAE,CAAC,GAAG,wBAAwB,CAAC;oBACtC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC7D,CAAC;gBACF,aAAa,GAAG,WAAW,CAAC;YAC7B,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YAChC,aAAa,GAAG,UAAU,CAAC;QAC5B,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACzD,OAAO,CAAC,YAAY,CACpB,CAAC;QACF,MAAM,CAAC,YAAY,GAAG,iBAAiB,CAAC;QACxC,IAAI,iBAAiB,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC1C,aAAa,GAAG,WAAW,CAAC;QAC7B,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,aAAa;QACrB,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;AACH,CAAC","sourcesContent":["import { stat } from \"node:fs/promises\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { isDatabaseConfigured, testConnection } from \"../../db/client.js\";\nimport {\n\tCRITICAL_DATABASE_TABLES,\n\tcheckCriticalTables,\n} from \"../../db/health.js\";\nimport type { HostedRunnerContext } from \"../app-context.js\";\nimport { sendJson } from \"../server-utils.js\";\n\nexport interface HealthCheckResult {\n\tstatus: \"healthy\" | \"degraded\" | \"unhealthy\";\n\tchecks: {\n\t\tdatabase: {\n\t\t\tstatus: \"up\" | \"down\" | \"unconfigured\";\n\t\t\tlatencyMs?: number;\n\t\t\tcriticalTables?: {\n\t\t\t\tstatus: \"ok\" | \"missing\" | \"error\";\n\t\t\t\tchecked: string[];\n\t\t\t\tmissing: string[];\n\t\t\t\terror?: string;\n\t\t\t};\n\t\t};\n\t\thostedRunner?: {\n\t\t\tstatus: \"ready\" | \"draining\" | \"unavailable\";\n\t\t\trunnerSessionId: string;\n\t\t\townerInstanceId?: string;\n\t\t\tworkspaceRoot: string;\n\t\t\tsnapshotRoot?: string;\n\t\t\tworkspaceId?: string;\n\t\t\tagentRunId?: string;\n\t\t\tmaestroSessionId?: string;\n\t\t\tlastDrain?: {\n\t\t\t\tstatus: string;\n\t\t\t\tmanifestPath: string;\n\t\t\t\tdrainedAt: string;\n\t\t\t\treason?: string;\n\t\t\t\trequestedBy?: string;\n\t\t\t};\n\t\t\terror?: string;\n\t\t};\n\t};\n\ttimestamp: number;\n}\n\nexport type HostedRunnerHealthCheck = NonNullable<\n\tHealthCheckResult[\"checks\"][\"hostedRunner\"]\n>;\n\nexport async function handleReadyz(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\thostedRunner?: HostedRunnerContext,\n): Promise<void> {\n\tconst result = await runHealthChecks({ hostedRunner });\n\n\tconst httpStatus = result.status === \"unhealthy\" ? 503 : 200;\n\tsendJson(res, httpStatus, result, cors, req);\n}\n\nexport async function checkHostedRunnerReadiness(\n\thostedRunner: HostedRunnerContext,\n): Promise<HostedRunnerHealthCheck> {\n\tconst base = {\n\t\trunnerSessionId: hostedRunner.runnerSessionId,\n\t\townerInstanceId: hostedRunner.ownerInstanceId,\n\t\tworkspaceRoot: hostedRunner.workspaceRoot,\n\t\t...(hostedRunner.snapshotRoot\n\t\t\t? { snapshotRoot: hostedRunner.snapshotRoot }\n\t\t\t: {}),\n\t\tworkspaceId: hostedRunner.workspaceId,\n\t\tagentRunId: hostedRunner.agentRunId,\n\t\tmaestroSessionId:\n\t\t\thostedRunner.activeMaestroSessionId ??\n\t\t\thostedRunner.configuredMaestroSessionId,\n\t\t...(hostedRunner.lastDrain\n\t\t\t? { lastDrain: { ...hostedRunner.lastDrain } }\n\t\t\t: {}),\n\t};\n\tif (hostedRunner.draining) {\n\t\treturn {\n\t\t\t...base,\n\t\t\tstatus: \"draining\",\n\t\t};\n\t}\n\ttry {\n\t\tconst stats = await stat(hostedRunner.workspaceRoot);\n\t\tif (!stats.isDirectory()) {\n\t\t\treturn {\n\t\t\t\t...base,\n\t\t\t\tstatus: \"unavailable\",\n\t\t\t\terror: \"workspace root is not a directory\",\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\t...base,\n\t\t\tstatus: \"ready\",\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\t...base,\n\t\t\tstatus: \"unavailable\",\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t};\n\t}\n}\n\nexport async function runHealthChecks(\n\toptions: {\n\t\thostedRunner?: