@rigkit/engine 0.2.2 → 0.2.4

package/src/engine.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { Database } from "bun:sqlite";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createDevMachineEngine, type InteractionPresentationRequest } from "./engine.ts";
@@ -9,10 +9,9 @@ import { createStateStore } from "./state.ts";
 import type {
   BaseProviderPlugin,
   ProviderRuntimeContext,
-  SshConnection,
   WorkflowProviderController,
 } from "./provider/types.ts";
-import type { DevMachineEvent, ExecResult, JsonValue, WorkspaceRecord } from "./types.ts";
+import type { DevMachineEvent, ExecResult, JsonValue } from "./types.ts";
 
 describe("DevMachineEngine workflow runtime", () => {
   test("plans, applies graph nodes, reuses graph cache, and forks workspaces", async () => {
@@ -28,68 +27,78 @@ describe("DevMachineEngine workflow runtime", () => {
           },
         });
 
-        const base = app.sequence("base").task("first", async ({ runtime, test }) => {
-          runtime.log("preparing base\\n", { label: "setup" });
+        const base = app.sequence("base").task("first", async ({ step, test }) => {
+          step.log("preparing base\\n", { label: "setup" });
           const vm = await test.createVm();
           await vm.exec("touch /tmp/first", { name: "touch first" });
           if (!(await vm.exists("/tmp/first"))) throw new Error("first was not created");
-          return { first: true, vm: await vm.snapshotRef() };
+          return { ctx: { first: true, vm: await vm.snapshotRef() } };
         });
 
-        const left = app.sequence("left").task("second", async ({ ctx, test }) => {
-          if (!ctx.first) throw new Error("missing first context");
-          const vm = await test.fromSnapshot(ctx.vm);
+        const left = app.sequence("left").task("second", async ({ step, test }) => {
+          if (!step.ctx.first) throw new Error("missing first context");
+          const vm = await test.fromSnapshot(step.ctx.vm);
           await vm.exec("touch /tmp/second", { name: "touch second" });
-          return { second: true, vm: await vm.snapshotRef() };
+          return { ctx: { second: true, vm: await vm.snapshotRef() } };
         });
 
-        const right = app.sequence("right").task("data", async ({ ctx }) => {
-          if (!ctx.first) throw new Error("missing first context");
-          return { data: "right-ready" };
+        const right = app.sequence("right").task("data", async ({ step }) => {
+          if (!step.ctx.first) throw new Error("missing first context");
+          return { ctx: { data: "right-ready" } };
         });
 
