@on-par/factory-cli 0.9.5-next.9 → 0.9.6-next.1

package/dist/cli/ship-steps.js

@@ -0,0 +1,273 @@
+// packages/cli/src/cli/ship-steps.ts — named steps of the ship flow: run-report/benchmark writers, sandbox logging, RunRequest builder (#2788)
+import { exec as execCb } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { promisify, styleText } from 'node:util';
+import { GITHUB_ISSUE_SOURCE, listQueuedSteering, localOnlyWorkspace, resolveBuildPublish, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, rewriteQueueForDecomposition, worktreeWorkspace, writeBenchmarkArtifacts, } from '@on-par/factory-core';
+import { currentSlice, findOpenPR, findSlicePlanComment, resolveFilingPolicy, resolveReviewFloorRules, withFileLock, withGitLock, } from '@on-par/factory-core/internal';
+import { recordGitPushes, resolveGitHubMode, GITHUB_STUB_CALLS_FILE } from './github-stub.js';
+import { shipRuntime } from './ship-runtime.js';
+// Captures the message of the last terminal event runIssue emits (ready/fail/
+// escalate/held/conflict/ci-failed/timeout) so the LaneParkError the ship adapter
+// raises carries the same diagnostic text shipIssue used to throw with —
+// RunOutcome's parked variant carries only the ParkReason enum, not free text.
+export const TERMINAL_EVENT_KINDS = new Set([
+    'ready',
+    'environment-released',
+    'fail',
+    'escalate',
+    'held',
+    'conflict',
+    'config',
+    'ci-failed',
+    'ci-infra',
+    'timeout',
+]);
+/** FACTORY_GITHUB=stub (#2652): record each `git push` ship runs in the stub's calls.jsonl. */
+export function stubAwareShipPhase(shipPhase) {
+    let shipPhaseForMode = shipPhase;
+    if (resolveGitHubMode(process.env) === 'stub') {
+        const base = shipPhase;
+        const stubCalls = join(resolve(process.env.FACTORY_GITHUB_STUB_DIR ?? ''), GITHUB_STUB_CALLS_FILE);
+        const defaultShipRunner = promisify(execCb);
+        const wrapped = (o) => base({ ...o, run: recordGitPushes(o.run ?? defaultShipRunner, stubCalls, o.branch) });
+        shipPhaseForMode = wrapped;
+    }
+    return shipPhaseForMode;
+}
+/** Logs the sandbox state for this run and returns the policy to wrap agent commands in, if any. */
+export function logSandboxPolicy(opts, sandboxPolicy, log) {
+    let activeSandboxPolicy;
+    if (opts.sandbox === false) {
+        console.error(styleText('yellow', 'factory: sandbox disabled by --no-sandbox — agent runs are UNCONTAINED'));
+        log('sandbox-disabled', 'sandbox disabled by --no-sandbox');
+    }
+    else if (!sandboxPolicy) {
+        log('sandbox-disabled', 'sandbox disabled by config/FACTORY_SANDBOX');
+    }
+    else if (sandboxPolicy.runtime === 'none') {
+        log('sandbox-unavailable', 'no sandbox runtime found (sandbox-exec/firejail) — running uncontained');
+    }
+    else if (sandboxPolicy.runtime === 'docker-sandbox') {
+        // docker-sandbox's containment is the microVM created by worktreeWorkspace in shipIssue
+        // (#653), not a command-prefix wrap — activeSandboxPolicy stays undefined because
+        // wrapCommandInSandbox remains a no-op for this runtime. createMicroVm logs the
+        // actual outcome ('sandbox' on success, 'sandbox-unavailable' on fallback), so no
+        // speculative log is emitted here.
+    }
+    else {
+        activeSandboxPolicy = sandboxPolicy;
+        if (sandboxPolicy.allowHosts.length > 0) {
+            log('sandbox-degraded', `host-level egress filtering unavailable in v1; intended allowlist: ${sandboxPolicy.allowHosts.join(', ')}`);
+        }
+    }
+    return activeSandboxPolicy;
+}
+/** ADR-0147: slice k >= 2 builds on its own branch, so the slice plan is read before the worktree exists. */
+export async function findSliceIndex({ sizeGateMode, ctx, work, octokit, ghRepo, issueNum, }) {
+    const { errorDetail, LaneParkError } = shipRuntime();
+    let sliceIndex;
+    // ADR-0161: stack runs as slice until stacked PRs are built.
