@farmslot/recipe-harness 0.7.0 → 0.9.0

package/dist/core/runner.js

@@ -1,22 +1,24 @@
-import { mkdir, stat, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, rm, stat } from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
 import { getRecipeActionManifestActionNames, validateRecipeArtifactPackage, } from '@farmslot/protocol';
 import { JsonArtifactWriter, JsonSummaryWriter, JsonTraceWriter } from '../node/writers.js';
 import { createCaptureHelperVideoRecorder, errorMessage, manifestTarget, } from '../recording/capture-helper.js';
-import { buildResolvedRecipe } from './compose.js';
-import { collectFlows, executeInlineFlowCall } from './flows.js';
-import { extractWorkflowGraph, normalizePreconditionResult, resolveNextNode, } from './graph.js';
+import { resolveRecipeDependencies, rootResolutionRef, validateRecipeDependencyParams, } from './compose.js';
+import { executeRecipe } from './execution.js';
+import { extractWorkflowGraph } from './graph.js';
 import { buildHudNode } from './hud.js';
 import { isRecord, normalizeRelativePath, readJsonFile } from './json.js';
-import { createEffectiveFlowCatalog, loadRecipeLibraries, } from './library.js';
-import { declaredObserverRefsFromManifest, defaultObserverRefsFromManifest, finalizeNodeObservations, resolveObserveRefs, runPassiveObservers, } from './passive-observations.js';
-import { evaluateNodeGate } from './predicates.js';
+import { loadRecipeLibraries, } from './library.js';
+import { resolveRecipeParams } from './parameters.js';
+import { defaultObserverRefsFromManifest } from './passive-observations.js';
+import { copyFileWithinRoots, statFileWithinRoot } from './path.js';
 import { cleanupAbortedRunVideoRecording, removePartialRunVideoOutput, } from './recording-cleanup.js';
-import { recordSyntheticFailure, traceNodeMetadata } from './trace.js';
+import { buildRecipeExecutionPlan, enforceRecipeExecutionPlan, recipeSourceForRequest, verifyExecutableSource, } from './trust.js';
+import { RECIPE_TRUST_ENV } from './trust-input.js';
 import { assertManifestIsValid, assertRecipeMatchesManifest } from './validation.js';
 const HARNESS_VERSION = '0.1.0';
-const RUNNER_BUILT_IN_ACTIONS = new Set(['call']);
-const DEFAULT_MAX_FLOW_CALL_DEPTH = 8;
+const RUNNER_BUILT_IN_ACTIONS = new Set(['call', 'end']);
 const noopLogger = {
     info() { },
     warn() { },
@@ -31,19 +33,6 @@ export function createRecipeRunner(options) {
     assertManifestIsValid(options.actionManifest);
     const declaredActions = new Set(getRecipeActionManifestActionNames(options.actionManifest));
     const adapterMap = new Map();
-    const preconditionMap = new Map();
-    const declaredPreconditions = new Set((options.actionManifest.pre_conditions ?? []).map((entry) => entry.id));
-    for (const checker of options.preconditions ?? []) {
-        if (!checker.id.trim())
-            throw new Error('Precondition checker id must be a non-empty string.');
-        if (!declaredPreconditions.has(checker.id)) {
-            throw new Error(`Precondition checker ${checker.id} is not declared by the action manifest.`);
-        }
-        if (preconditionMap.has(checker.id)) {
-            throw new Error(`Precondition checker ${checker.id} is registered more than once.`);
-        }
-        preconditionMap.set(checker.id, checker);
-    }
     for (const adapter of options.adapters) {
         if (!adapter.action.trim())
             throw new Error('Action adapter action must be a non-empty string.');
@@ -60,7 +49,7 @@ export function createRecipeRunner(options) {
             throw new Error(`Manifest action ${action} has no registered adapter.`);
         }
     }
-    return new DefaultRecipeRunner(options.actionManifest, adapterMap, preconditionMap, options.logger ?? noopLogger, options.hud, options.runner, options.recording);
