@ryanfw/prompt-orchestration-pipeline 1.3.2 → 1.3.4

package/src/ui/server/endpoints/__tests__/schema-file-endpoint.test.ts

@@ -0,0 +1,104 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+
+import { handleSchemaFile } from "../schema-file-endpoint";
+
+const SLUG = "demo";
+
+async function ensureDir(dir: string): Promise<void> {
+  await mkdir(dir, { recursive: true });
+}
+
+describe("handleSchemaFile", () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkdtemp(path.join(tmpdir(), "schema-file-endpoint-"));
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("rejects a plain `..` slug with 400 and does not serve a file outside pipeline-config", async () => {
+    await ensureDir(path.join(root, "schemas"));
+    await writeFile(path.join(root, "schemas", "schema.json"), "LEAKED");
+
+    const res = await handleSchemaFile(new Request("http://x"), "..", "schema.json", root);
+    const text = await res.text();
+
+    expect(res.status).toBe(400);
+    expect(text).not.toContain("LEAKED");
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+  });
+
+  it("rejects an encoded traversal slug with 400", async () => {
+    const res = await handleSchemaFile(new Request("http://x"), "..%2f..", "schema.json", root);
+
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+  });
+
+  it("rejects a traversal filename with 400 and does not read outside pipeline-config", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+    await writeFile(path.join(root, "secret.json"), "LEAKED");
+
+    const res = await handleSchemaFile(
+      new Request("http://x"),
+      SLUG,
+      "..%2f..%2f..%2fsecret.json",
+      root,
+    );
+    const text = await res.text();
+
+    expect(res.status).toBe(400);
+    expect(text).not.toContain("LEAKED");
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+  });
+
+  it("returns 200 with file contents for a valid request", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+    await writeFile(
+      path.join(root, "pipeline-config", SLUG, "schemas", "schema.json"),
+      '{"type":"object"}',
+    );
+
+    const res = await handleSchemaFile(new Request("http://x"), SLUG, "schema.json", root);
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; data: string };
+    expect(body.ok).toBe(true);
+    expect(body.data).toBe('{"type":"object"}');
+  });
+
+  it("returns 404 for a contained-but-missing schema file", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+
+    const res = await handleSchemaFile(new Request("http://x"), SLUG, "missing.json", root);
+
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("NOT_FOUND");
+  });
+
+  it("serves a legitimately percent-encoded filename (decode-once correctness)", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+    await writeFile(path.join(root, "pipeline-config", SLUG, "schemas", "my file.json"), "ok");
+
+    const res = await handleSchemaFile(new Request("http://x"), SLUG, "my%20file.json", root);
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; data: string };
+    expect(body.data).toBe("ok");
+  });
+});

package/src/ui/server/endpoints/__tests__/task-analysis-endpoint.test.ts

@@ -0,0 +1,103 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+
+import { handleTaskAnalysis } from "../task-analysis-endpoint";
+import { TaskAnalysisRepository } from "../../../../task-analysis/repository";
+import type { PersistedTaskAnalysis } from "../../../../task-analysis/types";
+
+const SLUG = "demo-pipeline";
+const TASK = "extract";
+
+function makeAnalysis(): PersistedTaskAnalysis {
+  return {
+    summary: "Extracts structured fields from raw input.",
+    stages: [{ name: "extract", purpose: "Pull fields out." }],
+    artifacts: {
+      reads: [{ fileName: "input.json", role: "source" }],
+      writes: [{ fileName: "output.json", role: "result" }],
+    },
+    models: [{ provider: "deepseek", method: "chat", stage: "extract" }],
+    analyzedAt: "2026-06-22T00:00:00.000Z",
+    analysisStatus: "ok",
+  };
+}
+
+describe("handleTaskAnalysis", () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkdtemp(path.join(tmpdir(), "task-analysis-endpoint-"));
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("returns a generated analysis written through the repository", async () => {
+    const analysis = makeAnalysis();
+    await TaskAnalysisRepository.write(root, SLUG, TASK, analysis);
+
+    const res = await handleTaskAnalysis(new Request("http://x"), SLUG, TASK, root);
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; data: PersistedTaskAnalysis };
+    expect(body.ok).toBe(true);
+    expect(body.data).toEqual(analysis);
+  });
+
+  it("returns 404 only when the analysis is truly absent", async () => {
+    const res = await handleTaskAnalysis(new Request("http://x"), SLUG, "missing-task", root);
+
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("NOT_FOUND");
+  });
+
+  it("returns 400 and does not read outside pipeline-config for a traversal slug", async () => {
+    const sentinelDir = path.join(root, "tasks");
+    await mkdir(sentinelDir, { recursive: true });
+    const sentinelPayload = "SENTINEL_OUTSIDE_PIPELINE_CONFIG";
+    await writeFile(path.join(sentinelDir, `${TASK}.analysis.json`), sentinelPayload);
+
+    const res = await handleTaskAnalysis(new Request("http://x"), "..", TASK, root);
+
+    expect(res.status).toBe(400);
+    const text = await res.text();
+    expect(text).not.toContain(sentinelPayload);
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_PATH");
+  });
+
+  it("returns 400 and does not read outside pipeline-config for a traversal taskId", async () => {
+    const sentinelPayload = "SENTINEL_OUTSIDE_ROOT_VIA_TASKID";
+    await writeFile(path.join(root, "secret.analysis.json"), sentinelPayload);
+
+    const res = await handleTaskAnalysis(
+      new Request("http://x"),
+      SLUG,
+      "..%2f..%2f..%2fsecret",
+      root,
+    );
+
+    expect(res.status).toBe(400);
+    const text = await res.text();
+    expect(text).not.toContain(sentinelPayload);
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_PATH");
+  });
+
+  it("returns 400 for a malformed percent-encoded slug", async () => {
+    const res = await handleTaskAnalysis(new Request("http://x"), "%zz", TASK, root);
+
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_PATH");
+  });
+});