+    if ((sizeGateMode === 'slice' || sizeGateMode === 'stack') &&
+        !ctx?.localOnly &&
+        !ctx?.resumeFrom &&
+        work.kind === GITHUB_ISSUE_SOURCE) {
+        try {
+            const lookup = await findSlicePlanComment({ octokit, repo: ghRepo, issue: issueNum });
+            if (lookup.status === 'found')
+                sliceIndex = currentSlice(lookup.plan)?.index;
+        }
+        catch (err) {
+            throw new LaneParkError(`slice plan lookup failed for #${issueNum}: ${errorDetail(err)} — parked before creating a worktree`, 'escalate');
+        }
+    }
+    return sliceIndex;
+}
+/** Sets up the run's workspace: reuse a kept worktree, create a factory worktree, or wrap the local-only one. */
+export async function setupRunWorkspace({ ctx, repoRoot, branch, worktree, log, worktreeSandbox, octokit, ghOwner, ghName, git, paths, }) {
+    let workspace;
+    if (ctx?.resumeFrom) {
+        workspace = { path: worktree, dispose: async () => { } };
+        log('worktree', `reusing kept worktree at ${worktree} (resume --from check)`);
+    }
+    else if (!ctx?.localOnly) {
+        workspace = await worktreeWorkspace({
+            repoRoot,
+            branch,
+            worktreePath: worktree,
+            log,
+            sandbox: worktreeSandbox,
+            findOpenPr: (br) => findOpenPR(octokit, ghOwner, ghName, br),
+            setup: (root, br, wt, sp, sandbox, setupLog, setupOpts) => withGitLock(root, () => withFileLock(paths.gitLock, 
+            // setupWorktree fetches origin itself before creating the worktree (#1167),
+            // so no explicit gitFetch here — still under the git + file locks.
+            () => git.setupWorktree(root, br, wt, sp, sandbox, setupLog, setupOpts), { onSteal: (pid) => log('lock-stolen', `stole ${paths.gitLock} from dead holder pid ${pid ?? 'unknown'}`) })),
+        });
+        log('worktree', `Worktree ready at ${worktree}`);
+    }
+    else {
+        workspace = localOnlyWorkspace(ctx.localOnly);
+        log('workspace', `local-only: using caller-provided workspace ${worktree} (no factory worktree created)`);
+    }
+    return workspace;
+}
+/** Rewrites the queue for a decomposed issue, then throws so the lane moves on to the children. */
+export function decomposeQueue({ issueNum, childIssues, paths, planLog, }) {
+    const { readTextFileOrEmpty, errorDetail, IssueDecomposedError } = shipRuntime();
+    const childList = childIssues.map((n) => `#${n}`).join(', ');
+    try {
+        const before = readTextFileOrEmpty(paths.queue);
+        const rewrite = rewriteQueueForDecomposition(before, { issue: issueNum, childIssues });
+        if (rewrite.changed) {
+            writeFileSync(paths.queue, rewrite.content);
+            planLog('decompose_filed', `queue entry for #${issueNum} replaced with ${childList}`);
+        }
+        else {
+            planLog('decompose_filed', `#${issueNum} had no queue entry to replace — continuing the lane with ${childList}`);
+        }
+    }
+    catch (err) {
+        planLog('decompose_file_failed', `queue rewrite for #${issueNum} failed: ${errorDetail(err)}`);
+    }
+    throw new IssueDecomposedError(`issue #${issueNum} decomposed into ${childList}`, childIssues);
+}
+/** Maps the core RunOutcome to the shipped branch name, or throws the park/pause error the lane expects. */
+export function finishOutcome({ outcome, opts, ctx, paths, issueNum, worktree, terminalMessage, log, }) {
+    const { LaneParkError, LaneEnvironmentPauseError } = shipRuntime();
+    if (opts.interactive && !ctx?.localOnly && (outcome.state === 'ready' || outcome.state === 'shipped')) {
+        const leftover = listQueuedSteering(paths.steering, issueNum);
+        if (leftover.length > 0) {
+            log('steering_unconsumed', `${leftover.length} steering message(s) not consumed (no worker phase remained)`);
+        }
+    }
+    if (outcome.state === 'ready' || outcome.state === 'shipped') {
+        if (ctx?.localOnly) {
+            console.log(styleText('green', `✅ Local-only run complete in ${worktree} (no PR — publishing disabled)`));
+        }
+        else {
+            console.log(styleText('green', `✅ Issue #${issueNum} → ${terminalMessage ?? 'ready'}`));
+        }
+        return outcome.branch;
+    }
+    if (outcome.state === 'released') {
+        throw new LaneEnvironmentPauseError(terminalMessage ?? 'environment failure on base', {
+            baseSha: outcome.baseSha,
+            failingChecks: outcome.failingChecks,
+            failureSignature: outcome.failureSignature,
+            buildPreserved: outcome.buildPreserved,
+        });
+    }