HostedRunnerContext;\n\t} = {},\n): Promise<HealthCheckResult> {\n\tconst checks: HealthCheckResult[\"checks\"] = {\n\t\tdatabase: { status: \"unconfigured\" },\n\t};\n\n\tlet overallStatus: HealthCheckResult[\"status\"] = \"healthy\";\n\n\t// Database check\n\tif (!isDatabaseConfigured()) {\n\t\tchecks.database.status = \"unconfigured\";\n\t\t// unconfigured is acceptable - some deployments don't use enterprise features\n\t} else {\n\t\tconst start = performance.now();\n\t\tconst connected = await testConnection();\n\t\tchecks.database.latencyMs = Math.round(performance.now() - start);\n\n\t\tif (connected) {\n\t\t\tchecks.database.status = \"up\";\n\t\t\ttry {\n\t\t\t\tconst tableChecks = await checkCriticalTables();\n\t\t\t\tconst missing = tableChecks.flatMap((table) => {\n\t\t\t\t\tif (!table.exists) return [table.name];\n\t\t\t\t\treturn (table.missingColumns ?? []).map(\n\t\t\t\t\t\t(column) => `${table.name}.${column}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\t\tchecks.database.criticalTables = {\n\t\t\t\t\tstatus: missing.length > 0 ? \"missing\" : \"ok\",\n\t\t\t\t\tchecked: tableChecks.map((table) => table.name),\n\t\t\t\t\tmissing,\n\t\t\t\t};\n\t\t\t\tif (missing.length > 0) {\n\t\t\t\t\toverallStatus = \"unhealthy\";\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tchecks.database.criticalTables = {\n\t\t\t\t\tstatus: \"error\",\n\t\t\t\t\tchecked: [...CRITICAL_DATABASE_TABLES],\n\t\t\t\t\tmissing: [...CRITICAL_DATABASE_TABLES],\n\t\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\t};\n\t\t\t\toverallStatus = \"unhealthy\";\n\t\t\t}\n\t\t} else {\n\t\t\tchecks.database.status = \"down\";\n\t\t\toverallStatus = \"degraded\";\n\t\t}\n\t}\n\n\tif (options.hostedRunner) {\n\t\tconst hostedRunnerCheck = await checkHostedRunnerReadiness(\n\t\t\toptions.hostedRunner,\n\t\t);\n\t\tchecks.hostedRunner = hostedRunnerCheck;\n\t\tif (hostedRunnerCheck.status !== \"ready\") {\n\t\t\toverallStatus = \"unhealthy\";\n\t\t}\n\t}\n\n\treturn {\n\t\tstatus: overallStatus,\n\t\tchecks,\n\t\ttimestamp: Date.now(),\n\t};\n}\n"]}

package/dist/server/handlers/hosted-runner-drain.d.ts

@@ -0,0 +1,128 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { HostedRunnerContext, WebServerContext } from "../app-context.js";
+import type { HeadlessRuntimeSnapshot } from "../headless-runtime-service.js";
+export declare const HOSTED_RUNNER_DRAIN_PATH = "/.well-known/evalops/remote-runner/drain";
+export declare const HOSTED_RUNNER_DRAIN_PROTOCOL_VERSION = "evalops.remote-runner.drain.v1";
+export declare const HOSTED_RUNNER_SNAPSHOT_MANIFEST_VERSION = "evalops.remote-runner.snapshot-manifest.v1";
+export declare const HOSTED_RUNNER_RETENTION_POLICY_VERSION = "evalops.remote-runner.retention.v1";
+export declare enum HostedRunnerDrainStatusValue {
+    Drained = "drained",
+    Interrupted = "interrupted"
+}
+export declare enum HostedRunnerRuntimeFlushStatusValue {
+    Completed = "completed",
+    Failed = "failed",
+    Skipped = "skipped"
+}
+export declare enum HostedRunnerWorkspaceExportPathTypeValue {
+    File = "file",
+    Directory = "directory",
+    Other = "other"
+}
+export declare enum HostedRunnerWorkspaceExportModeValue {
+    LocalPathContract = "local_path_contract"
+}
+export declare enum HostedRunnerDrainReasonValue {
+    KubernetesPreStop = "kubernetes_prestop",
+    ProcessShutdown = "process_shutdown"
+}
+export declare enum HostedRunnerDrainRequestedByValue {
+    KubernetesPreStop = "kubernetes_prestop",
+    MaestroWebServer = "maestro_web_server"
+}
+export type HostedRunnerDrainStatus = HostedRunnerDrainStatusValue;
+export type HostedRunnerRuntimeFlushStatus = HostedRunnerRuntimeFlushStatusValue;