package/src/ui/server/endpoints/__tests__/upload-endpoints.test.ts

@@ -1,12 +1,14 @@
-import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { mkdtemp, mkdir, readFile, rm, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { zipSync } from "fflate";
-import { describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { handleSeedUploadDirect, normalizeSeedUpload } from "../upload-endpoints";
 
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 async function pathExists(target: string): Promise<boolean> {
   try {
     await stat(target);
@@ -27,6 +29,32 @@ function concatBytes(parts: Uint8Array[]): Uint8Array<ArrayBuffer> {
   return out;
 }
 
+async function scaffoldWorkspace(tmpDir: string): Promise<void> {
+  const pipelineConfigDir = path.join(tmpDir, "pipeline-config", "test-pipeline");
+  await mkdir(pipelineConfigDir, { recursive: true });
+  await mkdir(path.join(pipelineConfigDir, "tasks"), { recursive: true });
+
+  await Bun.write(
+    path.join(tmpDir, "pipeline-config", "registry.json"),
+    JSON.stringify({
+      version: 1,
+      pipelines: {
+        "test-pipeline": {
+          name: "Test Pipeline",
+          description: "test pipeline",
+          configDir: pipelineConfigDir,
+          tasksDir: path.join(pipelineConfigDir, "tasks"),
+        },
+      },
+    }),
+  );
+
+  await Bun.write(
+    path.join(pipelineConfigDir, "pipeline.json"),
+    JSON.stringify({ name: "test-pipeline", tasks: [] }),
+  );
+}
+
 describe("normalizeSeedUpload", () => {
   it("extracts seed and binary artifact from a multipart zip upload", async () => {
     const seed = { name: "demo", pipeline: "x" };
@@ -57,10 +85,8 @@ describe("normalizeSeedUpload", () => {
 
     const result = await normalizeSeedUpload(request);
 
-    // AC3: seedObject deep-equals the original seed.
     expect(result.seedObject).toEqual(seed);
 
-    // AC3: exactly one artifact, byte-identical to the source blob.
     expect(result.artifacts).toHaveLength(1);
     const blob = result.artifacts![0]!;
     expect(blob.filename).toBe("artifacts/blob.bin");
@@ -70,110 +96,150 @@ describe("normalizeSeedUpload", () => {
 });
 
