@fungi.computer/bonsai 0.1.0 → 0.2.1

package/backend/methods.ts

@@ -1,3 +1,13 @@
+import {
+  runReply,
+  statusReply,
+  runsReplySchema,
+} from "@fungi.computer/workflows-wire";
+import {
+  startManualBuildWorkflow,
+  readBuildWorkflowRuns,
+  type BuildWorkflowBindings,
+} from "./build-workflow.js";
 import { resultRows } from "@fungi.computer/agar/method-presentation";
 import { openChangesGill, recentCommitsGill } from "./gills.js";
 import {
@@ -35,6 +45,8 @@ import {
 } from "@fungi.computer/agar/backend-definition";
 import type { AppMethodCallContext } from "@fungi.computer/puffball/app-method-runtime";
 import * as z from "zod";
+import * as S from "effect/Schema";
+import { releaseSchema } from "@fungi.computer/puffball/effect";
 import {
   gitSha1Schema,
   gitRepositoryNameSchema,
@@ -42,6 +54,10 @@ import {
 import {
   activityPage,
   appBuildView,
+  appBuildWorkflowInput,
+  appBuildStatusInput,
+  appRegistrationInput,
+  appRegistration,
   approvalResult,
   checkRequestResult,
   checkReportResult,
@@ -102,6 +118,9 @@ export type AppsBindingReply = Readonly<{
 
 /** The host `APPS` binding: fork a source, build it, and install a Release. */
 export type BonsaiAppsBinding = Readonly<{
+  register(
+    input: z.infer<typeof appRegistrationInput>,
+  ): Promise<AppsBindingReply>;
   fork(input: {
     platformAppId: string;
     name: string;
@@ -109,9 +128,13 @@ export type BonsaiAppsBinding = Readonly<{
   build(input: {
     appId: string;
     sourceRevision: string;
+    installationId?: string;
   }): Promise<AppsBindingReply>;
-  buildStatus(input: { jobId: string }): Promise<AppsBindingReply>;
+  buildStatus(
+    input: z.infer<typeof appBuildStatusInput>,
+  ): Promise<AppsBindingReply>;
   select(input: {
+    jobId: string;
     installationId: string;
     release: unknown;
   }): Promise<AppsBindingReply>;
@@ -120,10 +143,11 @@ export type BonsaiAppsBinding = Readonly<{
 /** What a Bonsai method runs against: the facet supplies it. */
 type BonsaiMethodContext = Readonly<{
   bonsai: Bonsai;
-  env?: Readonly<{
-    BACKGROUND?: BackgroundBinding;
-    APPS?: BonsaiAppsBinding;
-  }>;
+  env?: BuildWorkflowBindings &
+    Readonly<{
+      BACKGROUND?: BackgroundBinding;
+      APPS?: BonsaiAppsBinding;
+    }>;
 }>;
 