+    return new DefaultRecipeRunner(options.actionManifest, adapterMap, options.logger ?? noopLogger, options.hud, options.runner, options.recording, options.defaultSource, options.blockedCapabilities);
 }
 function collectWatchLogPaths(paths, nodes) {
     for (const node of Object.values(nodes)) {
@@ -69,15 +58,16 @@ function collectWatchLogPaths(paths, nodes) {
         paths.add(normalizeRelativePath(node.path).split(path.sep).join('/'));
     }
 }
-async function collectRunFileOffsets({ graph, flows, projectRoot, }) {
+async function collectRunFileOffsets({ graph, recipes, projectRoot, }) {
     const offsets = new Map();
     const paths = new Set();
     collectWatchLogPaths(paths, graph.nodes);
-    for (const flow of flows.values())
-        collectWatchLogPaths(paths, flow.nodes);
+    for (const recipe of recipes.values()) {
+        collectWatchLogPaths(paths, extractWorkflowGraph(recipe.document).nodes);
+    }
     for (const relativePath of paths) {
         try {
-            const info = await stat(path.join(projectRoot, relativePath));
+            const info = await statFileWithinRoot(projectRoot, relativePath);
             offsets.set(relativePath, info.size);
         }
         catch (error) {
@@ -94,73 +84,128 @@ function isNodeFileMissingError(error) {
 class DefaultRecipeRunner {
     #actionManifest;
     #adapters;
-    #preconditions;
     #logger;
     #defaultObserverRefs;
-    #declaredObserverRefs;
     #hud;
     #runnerProvenance;
     #recording;
-    constructor(actionManifest, adapters, preconditions, logger, hud, runnerProvenance, recording) {
+    #defaultSource;
+    #blockedCapabilities;
+    constructor(actionManifest, adapters, logger, hud, runnerProvenance, recording, defaultSource, blockedCapabilities) {
         this.#actionManifest = actionManifest;
         this.#adapters = adapters;
-        this.#preconditions = preconditions;
         this.#logger = logger;
         this.#defaultObserverRefs = defaultObserverRefsFromManifest(actionManifest);
-        this.#declaredObserverRefs = declaredObserverRefsFromManifest(actionManifest);
         this.#hud = hud;
         this.#runnerProvenance = runnerProvenance;
         this.#recording = recording;
+        this.#defaultSource = defaultSource;
+        this.#blockedCapabilities = blockedCapabilities;
     }
-    async run(request) {
+    async preflight(request) {
+        const { executionPlan } = await this.#resolveRequest(request);
+        enforceRecipeExecutionPlan(executionPlan, request, this.#blockedCapabilities);
+        return executionPlan;
+    }
+    async #resolveRequest(request) {
         if (!request.recipePath && request.recipeDocument == null) {
             throw new Error('Recipe run requires recipePath or recipeDocument.');
         }
         const projectRoot = path.resolve(request.projectRoot ?? process.cwd());
         const artifactsDir = path.resolve(request.artifactsDir);
-        const startedAt = new Date();
-        await mkdir(artifactsDir, { recursive: true });
+        const env = {
+            ...(request.inheritProcessEnv === false ? {} : process.env),
+            ...(request.env ?? {}),
+        };
+        const trustEnv = new Set(Object.values(RECIPE_TRUST_ENV));
+        for (const [key, value] of Object.entries(env)) {
+            if (value === undefined || trustEnv.has(key))
+                delete env[key];
+        }
         const sourceRecipePath = request.recipePath ? path.resolve(request.recipePath) : undefined;
         const recipe = request.recipeDocument ?? (await readJsonFile(sourceRecipePath));
+        if (!isRecord(recipe))
+            throw new Error('Recipe document must be an object.');
+        const recipeSource = recipeSourceForRequest(request, recipe, sourceRecipePath, this.#defaultSource);
         const libraryResolution = request.librarySources && request.librarySources.length > 0
