@growthub/cli 0.13.1 → 0.13.4

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/workspace-rail.jsx

@@ -232,6 +232,50 @@ function filterNavFolderRows(rows, query, typeFilter) {
   });
 }
 
+/**
+ * Derive which nav-folder item is "active" for the current route. The
+ * destination URLs here mirror `openDashboardItem`/`openViewItem`/
+ * `openWorkflowItem` below — so a freshly mounted rail can recover the
+ * active item (and therefore its parent folder) purely from
+ * pathname + searchParams, without depending on transient client state.
+ */
+function isNavItemActive(item, pathname, searchParams) {
+  if (!item || !pathname) return false;
+  const get = (key) => (searchParams && typeof searchParams.get === "function"
+    ? searchParams.get(key)
+    : null);
+  if (item.type === "dashboard") {
+    return pathname === "/" && get("dashboard") === String(item.refId || "");
+  }
+  if (item.type === "view") {
+    return pathname.startsWith("/data-model")
+      && get("object") === String(item.objectId || "");
+  }
+  if (item.type === "workflow") {
+    return pathname.startsWith("/workflows")
+      && get("object") === String(item.objectId || "")
+      && get("row") === String(item.rowId || "");
+  }
+  return false;
+}
+
+/**
+ * Walk the persisted nav-folder rows and return the folder id whose item
+ * matches the active route, or null if none do. This is the anchor the
+ * rail uses to keep the parent folder open while the user navigates
+ * between its dashboards / views / workflows.
+ */
+function deriveActiveNavFolderId(rows, pathname, searchParams) {
+  if (!Array.isArray(rows) || !rows.length) return null;
+  for (const folder of rows) {
+    const items = Array.isArray(folder?.items) ? folder.items : [];
+    for (const item of items) {
+      if (isNavItemActive(item, pathname, searchParams)) return folder.id;
+    }
+  }
+  return null;
+}
+
 function hexToTintBg(hex, alpha = 0.1) {
   const h = String(hex || "").replace("#", "");
   if (!/^[0-9a-f]{6}$/i.test(h)) return "#f5f5f5";
@@ -415,6 +459,19 @@ function NavFoldersSection({
   const dashboards = useMemo(() => listAvailableDashboards(workspaceConfig), [workspaceConfig]);
   const viewableObjects = useMemo(() => listAvailableObjectsForViews(workspaceConfig), [workspaceConfig]);
   const workflows = useMemo(() => listAvailableWorkflows(workspaceConfig), [workspaceConfig]);
+  const activeFolderId = useMemo(
+    () => deriveActiveNavFolderId(rows, pathname, searchParams),
+    [rows, pathname, searchParams],
+  );
+
+  // When the user lands on a route owned by a folder item (deep-link,
+  // reload, cross-page navigation), expand the Folders section so the
+  // active folder/item is visible without an extra click. Manual
+  // collapse still wins — the effect only fires when activeFolderId
+  // changes, not on every render.
+  useEffect(() => {
+    if (activeFolderId) setSectionCollapsed(false);
+  }, [activeFolderId]);
   const filteredEntries = useMemo(
     () => filterNavFolderRows(rows, filterQuery, filterType),
     [rows, filterQuery, filterType],
@@ -875,7 +932,10 @@ function NavFoldersSection({
               type="button"
               role="menuitem"
               className="workspace-rail-thread-menu-item"
-              onClick={() => startCustomizeItem(folder, item)}
+              onClick={(e) => {
+                e.stopPropagation();
+                startCustomizeItem(folder, item);
+              }}
             >
               <Pencil size={13} aria-hidden="true" /> Customize
             </button>
@@ -883,7 +943,10 @@ function NavFoldersSection({
               type="button"
               role="menuitem"
               className="workspace-rail-thread-menu-item is-destructive"
-              onClick={() => deleteItem(folder.id, item.id)}
+              onClick={(e) => {
+                e.stopPropagation();
+                deleteItem(folder.id, item.id);
+              }}
             >
               <Trash2 size={13} aria-hidden="true" /> Remove
             </button>
@@ -896,11 +959,7 @@ function NavFoldersSection({
   const renderItemRow = (folder, item) => {
     const composedId = `${folder.id}::${item.id}`;
     const isMenuOpen = openMenuId === composedId;
-    const isActive = item.type === "view" && pathname.startsWith(`/views/${encodeURIComponent(item.id)}`)
-      || (item.type === "workflow"