+    const reason = outcome.state === 'escalated' ? 'escalate' : outcome.reason;
+    const message = outcome.state === 'escalated' ? outcome.reason : (terminalMessage ?? `run parked: ${outcome.reason}`);
+    throw new LaneParkError(message, reason, outcome.state === 'parked'
+        ? { failureSignature: outcome.failureSignature, failingChecks: outcome.failingChecks }
+        : undefined);
+}
+export function buildRunRequest({ issueNum, ghRepo, repoRoot, branch, specPath, work, product, runStartedAt, lane, opts, ctx, autoRework, planApprovalEnabled, factoryConfig, repoConfig, classifierPolicy, loaders, efficiency, sizeGateMode, maxSlices, timeouts, modelPins, codexOff, failoverSettings, activeSandboxPolicy, processGroupGraceMs, paths, }) {
+    const { repoConfigFileFor } = shipRuntime();
+    return {
+        issue: issueNum,
+        repo: ghRepo,
+        branch,
+        specPath,
+        work,
+        workSource: ctx?.workSource,
+        product,
+        startedAt: runStartedAt,
+        lane,
+        options: {
+            interactive: Boolean(opts.interactive),
+            autoRework,
+            approvePlan: planApprovalEnabled,
+            sandboxDisabled: opts.sandbox === false,
+        },
+        localOnly: Boolean(ctx?.localOnly),
+        blockUnresolvedRegressions: resolveDesignRegressionBlock(factoryConfig),
+        readinessUpdateIssueBody: resolveReadinessUpdateIssueBody(factoryConfig),
+        publishFromBuild: resolveBuildPublish(factoryConfig),
+        sizeGateMode,
+        maxSlices,
+        prClassifier: classifierPolicy.enabled
+            ? {
+                rules: resolveReviewFloorRules(repoConfig),
+                gateLabel: resolveFilingPolicy(factoryConfig).selfFixLabel,
+                modelPin: repoConfig?.models?.pins?.classifier,
+            }
+            : undefined,
+        timeouts,
+        modelPins,
+        codexDisabled: codexOff,
+        skipCI: loaders.resolveSkipCI(factoryConfig),
+        failover: failoverSettings,
+        efficiency: { maxReworkRounds: efficiency.maxReworkRounds, fastPath: efficiency.fastPath },
+        sandboxPolicy: activeSandboxPolicy,
+        processGroupGraceMs,
+        preferredRoute: repoConfig?.route,
+        ...(ctx?.resumeFrom
+            ? {
+                resumeFrom: {
+                    phase: 'check',
+                    diffBase: ctx.resumeFrom.diffBase,
+                    route: ctx.resumeFrom.route,
+                    model: ctx.resumeFrom.model,
+                    buildMinutes: ctx.resumeFrom.buildMinutes,
+                },
+            }
+            : {}),
+        eventsFile: paths.events,
+        logsDir: paths.logs,
+        baselineCachePath: paths.baselineCache,
+        repoConfigFile: repoConfigFileFor(repoRoot, paths.config),
+        flakyLedgerPath: paths.flakyLedger,
+    };
+}
+export async function maybeWriteLocalRunReport(opts) {
+    if (process.env.FACTORY_LOCAL_ONLY !== '1')
+        return undefined;
+    const report = await (opts.writeLocalRunReport ?? shipRuntime().defaultWriteLocalRunReport())({
+        issue: opts.issueNum,
+        eventsFile: opts.paths.events,
+        reportsDir: opts.paths.reports,
+        startedAt: opts.startedAt,
+        outcome: opts.outcome,
+        profile: 'local-only',
+        branch: opts.branch,
+        worktree: opts.worktree,
+        specPath: opts.specPath,
+        route: opts.route,
+        reason: opts.reason,
+    });
+    console.log(styleText('cyan', `local-only report: ${report.path}`));
+    return report.path;
+}
+export async function maybeWriteBenchmarkArtifacts(opts) {
+    if (!opts.ctx?.localOnly || !opts.ctx.artifactsDir)
+        return;
+    try {
+        const { manifestPath } = await writeBenchmarkArtifacts({
+            issue: opts.issueNum,
+            artifactsDir: opts.ctx.artifactsDir,
+            eventsFile: opts.paths.events,
+            costsFile: opts.paths.costs,
+            startedAt: opts.startedAt,
+            outcome: opts.outcome,
+            workspace: opts.ctx.localOnly.workspace,
+            branch: opts.branch,
+            specPath: opts.specPath,
+            route: opts.route,
+            request: opts.ctx.workRequest,
+            checkSummary: opts.checkSummary,
+            reworkRounds: opts.reworkRounds,
+            failure: opts.failure,
+            reportPath: opts.reportPath,
+            diffBase: opts.diffBase,
+        });
+        opts.log('benchmark-artifacts', `manifest written to ${manifestPath}`);
+        console.log(styleText('cyan', `benchmark artifacts: ${manifestPath}`));
+    }
+    catch (err) {
+        // Never let artifact emission mask the run outcome.
