@growthub/cli 0.13.9 → 0.14.1

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/env-status/route.js

@@ -0,0 +1,31 @@
+/**
+ * GET /api/workspace/env-status
+ *
+ * The honest, secret-safe auth-readiness signal the creation cockpit needs.
+ * Returns the referenced auth/env ref SLUGS that currently resolve to a value
+ * in the server runtime (process.env) — so the api-registry drawer can mark
+ * "auth configured" from real runtime truth instead of guessing. Never returns,
+ * logs, or hashes a value.
+ */
+
+import { NextResponse } from "next/server";
+import { readWorkspaceConfig } from "@/lib/workspace-config";
+import { computeConfiguredEnvRefs, listPersistenceAdapterReadiness } from "@/lib/env-status";
+
+async function GET() {
+  let workspaceConfig = {};
+  try {
+    workspaceConfig = await readWorkspaceConfig();
+  } catch {
+    workspaceConfig = {};
+  }
+  const configuredEnvRefs = computeConfiguredEnvRefs(workspaceConfig, process.env);
+  const persistenceAdapters = listPersistenceAdapterReadiness(process.env);
+  return NextResponse.json({
+    kind: "growthub-env-status-v1",
+    configuredEnvRefs,
+    persistenceAdapters,
+  });
+}
+
+export { GET };

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/helper/apply/route.js

@@ -41,9 +41,168 @@ import {
   buildApplyReceipt,
   upsertHelperThreadRow,
 } from "@/lib/workspace-helper-apply";
+import { RESOLVER_PROPOSAL_TYPE, buildResolverProposal, validateResolverProposal } from "@/lib/workspace-resolver-proposal";
+import { writeResolverProposalFile } from "@/lib/server-resolver-write";
+import {
+  SWARM_PROPOSAL_TYPES,
+  SWARM_RUN_RESUME_PROPOSAL_TYPE,
+  SWARM_WORKFLOWS_OBJECT_ID,
+  validateSwarmRunProposal,
+  buildSandboxRowFromSwarmProposal,
+  deriveHelperWidgetCausationState,
+  upsertSwarmRunRow,
+  findSwarmRunRows,
+  summarizeSwarmRunProposal,
+} from "@/lib/workspace-swarm-proposal";
 
 const HELPER_APPLY_SOURCE_KEY = "helper:apply:receipts";
 
