@moretea-labs/forge 1.5.1 → 1.6.0

package/src/runtime/root/release-materialize.ts

@@ -14,6 +14,15 @@ import { CONTROL_PLANE_SCHEMA_VERSION } from '../control-plane/persistence/sqlit
  * `forge runtime service install` operation; staging alone never starts or
  * publishes anything.
  */
+export const FORGE_MACOS_RUNTIME_SIGNING_IDENTIFIER = 'com.moretea.forge.runtime';
+
+export interface MacOSRuntimeCodeSigning {
+  identifier: string;
+  teamIdentifier: string;
+  designatedRequirement: string;
+  authority: string;
+}
+
 export interface StagedRuntimeRelease {
   releasePath: string;
   manifestPath: string;
@@ -22,7 +31,6 @@ export interface StagedRuntimeRelease {
   diagnosticArtifactIdentity?: string;
   browserNodeBridgeArtifactIdentity?: string;
   browserHandoffArtifactIdentity?: string;
-  desktopHelperArtifactIdentity?: string;
   processRunnerArtifactIdentity?: string;
   checkRunnerArtifactIdentity?: string;
   externalPluginProbeArtifactIdentity?: string;
@@ -30,12 +38,15 @@ export interface StagedRuntimeRelease {
   codeGraphSidecarArtifactIdentity?: string;
   codeGraphLibraryArtifactIdentity?: string;
   controllerUiArtifactIdentity?: string;
+  macosCodeSigning?: MacOSRuntimeCodeSigning;
   manifestSha256: string;
   sourceCommit: string;
 }
 
 export interface RuntimeReleaseMaterializerDependencies {
   now?: () => number;
+  platform?: NodeJS.Platform;
+  signMacOSRuntime?: (input: { executable: string; controllerHome: string }) => MacOSRuntimeCodeSigning;
   uuid?: () => string;
   compileBinary?: (input: { sourceRoot: string; outputPath: string; entryPath?: string }) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
   bundleNodeHost?: (input: { sourceRoot: string; outputPath: string; entryPath: string }) => { ok: boolean; stderr?: string; stdout?: string; error?: string };
@@ -59,6 +70,8 @@ export interface CandidateRuntimeStageReceiptV1 {
 }
 
 export interface CandidateRuntimeReleaseStagerDependencies {
+  platform?: NodeJS.Platform;
+  inspectMacOSRuntime?: (executable: string) => MacOSRuntimeCodeSigning;
   runCandidateStager?: (input: {
     bunExecutable: string;
     scriptPath: string;
@@ -78,6 +91,95 @@ function sha256(path: string): string {
   return createHash('sha256').update(readFileSync(path)).digest('hex');
 }
 