-            ? await loadRecipeLibraries(request.librarySources, this.#logger)
+            ? await loadRecipeLibraries(request.librarySources, {
+                adapter: request.adapter,
+                logger: this.#logger,
+            })
             : undefined;
-        assertRecipeMatchesManifest(recipe, this.#actionManifest, libraryResolution ? { externalFlowIds: new Set(libraryResolution.flows.keys()) } : undefined);
+        const recipes = libraryResolution?.recipes ?? new Map();
+        const externalRecipeIds = new Set(recipes.keys());
+        assertRecipeMatchesManifest(recipe, this.#actionManifest, { externalRecipeIds });
         const graph = extractWorkflowGraph(recipe);
-        const recipeLocalFlows = await collectFlows(recipe, {
+        const rootRef = rootRecipeRef(sourceRecipePath, recipes, recipeSource.digest);
+        const dependencyResolution = resolveRecipeDependencies({
+            rootRef,
+            root: recipe,
+            rootSource: recipeSource,
+            recipes,
+        });
+        for (const resolved of dependencyResolution.recipes.values()) {
+            assertRecipeMatchesManifest(resolved.document, this.#actionManifest, { externalRecipeIds });
+        }
+        const params = resolveRecipeParams(rootRef, recipe, request.params ?? {});
+        validateRecipeDependencyParams({
+            root: recipe,
+            params,
+            recipes: dependencyResolution.recipes,
+        });
+        const executionPlan = buildRecipeExecutionPlan({
+            recipe,
+            params,
+            source: recipeSource,
+            recipes: dependencyResolution.recipes,
+            adapters: this.#adapters,
+            actionManifest: this.#actionManifest,
             projectRoot,
-            recipeDir: sourceRecipePath ? path.dirname(sourceRecipePath) : projectRoot,
+            artifactsDir,
+            env,
+            hud: this.#hud,
+            recordVideo: request.recordVideo,
         });
-        const usedLibraryFlows = new Map();
-        const { catalog: flowCatalog, overrides: flowOverrides } = createEffectiveFlowCatalog(recipeLocalFlows, libraryResolution, usedLibraryFlows, this.#logger);
+        return {
+            projectRoot,
+            artifactsDir,
+            sourceRecipePath,
+            recipe,
+            rootRef,
+            params,
+            recipeSource,
+            env,
+            libraryResolution,
+            graph,
+            recipes: dependencyResolution.recipes,
+            dependencyResolution,
+            executionPlan,
+        };
+    }
+    async run(request) {
+        const { projectRoot, artifactsDir, recipe, rootRef, params, env, libraryResolution, graph, recipes, dependencyResolution, executionPlan, } = await this.#resolveRequest(request);
+        enforceRecipeExecutionPlan(executionPlan, request, this.#blockedCapabilities);
+        const startedAt = new Date();
+        await mkdir(artifactsDir, { recursive: true });
         const runFileOffsets = await collectRunFileOffsets({
             graph,
-            flows: flowCatalog,
+            recipes,
             projectRoot,
         });
         const artifactWriter = new JsonArtifactWriter(artifactsDir);
         const traceWriter = new JsonTraceWriter(artifactsDir, this.#runnerProvenance);
         const summaryWriter = new JsonSummaryWriter(artifactsDir);
-        const outputs = new Map();
+        let outputs = new Map();
         const recipePath = await artifactWriter.copyRecipe(recipe);
-        // Emit the fully-composed recipe when `uses`/library composition adds flows the
-        // authored recipe.json does not already inline. buildResolvedRecipe inlines only
-        // the reachable flows (never the whole library) and drops `uses`, so the result
-        // is self-contained; it returns the same reference when there is nothing to add.