 const bindingErrorBody = z.object({ error: z.string() });
@@ -133,13 +157,15 @@ function refuseBindingReply(reply: AppsBindingReply): never {
   const parsed = bindingErrorBody.safeParse(reply.body);
   const message = parsed.success ? parsed.data.error : "Request refused";
   throw new AppMethodRefusal(
-    reply.status === 404
-      ? "not_found"
-      : reply.status === 409
-        ? "conflict"
-        : reply.status === 403
-          ? "forbidden"
-          : "invalid",
+    reply.status >= 500
+      ? "unavailable"
+      : reply.status === 404
+        ? "not_found"
+        : reply.status === 409
+          ? "conflict"
+          : reply.status === 403
+            ? "forbidden"
+            : "invalid",
     message,
   );
 }
@@ -220,6 +246,72 @@ const definition = defineAppBackend<BonsaiMethodContext>({
     },
   },
   methods: {
+    "apps.register": defineAppMethod({
+      description:
+        "Make this repository an App using its main commit's package.json build recipe. Owner only; does not build or install it.",
+      effect: "write",
+      requires: ["git.repository"],
+      input: appRegistrationInput,
+      output: appRegistration,
+      handler: async (input, context: BonsaiMethodContext, caller) => {
+        if (caller.role !== "owner")
+          throw new AppMethodRefusal("forbidden", "Owner only");
+        if (!context.env?.APPS)
+          throw new AppMethodRefusal(
+            "unavailable",
+            "App registration is unavailable",
+          );
+        const reply = await context.env.APPS.register(input);
+        if (reply.status >= 400) refuseBindingReply(reply);
+        return appRegistration.parse(reply.body);
+      },
+    }),
+    "apps.startBuildWorkflow": defineAppMethod({
+      description:
+        "Build, verify and install this repository through the published Workflow. Owner only.",
+      effect: "write",
+      requires: ["git.repository", "workflow.run", "workflow.publish"],
+      input: appBuildWorkflowInput,
+      output: runReply,
+      handler: (input, context: BonsaiMethodContext, caller) => {
+        if (caller.role !== "owner")
+          throw new AppMethodRefusal("forbidden", "Owner only");
+        return startManualBuildWorkflow(context.env ?? {}, input);
+      },
+    }),
+    "apps.buildWorkflowRuns": defineAppMethod({
+      description:
+        "Discover up to fifty runs of this installation's build Workflow, including accepted main pushes. Read-only; owner only.",
+      effect: "read",
+      requires: ["workflow.run"],
+      input: z.strictObject({}),
+      output: runsReplySchema,
+      handler: (_input, context: BonsaiMethodContext, caller) => {
+        if (caller.role !== "owner")
+          throw new AppMethodRefusal("forbidden", "Owner only");
+        return readBuildWorkflowRuns(context.env ?? {});
+      },
+    }),
+    "apps.buildWorkflowRun": defineAppMethod({
+      description:
+        "Read this installation's build Workflow and its recorded step results. Owner only.",
+      effect: "read",
+      requires: ["workflow.run"],
+      input: z.strictObject({ runId: z.string().min(1).max(256) }),
+      output: statusReply,
+      handler: async (input, context: BonsaiMethodContext, caller) => {
+        if (caller.role !== "owner")
+          throw new AppMethodRefusal("forbidden", "Owner only");
+        if (context.env?.WORKFLOWS === undefined)
+          throw new AppMethodRefusal(
+            "unavailable",
+            "Workflow access is not granted",
+          );
+        return statusReply.parse(
+          await context.env.WORKFLOWS.graphStatus(input),
+        );
+      },
+    }),
     "apps.build": defineAppMethod({
       description:
         "Build an App's registered source at one exact commit on this Oyster's Computer; the job keeps running after this call returns. Owner only.",
@@ -230,28 +322,44 @@ const definition = defineAppBackend<BonsaiMethodContext>({
       input: z.strictObject({
         appId: z.string().min(1).max(256),
         sourceRevision: z.string().min(1).max(256),
+        installationId: z.string().min(1).max(256).optional(),
       }),
       output: appBuildView,
+      present: {
+        rows: resultRows,
+        verb: "started",
+        row: ({ output }) => ({
+          id: output.jobId,
+          title: "Build " + output.status,
+          detail: output.sourceRevision,
+        }),
+      },
       handler: async (input, context: BonsaiMethodContext, caller) => {
         if (caller.role !== "owner")
           throw new AppMethodRefusal("forbidden", "Owner only");
         if (!context.env?.APPS)
           throw new AppMethodRefusal("unavailable", "Build is unavailable");
-        const reply = await context.env.APPS.build(input);
+        const request: Parameters<BonsaiAppsBinding["build"]>[0] = {
+          appId: input.appId,
+          sourceRevision: input.sourceRevision,
+        };
+        if (input.installationId !== undefined)
+          request.installationId = input.installationId;
+        const reply = await context.env.APPS.build(request);
         if (reply.status >= 400) refuseBindingReply(reply);
         return appBuildView.parse(reply.body);
       },
     }),
     "apps.buildStatus": defineAppMethod({
       description:
-        "Wait for one build job: Pending while it runs, then its settled status and Release. Owner only.",
+        "Read one build job or discover this repository's latest job. Pending until build and automatic installation settle. Owner only.",