         export default app
           .sequence("root")
           .add(base)
           .parallel({ left, right })
-          .task("join", async ({ ctx }) => {
-            if (!ctx.left.second) throw new Error("missing left context");
-            if (ctx.right.data !== "right-ready") throw new Error("missing right context");
-            return { vm: ctx.left.vm, summary: ctx.right.data };
+          .task("join", async ({ step }) => {
+            if (!step.ctx.left.second) throw new Error("missing left context");
+            if (step.ctx.right.data !== "right-ready") throw new Error("missing right context");
+            return { ctx: { vm: step.ctx.left.vm, summary: step.ctx.right.data } };
           })
           .workspace({
-            source: (ctx) => ctx.vm,
-            cwd: "/workspace/repo",
-            onCreated: async ({ providers, workspace, ctx, local, providerContext }) => {
-              if (ctx.summary !== "right-ready") throw new Error("missing final context");
-              if (providerContext.authority !== "fake-authority") throw new Error("missing provider context");
-              const vm = providers.test.fromWorkspace(workspace);
+            create: async ({ providers, workflow, workspace, local }) => {
+              if (workflow.ctx.summary !== "right-ready") throw new Error("missing final context");
+              const vm = await providers.test.fromSnapshot(workflow.ctx.vm);
               await vm.exec("touch /tmp/workspace-" + workspace.name, { name: "mark workspace" });
-              await local.open("vscode://" + workspace.name);
+              await local.open("created://" + workspace.name);
+              return {
+                summary: workflow.ctx.summary,
+                repoPath: "/workspace/repo",
+                vmId: vm.vmId,
+              };
+            },
+            remove: async ({ providers, workspace, workflow }) => {
+              if (workflow.ctx.summary !== "right-ready") throw new Error("missing final context on remove");
+              const vm = providers.test.fromId(workspace.ctx.vmId);
+              await vm.exec("touch /tmp/remove-" + workspace.name, { name: "mark workspace remove" });
             },
-            onOpen: async ({ providers, workspace, ctx, providerContext }) => {
-              if (ctx.summary !== "right-ready") throw new Error("missing final context on open");
-              if (providerContext.authority !== "fake-authority") throw new Error("missing provider context on open");
-              const vm = providers.test.fromWorkspace(workspace);
+          })
+          .workspaceOperation("open", {
+            run: async ({ providers, workspace, workflow, local }) => {
+              if (workflow.ctx.summary !== "right-ready") throw new Error("missing final context on open");
+              if (workspace.ctx.summary !== "right-ready") throw new Error("missing workspace context");
+              const vm = providers.test.fromId(workspace.ctx.vmId);
               await vm.exec("touch /tmp/open-" + workspace.name, { name: "mark workspace open" });
+              await local.open("open://" + workspace.name);
             },
           })
           .operation("mark", {
-            requiredHostCapabilities: [{ id: "cmux.open", schemaHash: "sha256:cmux-open-schema" }],
             input: (workflow) =>
               workflow
                 .workspaceInput({ name: "workspace", position: 0 })
                 .extend({
                   label: workflow.string({ defaultValue: "marked" }),
-                }),
+            }),
             run: async ({ input, providers, local }) => {
-              const vm = providers.test.fromWorkspace(input.workspace);
+              const vm = providers.test.fromId(input.workspace.ctx.vmId);
               await vm.exec("touch /tmp/mark-" + input.workspace.name, { name: "mark via operation" });
               await local.open("mark://" + input.workspace.name);
               return {
                 workspace: input.workspace.name,
                 label: input.label,
-                cwd: input.workspace.cwd ?? null,
+                repoPath: input.workspace.ctx.repoPath,
+                summary: input.workspace.ctx.summary,
               };
             },
           });
@@ -124,7 +133,7 @@ describe("DevMachineEngine workflow runtime", () => {
     ]);
 
     const applied = await engine.apply();
-    expect(applied.snapshotId).toBe("snap-2");
+    expect(applied.context.vm).toEqual({ provider: "test", kind: "vmSnapshot", snapshotId: "snap-2" });
     expect(events).toContainEqual({
       type: "log.output",
       nodePath: "base.first",
@@ -140,37 +149,33 @@ describe("DevMachineEngine workflow runtime", () => {
     expect(cached.finalContext?.summary).toBe("right-ready");
 
     const workspace = await engine.fork({ name: "work" });
-    expect(workspace.snapshotId).toBe("snap-2");
     expect(workspace.name).toBe("work");
-    expect(workspace.resourceId).toBe("workspace-work");
+    expect(workspace.ctx).toMatchObject({
+      summary: "right-ready",
+      repoPath: "/workspace/repo",
+      vmId: "vm-3",
+    });
     expect(engine.listWorkspaces()).toHaveLength(1);
-    expect(opened).toEqual(["vscode://work"]);
-    expect(provider.workspaceContextResourceIds).toEqual(["workspace-work"]);
-    expect(provider.hasFile("workspace-work", "/tmp/workspace-work")).toBe(true);
+    expect(opened).toEqual(["created://work"]);
+    expect(provider.hasFile("vm-3", "/tmp/workspace-work")).toBe(true);
 