-        const resolvedRecipe = buildResolvedRecipe(recipe, flowCatalog);
-        if (resolvedRecipe !== recipe) {
-            await artifactWriter.writeResolvedRecipe(resolvedRecipe);
+        for (const dependency of dependencyResolution.recipes.values()) {
+            await artifactWriter.copyResolvedRecipe(dependency.provenance.digest, dependency.document);
         }
+        await artifactWriter.writeRecipeResolution(dependencyResolution.document);
         let status = 'unknown';
-        let currentNodeId = graph.entry;
-        let mainStatus = 'unknown';
-        let runningTeardown = false;
-        const visited = new Set();
-        let transitionCount = 0;
-        const maxTransitions = Object.keys(graph.nodes).length * 3;
         const videoOptions = normalizeVideoRecordingOptions(request.recordVideo);
         const videoRecorder = videoOptions.mode !== 'off' ? this.#videoRecorder() : undefined;
         let runRecording;
+        let canExecute = true;
         if (videoRecorder) {
             try {
                 runRecording = await this.#startRunVideoRecording({
@@ -169,7 +214,7 @@ class DefaultRecipeRunner {
                     recipe,
                     projectRoot,
                     artifactsDir,
-                    env: request.env ?? {},
+                    env,
                 });
             }
             catch (error) {
@@ -185,212 +230,40 @@ class DefaultRecipeRunner {
                 });
                 this.#logger.error(`record.video start failed: ${message}`);
                 status = 'fail';
-                currentNodeId = undefined;
+                canExecute = false;
             }
         }
         try {
-            if (currentNodeId) {
-                const preconditionStatus = await this.#runPreconditions({
-                    graph,
+            if (canExecute) {
+                const execution = await executeRecipe({
+                    ref: rootRef,
                     recipe,
-                    projectRoot,
-                    artifactsDir,
-                    request,
-                    outputs,
-                    artifactWriter,
+                    params,
+                    recipes,
+                    actionManifest: this.#actionManifest,
+                    adapters: this.#adapters,
                     traceWriter,
-                    runFileOffsets,
+                    logger: this.#logger,
+                    defaultObserverRefs: this.#defaultObserverRefs,
+                    createContext: (nodeId, activeRecipe, activeOutputs, getOutput) => this.#createExecutionContext({
+                        nodeId,
+                        recipe: activeRecipe,
+                        projectRoot,
+                        artifactsDir,
+                        env,
+                        outputs: activeOutputs,
+                        getOutput,
+                        artifactWriter,
+                        runFileOffsets,
+                    }),
+                    registerArtifacts: (artifacts) => {
+                        for (const artifact of artifacts)
+                            artifactWriter.register(artifact);
+                    },
+                    publishHudProgress: (hudStatus, event) => this.#publishHudProgressOrRecord(traceWriter, hudStatus, event),
                 });
-                if (preconditionStatus === 'fail') {
-                    status = 'fail';
-                    currentNodeId = undefined;
-                }
-            }
-            while (currentNodeId) {
-                const activeNodeId = currentNodeId;
-                transitionCount += 1;
-                if (transitionCount > maxTransitions) {
-                    const error = new Error('Recipe graph exceeded its maximum transition count.');
-                    recordSyntheticFailure(traceWriter, activeNodeId, error);
-                    status = 'fail';
-                    break;
-                }
-                visited.add(activeNodeId);
-                const node = graph.nodes[activeNodeId];
-                if (!node) {
-                    const error = new Error(`Recipe node ${activeNodeId} does not exist.`);
-                    recordSyntheticFailure(traceWriter, activeNodeId, error);
-                    status = 'fail';
-                    break;
-                }
-                const action = String(node.action);
-                const adapter = action === 'call' ? undefined : this.#adapters.get(action);
-                if (action !== 'call' && !adapter) {
-                    const error = new Error(`No adapter registered for action ${action}.`);
-                    recordSyntheticFailure(traceWriter, activeNodeId, error, action);
-                    status = 'fail';
-                    break;
-                }
-                const nodeStartedAt = new Date();
-                const context = this.#createExecutionContext({
-                    nodeId: activeNodeId,
-                    recipe,
-                    projectRoot,
-                    artifactsDir,
-                    env: request.env ?? {},
-                    outputs,
-                    artifactWriter,
-                    runFileOffsets,
-                });
-                try {
-                    const gate = evaluateNodeGate(node, context.outputs);
