@growthub/cli 0.14.0 → 0.14.2

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/helper/apply/route.js

@@ -43,6 +43,17 @@ import {
 } from "@/lib/workspace-helper-apply";
 import { RESOLVER_PROPOSAL_TYPE, buildResolverProposal, validateResolverProposal } from "@/lib/workspace-resolver-proposal";
 import { writeResolverProposalFile } from "@/lib/server-resolver-write";
+import {
+  SWARM_PROPOSAL_TYPES,
+  SWARM_RUN_RESUME_PROPOSAL_TYPE,
+  SWARM_WORKFLOWS_OBJECT_ID,
+  validateSwarmRunProposal,
+  buildSandboxRowFromSwarmProposal,
+  deriveHelperWidgetCausationState,
+  upsertSwarmRunRow,
+  findSwarmRunRows,
+  summarizeSwarmRunProposal,
+} from "@/lib/workspace-swarm-proposal";
 
 const HELPER_APPLY_SOURCE_KEY = "helper:apply:receipts";
 
@@ -133,6 +144,65 @@ function normalizeApplyProposal(proposal, config, context = {}) {
   return normalizeDataModelObjectProposal(normalizeResolverProposal(proposal, config), config, context.integrationId);
 }
 
+/**
+ * Swarm lane (SWARM_RUN_CONTRACT_V1) — normalize a validated swarm proposal
+ * into the next workspace config plus an artifact target the sidecar cockpit
+ * can open. The model's intent payload is reduced through
+ * buildDefaultAgentSwarmGraph inside buildSandboxRowFromSwarmProposal — final
+ * graph JSON from the model is never trusted verbatim. Nothing executes here;
+ * runs stay behind POST /api/workspace/sandbox-run.
+ *
+ * Returns { ok, config, artifact, summary, error? }.
+ */
+function normalizeSwarmRunProposal(proposal, workspaceConfig) {
+  const validation = validateSwarmRunProposal(proposal);
+  if (!validation.ok) {
+    return { ok: false, config: workspaceConfig, artifact: null, summary: "", error: validation.error };
+  }
+
+  if (proposal.type === SWARM_RUN_RESUME_PROPOSAL_TYPE) {
+    const name = String(proposal.payload?.name || "").trim();
+    const matches = findSwarmRunRows(workspaceConfig, { name });
+    if (matches.length === 0) {
+      return {
+        ok: false,
+        config: workspaceConfig,
+        artifact: null,
+        summary: "",
+        error: `no governed swarm workflow named "${name}" to resume`,
+      };
+    }
+    // Resume is a governed pointer, not an execution: the receipt records the
+    // intent and the cockpit re-launches through sandbox-run.
+    return {
+      ok: true,
+      config: workspaceConfig,
+      artifact: { surface: "swarm-run", objectId: matches[0].objectId, name: matches[0].row.Name },
+      summary: summarizeSwarmRunProposal(proposal),
+    };
+  }
+
+  const helperState = deriveHelperWidgetCausationState(workspaceConfig);
+  if (!helperState.ready) {
+    return {
+      ok: false,
+      config: workspaceConfig,
+      artifact: null,
+      summary: "",
+      error: helperState.guidance,
+    };
+  }
+
+  const row = buildSandboxRowFromSwarmProposal(workspaceConfig, proposal);
+  const nextConfig = upsertSwarmRunRow(workspaceConfig, row);
+  return {
+    ok: true,
+    config: nextConfig,
+    artifact: { surface: "swarm-run", objectId: SWARM_WORKFLOWS_OBJECT_ID, name: row.Name },
+    summary: summarizeSwarmRunProposal(proposal),
+  };
+}
+
 async function POST(request) {
   let body;
   try {
@@ -177,7 +247,10 @@ async function POST(request) {
     normalizeApplyProposal(proposal, currentConfig, { integrationId: fallbackIntegrationId })
   );
   const resolverProposals = normalizedProposals.filter((p) => p?.type === RESOLVER_PROPOSAL_TYPE);
-  const configProposals = normalizedProposals.filter((p) => p?.type !== RESOLVER_PROPOSAL_TYPE);
+  const swarmProposals = normalizedProposals.filter((p) => SWARM_PROPOSAL_TYPES.includes(p?.type));
+  const configProposals = normalizedProposals.filter(
+    (p) => p?.type !== RESOLVER_PROPOSAL_TYPE && !SWARM_PROPOSAL_TYPES.includes(p?.type)
+  );
 
   for (const proposal of resolverProposals) {
     const validation = validateResolverProposal(proposal);
@@ -201,6 +274,23 @@ async function POST(request) {
     }
   }
 