-        && pathname.startsWith("/workflows")
-        && searchParams.get("object") === item.objectId
-        && searchParams.get("row") === item.rowId);
+    const isActive = isNavItemActive(item, pathname, searchParams);
     const style = navItemStyle(item);
     const typeHint = item.type === "dashboard" ? "Dashboard" : item.type === "workflow" ? "Workflow" : "View";
     return (
@@ -918,7 +977,11 @@ function NavFoldersSection({
           <button
             type="button"
             className="workspace-rail-nav-row-main"
-            onClick={() => {
+            onClick={(e) => {
+              // Child clicks must never reach the folder toggle — keep
+              // navigation independent from accordion state so the parent
+              // folder stays open while the user moves between its items.
+              e.stopPropagation();
               if (item.type === "dashboard") openDashboardItem(item);
               else if (item.type === "workflow") openWorkflowItem(item);
               else openViewItem(item);
@@ -996,7 +1059,10 @@ function NavFoldersSection({
               type="button"
               role="menuitem"
               className="workspace-rail-thread-menu-item"
-              onClick={() => startCustomizeFolder(folder)}
+              onClick={(e) => {
+                e.stopPropagation();
+                startCustomizeFolder(folder);
+              }}
             >
               <Pencil size={13} aria-hidden="true" /> Customize
             </button>
@@ -1005,7 +1071,8 @@ function NavFoldersSection({
               role="menuitem"
                   className="workspace-rail-thread-menu-item"
                   disabled={dashboards.length === 0}
-                  onClick={() => {
+                  onClick={(e) => {
+                    e.stopPropagation();
                     setOpenMenuId(null);
                     setMenuAnchor(null);
                     setAddPickerFor({ folderId: folder.id, kind: "dashboard" });
@@ -1018,7 +1085,8 @@ function NavFoldersSection({
               role="menuitem"
                   className="workspace-rail-thread-menu-item"
                   disabled={viewableObjects.length === 0}
-                  onClick={() => {
+                  onClick={(e) => {
+                    e.stopPropagation();
                     setOpenMenuId(null);
                     setMenuAnchor(null);
                     setAddPickerFor({ folderId: folder.id, kind: "view" });
@@ -1031,7 +1099,8 @@ function NavFoldersSection({
               role="menuitem"
                   className="workspace-rail-thread-menu-item"
                   disabled={workflows.length === 0}
-                  onClick={() => {
+                  onClick={(e) => {
+                    e.stopPropagation();
                     setOpenMenuId(null);
                     setMenuAnchor(null);
                     setAddPickerFor({ folderId: folder.id, kind: "workflow" });
@@ -1043,7 +1112,10 @@ function NavFoldersSection({
               type="button"
               role="menuitem"
               className="workspace-rail-thread-menu-item is-destructive"
-              onClick={() => deleteFolder(folder.id)}
+              onClick={(e) => {
+                e.stopPropagation();
+                deleteFolder(folder.id);
+              }}
             >
               <Trash2 size={13} aria-hidden="true" /> Delete
             </button>
@@ -1057,7 +1129,12 @@ function NavFoldersSection({
     const { folder, items, expand: forceExpand } = entry;
     const isMenuOpen = openMenuId === folder.id;
     const isCustomizing = customizeTarget?.scope === "folder" && customizeTarget.folderId === folder.id;
-    const collapsed = Boolean(folder.collapsed) && !forceExpand;
+    // Active-folder preservation: if a child item matches the current
+    // route, the parent folder stays open regardless of its persisted
+    // `collapsed` flag — so navigating between sibling items inside a
+    // folder never collapses the folder underneath the user.
+    const isActiveFolder = activeFolderId === folder.id;
+    const collapsed = !isActiveFolder && Boolean(folder.collapsed) && !forceExpand;
     const isExpanded = !collapsed;
     const style = navFolderStyle(folder);
     const visibleItems = items;

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/docs/sandbox-environment-primitive.md