       effect: "read",
       // The host grants its APPS operation only under these approvals.
       requires: ["git.repository", "computer.execute"],
       // A Workflow step waits on the job by polling this same call.
       pending: true,
-      input: z.strictObject({ jobId: z.string().min(1).max(256) }),
-      output: appBuildView,
+      input: appBuildStatusInput,
+      output: appBuildView.nullable(),
       handler: async (input, context: BonsaiMethodContext, caller) => {
         if (caller.role !== "owner")
           throw new AppMethodRefusal("forbidden", "Owner only");
@@ -259,27 +367,104 @@ const definition = defineAppBackend<BonsaiMethodContext>({
           throw new AppMethodRefusal("unavailable", "Build is unavailable");
         const reply = await context.env.APPS.buildStatus(input);
         if (reply.status >= 400) refuseBindingReply(reply);
-        const build = appBuildView.parse(reply.body);
-        return build.status === "running" ? pending(5_000) : build;
+        const build = appBuildView.nullable().parse(reply.body);
+        if (build === null) return null;
+        return build.status === "running" ||
+          (build.status === "succeeded" &&
+            build.installation?.kind === "pending")
+          ? pending(5_000)
+          : build;
+      },
+    }),
+    "apps.verifyBuild": defineAppMethod({
+      description:
+        "Wait for the build's boot gate and verify that its Release is the exact requested commit. A failed or mismatched build never installs.",
+      effect: "read",
+      requires: ["git.repository", "computer.execute"],
+      pending: true,
+      input: z.strictObject({
+        jobId: z.string().min(1).max(256),
+        sourceRevision: z.string().regex(/^git:[0-9a-f]{40}$/),
+      }),
+      output: z.strictObject({
+        release: z.unknown(),
+        summary: z.string().max(4000),
+      }),
+      present: {
+        rows: resultRows,
+        verb: "verified",
+        row: ({ output }) => ({
+          id: "apps.verifyBuild",
+          title: "Release verified",
+          detail: output.summary,
+        }),
+      },
+      handler: async (input, context: BonsaiMethodContext, caller) => {
+        if (caller.role !== "owner")
+          throw new AppMethodRefusal("forbidden", "Owner only");
+        if (!context.env?.APPS)
+          throw new AppMethodRefusal("unavailable", "Build is unavailable");
+        const reply = await context.env.APPS.buildStatus({
+          jobId: input.jobId,
+        });
+        if (reply.status >= 400) refuseBindingReply(reply);
+        const build = appBuildView.nullable().parse(reply.body);
+        if (build === null)
+          throw new AppMethodRefusal("not_found", "Build not found");
+        if (build.status === "running") return pending(5_000);
+        if (build.status !== "succeeded" || build.release === null)
+          throw new AppMethodRefusal(
+            "invalid",
+            "The build did not pass" +
+              (build.detail === null ? "" : ": " + build.detail.slice(-2000)),
+          );
+        const release = S.decodeUnknownSync(releaseSchema)(build.release);
+        if (release.artifact.provenance.sourceRevision !== input.sourceRevision)
+          throw new AppMethodRefusal(
+            "invalid",
+            "The build's Release is not the requested commit",
+          );
+        return {
+          release,
+          summary:
+            "Built " +
+            release.releaseId +
+            " of " +
+            release.appId +
+            " from " +
+            input.sourceRevision,
+        };
       },
     }),
     "apps.install": defineAppMethod({
       description:
         "Install a built Release at an installation id, or switch an already-live one onto it. Owner only.",
       effect: "write",
+      pending: true,
       // The host grants its APPS operation only under these approvals.
       requires: ["git.repository", "computer.execute"],
       input: z.strictObject({
+        jobId: z.string().min(1).max(256),
         installationId: z.string().min(1).max(256),
         release: z.unknown(),
       }),
       output: z.unknown(),
+      present: {
+        rows: resultRows,
+        verb: "installed",
+        row: ({ input }) => ({
+          id: "apps.install",
+          title: "Release installed",
+          detail: input.installationId,
+        }),
+      },
       handler: async (input, context: BonsaiMethodContext, caller) => {
         if (caller.role !== "owner")
           throw new AppMethodRefusal("forbidden", "Owner only");
         if (!context.env?.APPS)
           throw new AppMethodRefusal("unavailable", "Install is unavailable");
         const reply = await context.env.APPS.select(input);
+        if (reply.status === 202) return pending(5000);
         if (reply.status >= 400) refuseBindingReply(reply);
         return reply.body;
       },
@@ -697,7 +882,12 @@ const definition = defineAppBackend<BonsaiMethodContext>({
       effect: "write",
       // The continuation covers every write's requirements (apps.build's
       // computer.execute included); it only replays queued Git writes.
-      requires: ["git.repository", "computer.execute"],
+      requires: [
+        "git.repository",
+        "computer.execute",
+        "workflow.run",
+        "workflow.publish",
+      ],
       input: z.strictObject({}),
       output: z.strictObject({ more: z.boolean() }),
       handler: (_input, context, caller) =>