+        opts.log('benchmark-artifacts-failed', `could not write benchmark artifacts: ${err.message}`);
+    }
+}
+//# sourceMappingURL=ship-steps.js.map

package/dist/cli/ship-steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ship-steps.js","sourceRoot":"","sources":["../../src/cli/ship-steps.ts"],"names":[],"mappings":"AAAA,+IAA+I;AAE/I,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAsBjD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC5B,+BAA+B,EAC/B,4BAA4B,EAE5B,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,YAAY,EACZ,WAAW,GACZ,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE9F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,8EAA8E;AAC9E,kFAAkF;AAClF,yEAAyE;AACzE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAY;IACrD,OAAO;IACP,sBAAsB;IACtB,MAAM;IACN,UAAU;IACV,MAAM;IACN,UAAU;IACV,QAAQ;IACR,WAAW;IACX,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,SAA6C;IAC9E,IAAI,gBAAgB,GAAG,SAAS,CAAC;IACjC,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACnG,MAAM,iBAAiB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAA0B,CAAC,CAAC,EAAE,EAAE,CAC3C,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxF,gBAAgB,GAAG,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAC9B,IAA2B,EAC3B,aAAsD,EACtD,GAA2C;IAE3C,IAAI,mBAA8C,CAAC;IACnD,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,wEAAwE,CAAC,CAAC,CAAC;QAC7G,GAAG,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,aAAa,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5C,GAAG,CAAC,qBAAqB,EAAE,wEAAwE,CAAC,CAAC;IACvG,CAAC;SAAM,IAAI,aAAa,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACtD,wFAAwF;QACxF,kFAAkF;QAClF,gFAAgF;QAChF,kFAAkF;QAClF,mCAAmC;IACrC,CAAC;SAAM,CAAC;QACN,mBAAmB,GAAG,aAAa,CAAC;QACpC,IAAI,aAAa,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CACD,kBAAkB,EAClB,sEAAsE,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5G,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,YAAY,EACZ,GAAG,EACH,IAAI,EACJ,OAAO,EACP,MAAM,EACN,QAAQ,GAQT;IACC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,CAAC;IACrD,IAAI,UAA8B,CAAC;IACnC,6DAA6D;IAC7D,IACE,CAAC,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,OAAO,CAAC;QACtD,CAAC,GAAG,EAAE,SAAS;QACf,CAAC,GAAG,EAAE,UAAU;QAChB,IAAI,CAAC,IAAI,KAAK,mBAAmB,EACjC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;gBAAE,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,iCAAiC,QAAQ,KAAK,WAAW,CAAC,GAAG,CAAC,sCAAsC,EACpG,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,GAAG,EACH,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,GAAG,EACH,eAAe,EACf,OAAO,EACP,OAAO,EACP,MAAM,EACN,GAAG,EACH,KAAK,GAaN;IACC,IAAI,SAAoB,CAAC;IACzB,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;QACpB,SAAS,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,UAAU,EAAE,4BAA4B,QAAQ,wBAAwB,CAAC,CAAC;IAChF,CAAC;SAAM,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QAC3B,SAAS,GAAG,MAAM,iBAAiB,CAAC;YAClC,QAAQ;YACR,MAAM;YACN,YAAY,EAAE,QAAQ;YACtB,GAAG;YACH,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;YAC5D,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CACxD,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,CACrB,YAAY,CACV,KAAK,CAAC,OAAO;YACb,4EAA4E;YAC5E,mEAAmE;YACnE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EACvE,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,KAAK,CAAC,OAAO,yBAAyB,GAAG,IAAI,SAAS,EAAE,CAAC,EAAE,CAC5G,CACF;SACJ,CAAC,CAAC;QACH,GAAG,CAAC,UAAU,EAAE,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,GAAG,CAAC,WAAW,EAAE,+CAA+C,QAAQ,gCAAgC,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,WAAW,EACX,KAAK,EACL,OAAO,GAMR;IACC,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,WAAW,EAAE,CAAC;IACjF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACvF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,CAAC,iBAAiB,EAAE,oBAAoB,QAAQ,kBAAkB,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,iBAAiB,EAAE,IAAI,QAAQ,6DAA6D,SAAS,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,uBAAuB,EAAE,sBAAsB,QAAQ,YAAY,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,IAAI,oBAAoB,CAAC,UAAU,QAAQ,oBAAoB,SAAS,EAAE,EAAE,WAAW,CAAC,CAAC;AACjG,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAAC,EAC5B,OAAO,EACP,IAAI,EACJ,GAAG,EACH,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,GAAG,GAUJ;IACC,MAAM,EAAE,aAAa,EAAE,yBAAyB,EAAE,GAAG,WAAW,EAAE,CAAC;IACnE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;QACtG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,qBAAqB,EAAE,GAAG,QAAQ,CAAC,MAAM,8DAA8D,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7D,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,gCAAgC,QAAQ,gCAAgC,CAAC,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,QAAQ,MAAM,eAAe,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,yBAAyB,CAAC,eAAe,IAAI,6BAA6B,EAAE;YACpF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAe,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,eAAe,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtH,MAAM,IAAI,aAAa,CACrB,OAAO,EACP,MAAM,EACN,OAAO,CAAC,KAAK,KAAK,QAAQ;QACxB,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;QACtF,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAqCD,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,YAAY,EACZ,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,UAAU,EACV,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,UAAU,EACV,