-    const markOperation = engine.listOperations().find((operation) => operation.id === "mark");
-    expect(markOperation?.requiredHostCapabilities).toEqual([
-      { id: "cmux.open", schemaHash: "sha256:cmux-open-schema" },
-    ]);
+    const openOperation = engine.listRuntimeWorkspaceOperations().find((operation) => operation.id === "open");
+    expect(openOperation?.id).toBe("open");
     const marked = await engine.runOperation({ operation: "mark", input: { workspace: "work" } });
-    expect(marked).toEqual({ workspace: "work", label: "marked", cwd: "/workspace/repo" });
-    expect(opened).toEqual(["vscode://work", "mark://work"]);
-    expect(provider.hasFile("workspace-work", "/tmp/mark-work")).toBe(true);
-
-    const terminal = await engine.attachTerminal({ workspaceOrVmId: "work", printOnly: true });
-    expect(terminal.command).toBe("ssh workspace-work");
-    expect(provider.workspaceContextResourceIds).toEqual(["workspace-work", "workspace-work"]);
-    expect(provider.hasFile("workspace-work", "/tmp/open-work")).toBe(true);
+    expect(marked).toEqual({ workspace: "work", label: "marked", repoPath: "/workspace/repo", summary: "right-ready" });
+    expect(opened).toEqual(["created://work", "mark://work"]);
+    expect(provider.hasFile("vm-3", "/tmp/mark-work")).toBe(true);
 
-    const workspaceSnapshot = await engine.snapshotWorkspace({ workspace: "work", label: "verified-work" });
-    expect(workspaceSnapshot.metadata.snapshotId).toBe("snap-3");
-    expect(workspaceSnapshot.nodeName).toBe("verified-work");
+    await engine.runRuntimeOperation({ operation: "work/open" });
+    expect(opened).toEqual(["created://work", "mark://work", "open://work"]);
+    expect(provider.hasFile("vm-3", "/tmp/open-work")).toBe(true);
 
-    await engine.deleteWorkspace({ workspace: "work" });
+    await engine.runRuntimeOperation({ operation: "work/remove" });
     expect(engine.listWorkspaces()).toHaveLength(0);
+    expect(provider.hasFile("vm-3", "/tmp/remove-work")).toBe(true);
   });
 
-  test("creates workspaces from config create callbacks and exposes persisted workspace data", async () => {
+  test("creates workspaces from workspace definitions and exposes persisted workspace context", async () => {
     const projectDir = mkdtempSync(join(tmpdir(), "rigkit-"));
     writeFileSync(
       join(projectDir, "rig.config.ts"),
@@ -184,31 +189,42 @@ describe("DevMachineEngine workflow runtime", () => {
             const vm = await providers.test.createVm();
             await vm.exec("touch /tmp/template", { name: "prepare template" });
             return {
-              vm: await vm.snapshotRef(),
-              repoPath: "/workspace/repo",
+              ctx: {
+                vm: await vm.snapshotRef(),
+                repoPath: "/workspace/repo",
+              },
             };
           })
-          .create(async ({ ctx, name, providers }) => {
-            const vm = await providers.test.fromSnapshot(ctx.vm);
-            await vm.exec("touch /tmp/create-" + name, { name: "create workspace" });
-            return {
-              name,
-              vmId: vm.vmId,
-              sourceSnapshot: ctx.vm,
-              repoPath: ctx.repoPath,
-              ready: true,
-            };
+          .workspace({
+            create: async ({ workflow, workspace, providers }) => {
+              const vm = await providers.test.fromSnapshot(workflow.ctx.vm);
+              await vm.exec("touch /tmp/create-" + workspace.name, { name: "create workspace" });
+              return {
+                name: workspace.name,
+                vmId: vm.vmId,
+                sourceSnapshot: workflow.ctx.vm,
+                repoPath: workflow.ctx.repoPath,
+                ready: true,
+              };
+            },
+            remove: async () => {},
           })
           .operation("inspect", {
             input: (workflow) => workflow.workspaceInput({ name: "workspace", position: 0 }),
             run: async ({ input, local }) => {
               await local.open("created://" + input.workspace.name);
               return {
-                vmId: input.workspace.data.vmId,
-                repoPath: input.workspace.data.repoPath,
-                ready: input.workspace.data.ready,
+                vmId: input.workspace.ctx.vmId,
+                repoPath: input.workspace.ctx.repoPath,
+                ready: input.workspace.ctx.ready,
               };
             },
+          })
+          .workspaceOperation("status", {
+            run: async ({ workspace }) => ({
+              workspace: workspace.name,
+              vmId: workspace.ctx.vmId,
+            }),
           });
 