package/package.json

@@ -1,16 +1,17 @@
 {
   "name": "@fungi.computer/bonsai",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "author": "Levi <levi@technomancy.dev>",
   "type": "module",
   "description": "Bonsai: a git platform for many agents working at once, on Workers and Artifacts",
   "dependencies": {
-    "@fungi.computer/agar": "0.2.0",
-    "@fungi.computer/caps": "0.1.0",
-    "@fungi.computer/issues": "0.0.1",
-    "@fungi.computer/oyster": "0.2.0",
-    "@fungi.computer/puffball": "0.1.0",
-    "@fungi.computer/stipe": "0.0.1",
+    "@fungi.computer/agar": "0.3.0",
+    "@fungi.computer/caps": "0.2.0",
+    "@fungi.computer/issues": "0.1.0",
+    "@fungi.computer/oyster": "0.3.1",
+    "@fungi.computer/puffball": "0.2.0",
+    "@fungi.computer/sigils": "0.2.0",
+    "@fungi.computer/stipe": "0.1.0",
     "@pierre/diffs": "1.3.6",
     "@pierre/trees": "1.0.0-beta.6",
     "@tanstack/react-query": "5.102.8",
@@ -22,12 +23,16 @@
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "zod": "4.4.3",
-    "@fungi.computer/watchdog": "0.0.1",
+    "@fungi.computer/watchdog": "0.1.0",
     "effect": "4.0.2",
-    "@fungi.computer/cairn": "0.0.1",
-    "@fungi.computer/maosaico": "0.0.1",
+    "@fungi.computer/cairn": "0.1.0",
+    "@fungi.computer/maosaico": "0.1.0",
     "@visx/hierarchy": "3.12.0",
-    "@fungi.computer/gills": "0.1.0"
+    "@fungi.computer/gills": "0.2.0",
+    "@fungi.computer/nacre": "0.0.1",
+    "@fungi.computer/trellis": "0.2.0",
+    "@fungi.computer/braid": "0.2.0",
+    "@fungi.computer/workflows-wire": "0.2.0"
   },
   "devDependencies": {
     "playwright": "1.62.1",
@@ -43,12 +48,11 @@
     "vitest": "4.1.11",
     "wrangler": "4.135.0",
     "tsx": "4.23.12",
-    "@fungi.computer/braid": "0.1.0",
-    "@fungi.computer/gills": "0.1.0",
+    "@fungi.computer/gills": "0.2.0",
     "eslint": "10.9.1",
     "oxlint": "1.78.0",
     "jsdom": "29.0.1",
-    "@fungi.computer/computer": "0.1.0"
+    "@fungi.computer/computer-contract": "0.0.1"
   },
   "botanical": {
     "role": "app",
@@ -89,7 +93,9 @@
         "git.repository",
         "apps.open",
         "app.events.emit",
-        "computer.execute"
+        "computer.execute",
+        "workflow.run",
+        "workflow.publish"
       ],
       "receives": [
         "git.push"
@@ -117,9 +123,21 @@
           {
             "name": "APPS",
             "operations": [
+              "register",
+              "fork",
               "build",
               "buildStatus",
-              "select"
+              "select",
+              "repository"
+            ]
+          },
+          {
+            "name": "WORKFLOWS",
+            "operations": [
+              "catalog",
+              "runGraph",
+              "graphStatus",
+              "runs"
             ]
           }
         ]
@@ -132,7 +150,25 @@
       ],
       "stylesheets": [
         "web/bonsai.css"
-      ]
+      ],
+      "entry": "web/index.html",
+      "maxOutputBytes": 67108864,
+      "backend": {
+        "entry": "backend/index.ts",
+        "exportName": "BonsaiApp",
+        "compatibilityDate": "2026-09-04",
+        "runtime": {
+          "kind": "durable-facet",
+          "stateSchema": 1
+        }
+      },
+      "assetBase": "./",
+      "assets": {
+        "maxManifestBytes": 1048576,
+        "maxObjects": 1024,
+        "maxObjectBytes": 16777216,
+        "maxTotalBytes": 67108864
+      }
     }
   },
   "scripts": {
@@ -140,7 +176,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint backend web shared test --max-warnings=0 && oxlint --config ../../oxlint.config.ts --deny-warnings backend web shared test",
     "test": "pnpm run test:unit && pnpm run test:merge",
-    "test:unit": "vitest run && node --import tsx --test test/seed-resume.test.mjs test/insight-layout.test.mjs test/checks-workflow-template.test.mjs test/merge-template-build.test.mjs test/storyboard-save-template.test.mjs",
+    "test:unit": "vitest run && node --import tsx --test test/seed-resume.test.mjs test/insight-layout.test.mjs test/checks-workflow-template.test.mjs test/merge-template-build.test.mjs test/storyboard-save-template.test.mjs test/favicon.test.mjs",
     "test:merge": "node --import tsx test/git-push.native.mjs",
     "format:check": "node ../../tooling/repository/scripts/format-package-check.mjs",
     "lint:anti-slop": "node ../../tooling/repository/scripts/lint-package-anti-slop.mjs",