+function parseMacOSRuntimeCodeSigning(value: unknown, context: string): MacOSRuntimeCodeSigning | undefined {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${context}: macosCodeSigning must be an object`);
+  const record = value as Record<string, unknown>;
+  const field = (name: keyof MacOSRuntimeCodeSigning): string => {
+    const entry = record[name];
+    if (typeof entry !== 'string' || !entry.trim()) throw new Error(`${context}: macosCodeSigning.${name} is required`);
+    return entry.trim();
+  };
+  const signing = {
+    identifier: field('identifier'),
+    teamIdentifier: field('teamIdentifier'),
+    designatedRequirement: field('designatedRequirement'),
+    authority: field('authority'),
+  };
+  if (signing.identifier !== FORGE_MACOS_RUNTIME_SIGNING_IDENTIFIER) {
+    throw new Error(`${context}: macosCodeSigning.identifier must be ${FORGE_MACOS_RUNTIME_SIGNING_IDENTIFIER}`);
+  }
+  if (!/^[A-Z0-9]{10}$/.test(signing.teamIdentifier)) throw new Error(`${context}: macosCodeSigning.teamIdentifier is invalid`);
+  if (!signing.authority.startsWith('Developer ID Application: ')) throw new Error(`${context}: macosCodeSigning.authority must be Developer ID Application`);
+  if (!signing.designatedRequirement.includes(`identifier \"${FORGE_MACOS_RUNTIME_SIGNING_IDENTIFIER}\"`)
+    || !signing.designatedRequirement.includes('anchor apple generic')
+    || !signing.designatedRequirement.includes(`certificate leaf[subject.OU] = ${signing.teamIdentifier}`)) {
+    throw new Error(`${context}: macosCodeSigning.designatedRequirement is not the stable Developer ID contract`);
+  }
+  return signing;
+}
+
+function readActiveMacOSRuntimeTeam(controllerHome: string): string | undefined {
+  const authorityPath = join(resolve(controllerHome), 'runtime', 'releases', 'authority.json');
+  if (!existsSync(authorityPath)) return undefined;
+  try {
+    const authority = JSON.parse(readFileSync(authorityPath, 'utf8')) as { active?: { manifestPath?: string } };
+    if (!authority.active?.manifestPath || !existsSync(authority.active.manifestPath)) return undefined;
+    const manifest = JSON.parse(readFileSync(authority.active.manifestPath, 'utf8')) as Record<string, unknown>;
+    return parseMacOSRuntimeCodeSigning(manifest.macosCodeSigning, 'RUNTIME_RELEASE_ACTIVE_SIGNING_INVALID')?.teamIdentifier;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith('RUNTIME_RELEASE_ACTIVE_SIGNING_INVALID')) throw error;
+    return undefined;
+  }
+}
+
+function inspectMacOSRuntimeCodeSigning(executable: string): MacOSRuntimeCodeSigning {
+  const verify = runProcess('codesign', ['--verify', '--strict', executable], { timeoutMs: 30_000, maxOutputBytes: 64 * 1024 });
+  if (!verify.ok) throw new Error(`RUNTIME_RELEASE_MACOS_SIGNATURE_INVALID: ${verify.stderr || verify.stdout || verify.error}`.slice(0, 2_000));
+  const detail = runProcess('codesign', ['-dv', '--verbose=4', executable], { timeoutMs: 30_000, maxOutputBytes: 64 * 1024 });
+  if (!detail.ok) throw new Error(`RUNTIME_RELEASE_MACOS_SIGNATURE_INSPECTION_FAILED: ${detail.stderr || detail.stdout || detail.error}`.slice(0, 2_000));
+  const detailText = `${detail.stdout}\n${detail.stderr}`;
+  const identifier = detailText.match(/^Identifier=(.+)$/m)?.[1]?.trim() ?? '';
+  const teamIdentifier = detailText.match(/^TeamIdentifier=(.+)$/m)?.[1]?.trim() ?? '';
+  const authority = detailText.match(/^Authority=(Developer ID Application:.+)$/m)?.[1]?.trim() ?? '';
+  const requirementResult = runProcess('codesign', ['-d', '-r-', executable], { timeoutMs: 30_000, maxOutputBytes: 64 * 1024 });
+  if (!requirementResult.ok) throw new Error(`RUNTIME_RELEASE_MACOS_REQUIREMENT_INSPECTION_FAILED: ${requirementResult.stderr || requirementResult.stdout || requirementResult.error}`.slice(0, 2_000));
+  const requirementText = `${requirementResult.stdout}\n${requirementResult.stderr}`;
+  const designatedRequirement = requirementText.match(/^designated => (.+)$/m)?.[1]?.trim() ?? '';
+  return parseMacOSRuntimeCodeSigning({ identifier, teamIdentifier, authority, designatedRequirement }, 'RUNTIME_RELEASE_MACOS_SIGNATURE_INVALID')!;
+}
+
+function defaultSignMacOSRuntime(input: { executable: string; controllerHome: string }): MacOSRuntimeCodeSigning {
+  const identities = runProcess('security', ['find-identity', '-v', '-p', 'codesigning'], { timeoutMs: 30_000, maxOutputBytes: 128 * 1024 });
+  if (!identities.ok) throw new Error(`RUNTIME_RELEASE_MACOS_SIGNING_IDENTITY_LOOKUP_FAILED: ${identities.stderr || identities.stdout || identities.error}`.slice(0, 2_000));
+  const candidates = identities.stdout.split(/\r?\n/).flatMap((line) => {
+    const match = line.match(/^\s*\d+\)\s+([A-Fa-f0-9]{40})\s+\"(Developer ID Application: .+ \(([A-Z0-9]{10})\))\"/);
+    return match ? [{ hash: match[1]!, label: match[2]!, teamIdentifier: match[3]! }] : [];
+  });
+  const configured = process.env.FORGE_MACOS_RUNTIME_SIGNING_IDENTITY?.trim();
+  const expectedTeam = readActiveMacOSRuntimeTeam(input.controllerHome);
+  let selected = configured
+    ? candidates.find((candidate) => candidate.hash.toLowerCase() === configured.toLowerCase() || candidate.label === configured)
+    : undefined;
+  if (configured && !selected) throw new Error('RUNTIME_RELEASE_MACOS_SIGNING_IDENTITY_NOT_FOUND');
+  if (!selected) {
+    const eligible = expectedTeam ? candidates.filter((candidate) => candidate.teamIdentifier === expectedTeam) : candidates;
+    const teams = Array.from(new Set(eligible.map((candidate) => candidate.teamIdentifier)));
+    if (teams.length !== 1 || eligible.length === 0) {
+      throw new Error(expectedTeam ? 'RUNTIME_RELEASE_MACOS_SIGNING_IDENTITY_FOR_TEAM_REQUIRED' : 'RUNTIME_RELEASE_MACOS_SIGNING_IDENTITY_REQUIRED');
+    }
+    selected = eligible[0];
+  }
+  if (expectedTeam && selected.teamIdentifier !== expectedTeam) throw new Error('RUNTIME_RELEASE_MACOS_SIGNING_TEAM_CHANGED');
+  const signed = runProcess('codesign', [
+    '--force', '--sign', selected.hash, '--identifier', FORGE_MACOS_RUNTIME_SIGNING_IDENTIFIER, '--options', 'runtime', input.executable,
+  ], { timeoutMs: 120_000, maxOutputBytes: 128 * 1024 });
+  if (!signed.ok) throw new Error(`RUNTIME_RELEASE_MACOS_SIGNING_FAILED: ${signed.stderr || signed.stdout || signed.error}`.slice(0, 2_000));
+  const inspected = inspectMacOSRuntimeCodeSigning(input.executable);
+  if (inspected.teamIdentifier !== selected.teamIdentifier) throw new Error('RUNTIME_RELEASE_MACOS_SIGNING_TEAM_MISMATCH');
+  return inspected;
+}
+
 function sha256Directory(root: string): string {
   const hash = createHash('sha256');
   const visit = (directory: string): void => {
@@ -203,12 +305,28 @@ export function stageRuntimeReleaseFromCandidateSource(input: {
   if (sha256(manifestPath) !== receipt.manifestSha256) {
     throw new Error('RUNTIME_RELEASE_CANDIDATE_MANIFEST_IDENTITY_MISMATCH');
   }
+  let rawManifest: Record<string, unknown>;
+  try { rawManifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as Record<string, unknown>; }
+  catch (error) { throw new Error(`RUNTIME_RELEASE_CANDIDATE_MANIFEST_INVALID: ${error instanceof Error ? error.message : String(error)}`); }
+  const platform = dependencies.platform ?? process.platform;
+  const macosCodeSigning = parseMacOSRuntimeCodeSigning(rawManifest.macosCodeSigning, 'RUNTIME_RELEASE_CANDIDATE_SIGNING_INVALID');
+  if (platform === 'darwin') {
+    if (!macosCodeSigning) throw new Error('RUNTIME_RELEASE_CANDIDATE_MACOS_SIGNING_REQUIRED');
+    const actual = (dependencies.inspectMacOSRuntime ?? inspectMacOSRuntimeCodeSigning)(runtimePath);
+    if (actual.identifier !== macosCodeSigning.identifier
+      || actual.teamIdentifier !== macosCodeSigning.teamIdentifier
+      || actual.authority !== macosCodeSigning.authority
+      || actual.designatedRequirement !== macosCodeSigning.designatedRequirement) {
+      throw new Error('RUNTIME_RELEASE_CANDIDATE_MACOS_SIGNING_MISMATCH');
+    }
+  }
 