+function findRegistryRow(config, integrationId) {
+  const id = String(integrationId || "").trim();
+  if (!id) return null;
+  const objects = Array.isArray(config?.dataModel?.objects) ? config.dataModel.objects : [];
+  for (const object of objects) {
+    if (object?.objectType !== "api-registry") continue;
+    const row = (Array.isArray(object.rows) ? object.rows : []).find((candidate) =>
+      String(candidate?.integrationId || "").trim() === id
+    );
+    if (row) return row;
+  }
+  return null;
+}
+
+function findDataSourceForRegistry(config, integrationId) {
+  const id = String(integrationId || "").trim();
+  if (!id) return null;
+  const objects = Array.isArray(config?.dataModel?.objects) ? config.dataModel.objects : [];
+  for (const object of objects) {
+    if (object?.objectType !== "data-source") continue;
+    const row = (Array.isArray(object.rows) ? object.rows : []).find((candidate) =>
+      String(candidate?.registryId || "").trim() === id
+    );
+    if (row) return { object, row };
+  }
+  return null;
+}
+
+function inferRootPathFromLastResponse(lastResponse) {
+  if (!lastResponse) return "";
+  let parsed = lastResponse;
+  if (typeof lastResponse === "string") {
+    try { parsed = JSON.parse(lastResponse); } catch { return ""; }
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return "";
+  for (const key of ["records", "items", "data", "results", "capabilities"]) {
+    if (Array.isArray(parsed[key])) return key;
+  }
+  return "";
+}
+
+function normalizeResolverProposal(proposal, config) {
+  if (proposal?.type !== RESOLVER_PROPOSAL_TYPE || String(proposal?.code || "").trim()) return proposal;
+  const integrationId = proposal?.payload?.integrationId;
+  const registryRow = findRegistryRow(config, integrationId);
+  if (!registryRow) return proposal;
+  const generated = buildResolverProposal({
+    integrationId: registryRow.integrationId,
+    baseUrl: registryRow.baseUrl,
+    endpoint: registryRow.endpoint,
+    method: registryRow.method,
+    authRef: registryRow.authRef,
+    rootPath: proposal?.payload?.rootPath || inferRootPathFromLastResponse(registryRow.lastResponse),
+    entityType: proposal?.payload?.entityType || registryRow.entityTypes || "records",
+  });
+  return {
+    ...generated,
+    rationale: proposal.rationale || generated.rationale,
+    confidence: proposal.confidence || generated.confidence,
+  };
+}
+
+function normalizeDataModelObjectProposal(proposal, config, fallbackIntegrationId = "") {
+  if (proposal?.type !== "dataModel.object.update" || proposal?.payload?.id) return proposal;
+  const integrationId = proposal?.payload?.registryId || proposal?.payload?.integrationId || fallbackIntegrationId;
+  const target = findDataSourceForRegistry(config, integrationId);
+  if (!target?.object) return proposal;
+  return {
+    ...proposal,
+    payload: {
+      ...proposal.payload,
+      id: target.object.id,
+      sourceId: target.object.sourceId || target.row?.sourceId || target.object.binding?.sourceId || "",
+      binding: {
+        ...(target.object.binding || {}),
+        sourceStorage: target.object.binding?.sourceStorage || target.row?.sourceStorage || "workspace-source-records",
+        sourceId: target.object.binding?.sourceId || target.row?.sourceId || target.object.sourceId || "",
+        registryId: target.object.binding?.registryId || integrationId,
+      },
+    },
+  };
+}
+
+function normalizeApplyProposal(proposal, config, context = {}) {
+  return normalizeDataModelObjectProposal(normalizeResolverProposal(proposal, config), config, context.integrationId);
+}
+
+/**
+ * Swarm lane (SWARM_RUN_CONTRACT_V1) — normalize a validated swarm proposal
+ * into the next workspace config plus an artifact target the sidecar cockpit
+ * can open. The model's intent payload is reduced through
+ * buildDefaultAgentSwarmGraph inside buildSandboxRowFromSwarmProposal — final
+ * graph JSON from the model is never trusted verbatim. Nothing executes here;
+ * runs stay behind POST /api/workspace/sandbox-run.
+ *
+ * Returns { ok, config, artifact, summary, error? }.
+ */
+function normalizeSwarmRunProposal(proposal, workspaceConfig) {
+  const validation = validateSwarmRunProposal(proposal);
+  if (!validation.ok) {
+    return { ok: false, config: workspaceConfig, artifact: null, summary: "", error: validation.error };
+  }
+
+  if (proposal.type === SWARM_RUN_RESUME_PROPOSAL_TYPE) {
+    const name = String(proposal.payload?.name || "").trim();
+    const matches = findSwarmRunRows(workspaceConfig, { name });
+    if (matches.length === 0) {
+      return {
+        ok: false,
+        config: workspaceConfig,
+        artifact: null,
+        summary: "",
+        error: `no governed swarm workflow named "${name}" to resume`,
+      };
+    }
+    // Resume is a governed pointer, not an execution: the receipt records the
+    // intent and the cockpit re-launches through sandbox-run.
+    return {
+      ok: true,
+      config: workspaceConfig,
+      artifact: { surface: "swarm-run", objectId: matches[0].objectId, name: matches[0].row.Name },
+      summary: summarizeSwarmRunProposal(proposal),
+    };
+  }
+
+  const helperState = deriveHelperWidgetCausationState(workspaceConfig);
+  if (!helperState.ready) {
+    return {
+      ok: false,
+      config: workspaceConfig,
+      artifact: null,
+      summary: "",
+      error: helperState.guidance,
+    };
+  }
+
+  const row = buildSandboxRowFromSwarmProposal(workspaceConfig, proposal);
+  const nextConfig = upsertSwarmRunRow(workspaceConfig, row);
+  return {
+    ok: true,
+    config: nextConfig,
+    artifact: { surface: "swarm-run", objectId: SWARM_WORKFLOWS_OBJECT_ID, name: row.Name },
+    summary: summarizeSwarmRunProposal(proposal),
+  };
+}
+
 async function POST(request) {
   let body;
   try {
@@ -78,7 +237,61 @@ async function POST(request) {
   const skipped = [];
   let workingConfig = currentConfig;
 