+  // Swarm lane — governed sandbox-environment rows in the EXISTING dataModel
+  // patch field. Apply creates/updates the row; execution stays behind
+  // POST /api/workspace/sandbox-run, launched explicitly from the cockpit.
+  for (const proposal of swarmProposals) {
+    const result = normalizeSwarmRunProposal(proposal, workingConfig);
+    if (!result.ok) {
+      skipped.push({ proposal, reason: result.error || "invalid swarm proposal" });
+      continue;
+    }
+    workingConfig = result.config;
+    applied.push({
+      ...buildApplyReceipt({ ...proposal, affectedField: "dataModel" }, appliedAt, reviewedBy, sessionId),
+      artifact: result.artifact,
+      summary: result.summary,
+    });
+  }
+
   for (const proposal of configProposals) {
     if (
       !proposal ||
@@ -238,7 +328,11 @@ async function POST(request) {
   // refreshes in the same atomic write as the proposed mutations).
   // resolver.create writes a server file (affectedField "server-file"), so it
   // must NOT contribute a field to the config PATCH — exclude it here.
-  const mutatingApplied = applied.filter((r) => r.type !== "explain.object" && r.affectedField !== "server-file");
+  // swarm.run.resume is a governed pointer (no config mutation) — exclude it
+  // alongside explain.object so it never forces a config write on its own.
+  const mutatingApplied = applied.filter(
+    (r) => r.type !== "explain.object" && r.type !== SWARM_RUN_RESUME_PROPOSAL_TYPE && r.affectedField !== "server-file"
+  );
 
   // Upsert the thread row so audit history reflects this apply turn even
   // when nothing mutated (all skipped / explain-only) and even when the
@@ -308,6 +402,9 @@ async function POST(request) {
         "dataModel.row.add": "create_object",
         "repair.binding": "repair",
         "explain.object": "explain",
+        "swarm.run.propose": "swarm",
+        "swarm.workflow.save": "swarm",
+        "swarm.run.resume": "swarm",
       };
       const proposalIntent = firstProposal?.type ? TYPE_TO_INTENT_HINT[firstProposal.type] : null;
       const safeIntent = existingRow.intent || proposalIntent || "explain";

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/helper/query/route.js

@@ -70,6 +70,7 @@ const VALID_INTENTS = [
   "edit_view",
   "repair",
   "explain",
+  "swarm",
 ];
 
 const HELPER_SOURCE_KEY_PREFIX = "helper";

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/sandbox-agent-auth/login/route.js

@@ -15,7 +15,7 @@
  * NEVER written to `growthub.config.json`.
  *
  * Request body:
- *   { objectId: string, name: string }
+ *   { objectId: string, name: string, agentHost?: string }
  *
  * Response:
  *   {
@@ -49,6 +49,7 @@ async function POST(request) {
 
   const objectId = typeof body?.objectId === "string" ? body.objectId.trim() : "";
   const name = typeof body?.name === "string" ? body.name.trim() : "";
+  const agentHost = typeof body?.agentHost === "string" ? body.agentHost.trim() : "";
   if (!objectId || !name) {
     return NextResponse.json(
       { ok: false, error: "objectId and name are required" },
@@ -57,7 +58,7 @@ async function POST(request) {
   }
 
   try {
-    const result = await runAgentLogin({ objectId, name });
+    const result = await runAgentLogin({ objectId, name, agentHost });
     return NextResponse.json(result);
   } catch (error) {
     return NextResponse.json(

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/sandbox-agent-auth/logout/route.js

@@ -10,7 +10,7 @@
  * host's `notes` string.
  *
  * Request body:
- *   { objectId: string, name: string }
+ *   { objectId: string, name: string, agentHost?: string }
  *
  * Response:
  *   {
@@ -42,6 +42,7 @@ async function POST(request) {
 
   const objectId = typeof body?.objectId === "string" ? body.objectId.trim() : "";
   const name = typeof body?.name === "string" ? body.name.trim() : "";
+  const agentHost = typeof body?.agentHost === "string" ? body.agentHost.trim() : "";
   if (!objectId || !name) {
     return NextResponse.json(
       { ok: false, error: "objectId and name are required" },
@@ -50,7 +51,7 @@ async function POST(request) {
   }
 
   try {
-    const result = await runAgentLogout({ objectId, name });
+    const result = await runAgentLogout({ objectId, name, agentHost });
     return NextResponse.json(result);
   } catch (error) {
     return NextResponse.json(