         export default defineConfig({
@@ -238,9 +254,7 @@ describe("DevMachineEngine workflow runtime", () => {
 
     const workspace = await engine.fork({ name: "created" });
     expect(workspace.name).toBe("created");
-    expect(workspace.providerId).toBe("config");
-    expect(workspace.resourceId).toBe("vm-2");
-    expect(workspace.metadata).toMatchObject({
+    expect(workspace.ctx).toMatchObject({
       name: "created",
       vmId: "vm-2",
       repoPath: "/workspace/repo",
@@ -255,6 +269,9 @@ describe("DevMachineEngine workflow runtime", () => {
       ready: true,
     });
     expect(opened).toEqual(["created://created"]);
+
+    const status = await engine.runRuntimeOperation({ operation: "created/status" });
+    expect(status).toEqual({ workspace: "created", vmId: "vm-2" });
   });
 
   test("loads multiple workflows from defineConfig", async () => {
@@ -264,8 +281,8 @@ describe("DevMachineEngine workflow runtime", () => {
       `
         import { defineConfig, sequence } from "${import.meta.dir}/index.ts";
 
-        const api = sequence("api").step("ready", async () => ({ api: true }));
-        const web = sequence("web").step("ready", async () => ({ web: true }));
+        const api = sequence("api").step("ready", async () => ({ ctx: { api: true } }));
+        const web = sequence("web").step("ready", async () => ({ ctx: { web: true } }));
 
         export default defineConfig({
           providers: {},
@@ -295,7 +312,7 @@ describe("DevMachineEngine workflow runtime", () => {
       `
         import { defineConfig, sequence } from "${import.meta.dir}/index.ts";
 
-        const root = sequence("factory-test").step("ready", async () => ({ ready: true }));
+        const root = sequence("factory-test").step("ready", async () => ({ ctx: { ready: true } }));
 
         export default defineConfig({
           providers: {},
@@ -391,20 +408,16 @@ describe("DevMachineEngine workflow runtime", () => {
     state.saveWorkspace({
       id: "workspace-2",
       name: "demo",
-      providerId: "freestyle",
       workflow: "smoke",
-      resourceId: "resource-2",
-      snapshotId: "snap-2",
-      sourceRef: { snapshotId: "snap-2" },
-      context: { ready: true },
+      workflowCtx: { ready: true },
       createdAt: now,
       updatedAt: now,
-      metadata: { ready: true },
+      ctx: { ready: true },
     });
     expect(state.getWorkspace("demo")).toMatchObject({
       name: "demo",
       workflow: "smoke",
-      resourceId: "resource-2",
+      ctx: { ready: true },
     });
   });
 
@@ -421,7 +434,7 @@ describe("DevMachineEngine workflow runtime", () => {
           const app = workflow("handler-cache", { providers: {} });
 
           export default app.sequence("root").task("value", async () => {
-            return { value: "${value}" };
+            return { ctx: { value: "${value}" } };
           });
         `,
       );
@@ -479,7 +492,7 @@ describe("DevMachineEngine workflow runtime", () => {
           },
         });
 
-        export default app.sequence("root").task("ready", async () => ({ ready: true }));
+        export default app.sequence("root").task("ready", async () => ({ ctx: { ready: true } }));
       `,
     );
 
@@ -522,6 +535,73 @@ describe("DevMachineEngine workflow runtime", () => {
     expect(metadata["config.path"]).toBe(join(projectDir, "rig.config.ts"));
   });
 