-                    if (!gate.run) {
-                        const next = resolveNextNode(node, {});
-                        traceWriter.record({
-                            nodeId: activeNodeId,
-                            action,
-                            ...traceNodeMetadata(node),
-                            startedAt: nodeStartedAt.toISOString(),
-                            endedAt: new Date().toISOString(),
-                            durationMs: Date.now() - nodeStartedAt.getTime(),
-                            ok: true,
-                            next,
-                            output: { skipped: true, reason: gate.reason },
-                        });
-                        currentNodeId = next;
-                        continue;
-                    }
-                    const hudStarted = await this.#publishHudProgressOrRecord(traceWriter, 'running', {
-                        nodeId: activeNodeId,
-                        action,
-                        node,
-                        recipe,
-                        index: transitionCount,
-                        total: Object.keys(graph.nodes).length,
-                        context,
-                    });
-                    if (!hudStarted) {
-                        status = 'fail';
-                        break;
-                    }
-                    const result = action === 'call'
-                        ? await executeInlineFlowCall({
-                            callNodeId: activeNodeId,
-                            node,
-                            context,
-                            flowCatalog,
-                            adapters: this.#adapters,
-                            traceWriter,
-                            callStack: [],
-                            maxCallDepth: DEFAULT_MAX_FLOW_CALL_DEPTH,
-                            logger: this.#logger,
-                            defaultObserverRefs: this.#defaultObserverRefs,
-                            declaredObserverRefs: this.#declaredObserverRefs,
-                            publishHudProgress: (hudStatus, flowEvent) => this.#publishHudProgressOrRecord(traceWriter, hudStatus, {
-                                ...flowEvent,
-                                recipe,
-                            }),
-                        })
-                        : await adapter.execute(node, context);
-                    const observeRefs = resolveObserveRefs(action, node, this.#defaultObserverRefs, this.#declaredObserverRefs);
-                    const observationResult = action !== 'call' && (result.status == null || result.status === 'pass')
-                        ? await runPassiveObservers({
-                            action,
-                            node,
-                            adapter: adapter,
-                            context,
-                            logger: this.#logger,
-                            refs: observeRefs,
-                        })
-                        : {};
-                    if (result.output !== undefined)
-                        outputs.set(activeNodeId, result.output);
-                    for (const artifact of result.artifacts ?? [])
-                        artifactWriter.register(artifact);
-                    const next = resolveNextNode(node, result);
-                    const { observations, observationWarnings } = finalizeNodeObservations({
-                        nodeId: activeNodeId,
-                        node,
-                        result,
-                        observationResult,
-                        observeRefs,
-                    });
-                    traceWriter.record({
-                        nodeId: activeNodeId,
-                        action,
-                        ...traceNodeMetadata(node, result),
-                        startedAt: nodeStartedAt.toISOString(),
-                        endedAt: new Date().toISOString(),
-                        durationMs: Date.now() - nodeStartedAt.getTime(),
-                        ok: true,
-                        next,
-                        status: result.status,
-                        case: result.case,
-                        output: result.output,
-                        ...(observations ? { observations } : {}),
-                        ...(observationWarnings.length ? { observationWarnings } : {}),
-                    });
-                    const hudCompleted = await this.#publishHudProgressOrRecord(traceWriter, result.status === 'fail' ? 'fail' : 'pass', {
-                        nodeId: activeNodeId,
-                        action,
-                        node,
-                        recipe,
-                        index: transitionCount,
-                        total: Object.keys(graph.nodes).length,
-                        context,
-                    });
-                    if (!hudCompleted) {
-                        status = 'fail';
-                        break;
-                    }
-                    if (result.status) {
-                        if (runningTeardown) {
-                            status = mainStatus === 'fail' ? 'fail' : result.status;
-                            break;
-                        }
-                        mainStatus = result.status;
-                        if (graph.teardownEntry) {