   return {
     releasePath,
     manifestPath,
     releaseId: receipt.releaseId,
     artifactIdentity: receipt.artifactIdentity,
+    ...(macosCodeSigning ? { macosCodeSigning } : {}),
     manifestSha256: receipt.manifestSha256,
     sourceCommit: receipt.sourceCommit,
   };
@@ -297,6 +415,14 @@ export function stageRuntimeRelease(input: {
       throw new Error(`RUNTIME_RELEASE_BUILD_FAILED: ${compile.stderr || compile.stdout || compile.error}`.slice(0, 2_000));
     }
     chmodSync(executable, 0o700);
+    const platform = dependencies.platform ?? process.platform;
+    const macosCodeSigning = platform === 'darwin'
+      ? (dependencies.signMacOSRuntime ?? defaultSignMacOSRuntime)({ executable, controllerHome: resolve(input.controllerHome) })
+      : undefined;
+    if (platform === 'darwin' && !macosCodeSigning) throw new Error('RUNTIME_RELEASE_MACOS_SIGNING_REQUIRED');
+    const normalizedMacOSCodeSigning = macosCodeSigning
+      ? parseMacOSRuntimeCodeSigning(macosCodeSigning, 'RUNTIME_RELEASE_MACOS_SIGNING_INVALID')
+      : undefined;
     const artifactIdentity = `sha256:${sha256(executable)}`;
 