+export type HostedRunnerWorkspaceExportPathType = HostedRunnerWorkspaceExportPathTypeValue;
+export type HostedRunnerWorkspaceExportMode = HostedRunnerWorkspaceExportModeValue;
+export type HostedRunnerDrainReason = HostedRunnerDrainReasonValue | string;
+export type HostedRunnerDrainRequestedBy = HostedRunnerDrainRequestedByValue | string;
+export interface HostedRunnerRetentionPolicy {
+    policy_version: typeof HOSTED_RUNNER_RETENTION_POLICY_VERSION;
+    managed_by: "platform";
+    visibility: {
+        control_plane_metadata: "operator";
+        workspace_export: "tenant";
+        runtime_snapshot: "internal";
+        runtime_logs: "operator";
+    };
+    redaction: {
+        required_before_external_persistence: Array<"runtime_snapshot" | "runtime_logs">;
+        forbidden_plaintext: Array<"provider_credentials" | "tool_secrets" | "attach_tokens" | "artifact_access_tokens" | "raw_environment">;
+    };
+}
+export interface HostedRunnerDrainInput {
+    reason?: HostedRunnerDrainReason;
+    requestedBy?: HostedRunnerDrainRequestedBy;
+    exportPaths?: string[];
+}
+export interface HostedRunnerRuntimeDrainResult {
+    sessionId: string;
+    sessionFile?: string;
+    protocolVersion?: string;
+    cursor?: number;
+    snapshot?: HeadlessRuntimeSnapshot;
+}
+export interface HostedRunnerWorkspaceExportPath {
+    input: string;
+    path: string;
+    relative_path: string;
+    type: HostedRunnerWorkspaceExportPathType;
+}
+export interface HostedRunnerSnapshotManifest {
+    protocol_version: typeof HOSTED_RUNNER_SNAPSHOT_MANIFEST_VERSION;
+    runner_session_id: string;
+    workspace_id?: string;
+    agent_run_id?: string;
+    maestro_session_id: string;
+    reason?: string;
+    requested_by?: string;
+    created_at: string;
+    workspace_root: string;
+    runtime: {
+        flush_status: HostedRunnerRuntimeFlushStatus;
+        error?: string;
+        session_id: string;
+        session_file?: string;
+        protocol_version?: string;
+        cursor?: number;
+    };
+    workspace_export: {
+        mode: HostedRunnerWorkspaceExportMode;
+        paths: HostedRunnerWorkspaceExportPath[];
+    };
+    snapshot: HeadlessRuntimeSnapshot;
+    retention_policy: HostedRunnerRetentionPolicy;
+    git?: {
+        commit?: string;
+        branch?: string;
+        dirty?: boolean;
+    };
+}
+export interface HostedRunnerDrainResult {
+    status: HostedRunnerDrainStatus;
+    runner_session_id: string;
+    reason?: string;
+    requested_by?: string;
+    manifest_path: string;
+    manifest: HostedRunnerSnapshotManifest;
+}
+export interface DrainHostedRunnerOptions {
+    hostedRunner?: HostedRunnerContext;
+    drainRuntime?: (sessionId: string) => Promise<HostedRunnerRuntimeDrainResult | null>;
+    now?: () => Date;
+}
+interface HostedRunnerDrainRuntimeContext {
+    hostedRunner?: HostedRunnerContext;
+    headlessRuntimeService: Pick<WebServerContext["headlessRuntimeService"], "getRuntimeBySessionId">;
+}
+export interface DrainHostedRunnerForShutdownOptions {
+    now?: () => Date;
+    reason?: HostedRunnerDrainReason;
+    requestedBy?: HostedRunnerDrainRequestedBy;
+}
+export declare function parseHostedRunnerDrainInput(body: unknown): HostedRunnerDrainInput;
+export declare function drainHostedRunner(input: HostedRunnerDrainInput, options: DrainHostedRunnerOptions): Promise<HostedRunnerDrainResult | null>;
+export declare function drainHostedRunnerForShutdown(context: HostedRunnerDrainRuntimeContext, options?: DrainHostedRunnerForShutdownOptions): Promise<HostedRunnerDrainResult | null>;
+export declare function handleHostedRunnerDrain(req: IncomingMessage, res: ServerResponse, context: WebServerContext): Promise<void>;