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,GACW;IAChB,MAAM,EAAE,iBAAiB,EAAE,GAAG,WAAW,EAAE,CAAC;IAC5C,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,MAAM;QACZ,MAAM;QACN,QAAQ;QACR,IAAI;QACJ,UAAU,EAAE,GAAG,EAAE,UAAU;QAC3B,OAAO;QACP,SAAS,EAAE,YAAY;QACvB,IAAI;QACJ,OAAO,EAAE;YACP,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACtC,UAAU;YACV,WAAW,EAAE,mBAAmB;YAChC,eAAe,EAAE,IAAI,CAAC,OAAO,KAAK,KAAK;SACxC;QACD,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC;QAClC,0BAA0B,EAAE,4BAA4B,CAAC,aAAa,CAAC;QACvE,wBAAwB,EAAE,+BAA+B,CAAC,aAAa,CAAC;QACxE,gBAAgB,EAAE,mBAAmB,CAAC,aAAa,CAAC;QACpD,YAAY;QACZ,SAAS;QACT,YAAY,EAAE,gBAAgB,CAAC,OAAO;YACpC,CAAC,CAAC;gBACE,KAAK,EAAE,uBAAuB,CAAC,UAAU,CAAC;gBAC1C,SAAS,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC,YAAY;gBAC1D,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;aAC/C;YACH,CAAC,CAAC,SAAS;QACb,QAAQ;QACR,SAAS;QACT,aAAa,EAAE,QAAQ;QACvB,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;QAC5C,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC1F,aAAa,EAAE,mBAAmB;QAClC,mBAAmB;QACnB,cAAc,EAAE,UAAU,EAAE,KAAK;QACjC,GAAG,CAAC,GAAG,EAAE,UAAU;YACjB,CAAC,CAAC;gBACE,UAAU,EAAE;oBACV,KAAK,EAAE,OAAgB;oBACvB,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ;oBACjC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK;oBAC3B,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK;oBAC3B,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,YAAY;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,iBAAiB,EAAE,KAAK,CAAC,aAAa;QACtC,cAAc,EAAE,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;QACzD,eAAe,EAAE,KAAK,CAAC,WAAW;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAW9C;IACC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,WAAW,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QAC5F,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;QAC7B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAelD;IACC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,uBAAuB,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,QAAQ;YACpB,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACnC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YAC7B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,YAAY,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,wBAAwB,YAAY,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,oDAAoD;QACpD,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,wCAAwC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC"}

package/dist/cli/ship.d.ts

@@ -0,0 +1,41 @@
+import type { LocalOnlyPolicy, RunOutcome, WorkRequest, WorkRequestSourceKind } from '@on-par/factory-core';
+import { getFactoryPaths, type SizeGateMode } from '@on-par/factory-core';
+import type { CheckResumeRecord } from '@on-par/factory-core/internal';
+import type { CliDeps, ConfigLoaderKey, CoreOpKey, GitOpKey, ShellOpKey } from './index.js';
+export declare function shipIssue(issueNum: number, opts: {
+    product?: string;
+    autoRework?: boolean;
+    interactive?: boolean;
+    sandbox?: boolean;
+    approvePlan?: boolean;
+    branchPrefix?: string;
+    /** `run-issue --size-gate` (ADR-0147); undefined defers to sizeGate.mode in the config. */
+    sizeGate?: SizeGateMode;
+    /** run-issue --max-slices (ADR-0156); undefined defers to sizeGate.maxSlices. */
+    maxSlices?: number;
+    /** `--pr-classifier` / `--no-pr-classifier` (#1724); undefined defers to config/env. */
+    prClassifier?: boolean;
+}, ctx?: {
+    repoRoot: string;
+    ghRepo: string;
+    /** Resolved factory state paths, supplied by daemon lanes with an external state root. */
+    paths?: ReturnType<typeof getFactoryPaths>;
+    lane?: string;
+    workRequest?: WorkRequest;
+    /** Receives the core RunOutcome before shipIssue maps it to a return/throw — lets
+     *  `run-issue --run-children` read the PR number as data (#1747). */
+    onOutcome?: (outcome: RunOutcome) => void;
+    /** Input source for planPhase to resolve; defaults inside planPhase to this run's GitHub issue. */
+    workSource?: {
+        kind: WorkRequestSourceKind;
+        params: unknown;
+    };
+    /** Local-only policy (#508): run in this caller-provided workspace, skip
+     *  worktree creation, disable publishing, and skip the SHIP phase. */
+    localOnly?: LocalOnlyPolicy;
+    /** Benchmark artifact directory (#509) — only set for local-only runs. */
+    artifactsDir?: string;
+    /** Resume at CHECK on a kept worktree (#2564). */
+    resumeFrom?: CheckResumeRecord;
+}, deps?: Pick<CliDeps, 'octokit' | 'planPhase' | 'buildPhase' | 'checkPhase' | 'shipPhase' | 'checkBaseHealth' | ConfigLoaderKey | GitOpKey | ShellOpKey | CoreOpKey>): Promise<string>;
+//# sourceMappingURL=ship.d.ts.map

package/dist/cli/ship.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ship.d.ts","sourceRoot":"","sources":["../../src/cli/ship.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAOV,eAAe,EAEf,UAAU,EAIV,WAAW,EACX,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAML,eAAe,EAiBf,KAAK,YAAY,EAKlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAA2C,MAAM,+BAA+B,CAAC;AAkBhH,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAe5F,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,EACD,GAAG,CAAC,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;yEACqE;IACrE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IAC1C,mGAAmG;IACnG,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,qBAAqB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9D;0EACsE;IACtE,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC,EACD,IAAI,GAAE,IAAI,CACR,OAAO,EACL,SAAS,GACT,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,WAAW,GACX,iBAAiB,GACjB,eAAe,GACf,QAAQ,GACR,UAAU,GACV,SAAS,CACP,GACL,OAAO,CAAC,MAAM,CAAC,CA8VjB"}