-                            runningTeardown = true;
-                            currentNodeId = graph.teardownEntry;
-                            continue;
-                        }
-                        status = result.status;
-                        break;
-                    }
-                    currentNodeId = next;
-                }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    traceWriter.record({
-                        nodeId: activeNodeId,
-                        action,
-                        ...traceNodeMetadata(node),
-                        startedAt: nodeStartedAt.toISOString(),
-                        endedAt: new Date().toISOString(),
-                        durationMs: Date.now() - nodeStartedAt.getTime(),
-                        ok: false,
-                        error: message,
-                    });
-                    this.#logger.error(message);
-                    await this.#publishHudProgressOrRecord(traceWriter, 'fail', {
-                        nodeId: activeNodeId,
-                        action,
-                        node,
-                        recipe,
-                        index: transitionCount,
-                        total: Object.keys(graph.nodes).length,
-                        context,
-                        error: message,
-                    });
-                    status = 'fail';
-                    if (!runningTeardown && graph.teardownEntry) {
-                        mainStatus = 'fail';
-                        runningTeardown = true;
-                        currentNodeId = graph.teardownEntry;
-                        continue;
-                    }
-                    break;
-                }
+                status = execution.status;
+                outputs = execution.outputs;
             }
             artifactWriter.register({
                 path: 'summary.json',
@@ -404,30 +277,6 @@ class DefaultRecipeRunner {
                 label: 'Execution trace',
                 category: 'system',
             });
-            // Any resolution activity — a library flow used, a recipe-local override,
-            // or cross-source shadowing — gets the artifact, so an all-overridden run
-            // still leaves reviewable evidence of what the library would have provided.
-            const shadowedFlows = libraryResolution ? collectShadowedFlows(libraryResolution) : [];
-            if (libraryResolution &&
-                (usedLibraryFlows.size > 0 || flowOverrides.length > 0 || shadowedFlows.length > 0)) {
-                await writeFile(path.join(artifactsDir, 'resolved-flows.json'), `${JSON.stringify({
-                    schema_version: 1,
-                    kind: 'recipe-resolved-flows',
-                    sources: libraryResolution.sources,
-                    overrides: flowOverrides,
-                    shadowed: shadowedFlows,
-                    flows: Object.fromEntries([...usedLibraryFlows.values()].map((flow) => [
-                        flow.ref,
-                        { source: flow.source, file: flow.file, definition: flow.raw },
-                    ])),
-                }, null, 2)}\n`);
-                artifactWriter.register({
-                    path: 'resolved-flows.json',
-                    type: 'json',
-                    label: 'Library flow resolution for this run',
-                    category: 'system',
-                });
-            }
             if (status === 'pass') {
                 const runHudStartedAt = new Date();
                 try {
@@ -435,7 +284,7 @@ class DefaultRecipeRunner {
                         recipe,
                         projectRoot,
                         artifactsDir,
-                        env: request.env ?? {},
+                        env,
                         outputs,
                     });
                 }
@@ -464,6 +313,7 @@ class DefaultRecipeRunner {
                 catch (error) {
                     const message = errorMessage(error);
                     await removePartialRunVideoOutput(recordingToStop.outputPath, this.#logger);
+                    await rm(recordingToStop.stagingRoot, { recursive: true, force: true });
                     traceWriter.record({
                         nodeId: 'recipe-run:video',
                         action: 'record.video',
@@ -504,22 +354,18 @@ class DefaultRecipeRunner {
             },
             ...(this.#runnerProvenance ? { runner: this.#runnerProvenance } : {}),
             ...(libraryResolution
-                ? {
-                    flowResolution: buildFlowResolutionSummary(libraryResolution, usedLibraryFlows, flowOverrides),
-                }
+                ? { recipeLibraries: buildRecipeLibrarySummary(libraryResolution) }
                 : {}),
         };
         const summaryPath = await summaryWriter.write(summary);
         const artifactManifestPath = await artifactWriter.write(status, this.#runnerProvenance);
         const packageValidation = validateRecipeArtifactPackage({
             recipe,
-            // Hand the composed recipe and the run outcome to the validator: it validates
-            // the composition in full only for a passing run (parity with gateway/CLI), and
-            // leaves a gracefully-failed run's composition unchecked.