@@ -30,3 +30,38 @@ Workspace Builder excludes **`sandbox-environment`** from View widget bindings (
 ## Extension points
 
 - Custom adapters: `apps/workspace/lib/adapters/sandboxes/adapters/` (see `README.md` there).
+
+## Local agent auth onboarding
+
+Sandbox rows whose **`adapter` is `local-agent-host`** route execution through whichever local agent CLI is registered for `agentHost` (Claude Code, Codex, Cursor, Gemini, OpenCode, Pi, Qwen, Hermes, OpenClaw Gateway). The record sidecar exposes a **uniform** auth onboarding panel beside the existing **Run sandbox** bar — the mental model is identical for every host:
+
+1. **Check status** — probes the host CLI for reachability and (where the catalog declares one) a real auth-status subcommand.
+2. **Run login** — only shown when the host catalog declares a documented `loginCommand`. Spawns it server-side and surfaces stdout / stderr / login URL.
+3. **Log out** — only shown when the host catalog declares a documented `logoutCommand`.
+4. **Run sandbox** — existing button (unchanged execution path).
+
+Per-host capabilities (binary path, install hint, login/logout subcommands, notes for hosts without a documented login flow) are declared in **`apps/workspace/lib/sandbox-agent-host-catalog.js`**. Adding a new host means adding one entry there — never extending the auth helper or the panel component. The catalog is the single source of truth for "what does this host's onboarding look like?".
+
+Wired through `POST /api/workspace/sandbox-agent-auth/{status,login,logout}` and the helper at `apps/workspace/lib/sandbox-agent-auth.js`. The Claude flow mirrors the upstream Paperclip server route in `server/src/routes/agents.ts` (`claude auth login` / `claude auth logout`) so behaviour matches the hosted agents surface.
+
+### Status semantics — uniform across every host
+
+| Status      | Meaning                                                                          |
+| ----------- | -------------------------------------------------------------------------------- |
+| `active`    | A real auth probe confirmed authentication (login exit 0, or `auth status` exit 0). |
+| `reachable` | The CLI is callable (`--version` exit 0) — but authentication is **not** yet confirmed. |
+| `stale`     | The CLI is reachable but printed auth-shaped failure output.                     |
+| `missing`   | The binary is not on PATH.                                                       |
+| `checking`  | Transient UI state during a probe.                                               |
+| `unknown`   | Indeterminate.                                                                   |
+
+A `--version` (or equivalent reachability) probe **never** promotes to `active`. The next sandbox-run is the source of truth for session readiness.
+
+### Authority invariants
+
+- Auth setup is **separate** from the `local-agent-host` execution adapter — the adapter at `lib/adapters/sandboxes/default-local-agent-host.js` stays execution-only and does not mutate any host config file.
+- Raw host tokens **never** enter `growthub.config.json`. Each CLI manages its own on-disk auth state. The sandbox row stores only safe metadata: `agentAuthStatus`, `agentAuthProvider`, `agentAuthLastChecked`, `agentAuthLastExitCode`, `agentAuthLastMessage`, `agentAuthLastLoginUrl`.
+- Token-shaped output (`sk-ant-…`, `sk-…`, JWT, `Bearer …`, prefix patterns like `access_token=`, `api_key=`) is redacted server-side before crossing the response boundary.
+- The schema rejects out-of-band PATCHes that try to stash a secret field (`token`, `apiKey`, `accessToken`, `refreshToken`, `bearer`, `password`, `secret`, `sessionKey`) on a sandbox row.
+- The panel is hidden when `runLocality === "serverless"` (the local CLI is irrelevant in that case), when `adapter !== "local-agent-host"`, or when `agentHost` is not registered in the host auth catalog.
+- Hosts without a documented login subcommand show only the **Check status** button plus the catalog's `notes` line directing the operator to sign in via the host CLI directly. No invented subcommands.