+export {};
+//# sourceMappingURL=hosted-runner-drain.d.ts.map

package/dist/server/handlers/hosted-runner-drain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-runner-drain.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/hosted-runner-drain.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAK9E,eAAO,MAAM,wBAAwB,6CACM,CAAC;AAE5C,eAAO,MAAM,oCAAoC,mCAChB,CAAC;AAElC,eAAO,MAAM,uCAAuC,+CACP,CAAC;AAE9C,eAAO,MAAM,sCAAsC,uCACd,CAAC;AAEtC,oBAAY,4BAA4B;IACvC,OAAO,YAAY;IACnB,WAAW,gBAAgB;CAC3B;AAED,oBAAY,mCAAmC;IAC9C,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,OAAO,YAAY;CACnB;AAED,oBAAY,wCAAwC;IACnD,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,KAAK,UAAU;CACf;AAED,oBAAY,oCAAoC;IAC/C,iBAAiB,wBAAwB;CACzC;AAED,oBAAY,4BAA4B;IACvC,iBAAiB,uBAAuB;IACxC,eAAe,qBAAqB;CACpC;AAED,oBAAY,iCAAiC;IAC5C,iBAAiB,uBAAuB;IACxC,gBAAgB,uBAAuB;CACvC;AAED,MAAM,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AACnE,MAAM,MAAM,8BAA8B,GACzC,mCAAmC,CAAC;AACrC,MAAM,MAAM,mCAAmC,GAC9C,wCAAwC,CAAC;AAC1C,MAAM,MAAM,+BAA+B,GAC1C,oCAAoC,CAAC;AACtC,MAAM,MAAM,uBAAuB,GAAG,4BAA4B,GAAG,MAAM,CAAC;AAC5E,MAAM,MAAM,4BAA4B,GACrC,iCAAiC,GACjC,MAAM,CAAC;AAEV,MAAM,WAAW,2BAA2B;IAC3C,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,EAAE;QACX,sBAAsB,EAAE,UAAU,CAAC;QACnC,gBAAgB,EAAE,QAAQ,CAAC;QAC3B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,YAAY,EAAE,UAAU,CAAC;KACzB,CAAC;IACF,SAAS,EAAE;QACV,oCAAoC,EAAE,KAAK,CAC1C,kBAAkB,GAAG,cAAc,CACnC,CAAC;QACF,mBAAmB,EAAE,KAAK,CACvB,sBAAsB,GACtB,cAAc,GACd,eAAe,GACf,wBAAwB,GACxB,iBAAiB,CACnB,CAAC;KACF,CAAC;CACF;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,WAAW,CAAC,EAAE,4BAA4B,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,8BAA8B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACnC;AAED,MAAM,WAAW,+BAA+B;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,mCAAmC,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC5C,gBAAgB,EAAE,OAAO,uCAAuC,CAAC;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE;QACR,YAAY,EAAE,8BAA8B,CAAC;QAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,gBAAgB,EAAE;QACjB,IAAI,EAAE,+BAA+B,CAAC;QACtC,KAAK,EAAE,+BAA+B,EAAE,CAAC;KACzC,CAAC;IACF,QAAQ,EAAE,uBAAuB,CAAC;IAClC,gBAAgB,EAAE,2BAA2B,CAAC;IAC9C,GAAG,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACF;AAED,MAAM,WAAW,uBAAuB;IACvC,MAAM,EAAE,uBAAuB,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,4BAA4B,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACxC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,YAAY,CAAC,EAAE,CACd,SAAS,EAAE,MAAM,KACb,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACjB;AAED,UAAU,+BAA+B;IACxC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,sBAAsB,EAAE,IAAI,CAC3B,gBAAgB,CAAC,wBAAwB,CAAC,EAC1C,uBAAuB,CACvB,CAAC;CACF;AAED,MAAM,WAAW,mCAAmC;IACnD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,WAAW,CAAC,EAAE,4BAA4B,CAAC;CAC3C;AAgCD,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,OAAO,GACX,sBAAsB,CAmBxB;AAqLD,wBAAsB,iBAAiB,CACtC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,EAAE,wBAAwB,GAC/B,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAsHzC;AAuBD,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,+BAA+B,EACxC,OAAO,GAAE,mCAAwC,GAC/C,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAczC;AAED,wBAAsB,uBAAuB,CAC5C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,gBAAgB,GACvB,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/dist/server/handlers/hosted-runner-drain.js

@@ -0,0 +1,373 @@
+import { execFile } from "node:child_process";
+import { mkdir, realpath, stat, writeFile } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { promisify } from "node:util";
+import { HEADLESS_PROTOCOL_VERSION, createHeadlessRuntimeState, } from "../../cli/headless-protocol.js";