package/dist/cli/ship.js

@@ -0,0 +1,293 @@
+// packages/cli/src/cli/ship.ts — issue-level ship flow: resolve config, build RunRequest/RunPorts, run runIssue, map the outcome (#2788)
+import { resolve } from 'node:path';
+import { styleText } from 'node:util';
+import { applyRepoConfig, closedWorkSkipReason, createDefaultWorkSourceRegistry, createFileApprovalGate, drainSteering, getFactoryPaths, GITHUB_ISSUE_SOURCE, LaneFileGuard, phaseSnapshotFile, ProviderBreaker, resolveAutoFailover, resolveCodexDisabled, resolveEfficiencyPolicy, resolveEnvironmentPorts, resolveEnvironmentProxy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSizeGateMaxSlices, resolveSizeGateMode, ReworkHistory, runIssue, summarizeEvent, touchLastEvent, touchRunActivity, writePhaseSnapshot, } from '@on-par/factory-core';
+import { branchFor, checkBaseHealth, createCheckResumeStore, createPlanReuseStore, egressHostMessage, egressSummaryMessage, logCost, logEvent, recordLocalAuthFailure, resolveEffectiveConfig, resolvePrClassifierPolicy, shouldProxyEgress, startEgressProxy, worktreeSandboxFor, } from '@on-par/factory-core/internal';
+import { formatDeprecation } from './octokit.js';
+import { shipRuntime } from './ship-runtime.js';
+import { buildRunRequest, decomposeQueue, findSliceIndex, finishOutcome, logSandboxPolicy, maybeWriteBenchmarkArtifacts, maybeWriteLocalRunReport, setupRunWorkspace, stubAwareShipPhase, TERMINAL_EVENT_KINDS, } from './ship-steps.js';
+export async function shipIssue(issueNum, opts, ctx, deps = {}) {
+    const { resolveConfigLoaders, resolveGitOps, resolveShellOps, resolveCoreOps, resolvePhaseOps, getRepoRoot, getGitHubRepo, getOctokit, worktreePathFor, isCommandAvailableViaShell, readActiveProduct, resolveEnvironmentAcquirer, resolveLaneBaseUrl, IssueSkippedError, } = shipRuntime();
+    const loaders = resolveConfigLoaders(deps);
+    const git = resolveGitOps(deps);
+    const shell = resolveShellOps(deps);
+    const core = resolveCoreOps(deps);
+    const phases = resolvePhaseOps(deps);
+    const shipPhaseForMode = stubAwareShipPhase(phases.shipPhase);
+    const repoRoot = ctx?.repoRoot ?? (await getRepoRoot(shell));
+    const ghRepo = ctx?.ghRepo ?? (await getGitHubRepo(shell));
+    const paths = ctx?.paths ?? getFactoryPaths(repoRoot);
+    // GitHub REST deprecations seen on this run's client become one warn event per route (#2218).
+    const octokit = (deps.octokit ??
+        (() => getOctokit(shell, {
+            log: (d) => logEvent(paths.events, 'github_api_deprecated', issueNum, formatDeprecation(d), { lane: ctx?.lane }),
+        })))();
+    const [ghOwner, ghName] = ghRepo.split('/');
+    const repoConfig = loaders.loadRepoConfig(repoRoot, paths.root);
+    const factoryConfig = loaders.loadFactoryConfigForRepo(paths.config);
+    const classifierPolicy = resolvePrClassifierPolicy(factoryConfig, process.env, { classifier: opts.prClassifier });
+    const timeouts = loaders.resolveTimeouts(factoryConfig);
+    const failoverSettings = resolveAutoFailover(factoryConfig);
+    const breaker = new ProviderBreaker(paths.breaker);
+    const reworkHistory = new ReworkHistory(paths.reworkHistory);
+    const laneFileGuard = new LaneFileGuard(paths.laneFiles);
+    const efficiency = resolveEfficiencyPolicy(repoConfig);
+    const policy = {
+        models: applyRepoConfig(loaders.loadModelsConfig(), repoConfig),
+        routes: loaders.loadRoutesConfig(),
+        sandbox: factoryConfig.sandbox,
+        budget: { perIssueCapUsd: efficiency.perIssueCapUsd },
+        effective: opts.branchPrefix === undefined
+            ? resolveEffectiveConfig(repoConfig)
+            : { ...resolveEffectiveConfig(repoConfig), branchPrefix: opts.branchPrefix },
+    };
+    const router = new core.ModelRouter(policy.models, policy.routes, false, undefined, policy.effective.allowExperimental, policy.effective.localOnly);
+    router.setLocalAuthSink?.(recordLocalAuthFailure);
+    router.skipMissingHarnessClis(core.isCommandAvailable);
+    let issueSpend = 0;
+    let laneSandboxRuntime = 'none';
+    const laneWorkspaceBackend = factoryConfig.workspace?.backend === 'disposable-docker' ? 'disposable-docker' : 'worktree';
+    router.setCostSink((entry) => {
+        issueSpend += entry.cost ?? 0;
+        logCost(paths.costs, {
+            ...entry,
+            issue: String(issueNum),
+            sandboxRuntime: laneSandboxRuntime,
+            reworkRoundCount: laneReworkRounds,
+            workspaceBackend: laneWorkspaceBackend,
+        });
+    });
+    const modelPins = loaders.resolveEffectiveModelPins(router.registryRef, repoConfig);
+    const codexOff = resolveCodexDisabled(repoConfig);
+    const constitutionLoader = new core.ConstitutionLoader();
+    const product = opts.product ?? readActiveProduct(paths.product);
+    const autoRework = opts.autoRework ?? true;
+    const work = ctx?.workRequest ??