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/orchestration-graph-runner.js

@@ -13,6 +13,7 @@ import {
   redactSecretsFromText,
   substituteVariables
 } from "./orchestration-graph.js";
+import { buildInputPayloadForRunner } from "./orchestration-run-inputs.js";
 
 function normalizeMethod(value) {
   const method = String(value || "GET").trim().toUpperCase();
@@ -255,8 +256,13 @@ async function executeApiRegistryCall(workspaceConfig, nodeConfig, inputPayload,
 /**
  * Run a growthub-native orchestration graph when present on the sandbox row.
  * Returns null when the row has no executable graph (caller falls back to adapter path).
+ *
+ * `runInputs` (V2) — normalized manual run input envelope. When provided, the
+ * non-secret values override matching keys in the input node's samplePayload
+ * for `human-input` / form workflows. Secret values (those stored as
+ * `{ secretRef }`) are never expanded into the runner payload.
  */
-async function runOrchestrationGraphIfPresent({ workspaceConfig, row, timeoutMs }) {
+async function runOrchestrationGraphIfPresent({ workspaceConfig, row, timeoutMs, runInputs }) {
   const graph = parseOrchestrationGraph(row?.orchestrationGraph || row?.orchestrationConfig);
   if (!graph || String(graph.provider || "").trim() !== "growthub-native") return null;
 
@@ -274,7 +280,10 @@ async function runOrchestrationGraphIfPresent({ workspaceConfig, row, timeoutMs
   }
 
   const inputNode = extractInputNode(graph);
-  const inputPayload = parseInputPayload(inputNode);
+  const baseInputPayload = parseInputPayload(inputNode);
+  const manualPayload = runInputs ? buildInputPayloadForRunner(runInputs) : {};
+  const inputPayload = { ...baseInputPayload, ...manualPayload };
+  const consumedInputKeys = Object.keys(manualPayload);
   const transformConfig = extractTransformConfig(graph);
   const resultNode = graph.nodes?.find((n) => n?.type === "tool-result");
   const successCodes = Array.isArray(resultNode?.config?.successStatusCodes)
@@ -314,7 +323,10 @@ async function runOrchestrationGraphIfPresent({ workspaceConfig, row, timeoutMs
     adapterMeta: {
       ...(raw.adapterMeta || {}),
       orchestrationProvider: graph.provider,
-      orchestrationVersion: graph.version
+      orchestrationVersion: graph.version,
+      ...(consumedInputKeys.length
+        ? { runInputsConsumed: consumedInputKeys, runInputSource: String(runInputs?.source || "manual") }
+        : {})
     }
   };
 }

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/orchestration-run-console.js