     const diagnosticExecutable = join(staging, 'forge-cli');
@@ -407,28 +533,18 @@ export function stageRuntimeRelease(input: {
     cpSync(sourceControllerUiPath, controllerUiPath, { recursive: true, force: false });
     const controllerUiArtifactIdentity = `sha256:${sha256Directory(controllerUiPath)}`;
 
-    const desktopHelperEntrypoint = 'forge-desktop-helper.mjs' as const;
-    const sourceDesktopHelperPath = join(sourceRoot, 'bin', desktopHelperEntrypoint);
-    if (!existsSync(sourceDesktopHelperPath)) {
-      throw new Error(`RUNTIME_RELEASE_DESKTOP_HELPER_SOURCE_MISSING: ${sourceDesktopHelperPath}`);
-    }
-    const desktopHelperPath = join(staging, desktopHelperEntrypoint);
-    copyFileSync(sourceDesktopHelperPath, desktopHelperPath);
-    chmodSync(desktopHelperPath, 0o700);
-    const desktopHelperArtifactIdentity = `sha256:${sha256(desktopHelperPath)}`;
     const manifest = {
       schemaVersion: 1,
       releaseId,
       artifactIdentity,
       entrypoint: 'forge-runtime',
+      ...(normalizedMacOSCodeSigning ? { macosCodeSigning: normalizedMacOSCodeSigning } : {}),
       diagnosticEntrypoint: 'forge-cli',
       diagnosticArtifactIdentity,
       browserNodeBridgeEntrypoint,
       browserNodeBridgeArtifactIdentity,
       browserHandoffEntrypoint,
       browserHandoffArtifactIdentity,
-      desktopHelperEntrypoint,
-      desktopHelperArtifactIdentity,
       processRunnerEntrypoint,
       processRunnerArtifactIdentity,
       checkRunnerEntrypoint,
@@ -464,10 +580,10 @@ export function stageRuntimeRelease(input: {
       manifestPath: join(releasePath, 'manifest.json'),
       releaseId,
       artifactIdentity,
+      ...(normalizedMacOSCodeSigning ? { macosCodeSigning: normalizedMacOSCodeSigning } : {}),
       diagnosticArtifactIdentity,
       browserNodeBridgeArtifactIdentity,
       browserHandoffArtifactIdentity,
-      desktopHelperArtifactIdentity,
       processRunnerArtifactIdentity,
       checkRunnerArtifactIdentity,
       externalPluginProbeArtifactIdentity,
@@ -484,12 +600,23 @@ export function stageRuntimeRelease(input: {
   }
 }
 