+import { ApiError, readJsonBody, sendJson } from "../server-utils.js";
+const execFileAsync = promisify(execFile);
+export const HOSTED_RUNNER_DRAIN_PATH = "/.well-known/evalops/remote-runner/drain";
+export const HOSTED_RUNNER_DRAIN_PROTOCOL_VERSION = "evalops.remote-runner.drain.v1";
+export const HOSTED_RUNNER_SNAPSHOT_MANIFEST_VERSION = "evalops.remote-runner.snapshot-manifest.v1";
+export const HOSTED_RUNNER_RETENTION_POLICY_VERSION = "evalops.remote-runner.retention.v1";
+export var HostedRunnerDrainStatusValue;
+(function (HostedRunnerDrainStatusValue) {
+    HostedRunnerDrainStatusValue["Drained"] = "drained";
+    HostedRunnerDrainStatusValue["Interrupted"] = "interrupted";
+})(HostedRunnerDrainStatusValue || (HostedRunnerDrainStatusValue = {}));
+export var HostedRunnerRuntimeFlushStatusValue;
+(function (HostedRunnerRuntimeFlushStatusValue) {
+    HostedRunnerRuntimeFlushStatusValue["Completed"] = "completed";
+    HostedRunnerRuntimeFlushStatusValue["Failed"] = "failed";
+    HostedRunnerRuntimeFlushStatusValue["Skipped"] = "skipped";
+})(HostedRunnerRuntimeFlushStatusValue || (HostedRunnerRuntimeFlushStatusValue = {}));
+export var HostedRunnerWorkspaceExportPathTypeValue;
+(function (HostedRunnerWorkspaceExportPathTypeValue) {
+    HostedRunnerWorkspaceExportPathTypeValue["File"] = "file";
+    HostedRunnerWorkspaceExportPathTypeValue["Directory"] = "directory";
+    HostedRunnerWorkspaceExportPathTypeValue["Other"] = "other";
+})(HostedRunnerWorkspaceExportPathTypeValue || (HostedRunnerWorkspaceExportPathTypeValue = {}));
+export var HostedRunnerWorkspaceExportModeValue;
+(function (HostedRunnerWorkspaceExportModeValue) {
+    HostedRunnerWorkspaceExportModeValue["LocalPathContract"] = "local_path_contract";
+})(HostedRunnerWorkspaceExportModeValue || (HostedRunnerWorkspaceExportModeValue = {}));
+export var HostedRunnerDrainReasonValue;
+(function (HostedRunnerDrainReasonValue) {
+    HostedRunnerDrainReasonValue["KubernetesPreStop"] = "kubernetes_prestop";
+    HostedRunnerDrainReasonValue["ProcessShutdown"] = "process_shutdown";
+})(HostedRunnerDrainReasonValue || (HostedRunnerDrainReasonValue = {}));
+export var HostedRunnerDrainRequestedByValue;
+(function (HostedRunnerDrainRequestedByValue) {
+    HostedRunnerDrainRequestedByValue["KubernetesPreStop"] = "kubernetes_prestop";
+    HostedRunnerDrainRequestedByValue["MaestroWebServer"] = "maestro_web_server";
+})(HostedRunnerDrainRequestedByValue || (HostedRunnerDrainRequestedByValue = {}));
+function getString(value, field) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new ApiError(400, `${field} must be a string`);
+    }
+    const trimmed = value.trim();
+    return trimmed || undefined;
+}
+function getStringArray(value, field) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        throw new ApiError(400, `${field} must be an array of strings`);
+    }
+    const strings = value.map((entry, index) => {
+        if (typeof entry !== "string" || !entry.trim()) {
+            throw new ApiError(400, `${field}[${index}] must be a non-empty string`);
+        }
+        if (entry.includes("\0")) {
+            throw new ApiError(400, `${field}[${index}] contains a null byte`);
+        }
+        return entry.trim();
+    });
+    return strings.length ? strings : undefined;
+}
+export function parseHostedRunnerDrainInput(body) {
+    if (body === undefined || body === null) {
+        return {};
+    }
+    if (typeof body !== "object" || Array.isArray(body)) {
+        throw new ApiError(400, "Drain payload must be a JSON object");
+    }
+    const record = body;
+    return {
+        reason: getString(record.reason, "reason") ??