+  test("stores provider host JSON state outside project state", async () => {
+    const projectDir = mkdtempSync(join(tmpdir(), "rigkit-"));
+    const hostStorageDir = join(projectDir, ".host-storage");
+    const opened: string[] = [];
+    const plugin: BaseProviderPlugin = {
+      providerId: "test",
+      async createProvider({ storage, hostStorage, local }) {
+        storage.set("project", { value: "state" });
+        hostStorage.set("token", { value: "secret" });
+        await local.open("rigkit://provider-auth");
+        return new FakeWorkflowProvider();
+      },
+    };
+
+    writeFileSync(
+      join(projectDir, "rig.config.ts"),
+      `
+        import { defineProvider, workflow } from "${import.meta.dir}/index.ts";
+
+        const app = workflow("provider-host-storage", {
+          providers: {
+            test: defineProvider("test", {}),
+          },
+        });
+
+        export default app.sequence("root").task("ready", async () => ({ ctx: { ready: true } }));
+      `,
+    );
+
+    const engine = await createDevMachineEngine({
+      projectDir,
+      hostStorageDir,
+      providers: [plugin],
+      local: {
+        open: async (target) => {
+          opened.push(target);
+        },
+      },
+    });
+
+    await engine.load();
+    await engine.plan();
+
+    expect(opened).toEqual(["rigkit://provider-auth"]);
+
+    const files = readdirSync(hostStorageDir);
+    expect(files).toHaveLength(1);
+    const hostState = JSON.parse(readFileSync(join(hostStorageDir, files[0]!), "utf8"));
+    expect(hostState.records.token.value.value).toBe("secret");
+
+    const main = new Database(engine.getProjectInfo().statePath);
+    const projectRow = main
+      .query<{ value_json: string }, []>(
+        "select value_json from provider_state where provider_id = 'test' and key = 'project'",
+      )
+      .get();
+    const leakedHostRow = main
+      .query<{ value_json: string }, []>(
+        "select value_json from provider_state where provider_id = 'test' and key = 'token'",
+      )
+      .get();
+    main.close();
+
+    expect(projectRow ? JSON.parse(projectRow.value_json).value : undefined).toBe("state");
+    expect(leakedHostRow).toBeNull();
+  });
+
   test("rejects task outputs that are not JSON serializable", async () => {
     const projectDir = mkdtempSync(join(tmpdir(), "rigkit-"));
     writeFileSync(
@@ -536,7 +616,7 @@ describe("DevMachineEngine workflow runtime", () => {
         });
 
         export default app.sequence("bad").task("returns-function", async () => {
-          return { fn: () => "nope" };
+          return { ctx: { fn: () => "nope" } };
         });
       `,
     );
@@ -565,7 +645,7 @@ describe("DevMachineEngine workflow runtime", () => {
 
         export default app.sequence("auth").task("login", async ({ test }) => {
           const result = await test.openTerminal("GitHub auth", "gh auth login");
-          return { finished: result.finished };
+          return { ctx: { finished: result.finished } };
         });
       `,
     );
@@ -611,7 +691,7 @@ describe("DevMachineEngine workflow runtime", () => {
 
         export default app.sequence("auth").task("login", async ({ test }) => {
           const result = await test.openTerminal("GitHub auth", "gh auth login");
-          return { finished: result.finished };
+          return { ctx: { finished: result.finished } };
         });
       `,
     );
@@ -665,7 +745,7 @@ describe("DevMachineEngine workflow runtime", () => {
         export default app.sequence("setup").task("touch", async ({ test }) => {
           const vm = await test.createVm();
           await vm.exec("touch /tmp/setup", { name: "touch setup" });
-          return { vm: await vm.snapshotRef() };
+          return { ctx: { vm: await vm.snapshotRef() } };
         });
       `,
     );
@@ -723,8 +803,8 @@ describe("DevMachineEngine workflow runtime", () => {
 