-export function assertRuntimeReleaseFiles(release: StagedRuntimeRelease): void {
+export function assertRuntimeReleaseFiles(release: StagedRuntimeRelease, dependencies: { platform?: NodeJS.Platform; inspectMacOSRuntime?: (executable: string) => MacOSRuntimeCodeSigning } = {}): void {
   if (!existsSync(release.releasePath) || !existsSync(release.manifestPath)) {
     throw new Error(`RUNTIME_RELEASE_FILES_MISSING: ${release.releasePath}`);
   }
-  if (!existsSync(join(release.releasePath, 'forge-runtime'))) {
-    throw new Error(`RUNTIME_RELEASE_ENTRYPOINT_MISSING: ${join(release.releasePath, 'forge-runtime')}`);
+  const runtimePath = join(release.releasePath, 'forge-runtime');
+  if (!existsSync(runtimePath)) {
+    throw new Error(`RUNTIME_RELEASE_ENTRYPOINT_MISSING: ${runtimePath}`);
+  }
+  const platform = dependencies.platform ?? process.platform;
+  if (platform === 'darwin' && release.macosCodeSigning) {
+    const actual = (dependencies.inspectMacOSRuntime ?? inspectMacOSRuntimeCodeSigning)(runtimePath);
+    if (actual.identifier !== release.macosCodeSigning.identifier
+      || actual.teamIdentifier !== release.macosCodeSigning.teamIdentifier
+      || actual.authority !== release.macosCodeSigning.authority
+      || actual.designatedRequirement !== release.macosCodeSigning.designatedRequirement) {
+      throw new Error('RUNTIME_RELEASE_MACOS_SIGNING_MISMATCH');
+    }
   }
   if (release.diagnosticArtifactIdentity && !existsSync(join(release.releasePath, 'forge-cli'))) {
     throw new Error(`RUNTIME_RELEASE_DIAGNOSTIC_ENTRYPOINT_MISSING: ${join(release.releasePath, 'forge-cli')}`);
@@ -500,9 +627,6 @@ export function assertRuntimeReleaseFiles(release: StagedRuntimeRelease): void {
   if (release.browserHandoffArtifactIdentity && !existsSync(join(release.releasePath, 'browser-handoff-host.js'))) {
     throw new Error(`RUNTIME_RELEASE_BROWSER_HANDOFF_HOST_MISSING: ${join(release.releasePath, 'browser-handoff-host.js')}`);
   }
-  if (release.desktopHelperArtifactIdentity && !existsSync(join(release.releasePath, 'forge-desktop-helper.mjs'))) {
-    throw new Error(`RUNTIME_RELEASE_DESKTOP_HELPER_MISSING: ${join(release.releasePath, 'forge-desktop-helper.mjs')}`);
-  }
   if (release.processRunnerArtifactIdentity && !existsSync(join(release.releasePath, 'process-runner.js'))) {
     throw new Error(`RUNTIME_RELEASE_PROCESS_RUNNER_MISSING: ${join(release.releasePath, 'process-runner.js')}`);
   }

package/src/runtime/root/service.ts

@@ -232,7 +232,7 @@ export function syncForgeRuntimeActiveEntrypoint(controllerHome: string): { path
 }
 
 export function ensureForgeRuntimeLaunchAgentContract(
-  input: { controllerHome: string; bootstrapNodeExecutable?: string; bootstrapRunnerPath?: string },
+  input: { controllerHome: string; bootstrapNodeExecutable?: string; bootstrapRunnerPath?: string; installUserLaunchAgent?: boolean },
 ): { paths: ForgeRuntimeServicePaths; mode: 'release' | 'bootstrap'; changed: boolean } {
   const paths = forgeRuntimeServicePaths(input.controllerHome);
   const active = activeRuntimeEntrypoint(input.controllerHome);
@@ -250,10 +250,12 @@ export function ensureForgeRuntimeLaunchAgentContract(
       : { nodeExecutable: input.bootstrapNodeExecutable!, runnerPath: input.bootstrapRunnerPath! }),
   });
   const existingSource = existsSync(paths.sourcePlistPath) ? readFileSync(paths.sourcePlistPath, 'utf8') : undefined;
-  const existingInstalled = existsSync(paths.installedPlistPath) ? readFileSync(paths.installedPlistPath, 'utf8') : undefined;
-  const changed = existingSource !== plist || existingInstalled !== plist;
+  const existingInstalled = input.installUserLaunchAgent && existsSync(paths.installedPlistPath)
+    ? readFileSync(paths.installedPlistPath, 'utf8')
+    : undefined;
+  const changed = existingSource !== plist || (input.installUserLaunchAgent === true && existingInstalled !== plist);
   if (existingSource !== plist) atomicWrite(paths.sourcePlistPath, plist);
-  if (existingInstalled !== plist) atomicWrite(paths.installedPlistPath, plist, 0o644);
+  if (input.installUserLaunchAgent === true && existingInstalled !== plist) atomicWrite(paths.installedPlistPath, plist, 0o644);
   return { paths, mode: useRelease ? 'release' : 'bootstrap', changed };
 }
 