-            ...(resolvedRecipe !== recipe ? { resolvedRecipe } : {}),
-            // Only a confirmed failure relaxes composition enforcement; an unknown/incomplete
-            // status still requires the composition to be proven.
-            runPassed: status !== 'fail',
+            resolvedRecipes: Object.fromEntries([...dependencyResolution.recipes.values()].map((entry) => [
+                entry.provenance.digest,
+                entry.document,
+            ])),
+            recipeResolution: dependencyResolution.document,
             manifest: {
                 version: 1,
                 runStatus: status,
@@ -531,6 +377,7 @@ class DefaultRecipeRunner {
                 'summary.json',
                 'trace.json',
                 'artifact-manifest.json',
+                'recipe-resolution.json',
                 ...artifactWriter.list().map((entry) => entry.path),
             ],
         });
@@ -541,60 +388,7 @@ class DefaultRecipeRunner {
         }
         return { status, summaryPath, tracePath, artifactManifestPath, recipePath };
     }
-    async #runPreconditions({ graph, recipe, projectRoot, artifactsDir, request, outputs, artifactWriter, traceWriter, runFileOffsets, }) {
-        for (const gate of graph.preconditions) {
-            const nodeId = `pre_conditions:${gate.id}`;
-            const checker = this.#preconditions.get(gate.id);
-            if (!checker) {
-                recordSyntheticFailure(traceWriter, nodeId, new Error(`Precondition ${gate.id} is declared by the recipe but has no checker registered.`), 'pre_condition');
-                return 'fail';
-            }
-            const startedAt = new Date();
-            const context = this.#createExecutionContext({
-                nodeId,
-                recipe,
-                projectRoot,
-                artifactsDir,
-                env: request.env ?? {},
-                outputs,
-                artifactWriter,
-                runFileOffsets,
-            });
-            try {
-                const rawResult = await checker.execute(gate, context);
-                const result = normalizePreconditionResult(rawResult);
-                if (result.output !== undefined)
-                    outputs.set(nodeId, result.output);
-                if (result.ok === false) {
-                    throw new Error(result.error ?? `Precondition ${gate.id} failed.`);
-                }
-                traceWriter.record({
-                    nodeId,
-                    action: 'pre_condition',
-                    startedAt: startedAt.toISOString(),
-                    endedAt: new Date().toISOString(),
-                    durationMs: Date.now() - startedAt.getTime(),
-                    ok: true,
-                    output: result.output,
-                });
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                traceWriter.record({
-                    nodeId,
-                    action: 'pre_condition',
-                    startedAt: startedAt.toISOString(),
-                    endedAt: new Date().toISOString(),
-                    durationMs: Date.now() - startedAt.getTime(),
-                    ok: false,
-                    error: message,
-                });
-                return 'fail';
-            }
-        }
-        return 'pass';
-    }
-    #createExecutionContext({ nodeId, recipe, projectRoot, artifactsDir, env, outputs, artifactWriter, runFileOffsets, }) {
+    #createExecutionContext({ nodeId, recipe, projectRoot, artifactsDir, env, outputs, getOutput, artifactWriter, runFileOffsets, }) {
         return {
             nodeId,
             recipe,
@@ -602,11 +396,7 @@ class DefaultRecipeRunner {
             artifactsDir,
             env,
             outputs,
-            getOutput(nodeId) {
-                if (!outputs.has(nodeId))
-                    throw new Error(`No output recorded for node ${nodeId}.`);
-                return outputs.get(nodeId);
-            },
+            getOutput,
             resolveProjectPath(relativePath) {
                 return path.join(projectRoot, normalizeRelativePath(relativePath));
             },
@@ -648,8 +438,9 @@ class DefaultRecipeRunner {