@@ -0,0 +1,384 @@
+/**
+ * Live Runs Console model layer.
+ *
+ * Pure, framework-free transformation of sandbox run records (saved under
+ * `growthub.source-records.json` and `row.lastResponse`) into the shape the
+ * Live Runs Console UI consumes: lifecycle, log tree, timeline, search, and
+ * a redacted JSON bundle that can be downloaded client-side.
+ *
+ * This module deliberately does NOT import React, does NOT call fetch, and
+ * does NOT mutate workspace config. It is the seam between the AWaC run
+ * substrate (sandbox-run route + source records) and the observability UI.
+ *
+ * See:
+ *   - app/api/workspace/sandbox-run/route.js  (writes records this consumes)
+ *   - app/data-model/components/OrchestrationRunTracePanel.jsx (consumer)
+ *   - lib/orchestration-run-trace.js           (lower-level record parser)
+ */
+
+import { redactSecretsFromText } from "./orchestration-graph.js";
+import { redactRunInputsEnvelope, summarizeRunInputs } from "./orchestration-run-inputs.js";
+
+const RUN_LOG_BUNDLE_KIND = "growthub-sandbox-run-log-v1";
+const DEFAULT_EXPORT_TARGETS = Object.freeze([
+  "download-json",
+  "copy-output",
+  "download-stdout",
+  "download-stderr",
+  "download-normalized-output",
+  "download-log-node"
+]);
+
+function safeString(value) {
+  if (value == null) return "";
+  return typeof value === "string" ? value : String(value);
+}
+
+function safeJsonString(value) {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return "";
+  }
+}
+
+function parseDateMs(value) {
+  const text = safeString(value).trim();
+  if (!text) return null;
+  const ms = Date.parse(text);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function clampNumber(value) {
+  const n = Number(value);
+  return Number.isFinite(n) ? n : null;
+}
+
+function deriveRunSummary(record) {
+  if (!record || typeof record !== "object") {
+    return { status: "unknown", ok: false, label: "unknown" };
+  }
+  const exitCode = clampNumber(record.exitCode);
+  const errorText = safeString(record.error).trim();
+  const httpStatus = clampNumber(record?.adapterMeta?.httpStatus);
+  const aborted = record?.adapterMeta?.aborted === true;
+  let status = "unknown";
+  let ok = false;
+  if (aborted) {
+    status = "canceled";
+  } else if (exitCode === 0 && !errorText && (httpStatus == null || (httpStatus >= 200 && httpStatus < 300))) {
+    status = "completed";
+    ok = true;
+  } else if (errorText || (exitCode != null && exitCode !== 0)) {
+    status = "failed";
+  } else if (record?.lifecycleStatus === "executing" || record?.lifecycleStatus === "queued") {
+    status = String(record.lifecycleStatus);
+  }
+  return { status, ok, label: status };
+}
+
+function deriveRunLifecycle(record) {
+  if (!record || typeof record !== "object") return [];
+  const ranAtMs = parseDateMs(record.ranAt);
+  const durationMs = clampNumber(record.durationMs) || 0;
+  const finishedAtMs = ranAtMs != null ? ranAtMs + durationMs : null;
+  const lifecycle = [];
+  if (ranAtMs != null) {
+    lifecycle.push({ label: "Triggered", at: new Date(ranAtMs).toISOString(), durationMs: 0 });
+    lifecycle.push({ label: "Dequeued", at: new Date(ranAtMs).toISOString(), durationMs: 0 });
+    lifecycle.push({ label: "Started", at: new Date(ranAtMs).toISOString(), durationMs });
+    if (finishedAtMs != null) {
+      lifecycle.push({ label: "Finished", at: new Date(finishedAtMs).toISOString(), durationMs: 0 });
+    }
+  }
+  return lifecycle;
+}
+
+function buildLogChildren(record, summary) {
+  const children = [];
+  const stdout = safeString(record?.stdout).trim();
+  const stderr = safeString(record?.stderr).trim();
+  const errorText = safeString(record?.error).trim();
+  const output = safeJsonString(record?.output ?? record?.normalizedOutput ?? record?.response).trim();
+  const adapterMeta = record?.adapterMeta;
+  const durationMs = clampNumber(record?.durationMs) || 0;
+
+  if (errorText) {
+    children.push({
+      id: "error",
+      label: "error",
+      type: "error",
+      status: "failed",
+      durationMs: 0,
+      text: redactSecretsFromText(errorText)
+    });
+  }
+  if (stdout) {
+    children.push({
+      id: "stdout",
+      label: "stdout",
+      type: "stream",
+      status: "info",
+      durationMs,
+      text: redactSecretsFromText(stdout)
+    });
+  }
+  if (stderr) {
+    children.push({
+      id: "stderr",