         export default app.sequence("schema").task("value", { output: schema }, async () => {
           return process.env.RIGKIT_SCHEMA_MODE === "next"
-            ? { value: "ok", next: true }
-            : { value: "ok" };
+            ? { ctx: { value: "ok", next: true } }
+            : { ctx: { value: "ok" } };
         });
       `,
     );
@@ -756,6 +836,94 @@ describe("DevMachineEngine workflow runtime", () => {
       }
     }
   });
+
+  test("expires task cache when cacheTTL has elapsed", async () => {
+    const projectDir = mkdtempSync(join(tmpdir(), "rigkit-cache-ttl-"));
+    writeFileSync(
+      join(projectDir, "rig.config.ts"),
+      `
+        import { sequence } from "${import.meta.dir}/index.ts";
+
+        export default sequence("ttl").task("daily-check", { cacheTTL: "1d" }, async () => {
+          return { ctx: { checked: true } };
+        });
+      `,
+    );
+
+    const engine = await createDevMachineEngine({ projectDir });
+    await engine.load();
+    await engine.apply();
+    expect((await engine.plan()).cachedNodeCount).toBe(1);
+
+    const db = new Database(engine.getProjectInfo().statePath);
+    db.run("update workflow_node_runs set created_at = ?", [
+      new Date(Date.now() - 2 * 24 * 60 * 60 * 1000).toISOString(),
+    ]);
+    db.close();
+
+    const expired = await engine.plan();
+    expect(expired.cachedNodeCount).toBe(0);
+    expect(expired.nodes[0]?.status).toBe("pending");
+  });
+
+  test("step.invalidate invalidates a previous task and replays from that point", async () => {
+    const projectDir = mkdtempSync(join(tmpdir(), "rigkit-invalidate-"));
+    const previous = {
+      authCount: process.env.RIGKIT_AUTH_COUNT,
+      checkCount: process.env.RIGKIT_CHECK_COUNT,
+      forceReauth: process.env.RIGKIT_FORCE_REAUTH,
+    };
+    process.env.RIGKIT_AUTH_COUNT = "0";
+    process.env.RIGKIT_CHECK_COUNT = "0";
+    process.env.RIGKIT_FORCE_REAUTH = "0";
+
+    writeFileSync(
+      join(projectDir, "rig.config.ts"),
+      `
+        import { sequence } from "${import.meta.dir}/index.ts";
+
+        export default sequence("reauth")
+          .task("prepare", async () => ({ ctx: { prepared: true } }))
+          .task("github-auth", async () => {
+            const count = Number(process.env.RIGKIT_AUTH_COUNT ?? "0") + 1;
+            process.env.RIGKIT_AUTH_COUNT = String(count);
+            return { ctx: { token: "token-" + count } };
+          })
+          .task("check-auth", { cacheTTL: 0 }, async ({ step }) => {
+            const count = Number(process.env.RIGKIT_CHECK_COUNT ?? "0") + 1;
+            process.env.RIGKIT_CHECK_COUNT = String(count);
+            if (process.env.RIGKIT_FORCE_REAUTH === "1") {
+              process.env.RIGKIT_FORCE_REAUTH = "0";
+              return step.invalidate("github-auth");
+            }
+            return { ctx: step.ctx };
+          });
+      `,
+    );
+
+    try {
+      const engine = await createDevMachineEngine({ projectDir });
+      await engine.load();
+
+      const first = await engine.apply();
+      expect(first.context.token).toBe("token-1");
+      expect(process.env.RIGKIT_AUTH_COUNT).toBe("1");
+      expect(process.env.RIGKIT_CHECK_COUNT).toBe("1");
+
+      process.env.RIGKIT_FORCE_REAUTH = "1";
+      const second = await engine.apply();
+      expect(second.context.token).toBe("token-2");
+      expect(process.env.RIGKIT_AUTH_COUNT).toBe("2");
+      expect(process.env.RIGKIT_CHECK_COUNT).toBe("3");
+
+      const validRuns = engine.listNodeRuns().filter((run) => !run.invalidated);
+      expect(validRuns.map((run) => run.nodePath).sort()).toEqual(["check-auth", "github-auth", "prepare"]);
+    } finally {
+      restoreEnv("RIGKIT_AUTH_COUNT", previous.authCount);
+      restoreEnv("RIGKIT_CHECK_COUNT", previous.checkCount);
+      restoreEnv("RIGKIT_FORCE_REAUTH", previous.forceReauth);
+    }
+  });
 });
 