-  for (const proposal of body.proposals) {
+  // Resolver-file lane (AWaC: server file, NOT a config PATCH field). Handled
+  // separately so it never touches writeWorkspaceConfig and never widens the
+  // PATCH allowlist. Gated by filesystem/read-only; emits a receipt either way.
+  const fallbackIntegrationId = body.proposals
+    .map((proposal) => proposal?.payload?.integrationId || proposal?.payload?.registryId)
+    .find((value) => String(value || "").trim());
+  const normalizedProposals = body.proposals.map((proposal) =>
+    normalizeApplyProposal(proposal, currentConfig, { integrationId: fallbackIntegrationId })
+  );
+  const resolverProposals = normalizedProposals.filter((p) => p?.type === RESOLVER_PROPOSAL_TYPE);
+  const swarmProposals = normalizedProposals.filter((p) => SWARM_PROPOSAL_TYPES.includes(p?.type));
+  const configProposals = normalizedProposals.filter(
+    (p) => p?.type !== RESOLVER_PROPOSAL_TYPE && !SWARM_PROPOSAL_TYPES.includes(p?.type)
+  );
+
+  for (const proposal of resolverProposals) {
+    const validation = validateResolverProposal(proposal);
+    if (!validation.ok) {
+      skipped.push({ proposal, reason: validation.error || "invalid resolver proposal" });
+      continue;
+    }
+    try {
+      const result = await writeResolverProposalFile(proposal);
+      applied.push({
+        ...buildApplyReceipt(proposal, appliedAt, reviewedBy, sessionId),
+        resolverPath: result.path,
+        resolverFilename: result.filename,
+      });
+    } catch (err) {
+      if (err?.code === "WORKSPACE_PERSISTENCE_READ_ONLY") {
+        skipped.push({ proposal, reason: `read-only runtime — ${err.guidance || "resolver not written"}` });
+      } else {
+        skipped.push({ proposal, reason: err?.message || "resolver write failed" });
+      }
+    }
+  }
+
+  // Swarm lane — governed sandbox-environment rows in the EXISTING dataModel
+  // patch field. Apply creates/updates the row; execution stays behind
+  // POST /api/workspace/sandbox-run, launched explicitly from the cockpit.
+  for (const proposal of swarmProposals) {
+    const result = normalizeSwarmRunProposal(proposal, workingConfig);
+    if (!result.ok) {
+      skipped.push({ proposal, reason: result.error || "invalid swarm proposal" });
+      continue;
+    }
+    workingConfig = result.config;
+    applied.push({
+      ...buildApplyReceipt({ ...proposal, affectedField: "dataModel" }, appliedAt, reviewedBy, sessionId),
+      artifact: result.artifact,
+      summary: result.summary,
+    });
+  }
+
+  for (const proposal of configProposals) {
     if (
       !proposal ||
       typeof proposal.type !== "string" ||
@@ -113,7 +326,13 @@ async function POST(request) {
   // Patch — collect every affected field from accepted proposals AND
   // append the thread row update (so the user-visible Helper Threads object
   // refreshes in the same atomic write as the proposed mutations).
-  const mutatingApplied = applied.filter((r) => r.type !== "explain.object");
+  // resolver.create writes a server file (affectedField "server-file"), so it
+  // must NOT contribute a field to the config PATCH — exclude it here.
+  // swarm.run.resume is a governed pointer (no config mutation) — exclude it
+  // alongside explain.object so it never forces a config write on its own.
+  const mutatingApplied = applied.filter(
+    (r) => r.type !== "explain.object" && r.type !== SWARM_RUN_RESUME_PROPOSAL_TYPE && r.affectedField !== "server-file"
+  );
 
   // Upsert the thread row so audit history reflects this apply turn even
   // when nothing mutated (all skipped / explain-only) and even when the
@@ -129,7 +348,7 @@ async function POST(request) {
     try {
       const existingRows = (workingConfig?.dataModel?.objects || []).find((o) => o?.id === "helper-threads")?.rows || [];
       const existingRow = existingRows.find((r) => r?.id === threadId) || {};
-      const firstProposal = body.proposals?.[0];
+      const firstProposal = normalizedProposals?.[0];
       const seedTitle = existingRow.title
         || (firstProposal?.rationale ? String(firstProposal.rationale).slice(0, 72) : "Helper thread");
 