package/src/runtime/safe-tooling/index.ts

@@ -1,6 +1,5 @@
 export * from './types';
 export * from './plugin-summary';
-export * from './browser-safe';
 export * from './job-summary';
 export * from './external-filesystem';
 export * from './workspace-auth';

package/src/runtime/safe-tooling/types.ts

@@ -44,36 +44,6 @@ export interface SafePluginSummary {
   };
 }
 
-export interface WebTarget {
-  targetKey: string;
-  domain: string;
-  origin: string;
-  allowed: true;
-  defaultPath: '/';
-}
-
-export interface WebDomainAccessPreview {
-  ticketId: string;
-  normalizedDomain: string;
-  domainKey: string;
-  reason: string;
-  expiresAt: string;
-  alreadyAllowed: boolean;
-  currentAllowedDomainCount: number;
-  risk: 'workspace_write';
-  confirmation: 'authorization';
-  localOnly: true;
-  willChange: {
-    pluginId: 'browser';
-    configField: 'allowedDomains';
-    addDomain: string;
-  };
-  safety: {
-    arbitraryUrlAccepted: false;
-    domainOnly: true;
-    sensitiveConfigReturned: false;
-  };
-}
 
 export interface SafeJobResultSummary {
   jobId: string;

package/src/runtime/standalone-recovery/core.ts

@@ -1740,7 +1740,7 @@ export async function activateRuntimeRelease(
       return { ok: false, attempted: true, detail, serviceTarget: service.target, verify: await verifyLocal(config) } satisfies RuntimeReleaseActivationResult;
     }
     try {
-      ensureForgeRuntimeLaunchAgentContract({ controllerHome: config.controllerHome });
+      ensureForgeRuntimeLaunchAgentContract({ controllerHome: config.controllerHome, installUserLaunchAgent: true });
     } catch (error) {
       const detail = `runtime launchd stable-release contract update failed: ${error instanceof Error ? error.message : String(error)}`;
       audit(config, 'runtime_release_activation_launchd_contract_failed', { serviceTarget: service.target, operationId, detail });
@@ -1821,7 +1821,7 @@ export async function activateRuntimeRelease(
             physicalHome: storageMigration.physicalHome,
           });
         }
-        ensureForgeRuntimeLaunchAgentContract({ controllerHome: config.controllerHome });
+        ensureForgeRuntimeLaunchAgentContract({ controllerHome: config.controllerHome, installUserLaunchAgent: true });
         const previousRevision = previousActive?.releaseId ?? '';
         const previousIdentity = previousActive?.artifactIdentity;
         if (