package/scripts/release.mjs

@@ -9,6 +9,10 @@ import process from "node:process";
 import { log } from "node:console";
 import { installRelease, packRelease } from "@fungi.computer/oyster/pack";
 import { standaloneAppSet } from "@fungi.computer/oyster/standalone/app-set";
+import {
+  appBuildRecipe,
+  readBuildManifest,
+} from "@fungi.computer/oyster/build";
 
 const root = fileURLToPath(new URL("../", import.meta.url));
 const repository = fileURLToPath(new URL("../../../", import.meta.url));
@@ -22,6 +26,13 @@ const revision = execFileSync("git", ["rev-parse", "HEAD"], {
 }).trim();
 const bonsai = standaloneAppSet.find((app) => app.installationId === "bonsai");
 if (!bonsai) throw new Error("The standalone App set must include Bonsai");
+const manifest = readBuildManifest(
+  execFileSync(
+    "git",
+    ["show", revision + ":" + bonsai.directory + "/package.json"],
+    { cwd: repository, encoding: "utf8" },
+  ),
+);
 const stamp = Date.now().toString(36);
 const outDirectory = `${root}.botanical/release`;
 
@@ -34,7 +45,7 @@ await packRelease({
     cwd: repository,
     encoding: "utf8",
   }).trim(),
-  recipe: bonsai.recipe,
+  recipe: appBuildRecipe(manifest, bonsai.directory),
   outDirectory,
 });
 

package/scripts/shed-terminal-proof.mjs

@@ -20,7 +20,7 @@ import * as z from "zod";
 import { installRelease } from "@fungi.computer/oyster/pack";
 import { parseSourceRevision } from "@fungi.computer/puffball";
 import { releaseSchema } from "@fungi.computer/puffball/effect";
-import { workbenchDirectorySchema } from "@fungi.computer/oyster/shell/workbench-directory";
+import { workbenchDirectorySchema } from "@fungi.computer/nacre/workbench-directory";
 