+        (await createDefaultWorkSourceRegistry({ octokit }).resolve(GITHUB_ISSUE_SOURCE, {
+            repo: ghRepo,
+            issue: issueNum,
+        }));
+    const issueTitle = work.title;
+    const sizeGateMode = opts.sizeGate ?? resolveSizeGateMode(factoryConfig);
+    const maxSlices = opts.maxSlices ?? resolveSizeGateMaxSlices(factoryConfig);
+    const sliceIndex = await findSliceIndex({ sizeGateMode, ctx, work, octokit, ghRepo, issueNum });
+    const branch = ctx?.resumeFrom?.branch ?? branchFor(issueNum, issueTitle, policy.effective.branchPrefix, sliceIndex);
+    const worktree = ctx?.resumeFrom
+        ? ctx.resumeFrom.worktree
+        : ctx?.localOnly
+            ? ctx.localOnly.workspace
+            : worktreePathFor(repoRoot, ghRepo, issueNum, policy.effective.branchPrefix, loaders);
+    const specPath = resolve(paths.plans, `issue-${issueNum}.md`);
+    const runStartedAt = new Date().toISOString();
+    const lane = ctx?.lane;
+    let terminalMessage;
+    let laneReworkRounds = 0;
+    const mkLog = (phase) => (type, msg, extra) => {
+        if (TERMINAL_EVENT_KINDS.has(type))
+            terminalMessage = msg;
+        if (type === 'rework')
+            laneReworkRounds++;
+        // checkPhase logs each skipped checker as a 'check' event prefixed "SKIPPED: " —
+        // echo it to the terminal the way shipIssue used to print it directly.
+        if (type === 'check' && msg.startsWith('SKIPPED: ')) {
+            console.error(styleText('yellow', `  SKIP: ${msg.slice('SKIPPED: '.length)}`));
+        }
+        // Likewise for each failing checker, so a parked run still names which checker
+        // failed and why — the parked RunOutcome carries only an aggregate count (#675).
+        if (type === 'check' && msg.startsWith('FAILED: ')) {
+            console.error(styleText('red', `  FAIL: ${msg.slice('FAILED: '.length)}`));
+        }
+        logEvent(paths.events, type, issueNum, msg, { ...extra, lane, phase });
+        // Best-effort lastEvent summary (#1327) for factory.run.snapshot — an
+        // observability side channel, so a write failure is swallowed, not logged (that
+        // would re-enter this same function for every event this chokepoint fires on).
+        touchLastEvent(phaseSnapshotFile(paths.runs, issueNum), summarizeEvent(type, msg)).catch(() => { });
+    };
+    const log = mkLog();
+    log('issue-title', issueTitle);
+    if (modelPins.plan) {
+        const source = modelPins.sources.plan === 'repo' ? '.factory/config.json' : 'FACTORY_PLAN_MODEL';
+        log('model-override', `plan model pinned to ${modelPins.plan} (${source})`);
+    }
+    if (modelPins.build) {
+        const source = modelPins.sources.build === 'repo' ? '.factory/config.json' : 'FACTORY_BUILD_MODEL';
+        log('model-override', `build model pinned to ${modelPins.build} (${source})`);
+    }
+    const skipReason = closedWorkSkipReason(work);
+    if (skipReason) {
+        log('skipped-already-closed', skipReason);
+        console.log(styleText('yellow', `skipped: ${skipReason}`));
+        throw new IssueSkippedError(skipReason, 'already-closed');
+    }
+    const sandboxPolicy = resolveSandboxPolicy(policy.sandbox, {
+        worktree,
+        repoRoot,
+        cliDisabled: opts.sandbox === false,
+        laneId: lane,
+        isAvailable: (cmd) => isCommandAvailableViaShell(shell, cmd),
+    });
+    laneSandboxRuntime = sandboxPolicy?.runtime ?? 'none';
+    const worktreeSandbox = worktreeSandboxFor(sandboxPolicy?.runtime, {
+        allowHosts: sandboxPolicy?.allowHosts ?? [],
+    });
+    const activeSandboxPolicy = logSandboxPolicy(opts, sandboxPolicy, log);
+    // Setup worktree FIRST — PLAN needs cwd=worktree to run claude. Worktree cleanup
+    // stays a CLI concern (not called here, matching today — a worktree persists past
+    // a successful run for GC/sweep commands to reclaim later).
+    const workspace = await setupRunWorkspace({
+        ctx,
+        repoRoot,
+        branch,
+        worktree,
+        log,
+        worktreeSandbox,
+        octokit,
+        ghOwner,
+        ghName,
+        git,
+        paths,
+    });
+    const planApprovalEnabled = opts.approvePlan ?? resolvePlanApproval(factoryConfig);
+    const processGroupGraceMs = resolveProcessGroupGraceMs(factoryConfig);
+    const portsSettings = resolveEnvironmentPorts(factoryConfig);
+    if (!portsSettings.enabled) {
+        log('environment_lease', 'port leasing disabled (environment.ports.enabled=false or FACTORY_ENV_PORTS=0)');
+    }
+    // acquireEnvironment.recordPgid/release only persist/deallocate the lease — process-
+    // group tracking and killing is runIssue's own unconditional tracker (Invariant 3),
+    // so a lease-disabled/failed run still tears down every spawned agent process.