 describe("handleSeedUploadDirect", () => {
+  let dataDir: string;
+
+  beforeEach(async () => {
+    dataDir = await mkdtemp(path.join(tmpdir(), "upload-endpoint-"));
+    await scaffoldWorkspace(dataDir);
+  });
+
+  afterEach(async () => {
+    await rm(dataDir, { recursive: true, force: true });
+  });
+
   it("stages artifacts under staging/{jobId}/ without creating current/{jobId}/", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-direct-"));
-    try {
-      const content = new TextEncoder().encode("# notes\nhello\n");
-      const seedObject = { name: "demo", pipeline: "x" };
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, [
-        { filename: "notes.md", content },
-      ]);
-      expect(response.status).toBe(201);
-      const body = (await response.json()) as { data: { jobId: string } };
-      const jobId = body.data.jobId;
-
-      const pipelineData = path.join(dataDir, "pipeline-data");
-
-      // Artifact staged byte-identical under staging/{jobId}/.
-      const staged = path.join(pipelineData, "staging", jobId, "notes.md");
-      const stagedBytes = await readFile(staged);
-      expect(Array.from(stagedBytes)).toEqual(Array.from(content));
-
-      // Pending seed trigger written.
-      expect(await pathExists(path.join(pipelineData, "pending", `${jobId}-seed.json`))).toBe(true);
-
-      // The endpoint must not create current/{jobId}/.
-      expect(await pathExists(path.join(pipelineData, "current", jobId))).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const content = new TextEncoder().encode("# notes\nhello\n");
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, [
+      { filename: "notes.md", content },
+    ]);
+    expect(response.status).toBe(201);
+    const body = (await response.json()) as { data: { jobId: string } };
+    const jobId = body.data.jobId;
+    expect(jobId).toMatch(UUID_PATTERN);
+
+    const pipelineData = path.join(dataDir, "pipeline-data");
+
+    const staged = path.join(pipelineData, "staging", jobId, "notes.md");
+    const stagedBytes = await readFile(staged);
+    expect(Array.from(stagedBytes)).toEqual(Array.from(content));
+
+    expect(await pathExists(path.join(pipelineData, "pending", `${jobId}-seed.json`))).toBe(true);
+
+    expect(await pathExists(path.join(pipelineData, "current", jobId))).toBe(false);
+  });
+
+  it("rejects seed with unknown pipeline as 400 with error envelope and writes no files", async () => {
+    const response = await handleSeedUploadDirect(
+      { name: "demo", pipeline: "missing-pipeline" },
+      dataDir,
+      [{ filename: "notes.md", content: new TextEncoder().encode("hi") }],
+    );
+
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message).toContain("not found");
+
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "staging"))).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("AC-12: unsafe artifact path returns 400 and does not create the escape target", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-unsafe-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const response = await handleSeedUploadDirect(seedObject, dataDir, [
-        { filename: "../../../../tmp/PWNED.txt", content: new TextEncoder().encode("pwned") },
-      ]);
-      expect(response.status).toBe(400);
-
-      const escapeTarget = "/tmp/PWNED.txt";
-      expect(await pathExists(escapeTarget)).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const filename = "../../../../tmp/PWNED.txt";
+    const response = await handleSeedUploadDirect(seedObject, dataDir, [
+      { filename, content: new TextEncoder().encode("pwned") },
+    ]);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(filename);
+
+    const escapeTarget = "/tmp/PWNED.txt";
+    expect(await pathExists(escapeTarget)).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "staging"))).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("AC-13: mixed safe and unsafe paths return 400 with no partial writes", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-mixed-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const artifacts = [
-        { filename: "safe.md", content: new TextEncoder().encode("safe") },
-        { filename: "../../tmp/escape.txt", content: new TextEncoder().encode("escape") },
-      ];
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
-      expect(response.status).toBe(400);
-
-      const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
-      expect(await pathExists(stagingRoot)).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const unsafeFilename = "../../tmp/escape.txt";
+    const artifacts = [
+      { filename: "safe.md", content: new TextEncoder().encode("safe") },
+      { filename: unsafeFilename, content: new TextEncoder().encode("escape") },
+    ];
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(unsafeFilename);
+
+    const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
+    expect(await pathExists(stagingRoot)).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("rejects root-normalizing artifact paths without partial writes", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-root-target-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const artifacts = [
-        { filename: "safe.md", content: new TextEncoder().encode("safe") },
-        { filename: "dir/..", content: new TextEncoder().encode("root") },
-      ];
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
-      expect(response.status).toBe(400);
-
-      const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
-      expect(await pathExists(stagingRoot)).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const unsafeFilename = "dir/..";
+    const artifacts = [
+      { filename: "safe.md", content: new TextEncoder().encode("safe") },
+      { filename: unsafeFilename, content: new TextEncoder().encode("root") },
+    ];
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(unsafeFilename);
+
+    const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
+    expect(await pathExists(stagingRoot)).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
+  });
+
+  it("rejects absolute artifact paths without partial writes", async () => {
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const filename = "/etc/passwd";
+    const response = await handleSeedUploadDirect(seedObject, dataDir, [
+      { filename, content: new TextEncoder().encode("data") },
+    ]);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(filename);
+
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "staging"))).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("AC-14: all-safe artifact paths with nesting return 201 and files present", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-safe-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const artifacts = [
-        { filename: "out.json", content: new TextEncoder().encode("{}") },
-        { filename: "data/foo.json", content: new TextEncoder().encode('{"a":1}') },
-      ];
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
-      expect(response.status).toBe(201);
-
-      const body = (await response.json()) as { data: { jobId: string } };
-      const jobId = body.data.jobId;
-      const stagingJobDir = path.join(dataDir, "pipeline-data", "staging", jobId);
-
-      expect(await pathExists(path.join(stagingJobDir, "out.json"))).toBe(true);
-      expect(await pathExists(path.join(stagingJobDir, "data/foo.json"))).toBe(true);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const artifacts = [
+      { filename: "out.json", content: new TextEncoder().encode("{}") },
+      { filename: "data/foo.json", content: new TextEncoder().encode('{"a":1}') },
+    ];
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
+    expect(response.status).toBe(201);
+
+    const body = (await response.json()) as { data: { jobId: string } };
+    const jobId = body.data.jobId;
+    const stagingJobDir = path.join(dataDir, "pipeline-data", "staging", jobId);
+
+    expect(await pathExists(path.join(stagingJobDir, "out.json"))).toBe(true);
+    expect(await pathExists(path.join(stagingJobDir, "data/foo.json"))).toBe(true);
   });
 });