package/src/runtime/workflow/schedules/browser-probe.ts

@@ -0,0 +1,180 @@
+import { createHash } from 'crypto';
+import type { RepositoryRecord } from '../../../cli/repositories/types';
+import { executeBrowserPluginAction } from '../../plugins/browser-adapter';
+
+export type ScheduledBrowserProbeStatus = 'observed' | 'keepalive' | 'auth_required';
+
+export interface ScheduledBrowserProbeResult {
+  status: ScheduledBrowserProbeStatus;
+  fingerprint?: string;
+  url?: string;
+  sessionId: string;
+  projectedLineCount: number;
+  observedChars: number;
+  truncated: boolean;
+  authReason?: string;
+}
+
+function stringValue(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+function recordValue(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+
+function stringList(value: unknown): string[] {
+  return Array.isArray(value) ? value.map((entry) => String(entry).trim()).filter(Boolean) : [];
+}
+
+function boundedNumber(value: unknown, fallback: number, min: number, max: number): number {
+  return typeof value === 'number' && Number.isFinite(value)
+    ? Math.max(min, Math.min(Math.trunc(value), max))
+    : fallback;
+}
+
+export function buildScheduledBrowserFingerprint(text: string, includeTerms: string[] = [], ignorePatterns: string[] = []): { fingerprint: string; lineCount: number } {
+  const terms = includeTerms.map((term) => term.toLocaleLowerCase());
+  let lines = text
+    .split(/\r?\n/)
+    .map((line) => line.replace(/\s+/g, ' ').trim())
+    .filter(Boolean);
+  if (terms.length > 0) {
+    lines = lines.filter((line) => {
+      const normalized = line.toLocaleLowerCase();
+      return terms.some((term) => normalized.includes(term));
+    });
+  }
+  for (const pattern of ignorePatterns) {
+    try {
+      const expression = new RegExp(pattern, 'giu');
+      lines = lines.map((line) => line.replace(expression, ' ').replace(/\s+/g, ' ').trim()).filter(Boolean);
+    } catch {
+      throw new Error(`SCHEDULE_BROWSER_PROBE_IGNORE_PATTERN_INVALID: ${pattern}`);
+    }
+  }
+  lines = [...new Set(lines)].sort((left, right) => left.localeCompare(right));
+  return { fingerprint: createHash('sha256').update(lines.join('\n')).digest('hex'), lineCount: lines.length };
+}
+
+export function classifyScheduledBrowserObservation(
+  previousFingerprint: string | undefined,
+  currentFingerprint: string | undefined,
+  wakeOnFirstObservation = false,
+): { status: 'baseline' | 'unchanged' | 'changed'; shouldWake: boolean } {
+  const firstObservation = !previousFingerprint;
+  const changed = Boolean(previousFingerprint && currentFingerprint && previousFingerprint !== currentFingerprint);
+  return {
+    status: firstObservation ? 'baseline' : changed ? 'changed' : 'unchanged',
+    shouldWake: changed || (firstObservation && wakeOnFirstObservation),
+  };
+}
+
+function containsAny(value: string | undefined, terms: string[]): string | undefined {
+  if (!value) return undefined;
+  const normalized = value.toLocaleLowerCase();
+  return terms.find((term) => normalized.includes(term.toLocaleLowerCase()));
+}
+
+async function browserAction(
+  controllerHome: string,
+  repository: RepositoryRecord,
+  occurrenceId: string,
+  actionId: string,
+  args: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  return executeBrowserPluginAction({
+    controllerHome,
+    repoId: repository.repoId,
+    repoRoot: repository.canonicalRoot,
+    pluginId: 'browser',
+    actionId,
+    requestId: `schedule-browser-probe:${occurrenceId}:${actionId}`,
+    args,
+    origin: { surface: 'schedule', actor: 'browser-probe', correlationId: occurrenceId },
+  });
+}
+
+/**
+ * Bounded read-only browser observation for Schedule. It never interprets page
+ * meaning: it only refreshes/navigates, extracts bounded text, projects matching
+ * lines, detects configured login markers, and returns a stable fingerprint.
+ */
+export async function executeScheduledBrowserProbe(input: {
+  controllerHome: string;
+  repository: RepositoryRecord;
+  occurrenceId: string;
+  args: Record<string, unknown>;
+}): Promise<ScheduledBrowserProbeResult> {
+  const requestedSessionId = stringValue(input.args.probe_session_id) ?? stringValue(input.args.session_id);
+  const url = stringValue(input.args.probe_url) ?? stringValue(input.args.url);
+  if (!requestedSessionId && !url) throw new Error('SCHEDULE_BROWSER_PROBE_TARGET_REQUIRED');
+
+  const waitUntil = stringValue(input.args.wait_until) ?? 'domcontentloaded';
+  const timeoutMs = boundedNumber(input.args.timeout_ms, 60_000, 1_000, 120_000);
+  let navigation: Record<string, unknown>;
+  if (url) {
+    navigation = await browserAction(input.controllerHome, input.repository, input.occurrenceId, 'navigate', {
+      ...(requestedSessionId ? { session_id: requestedSessionId } : {}),
+      url,
+      wait_until: waitUntil,
+      timeout_ms: timeoutMs,
+      retries: 1,
+    });
+  } else {
+    navigation = await browserAction(input.controllerHome, input.repository, input.occurrenceId, 'reload', {
+      session_id: requestedSessionId!,
+      wait_until: waitUntil,
+      timeout_ms: timeoutMs,
+    });
+  }
+
+  const session = recordValue(navigation.session);
+  const sessionId = stringValue(navigation.sessionId) ?? stringValue(session.sessionId) ?? stringValue(session.id) ?? requestedSessionId;
+  if (!sessionId) throw new Error('SCHEDULE_BROWSER_PROBE_SESSION_UNAVAILABLE');
+  const observedUrl = stringValue(navigation.url) ?? stringValue(session.url) ?? url;
+  const loginUrlTerms = stringList(input.args.login_url_terms);
+  const urlLoginMarker = containsAny(observedUrl, loginUrlTerms);
+
+  const keepaliveOnly = input.args.keepalive_only === true;
+  const loginTextTerms = stringList(input.args.login_text_terms);
+  const mustExtractText = !keepaliveOnly || loginTextTerms.length > 0;
+  let rawText = '';
+  let truncated = false;
+  if (mustExtractText) {
+    const textResult = await browserAction(input.controllerHome, input.repository, input.occurrenceId, 'get_text', {
+      session_id: sessionId,
+      ...(stringValue(input.args.selector) ? { selector: stringValue(input.args.selector) } : {}),
+      max_chars: boundedNumber(input.args.max_chars, 20_000, 256, 100_000),
+    });
+    rawText = stringValue(textResult.text) ?? '';
+    truncated = textResult.truncated === true;
+  }
+  const textLoginMarker = containsAny(rawText, loginTextTerms);
+  const authMarker = urlLoginMarker ?? textLoginMarker;
+  if (authMarker) {
+    return {
+      status: 'auth_required',
+      url: observedUrl,
+      sessionId,
+      projectedLineCount: 0,
+      observedChars: rawText.length,
+      truncated,
+      authReason: `matched configured login marker: ${authMarker}`,
+    };
+  }
+  if (keepaliveOnly) {
+    return { status: 'keepalive', url: observedUrl, sessionId, projectedLineCount: 0, observedChars: rawText.length, truncated };
+  }
+
+  const projected = buildScheduledBrowserFingerprint(rawText, stringList(input.args.include_terms), stringList(input.args.ignore_patterns));
+  return {
+    status: 'observed',
+    fingerprint: projected.fingerprint,
+    url: observedUrl,
+    sessionId,
+    projectedLineCount: projected.lineCount,
+    observedChars: rawText.length,
+    truncated,
+  };
+}