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/sandbox-agent-auth/status/route.js

@@ -20,7 +20,7 @@
  * load.
  *
  * Request body:
- *   { objectId: string, name: string }
+ *   { objectId: string, name: string, agentHost?: string }
  *
  * Response (success):
  *   {
@@ -52,6 +52,7 @@ async function POST(request) {
 
   const objectId = typeof body?.objectId === "string" ? body.objectId.trim() : "";
   const name = typeof body?.name === "string" ? body.name.trim() : "";
+  const agentHost = typeof body?.agentHost === "string" ? body.agentHost.trim() : "";
   if (!objectId || !name) {
     return NextResponse.json(
       { ok: false, error: "objectId and name are required" },
@@ -60,7 +61,7 @@ async function POST(request) {
   }
 
   try {
-    const result = await checkAgentStatus({ objectId, name });
+    const result = await checkAgentStatus({ objectId, name, agentHost });
     return NextResponse.json(result);
   } catch (error) {
     return NextResponse.json(

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/api/workspace/sandbox-run/route.js

@@ -43,6 +43,7 @@
  *       envRefsMissing:  string[],
  *       networkAllow:    boolean,
  *       allowList:       string[],
+ *       browserAccess:   boolean,                // first-class browser capability (implies networkAllow)
  *       adapterMeta?:    Record<string, unknown>
  *     }
  *   }
@@ -173,6 +174,7 @@ async function runServerlessScheduler({
   timeoutMs,
   networkAllow,
   allowList,
+  browserAccess,
   envRefSlugs,
   envRefsResolved,
   envRefsMissing
@@ -251,6 +253,7 @@ async function runServerlessScheduler({
       timeoutMs,
       networkAllow,
       allowList,
+      browserAccess,
       envRefSlugs,
       envRefsResolved,
       envRefsMissing
@@ -338,6 +341,8 @@ async function runServerlessScheduler({
 function buildRunResponse({
   runId,
   ranAt,
+  objectId,
+  name,
   runLocality,
   schedulerRegistryId,
   runtime,
@@ -351,6 +356,7 @@ function buildRunResponse({
   envRefsMissing,
   networkAllow,
   allowList,
+  browserAccess,
   result,
   timeoutMs,
   row,
@@ -359,6 +365,10 @@ function buildRunResponse({
   const base = {
     runId,
     ranAt,
+    // Identity travels with the persisted record so run-console consumers
+    // (lineage, swarm projection title) don't depend on the row context.
+    objectId: objectId ? String(objectId).trim() : undefined,
+    name: name ? String(name).trim() : undefined,
     runLocality,
     schedulerRegistryId: schedulerRegistryId ? String(schedulerRegistryId).trim() : null,
     runtime,
@@ -378,6 +388,7 @@ function buildRunResponse({
     envRefsMissing,
     networkAllow,
     allowList,
+    browserAccess,
     adapterMeta: result.adapterMeta || null
   };
   if (row && (row.resolverTemplateId || row.connectorKind || row.executionLane)) {
@@ -439,14 +450,7 @@ async function GET(request) {
   });
 }
 