+            getString(record.stop_reason, "stop_reason"),
+        requestedBy: getString(record.requested_by, "requested_by") ??
+            getString(record.requestedBy, "requestedBy"),
+        exportPaths: getStringArray(record.export_paths, "export_paths") ??
+            getStringArray(record.exportPaths, "exportPaths"),
+    };
+}
+function isWithinPath(root, target) {
+    const rel = relative(root, target);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+function safeManifestFileName(runnerSessionId, requestedAt) {
+    const safeSession = runnerSessionId.replace(/[^A-Za-z0-9_.-]/g, "_");
+    const safeTimestamp = requestedAt.replace(/[^A-Za-z0-9_.-]/g, "_");
+    return `${safeSession}-${safeTimestamp}.json`;
+}
+async function resolveWorkspaceRoot(hostedRunner) {
+    try {
+        const workspaceRoot = await realpath(hostedRunner.workspaceRoot);
+        const stats = await stat(workspaceRoot);
+        if (!stats.isDirectory()) {
+            throw new ApiError(503, "Hosted runner workspace root is not a directory");
+        }
+        return workspaceRoot;
+    }
+    catch (error) {
+        if (error instanceof ApiError) {
+            throw error;
+        }
+        throw new ApiError(503, `Hosted runner workspace root is unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+async function resolveWorkspaceExportPaths(workspaceRoot, exportPaths) {
+    const requested = exportPaths?.length ? exportPaths : ["."];
+    const paths = [];
+    for (const input of requested) {
+        const logicalPath = isAbsolute(input)
+            ? resolve(input)
+            : resolve(workspaceRoot, input);
+        let realPath;
+        try {
+            realPath = await realpath(logicalPath);
+        }
+        catch (error) {
+            throw new ApiError(400, `Export path is unavailable: ${input} (${error instanceof Error ? error.message : String(error)})`);
+        }
+        if (!isWithinPath(workspaceRoot, realPath)) {
+            throw new ApiError(400, `Export path escapes hosted runner workspace root: ${input}`);
+        }
+        const pathStat = await stat(realPath);
+        paths.push({
+            input,
+            path: realPath,
+            relative_path: relative(workspaceRoot, realPath) || ".",
+            type: pathStat.isDirectory()
+                ? HostedRunnerWorkspaceExportPathTypeValue.Directory
+                : pathStat.isFile()
+                    ? HostedRunnerWorkspaceExportPathTypeValue.File
+                    : HostedRunnerWorkspaceExportPathTypeValue.Other,
+        });
+    }
+    return paths;
+}
+async function gitOutput(workspaceRoot, args) {
+    try {
+        const { stdout } = await execFileAsync("git", ["-C", workspaceRoot, ...args], {
+            encoding: "utf8",
+            timeout: 1000,
+        });
+        const output = stdout.trim();
+        return output || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function collectGitState(workspaceRoot) {
+    const [commit, branch, status] = await Promise.all([
+        gitOutput(workspaceRoot, ["rev-parse", "HEAD"]),
+        gitOutput(workspaceRoot, ["rev-parse", "--abbrev-ref", "HEAD"]),
+        gitOutput(workspaceRoot, ["status", "--porcelain"]),
+    ]);
+    if (!commit && !branch && status === undefined) {
+        return undefined;
+    }
+    return {
+        ...(commit ? { commit } : {}),
+        ...(branch && branch !== "HEAD" ? { branch } : {}),
+        dirty: Boolean(status),
+    };
+}
+function buildHostedRunnerSnapshot(sessionId, workspaceRoot, runtime) {
+    const state = createHeadlessRuntimeState();
+    state.protocol_version =
+        runtime.protocol_version ?? HEADLESS_PROTOCOL_VERSION;
+    state.session_id = sessionId;
+    state.cwd = workspaceRoot;
+    state.provider = "typescript";
+    state.model = "typescript-hosted-runner";
+    state.is_ready =
+        runtime.flush_status === HostedRunnerRuntimeFlushStatusValue.Completed;
+    state.last_status =
+        runtime.flush_status === HostedRunnerRuntimeFlushStatusValue.Completed
+            ? "Drained"