 type FakeSnapshotRef = {
@@ -775,14 +943,13 @@ type FakeVm = {
 type FakeRuntime = {
   createVm(): Promise<FakeVm>;
   fromSnapshot(ref: FakeSnapshotRef): Promise<FakeVm>;
-  fromWorkspace(workspace: Pick<WorkspaceRecord, "resourceId">): FakeVm;
+  fromId(vmId: string): FakeVm;
   openTerminal(label: string, command: string): Promise<{ finished: true }>;
 };
 
-class FakeWorkflowProvider implements WorkflowProviderController<FakeRuntime, { authority: string }> {
+class FakeWorkflowProvider implements WorkflowProviderController<FakeRuntime> {
   readonly providerId = "test";
   snapshots: FakeSnapshotRef[] = [];
-  workspaceContextResourceIds: string[] = [];
   private nextVm = 1;
   private files = new Map<string, Set<string>>();
   terminalStopped = 0;
@@ -797,7 +964,7 @@ class FakeWorkflowProvider implements WorkflowProviderController<FakeRuntime, {
     return {
       createVm: async () => this.createVm(context),
       fromSnapshot: async () => this.createVm(context),
-      fromWorkspace: (workspace) => this.vmRuntime({ vmId: workspace.resourceId }, context),
+      fromId: (vmId) => this.vmRuntime({ vmId }, context),
       openTerminal: async (label, command) => {
         const completed = this.options.terminalCompleted ?? Promise.resolve({ finished: true as const });
         return await context.interaction.present({
@@ -817,42 +984,6 @@ class FakeWorkflowProvider implements WorkflowProviderController<FakeRuntime, {
     return isFakeSnapshotRef(ref);
   }
 
-  workspace = {
-    canUse: (ref: JsonValue) => isFakeSnapshotRef(ref),
-    createWorkspace: async (ref: JsonValue, input: { name: string }) => {
-      if (!isFakeSnapshotRef(ref)) throw new Error("bad ref");
-      const resourceId = `workspace-${input.name}`;
-      this.files.set(resourceId, new Set());
-      return {
-        providerId: "test",
-        resourceId,
-        snapshotId: ref.snapshotId,
-        sourceRef: ref,
-      };
-    },
-    deleteWorkspace: async () => {},
-    snapshotWorkspace: async (workspace: WorkspaceRecord) => {
-      const ref = this.createSnapshot({ vmId: workspace.resourceId });
-      return {
-        providerId: "test",
-        resourceId: workspace.resourceId,
-        snapshotId: ref.snapshotId,
-        sourceRef: ref,
-      };
-    },
-    ssh: async (workspaceOrResourceId: string): Promise<SshConnection> => ({
-      kind: "ssh",
-      host: "fake",
-      username: workspaceOrResourceId,
-      auth: { type: "token", token: "fake" },
-      command: `ssh ${workspaceOrResourceId}`,
-    }),
-    workspaceContext: (workspace: WorkspaceRecord) => {
-      this.workspaceContextResourceIds.push(workspace.resourceId);
-      return { authority: "fake-authority" };
-    },
-  };
-
   hasFile(vmId: string, path: string): boolean {
     return this.files.get(vmId)?.has(path) ?? false;
   }
@@ -905,6 +1036,14 @@ function result(ok: boolean): ExecResult {
   return { stdout: "", stderr: "", exitCode: ok ? 0 : 1, ok };
 }
 
+function restoreEnv(name: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[name];
+  } else {
+    process.env[name] = value;
+  }
+}
+
 function isFakeSnapshotRef(value: unknown): value is FakeSnapshotRef {
   return Boolean(
     value &&