package/src/ui/server/endpoints/concurrency-endpoint.ts

@@ -26,7 +26,7 @@ interface PublicConcurrencyStatus {
   }>;
   staleSlots: Array<{
     jobId: string;
-    reason: "missing_current_job" | "missing_pid" | "dead_pid" | "invalid_json";
+    reason: "missing_current_job" | "missing_pid" | "dead_pid" | "invalid_json" | "stale_runner";
   }>;
 }
 
@@ -62,6 +62,7 @@ export async function handleConcurrencyStatus(dataDir: string): Promise<Response
       getPipelineDataDir(dataDir),
       orchestrator.maxConcurrentJobs,
       orchestrator.lockFileTimeout,
+      orchestrator.staleLeaseTimeoutMs,
     );
     const response = sendJson(200, { ok: true, data: toPublicStatus(status) });
     response.headers.set("Cache-Control", "no-store");

package/src/ui/server/endpoints/create-pipeline-endpoint.ts

@@ -1,18 +1,16 @@
-import { mkdir, rename } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import path from "node:path";
 
-import { getConfig, resetConfig } from "../../../core/config";
+import { resetConfig } from "../../../core/config";
+import {
+  readRegistrySync,
+  registerPipeline,
+} from "../../../config/pipeline-registry";
 import { createErrorResponse } from "../config-bridge";
 import { sendJson } from "../utils/http-utils";
 import { ensureUniqueSlug, generateSlug } from "../utils/slug";
 
-async function writeAtomicJson(filePath: string, value: unknown): Promise<void> {
-  const tmpPath = `${filePath}.${process.pid}.tmp`;
-  await Bun.write(tmpPath, JSON.stringify(value, null, 2));
-  await rename(tmpPath, filePath);
-}
-
-export async function handleCreatePipeline(req: Request): Promise<Response> {
+export async function handleCreatePipeline(req: Request, root: string): Promise<Response> {
   const body = (await req.json()) as Record<string, unknown>;
   const name = typeof body["name"] === "string" ? body["name"].trim() : "";
   const description = typeof body["description"] === "string" ? body["description"].trim() : "";
@@ -20,33 +18,20 @@ export async function handleCreatePipeline(req: Request): Promise<Response> {
     return sendJson(400, createErrorResponse("BAD_REQUEST", "pipeline name is required"));
   }
 
-  const root = process.env["PO_ROOT"] ?? process.cwd();
-  const registryPath = path.join(root, "pipeline-config", "registry.json");
-  const registry = (await Bun.file(registryPath).exists())
-    ? (JSON.parse(await Bun.file(registryPath).text()) as { pipelines: Record<string, { configDir: string; tasksDir: string }> })
-    : { pipelines: {} };
+  const registry = readRegistrySync(root);
   const slug = ensureUniqueSlug(generateSlug(name), new Set(Object.keys(registry.pipelines)));
 
   const configDir = path.join(root, "pipeline-config", slug);
   const tasksDir = path.join(configDir, "tasks");
   await mkdir(tasksDir, { recursive: true });
   await Bun.write(path.join(configDir, "pipeline.json"), JSON.stringify({ name, description, slug }, null, 2));
-  await registryFileUpdate(registryPath, registry, slug, configDir, tasksDir);
+  await registerPipeline(root, slug, {
+    name,
+    description,
+    configDir: path.relative(root, configDir),
+    tasksDir: path.relative(root, tasksDir),
+  });
   resetConfig();
 
   return sendJson(201, { ok: true, data: { slug, name, description } });
 }
-
-async function registryFileUpdate(
-  registryPath: string,
-  registry: { pipelines: Record<string, { configDir: string; tasksDir: string }> },
-  slug: string,
-  configDir: string,
-  tasksDir: string,
-): Promise<void> {
-  registry.pipelines[slug] = {
-    configDir: path.relative(process.env["PO_ROOT"] ?? process.cwd(), configDir),
-    tasksDir: path.relative(process.env["PO_ROOT"] ?? process.cwd(), tasksDir),
-  };
-  await writeAtomicJson(registryPath, registry);
-}