+            : runtime.flush_status === HostedRunnerRuntimeFlushStatusValue.Failed
+                ? "Drain interrupted before runtime flush completed"
+                : "Drain skipped: no runtime activity was available";
+    if (runtime.error) {
+        state.last_error = runtime.error;
+        state.last_error_type = "protocol";
+    }
+    return {
+        protocolVersion: runtime.protocol_version ?? HEADLESS_PROTOCOL_VERSION,
+        session_id: sessionId,
+        cursor: runtime.cursor ?? 0,
+        last_init: null,
+        state,
+    };
+}
+function buildHostedRunnerRetentionPolicy() {
+    return {
+        policy_version: HOSTED_RUNNER_RETENTION_POLICY_VERSION,
+        managed_by: "platform",
+        visibility: {
+            control_plane_metadata: "operator",
+            workspace_export: "tenant",
+            runtime_snapshot: "internal",
+            runtime_logs: "operator",
+        },
+        redaction: {
+            required_before_external_persistence: [
+                "runtime_snapshot",
+                "runtime_logs",
+            ],
+            forbidden_plaintext: [
+                "provider_credentials",
+                "tool_secrets",
+                "attach_tokens",
+                "artifact_access_tokens",
+                "raw_environment",
+            ],
+        },
+    };
+}
+export async function drainHostedRunner(input, options) {
+    const hostedRunner = options.hostedRunner;
+    if (!hostedRunner?.enabled || !hostedRunner.runnerSessionId) {
+        return null;
+    }
+    hostedRunner.draining = true;
+    const requestedAt = (options.now?.() ?? new Date()).toISOString();
+    const workspaceRoot = await resolveWorkspaceRoot(hostedRunner);
+    const snapshotRoot = resolve(workspaceRoot, hostedRunner.snapshotRoot ?? ".maestro/runner-snapshots");
+    const exportPaths = await resolveWorkspaceExportPaths(workspaceRoot, input.exportPaths);
+    const activeSessionId = hostedRunner.activeMaestroSessionId ??
+        hostedRunner.configuredMaestroSessionId;
+    const maestroSessionId = activeSessionId ?? hostedRunner.runnerSessionId;
+    let status = HostedRunnerDrainStatusValue.Drained;
+    let runtime = {
+        flush_status: HostedRunnerRuntimeFlushStatusValue.Skipped,
+        session_id: maestroSessionId,
+    };
+    let runtimeSnapshot;
+    if (activeSessionId && options.drainRuntime) {
+        try {
+            const runtimeResult = await options.drainRuntime(activeSessionId);
+            const runtimeProtocolVersion = runtimeResult?.protocolVersion ??
+                runtimeResult?.snapshot?.protocolVersion;
+            const runtimeCursor = runtimeResult?.cursor ?? runtimeResult?.snapshot?.cursor;
+            runtime = runtimeResult
+                ? {
+                    flush_status: HostedRunnerRuntimeFlushStatusValue.Completed,
+                    session_id: runtimeResult.sessionId,
+                    ...(runtimeResult.sessionFile
+                        ? { session_file: runtimeResult.sessionFile }
+                        : {}),
+                    ...(runtimeProtocolVersion
+                        ? { protocol_version: runtimeProtocolVersion }
+                        : {}),
+                    ...(runtimeCursor !== undefined ? { cursor: runtimeCursor } : {}),
+                }
+                : {
+                    flush_status: HostedRunnerRuntimeFlushStatusValue.Skipped,
+                    session_id: activeSessionId,
+                };
+            runtimeSnapshot = runtimeResult?.snapshot;
+        }
+        catch (error) {
+            status = HostedRunnerDrainStatusValue.Interrupted;
+            runtime = {
+                flush_status: HostedRunnerRuntimeFlushStatusValue.Failed,
+                session_id: activeSessionId,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    await mkdir(snapshotRoot, { recursive: true });
+    const snapshotPath = join(snapshotRoot, safeManifestFileName(hostedRunner.runnerSessionId, requestedAt));
+    const git = await collectGitState(workspaceRoot);
+    const snapshot = runtimeSnapshot ??