@@ -183,6 +402,9 @@ async function POST(request) {
         "dataModel.row.add": "create_object",
         "repair.binding": "repair",
         "explain.object": "explain",
+        "swarm.run.propose": "swarm",
+        "swarm.workflow.save": "swarm",
+        "swarm.run.resume": "swarm",
       };
       const proposalIntent = firstProposal?.type ? TYPE_TO_INTENT_HINT[firstProposal.type] : null;
       const safeIntent = existingRow.intent || proposalIntent || "explain";
@@ -192,7 +414,7 @@ async function POST(request) {
         intent: safeIntent,
         prompt: existingRow.prompt || "",
         summary: existingRow.summary || "",
-        proposals: existingRow.proposals || body.proposals || [],
+        proposals: existingRow.proposals || normalizedProposals || [],
         warnings: existingRow.warnings || [],
         receipts: existingRow.receipts || null,
         model: existingRow.model || "external-apply",
@@ -207,7 +429,7 @@ async function POST(request) {
           affectedField: a.affectedField,
           rationale: a.rationale,
           confidence: a.confidence,
-          payload: body.proposals?.[idx]?.payload ?? null,
+          payload: normalizedProposals?.[idx]?.payload ?? null,
         })),
         lastSkipped: skipped.map((s) => ({
           type: s.proposal?.type,

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/helper/query/route.js

@@ -70,6 +70,7 @@ const VALID_INTENTS = [
   "edit_view",
   "repair",
   "explain",
+  "swarm",
 ];
 
 const HELPER_SOURCE_KEY_PREFIX = "helper";

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/sandbox-run/route.js

@@ -338,6 +338,8 @@ async function runServerlessScheduler({
 function buildRunResponse({
   runId,
   ranAt,
+  objectId,
+  name,
   runLocality,
   schedulerRegistryId,
   runtime,
@@ -359,6 +361,10 @@ function buildRunResponse({
   const base = {
     runId,
     ranAt,
+    // Identity travels with the persisted record so run-console consumers
+    // (lineage, swarm projection title) don't depend on the row context.
+    objectId: objectId ? String(objectId).trim() : undefined,
+    name: name ? String(name).trim() : undefined,
     runLocality,
     schedulerRegistryId: schedulerRegistryId ? String(schedulerRegistryId).trim() : null,
     runtime,
@@ -439,14 +445,7 @@ async function GET(request) {
   });
 }
 
-async function POST(request) {
-  let body;
-  try {
-    body = await request.json();
-  } catch {
-    return NextResponse.json({ ok: false, error: "invalid JSON body" }, { status: 400 });
-  }
-
+async function executeSandboxRun(body, { emit } = {}) {
   const objectId = typeof body?.objectId === "string" ? body.objectId.trim() : "";
   const name = typeof body?.name === "string" ? body.name.trim() : "";
   const useDraft = body?.useDraft === true;
@@ -580,7 +579,8 @@ async function POST(request) {
         instructions,
         command,
         timeoutMs,
-        sandboxName: rowForRun.Name || name
+        sandboxName: rowForRun.Name || name,
+        onEvent: emit
       }
     });
     if (graphResult !== null) {
@@ -665,6 +665,8 @@ async function POST(request) {
   const response = buildRunResponse({
     runId,
     ranAt,
+    objectId,
+    name: rowForRun.Name || name,
     runLocality,
     schedulerRegistryId: runLocality === "serverless" ? schedulerRegistryId : null,
     runtime,
@@ -754,4 +756,63 @@ async function POST(request) {
   });
 }
 