-async function POST(request) {
-  let body;
-  try {
-    body = await request.json();
-  } catch {
-    return NextResponse.json({ ok: false, error: "invalid JSON body" }, { status: 400 });
-  }
-
+async function executeSandboxRun(body, { emit } = {}) {
   const objectId = typeof body?.objectId === "string" ? body.objectId.trim() : "";
   const name = typeof body?.name === "string" ? body.name.trim() : "";
   const useDraft = body?.useDraft === true;
@@ -498,7 +502,11 @@ async function POST(request) {
   let adapterId = (typeof rowForRun.adapter === "string" && rowForRun.adapter.trim()) ? rowForRun.adapter.trim() : DEFAULT_SANDBOX_ADAPTER;
   const agentHost = typeof rowForRun.agentHost === "string" ? rowForRun.agentHost.trim() : "";
   const schedulerRegistryId = typeof rowForRun.schedulerRegistryId === "string" ? rowForRun.schedulerRegistryId.trim() : "";
-  const networkAllow = coerceBoolean(rowForRun.networkAllow);
+  const browserAccess = coerceBoolean(rowForRun.browserAccess);
+  // Browser access implies outbound network — the same deterministic
+  // normalization the sidecar toggle applies, enforced server-side so
+  // rows patched via the API behave identically to rows saved in the UI.
+  const networkAllow = coerceBoolean(rowForRun.networkAllow) || browserAccess;
   const allowList = parseSandboxAllowList(rowForRun.allowList);
   const envRefSlugs = parseSandboxEnvRefs(rowForRun.envRefs);
   const command = typeof rowForRun.command === "string" ? rowForRun.command : "";
@@ -577,10 +585,12 @@ async function POST(request) {
         envRefsResolved,
         networkAllow,
         allowList,
+        browserAccess,
         instructions,
         command,
         timeoutMs,
-        sandboxName: rowForRun.Name || name
+        sandboxName: rowForRun.Name || name,
+        onEvent: emit
       }
     });
     if (graphResult !== null) {
@@ -607,6 +617,7 @@ async function POST(request) {
       timeoutMs,
       networkAllow,
       allowList,
+      browserAccess,
       envRefSlugs,
       envRefsResolved,
       envRefsMissing
@@ -640,6 +651,7 @@ async function POST(request) {
         timeoutMs,
         networkAllow,
         allowList,
+        browserAccess,
         env,
         envRefSlugs,
         envRefsMissing,
@@ -665,6 +677,8 @@ async function POST(request) {
   const response = buildRunResponse({
     runId,
     ranAt,
+    objectId,
+    name: rowForRun.Name || name,
     runLocality,
     schedulerRegistryId: runLocality === "serverless" ? schedulerRegistryId : null,
     runtime,
@@ -678,6 +692,7 @@ async function POST(request) {
     envRefsMissing,
     networkAllow,
     allowList,
+    browserAccess,
     result,
     timeoutMs,
     row: rowForRun,
@@ -754,4 +769,63 @@ async function POST(request) {
   });
 }
 
+async function POST(request) {
+  const accept = request.headers.get("accept") || "";
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ ok: false, error: "invalid JSON body" }, { status: 400 });
+  }
+
+  const wantsStream = body?.stream === true || accept.includes("application/x-ndjson");
+  if (!wantsStream) {
+    return executeSandboxRun(body);
+  }
+
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream({
+    start(controller) {
+      const emit = (event) => {
+        controller.enqueue(encoder.encode(`${JSON.stringify(event)}\n`));
+      };
+      emit({
+        kind: "growthub-sandbox-run-delta-v1",
+        type: "sandbox-run.accepted",
+        emittedAt: new Date().toISOString(),
+        objectId: typeof body?.objectId === "string" ? body.objectId.trim() : "",
+        name: typeof body?.name === "string" ? body.name.trim() : ""
+      });
+      executeSandboxRun(body, { emit })
+        .then(async (response) => {
+          const finalPayload = await response.json().catch(() => ({ ok: false, error: "stream final payload unreadable" }));
+          emit({
+            kind: "growthub-sandbox-run-delta-v1",
+            type: "sandbox-run.final",
+            emittedAt: new Date().toISOString(),
+            status: response.status,
+            payload: finalPayload
+          });
+        })
+        .catch((error) => {
+          emit({
+            kind: "growthub-sandbox-run-delta-v1",
+            type: "sandbox-run.final",
+            emittedAt: new Date().toISOString(),
+            status: 500,
+            payload: { ok: false, error: error?.message || "sandbox run failed" }
+          });
+        })
+        .finally(() => controller.close());
+    }
+  });
+
+  return new Response(stream, {
+    headers: {
+      "content-type": "application/x-ndjson; charset=utf-8",
+      "cache-control": "no-store"
+    }
+  });
+}
+
 export { GET, POST };

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/app/components/WorkspaceHelperSetupModal.jsx

@@ -14,7 +14,7 @@ const HELPER_AGENT_CHOICES = [
   { id: "gemini_local", label: "Gemini CLI (local)", body: "Uses Gemini CLI." },
   { id: "opencode_local", label: "OpenCode (local)", body: "Uses OpenCode on this machine." },
   { id: "pi_local", label: "Pi (local)", body: "Uses Pi on this machine." },
-  { id: "qwen_code_local", label: "Qwen Code (local)", body: "Uses Qwen Code on this machine." },
+  { id: "qwen_local", label: "Qwen Code (local)", body: "Uses Qwen Code on this machine." },
 ];
 
 const HELPER_EXECUTION_ADAPTERS = [
@@ -255,7 +255,7 @@ function WorkspaceHelperSetupModal({ workspaceConfig, open, onClose, onSaved })
                 />
                 serverless
               </label>
-              <small>Local uses process sandbox or Paperclip agent host on this machine. Serverless delegates to an API Registry URL.</small>
+              <small>Choose local execution or a scheduled serverless run.</small>
             </div>
             <div className="workspace-helper-setup-field-stack">
               <label>