+      label: "stderr",
+      type: "stream",
+      status: "failed",
+      durationMs: 0,
+      text: redactSecretsFromText(stderr)
+    });
+  }
+  if (output && output !== stdout) {
+    children.push({
+      id: "normalized-output",
+      label: "normalized output",
+      type: "output",
+      status: "info",
+      durationMs: 0,
+      text: redactSecretsFromText(output)
+    });
+  }
+  if (adapterMeta && typeof adapterMeta === "object") {
+    children.push({
+      id: "adapter-meta",
+      label: "adapter meta",
+      type: "meta",
+      status: "info",
+      durationMs: 0,
+      text: redactSecretsFromText(safeJsonString(adapterMeta))
+    });
+  }
+  return children;
+}
+
+function buildRunLogTree(record) {
+  if (!record || typeof record !== "object") return [];
+  const summary = deriveRunSummary(record);
+  const durationMs = clampNumber(record?.durationMs) || 0;
+  const attemptChildren = buildLogChildren(record, summary);
+  const attemptNode = {
+    id: "attempt-1",
+    label: "Attempt 1",
+    type: "attempt",
+    status: summary.status,
+    durationMs,
+    children: attemptChildren
+  };
+  const rootNode = {
+    id: "root",
+    label: safeString(record?.adapter || "agent-run").trim() || "agent-run",
+    type: "root",
+    status: summary.status,
+    durationMs,
+    children: [attemptNode]
+  };
+  return [rootNode];
+}
+
+function buildExportsForRecord(record, stdoutText, stderrText, outputText) {
+  const declared = record?.exports?.available;
+  if (Array.isArray(declared) && declared.length > 0) {
+    return {
+      available: declared.map((id) => safeString(id).trim()).filter(Boolean),
+      external: Array.isArray(record?.exports?.external) ? record.exports.external.slice() : []
+    };
+  }
+  const available = ["download-json"];
+  if (stdoutText || outputText) available.push("copy-output");
+  if (stdoutText) available.push("download-stdout");
+  if (stderrText) available.push("download-stderr");
+  if (outputText && outputText !== stdoutText) available.push("download-normalized-output");
+  available.push("download-log-node");
+  return { available, external: [] };
+}
+
+function normalizeRunConsoleRecord(record) {
+  if (!record || typeof record !== "object") return null;
+  const summary = deriveRunSummary(record);
+  const lifecycle = deriveRunLifecycle(record);
+  const ranAtMs = parseDateMs(record.ranAt);
+  const durationMs = clampNumber(record.durationMs);
+  const finishedAt = ranAtMs != null && durationMs != null
+    ? new Date(ranAtMs + durationMs).toISOString()
+    : "";
+  const adapterMeta = record?.adapterMeta && typeof record.adapterMeta === "object"
+    ? record.adapterMeta
+    : null;
+  const templateTrace = record?.templateTrace && typeof record.templateTrace === "object"
+    ? record.templateTrace
+    : null;
+
+  const stdoutText = safeString(typeof record.stdout === "string" ? record.stdout : safeJsonString(record.stdout));
+  const stderrText = safeString(record.stderr);
+  const errorText = safeString(record.error);
+  const outputRaw = record.output ?? record.normalizedOutput ?? record.response;
+  const outputText = typeof outputRaw === "string" ? outputRaw : safeJsonString(outputRaw);
+  const rawInput = record.input || record.runInputs || null;
+  const safeInput = rawInput ? redactRunInputsEnvelope(rawInput) : null;
+  const inputSummary = safeInput ? summarizeRunInputs(safeInput) : null;
+  const exports = buildExportsForRecord(record, stdoutText, stderrText, outputText);
+
+  return {
+    runId: safeString(record.runId).trim(),
+    status: summary.status,
+    ok: summary.ok,
+    exitCode: clampNumber(record.exitCode),
+    ranAt: safeString(record.ranAt).trim(),
+    finishedAt,
+    durationMs: durationMs == null ? null : durationMs,
+    queueMs: 0,
+    runtime: safeString(record.runtime).trim(),
+    adapter: safeString(record.adapter).trim(),
+    runLocality: safeString(record.runLocality).trim(),
+    lifecycleStatus: safeString(record.lifecycleStatus).trim(),
+    version: safeString(record.version).trim(),
+    sourceId: safeString(record.sourceId).trim(),
+    lifecycle,
+    payload: {
+      objectId: safeString(record.objectId).trim(),
+      name: safeString(record.name || record.sandboxName).trim(),
+      runtime: safeString(record.runtime).trim(),
+      adapter: safeString(record.adapter).trim(),