+        buildHostedRunnerSnapshot(maestroSessionId, workspaceRoot, runtime);
+    const manifest = {
+        protocol_version: HOSTED_RUNNER_SNAPSHOT_MANIFEST_VERSION,
+        runner_session_id: hostedRunner.runnerSessionId,
+        ...(hostedRunner.workspaceId
+            ? { workspace_id: hostedRunner.workspaceId }
+            : {}),
+        ...(hostedRunner.agentRunId
+            ? { agent_run_id: hostedRunner.agentRunId }
+            : {}),
+        maestro_session_id: maestroSessionId,
+        ...(input.reason ? { reason: input.reason } : {}),
+        ...(input.requestedBy ? { requested_by: input.requestedBy } : {}),
+        created_at: requestedAt,
+        workspace_root: workspaceRoot,
+        runtime,
+        workspace_export: {
+            mode: HostedRunnerWorkspaceExportModeValue.LocalPathContract,
+            paths: exportPaths,
+        },
+        snapshot,
+        retention_policy: buildHostedRunnerRetentionPolicy(),
+        ...(git ? { git } : {}),
+    };
+    await writeFile(snapshotPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+    hostedRunner.lastDrain = {
+        status,
+        manifestPath: snapshotPath,
+        drainedAt: requestedAt,
+        ...(input.reason ? { reason: input.reason } : {}),
+        ...(input.requestedBy ? { requestedBy: input.requestedBy } : {}),
+    };
+    return {
+        status,
+        runner_session_id: hostedRunner.runnerSessionId,
+        ...(input.reason ? { reason: input.reason } : {}),
+        ...(input.requestedBy ? { requested_by: input.requestedBy } : {}),
+        manifest_path: snapshotPath,
+        manifest,
+    };
+}
+async function drainActiveRuntime(context, sessionId) {
+    const runtime = context.headlessRuntimeService.getRuntimeBySessionId(sessionId);
+    if (!runtime) {
+        return null;
+    }
+    const snapshot = runtime.getSnapshot();
+    const sessionFile = runtime.getSessionFile();
+    await runtime.dispose();
+    return {
+        sessionId: snapshot.session_id,
+        sessionFile,
+        protocolVersion: snapshot.protocolVersion,
+        cursor: snapshot.cursor,
+        snapshot,
+    };
+}
+export async function drainHostedRunnerForShutdown(context, options = {}) {
+    return drainHostedRunner({
+        reason: options.reason ?? HostedRunnerDrainReasonValue.ProcessShutdown,
+        requestedBy: options.requestedBy ??
+            HostedRunnerDrainRequestedByValue.MaestroWebServer,
+    }, {
+        hostedRunner: context.hostedRunner,
+        drainRuntime: (sessionId) => drainActiveRuntime(context, sessionId),
+        now: options.now,
+    });
+}
+export async function handleHostedRunnerDrain(req, res, context) {
+    res.setHeader("Cache-Control", "no-store");
+    const body = await readJsonBody(req, 64_000);
+    const input = parseHostedRunnerDrainInput(body);
+    const result = await drainHostedRunner(input, {
+        hostedRunner: context.hostedRunner,
+        drainRuntime: (sessionId) => drainActiveRuntime(context, sessionId),
+    });
+    if (!result) {
+        sendJson(res, 404, {
+            error: "hosted runner drain unavailable",
+        }, context.corsHeaders, req);
+        return;
+    }
+    sendJson(res, result.status === HostedRunnerDrainStatusValue.Interrupted ? 503 : 200, {
+        protocol_version: HOSTED_RUNNER_DRAIN_PROTOCOL_VERSION,
+        status: result.status,
+        runner_session_id: result.runner_session_id,
+        requested_by: result.requested_by,
+        reason: result.reason,
+        manifest_path: result.manifest_path,
+        manifest: result.manifest,
+    }, context.corsHeaders, req);
+}
+//# sourceMappingURL=hosted-runner-drain.js.map