+async function POST(request) {
+  const accept = request.headers.get("accept") || "";
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ ok: false, error: "invalid JSON body" }, { status: 400 });
+  }
+
+  const wantsStream = body?.stream === true || accept.includes("application/x-ndjson");
+  if (!wantsStream) {
+    return executeSandboxRun(body);
+  }
+
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream({
+    start(controller) {
+      const emit = (event) => {
+        controller.enqueue(encoder.encode(`${JSON.stringify(event)}\n`));
+      };
+      emit({
+        kind: "growthub-sandbox-run-delta-v1",
+        type: "sandbox-run.accepted",
+        emittedAt: new Date().toISOString(),
+        objectId: typeof body?.objectId === "string" ? body.objectId.trim() : "",
+        name: typeof body?.name === "string" ? body.name.trim() : ""
+      });
+      executeSandboxRun(body, { emit })
+        .then(async (response) => {
+          const finalPayload = await response.json().catch(() => ({ ok: false, error: "stream final payload unreadable" }));
+          emit({
+            kind: "growthub-sandbox-run-delta-v1",
+            type: "sandbox-run.final",
+            emittedAt: new Date().toISOString(),
+            status: response.status,
+            payload: finalPayload
+          });
+        })
+        .catch((error) => {
+          emit({
+            kind: "growthub-sandbox-run-delta-v1",
+            type: "sandbox-run.final",
+            emittedAt: new Date().toISOString(),
+            status: 500,
+            payload: { ok: false, error: error?.message || "sandbox run failed" }
+          });
+        })
+        .finally(() => controller.close());
+    }
+  });
+
+  return new Response(stream, {
+    headers: {
+      "content-type": "application/x-ndjson; charset=utf-8",
+      "cache-control": "no-store"
+    }
+  });
+}
+
 export { GET, POST };

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/components/WorkspaceActivationPanel.jsx

@@ -51,6 +51,7 @@ export function WorkspaceActivationPanel({
   workspaceSourceRecords,
   metadataGraph,
   onOpenHelper,
+  onStepAction,
   compact = false,
   showLenses = false,
 }) {
@@ -136,7 +137,22 @@ export function WorkspaceActivationPanel({
                     <span>{step.hint}</span>
                   </p>
                 ) : null}
-                {step.href ? (
+                {step.action && onStepAction ? (
+                  <a
+                    href={`#${step.action}`}
+                    className={
+                      "workspace-activation-step-cta"
+                      + (isNext ? " is-primary" : "")
+                    }
+                    onClick={(event) => {
+                      event.preventDefault();
+                      onStepAction(step);
+                    }}
+                  >
+                    <span>{step.cta || (step.status === "complete" ? "Review" : "Open")}</span>
+                    <ArrowRight size={12} aria-hidden="true" />
+                  </a>
+                ) : step.href ? (
                   <Link
                     href={step.href}
                     className={

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/components/WorkspaceHelperSetupModal.jsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
+import { createPortal } from "react-dom";
 import { X } from "lucide-react";
 
 const HELPER_SANDBOX_OBJECT_ID = "workspace-helper-sandbox";
@@ -13,7 +14,7 @@ const HELPER_AGENT_CHOICES = [
   { id: "gemini_local", label: "Gemini CLI (local)", body: "Uses Gemini CLI." },
   { id: "opencode_local", label: "OpenCode (local)", body: "Uses OpenCode on this machine." },
   { id: "pi_local", label: "Pi (local)", body: "Uses Pi on this machine." },
-  { id: "qwen_code_local", label: "Qwen Code (local)", body: "Uses Qwen Code on this machine." },
+  { id: "qwen_local", label: "Qwen Code (local)", body: "Uses Qwen Code on this machine." },
 ];
 
 const HELPER_EXECUTION_ADAPTERS = [
@@ -185,7 +186,9 @@ function WorkspaceHelperSetupModal({ workspaceConfig, open, onClose, onSaved })
     }
   }
 
-  return (
+  if (typeof document === "undefined") return null;
+
+  return createPortal((
     <div className="workspace-helper-setup-modal-backdrop" role="presentation">
       <div className="workspace-helper-setup-modal" role="dialog" aria-modal="true" aria-label="Set up workspace helper">
         <button type="button" className="workspace-helper-setup-modal-close" onClick={onClose} aria-label="Close setup">
@@ -342,7 +345,7 @@ function WorkspaceHelperSetupModal({ workspaceConfig, open, onClose, onSaved })
         </div>
       </div>
     </div>
-  );
+  ), document.body);
 }
 
 export {