+      command: redactSecretsFromText(safeString(record.command)),
+      instructions: redactSecretsFromText(safeString(record.instructions)),
+      useDraft: Boolean(record.useDraft),
+      version: safeString(record.version).trim(),
+      schedulerRegistryId: safeString(record.schedulerRegistryId).trim(),
+      agentHost: safeString(record.agentHost).trim(),
+      timeoutMs: clampNumber(record.timeoutMs),
+      runInputs: safeInput,
+      inputSource: inputSummary ? inputSummary.source : "",
+      inputFieldCount: inputSummary ? inputSummary.fieldCount : 0,
+      inputFileCount: inputSummary ? inputSummary.fileCount : 0,
+      inputSummary
+    },
+    exports,
+    output: {
+      stdout: redactSecretsFromText(stdoutText),
+      stderr: redactSecretsFromText(stderrText),
+      error: redactSecretsFromText(errorText),
+      normalizedOutput: redactSecretsFromText(outputText),
+      exitCode: clampNumber(record.exitCode)
+    },
+    context: {
+      envRefsResolved: Array.isArray(record.envRefsResolved) ? record.envRefsResolved.slice() : [],
+      envRefsMissing: Array.isArray(record.envRefsMissing) ? record.envRefsMissing.slice() : [],
+      networkAllow: Boolean(record.networkAllow),
+      allowList: Array.isArray(record.allowList) ? record.allowList.slice() : [],
+      adapterMeta,
+      templateTrace
+    },
+    logTree: buildRunLogTree(record)
+  };
+}
+
+function buildRunTimeline(records) {
+  const list = Array.isArray(records) ? records : [];
+  const items = list
+    .map((record) => {
+      const normalized = normalizeRunConsoleRecord(record);
+      if (!normalized) return null;
+      const startedMs = parseDateMs(normalized.ranAt);
+      return {
+        runId: normalized.runId,
+        status: normalized.status,
+        durationMs: normalized.durationMs == null ? 0 : normalized.durationMs,
+        startedMs,
+        ranAt: normalized.ranAt
+      };
+    })
+    .filter(Boolean);
+
+  const max = items.reduce((m, it) => Math.max(m, it.durationMs || 0), 0);
+  return items.map((it) => ({
+    ...it,
+    barRatio: max > 0 ? Math.min(1, (it.durationMs || 0) / max) : 0
+  }));
+}
+
+function nodeMatchesQuery(node, query) {
+  const text = String(query || "").trim().toLowerCase();
+  if (!text) return true;
+  const haystack = [
+    node?.id,
+    node?.label,
+    node?.type,
+    node?.status,
+    node?.text
+  ]
+    .filter(Boolean)
+    .join(" ")
+    .toLowerCase();
+  return haystack.includes(text);
+}
+
+function nodeIsError(node) {
+  if (!node) return false;
+  if (node.type === "error") return true;
+  if (node.type === "stream" && node.id === "stderr") return true;
+  if (node.status === "failed" && node.type !== "stream") return true;
+  return false;
+}
+
+function filterNodeTree(nodes, predicate) {
+  if (!Array.isArray(nodes)) return [];
+  const out = [];
+  for (const node of nodes) {
+    const children = filterNodeTree(node?.children, predicate);
+    const selfMatches = predicate(node);
+    if (selfMatches || children.length > 0) {
+      out.push({ ...node, children });
+    }
+  }
+  return out;
+}
+
+function filterRunLogTree(tree, { query = "", errorsOnly = false } = {}) {
+  return filterNodeTree(tree, (node) => {
+    if (errorsOnly && !nodeIsError(node) && !(Array.isArray(node?.children) && node.children.some(nodeIsError))) {
+      return false;
+    }
+    return nodeMatchesQuery(node, query);
+  });
+}
+
+function formatRunDuration(ms) {
+  const n = clampNumber(ms);
+  if (n == null) return "—";
+  if (n < 1000) return `${Math.round(n)} ms`;
+  if (n < 60_000) return `${(n / 1000).toFixed(1)} s`;
+  const minutes = Math.floor(n / 60_000);
+  const seconds = Math.round((n % 60_000) / 1000);
+  return `${minutes}m ${seconds}s`;
+}
+
+function downloadRunBundle({ record, runId, sourceId } = {}) {
+  const normalized = normalizeRunConsoleRecord(record || {});
+  return {
+    kind: RUN_LOG_BUNDLE_KIND,
+    exportedAt: new Date().toISOString(),
+    runId: safeString(runId).trim() || (normalized ? normalized.runId : ""),
+    sourceId: safeString(sourceId).trim() || (normalized ? normalized.sourceId : ""),
+    record: normalized
+  };
+}
+
+export {
+  RUN_LOG_BUNDLE_KIND,
+  DEFAULT_EXPORT_TARGETS,
+  normalizeRunConsoleRecord,
+  deriveRunSummary,
+  deriveRunLifecycle,
+  buildRunLogTree,
+  buildRunTimeline,
+  filterRunLogTree,
+  formatRunDuration,
+  downloadRunBundle
+};