             throw new Error('--record-video requires a recording target. Provide a project RecordingTargetProvider or CLI target flags.');
         }
         const relativePath = 'videos/recipe-run.mp4';
-        const outputPath = path.join(artifactsDir, relativePath);
-        await mkdir(path.dirname(outputPath), { recursive: true });
+        const stagingRoot = await mkdtemp(path.join(os.tmpdir(), 'farmslot-recipe-video-'));
+        const stagingRelativePath = 'recipe-run.mp4';
+        const outputPath = path.join(stagingRoot, stagingRelativePath);
         let recording;
         try {
             recording = await recorder.start({
@@ -663,6 +454,7 @@ class DefaultRecipeRunner {
         }
         catch (error) {
             await removePartialRunVideoOutput(outputPath, this.#logger);
+            await rm(stagingRoot, { recursive: true, force: true });
             throw error;
         }
         const entry = {
@@ -680,11 +472,20 @@ class DefaultRecipeRunner {
             },
             ...(videoOptions.maxFps != null ? { maxFps: videoOptions.maxFps } : {}),
         };
-        return { recording, entry, outputPath };
+        return {
+            recording,
+            entry,
+            outputPath,
+            stagingRoot,
+            stagingRelativePath,
+            artifactsDir,
+        };
     }
     async #stopRunVideoRecording(runRecording) {
         const result = await runRecording.recording.stop();
         await assertVideoOutputReady(runRecording.outputPath);
+        await copyFileWithinRoots(runRecording.stagingRoot, runRecording.stagingRelativePath, runRecording.artifactsDir, runRecording.entry.path);
+        await rm(runRecording.stagingRoot, { recursive: true, force: true });
         return result.recorder
             ? {
                 ...runRecording.entry,
@@ -727,6 +528,7 @@ class DefaultRecipeRunner {
         const adapter = this.#adapters.get(hudAction);
         if (!adapter)
             return;
+        await verifyExecutableSource(adapter, `Action ${hudAction}`);
         await adapter.execute(buildHudNode(status, event, this.#hud), event.context);
     }
     async #publishRunHud(status, request) {
@@ -736,6 +538,7 @@ class DefaultRecipeRunner {
         const adapter = this.#adapters.get(hudAction);
         if (!adapter)
             return;
+        await verifyExecutableSource(adapter, `Action ${hudAction}`);
         const context = {
             nodeId: 'recipe-complete',
             recipe: request.recipe,
@@ -780,30 +583,32 @@ class DefaultRecipeRunner {
         return 'Recipe run';
     }
 }
-function buildFlowResolutionSummary(resolution, usedLibraryFlows, overrides) {
+function buildRecipeLibrarySummary(resolution) {
     return {
         sources: resolution.sources,
-        used: [...usedLibraryFlows.values()].map((flow) => ({
-            ref: flow.ref,
-            source: flow.source,
-            file: flow.file,
-            ...(flow.shadows.length > 0 ? { shadows: flow.shadows } : {}),
-            ...(flow.lastVerified ? { lastVerified: flow.lastVerified } : {}),
-        })),
-        overrides,
-        shadowed: collectShadowedFlows(resolution),
+        shadowed: collectShadowedRecipes(resolution),
     };
 }
-function collectShadowedFlows(resolution) {
-    return [...resolution.flows.values()]
-        .filter((flow) => flow.shadows.length > 0)
-        .map((flow) => ({
-        ref: flow.ref,
-        source: flow.source,
-        file: flow.file,
-        shadows: flow.shadows,
+function collectShadowedRecipes(resolution) {
+    return [...resolution.recipes.values()]
+        .filter((recipe) => recipe.shadows.length > 0)
+        .map((recipe) => ({
+        ref: recipe.ref,
+        source: recipe.source,
+        file: recipe.file,
+        shadows: recipe.shadows,
     }));
 }
+function rootRecipeRef(sourceRecipePath, recipes, digest) {
+    if (sourceRecipePath) {
+        const resolvedPath = path.resolve(sourceRecipePath);
+        const match = [...recipes.values()].find((recipe) => path.resolve(recipe.path) === resolvedPath);
+        if (match)
+            return match.ref;
+        return rootResolutionRef(digest);
+    }
+    return rootResolutionRef(digest);
+}
 function normalizeVideoRecordingOptions(input) {
     if (!input)
         return { mode: 'off' };