 const [packedDirectory, expectedRevision, tourtoisDirectory, tourtoisRevision] =
   z
@@ -227,11 +227,13 @@ try {
     "The unchanged Shed backend runs a native command",
   );
   const result = await command.json();
-  assert.equal(result.status, "succeeded");
-  assert.equal(result.output.status, "completed");
-  assert.equal(result.output.stdout, "standalone-shed-terminal");
-  assert.equal(result.output.stderr, "");
-  assert.equal(result.output.exitCode, 0);
+  assert.deepEqual(result, {
+    stdout: "standalone-shed-terminal",
+    stderr: "",
+    exitCode: 0,
+    stdoutTruncated: false,
+    stderrTruncated: false,
+  });
 
   const directoryResponse = await globalThis.fetch(
     `${origin}/api/workbench/directory`,
@@ -568,8 +570,8 @@ try {
       // Tourtois window chrome, not Shed's own light/full prompt, so they
       // work the same escalated or not.
       // Port 8099, not 8080: 8080 is computerDaemonPort, computerd's own
-      // reserved control-plane port (packages/computer/src/
-      // operation-contract.ts); starting a demo process there throws
+      // reserved control-plane port (packages/computer-contract/src/
+      // index.ts); starting a demo process there throws
       // ComputerPortReservedError, confirmed against the real VM.
       //
       // Not python3 -m http.server: packages/computer/Dockerfile only

package/shared/contract.ts

@@ -12,6 +12,15 @@ import { commit } from "@fungi.computer/agar/roles/files";
 
 export const productName = "Bonsai";
 
+/** An explicit owner action starts the same published build/install Workflow. */
+export const appBuildWorkflowInput = z.strictObject({
+  repo: repoName,
+  sourceRevision: z.string().min(1).max(256),
+  installationId: z.string().min(1).max(256),
+  requestId: z.string().min(1).max(256),
+});
+export type AppBuildWorkflowInput = z.infer<typeof appBuildWorkflowInput>;
+
 /** Any JSON value: App method inputs and results travel as JSON. */
 export const jsonValue = z.json();
 export type JsonValue = z.infer<typeof jsonValue>;
@@ -389,6 +398,22 @@ export const issueFiles = z.strictObject({
 export type IssueFiles = z.infer<typeof issueFiles>;
 export const repoPage = z.strictObject({ repos: z.array(repoSummary) });
 
+/** The host's install decision on this build, not a consent request. */
+const appBuildInstallation = z.discriminatedUnion("kind", [
+  z.strictObject({ kind: z.literal("pending"), installationId: z.string() }),
+  z.strictObject({ kind: z.literal("installed"), installationId: z.string() }),
+  z.strictObject({
+    kind: z.literal("needs_consent"),
+    installationId: z.string(),
+  }),
+  z.strictObject({
+    kind: z.literal("failed"),
+    installationId: z.string(),
+    detail: z.string(),
+  }),
+]);
+export type AppBuildInstallation = z.infer<typeof appBuildInstallation>;
+
 /** One App build job as its owner sees it; a settled success carries its Release. */
 export const appBuildView = z.strictObject({
   jobId: z.string().min(1).max(256),
@@ -399,6 +424,22 @@ export const appBuildView = z.strictObject({
   detail: z.string().max(65_536).nullable(),
   /** The recorded Release, parsed by its owner where it is installed. */
   release: z.unknown(),
+  installation: appBuildInstallation.nullable(),
+});
+
+/** Register the calling installation's repository, never a caller-supplied recipe. */
+export const appRegistrationInput = z.strictObject({ repo: repoName });
+
+/** Workflows wait for one job; Settings discovers its repository's latest job. */
+export const appBuildStatusInput = z.union([
+  z.strictObject({ jobId: z.string().min(1).max(256) }),
+  appRegistrationInput,
+]);
+
+/** The host's App identity and exact main commit whose metadata it registered. */
+export const appRegistration = appBuildView.pick({
+  appId: true,
+  sourceRevision: true,
 });
 
 export const errorBody = z.strictObject({ error: z.string() });