+    const acquireEnvironment = portsSettings.enabled
+        ? resolveEnvironmentAcquirer({
+            laneSandboxRuntime: sandboxPolicy?.runtime ?? 'none',
+            paths,
+            worktree,
+            branch,
+            range: portsSettings.range,
+            processGroupGraceMs,
+            log,
+            findPortListeners: core.defaultFindPortListeners,
+            reapOrphanProcesses: core.reapOrphanProcesses,
+        })
+        : undefined;
+    const proxySettings = resolveEnvironmentProxy(factoryConfig);
+    const resolveBaseUrl = (appPort) => resolveLaneBaseUrl(paths, proxySettings, worktree, appPort);
+    const request = buildRunRequest({
+        issueNum,
+        ghRepo,
+        repoRoot,
+        branch,
+        specPath,
+        work,
+        product,
+        runStartedAt,
+        lane,
+        opts,
+        ctx,
+        autoRework,
+        planApprovalEnabled,
+        factoryConfig,
+        repoConfig,
+        classifierPolicy,
+        loaders,
+        efficiency,
+        sizeGateMode,
+        maxSlices,
+        timeouts,
+        modelPins,
+        codexOff,
+        failoverSettings,
+        activeSandboxPolicy,
+        processGroupGraceMs,
+        paths,
+    });
+    const ports = {
+        router,
+        octokit,
+        workspace,
+        events: mkLog,
+        acquireEnvironment,
+        resolveBaseUrl,
+        getIssueSpend: () => issueSpend,
+        breaker,
+        planReuse: ctx?.localOnly ? undefined : createPlanReuseStore(specPath),
+        checkResume: ctx?.localOnly ? undefined : createCheckResumeStore(specPath),
+        planPhase: phases.planPhase,
+        buildPhase: phases.buildPhase,
+        checkPhase: phases.checkPhase,
+        shipPhase: shipPhaseForMode,
+        checkBaseHealth: deps.checkBaseHealth ?? checkBaseHealth,
+        resolveConstitution: () => 
+        // Resolved once here — runIssue calls this exactly once and reuses the value for
+        // every phase, so the build worker can never author the standards it is graded by.
+        // A local-only workspace is caller-provided, not a checkout of repoRoot, so it keeps its own constitution.
+        constitutionLoader.resolve(worktree, product, factoryConfig.paths?.constitution, ctx?.localOnly ? undefined : repoRoot),
+        createApprovalGate: () => createFileApprovalGate({ dir: paths.approvals, timeoutMs: timeouts.approval * 1000 }),
+        drainSteering: () => drainSteering(paths.steering, issueNum, worktree),
+        reworkHistory,
+        laneFileGuard,
+        recordPhase: (phase) => {
+            const now = new Date().toISOString();
+            return writePhaseSnapshot(phaseSnapshotFile(paths.runs, issueNum), {
+                issue: issueNum,
+                phase,
+                updatedAt: now,
+                lastActivityAt: now,
+            });
+        },
+        onActivity: () => touchRunActivity(phaseSnapshotFile(paths.runs, issueNum), new Date().toISOString()),
+        onDecomposed: (childIssues) => {
+            decomposeQueue({ issueNum, childIssues, paths, planLog: mkLog('plan') });
+        },
+        writeLocalRunReport: (info) => maybeWriteLocalRunReport({
+            issueNum,
+            paths,
+            startedAt: runStartedAt,
+            outcome: info.outcome,
+            branch: info.branch,
+            worktree,
+            specPath,
+            route: info.route,
+            reason: info.reason,
+            writeLocalRunReport: core.writeLocalRunReport,
+        }),
+        writeBenchmarkArtifacts: (info) => maybeWriteBenchmarkArtifacts({
+            issueNum,
+            paths,
+            ctx,
+            startedAt: runStartedAt,
+            outcome: info.outcome === 'parked' ? 'failed' : info.outcome,
+            branch: info.branch,
+            specPath,
+            route: info.route,
+            checkSummary: info.checkSummary,
+            reworkRounds: info.reworkRounds,
+            failure: info.failure,
+            reportPath: info.reportPath,
+            diffBase: info.diffBase,
+            log,
+        }),
+    };
+    // #2214: report-only per-lane egress proxy for sandbox-exec. Started here, after worktree setup,
+    // so the finally below is the single place that stops it on every exit path.
+    const proxied = shouldProxyEgress(request.sandboxPolicy) ? request.sandboxPolicy : undefined;
+    const egressProxy = proxied
+        ? await startEgressProxy({
+            allowHosts: proxied.allowHosts,
+            blockTelemetry: proxied.blockTelemetry,
+            onHost: (host, allowed) => log('egress_host', egressHostMessage(host, allowed)),
+        })
+        : undefined;
+    let outcome;
+    try {
+        outcome = await runIssue(proxied && egressProxy ? { ...request, sandboxPolicy: { ...proxied, proxyUrl: egressProxy.url } } : request, policy, ports);
+    }
+    finally {
+        if (proxied && egressProxy) {
+            log('egress_summary', egressSummaryMessage(egressProxy.hosts(), proxied.allowHosts));
+            await egressProxy.close();
+        }
+    }
+    ctx?.onOutcome?.(outcome);
+    return finishOutcome({ outcome, opts, ctx, paths, issueNum, worktree, terminalMessage, log });
+}
+//# sourceMappingURL=ship.js.map