package/src/runtime/workflow/schedules/chatgpt-automation-migration.ts

@@ -0,0 +1,40 @@
+import type { RepositorySchedule } from './types';
+
+export const CHATGPT_AUTOMATION_EXECUTION_PROFILE = 'chatgpt_browser_v1';
+export const CHATGPT_AUTOMATION_DEFAULT_MODEL = 'gpt-5.6';
+export const CHATGPT_AUTOMATION_DEFAULT_REASONING = 'high';
+export const CHATGPT_AUTOMATION_DEFAULT_TAB_POLICY = 'auto';
+
+export interface ChatgptAutomationScheduleMigrationResult {
+  changed: boolean;
+  schedule: RepositorySchedule;
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+export function migrateChatgptAutomationSchedule(schedule: RepositorySchedule): ChatgptAutomationScheduleMigrationResult {
+  if (schedule.action.operation !== 'external_controller_wake') return { changed: false, schedule };
+  const current = schedule.action.arguments ?? {};
+  const controllerType = nonEmptyString(current.controller_type) ?? 'chatgpt';
+  if (controllerType !== 'chatgpt') return { changed: false, schedule };
+
+  const argumentsNext: Record<string, unknown> = {
+    ...current,
+    controller_type: controllerType,
+    model: nonEmptyString(current.model) ?? CHATGPT_AUTOMATION_DEFAULT_MODEL,
+    reasoning: nonEmptyString(current.reasoning) ?? CHATGPT_AUTOMATION_DEFAULT_REASONING,
+    tab_policy: nonEmptyString(current.tab_policy) ?? CHATGPT_AUTOMATION_DEFAULT_TAB_POLICY,
+    execution_profile: nonEmptyString(current.execution_profile) ?? CHATGPT_AUTOMATION_EXECUTION_PROFILE,
+  };
+  const changed = Object.entries(argumentsNext).some(([key, value]) => current[key] !== value);
+  if (!changed) return { changed: false, schedule };
+  return {
+    changed: true,
+    schedule: {
+      ...schedule,
+      action: { ...schedule.action, arguments: argumentsNext },
+    },
+  };
+}