@straiffi/archon 1.8.14 → 1.8.16

package/dist/server/index.js

@@ -10,10 +10,13 @@ import { adjectives, animals, uniqueNamesGenerator } from 'unique-names-generato
 import db from './db.js';
 import { pruneAllRepositoryGraphScans } from './lib/repositoryGraphRetention.js';
 import { registerRepositoryGraphRoutes } from './lib/repositoryGraphRoutes.js';
+import { registerExecutionEnvironmentRoutes } from './lib/executionEnvironmentRoutes.js';
+import { dockerSandboxAdapter, dockerSandboxRunner, dockerSandboxRuntimeController, } from './lib/dockerSandboxEnvironmentOperations.js';
 import { deleteChatSession, getChatSession, listChatSessions } from './lib/chats.js';
 import { deleteSpecSession, getCreatedTicketIdsForSnapshot, getSpecSession, getSpecSnapshot, listSpecSessions } from './lib/specs.js';
 import { getSpecSnapshotRepositoryEvidenceFreshness } from './lib/specSnapshotEvidence.js';
 import { projectSpecSnapshotForActionPrompt } from './lib/specRepositoryEvidenceFormatting.js';
+import { MULTI_BUNDLE_SPEC_CHAT_UNAVAILABLE_ERROR, hasMultipleSpecBundleGroups } from './lib/specBundleGroups.js';
 import { createChatAttachment, createSpecAttachment, getAttachmentById, deleteChatAttachment, deleteProjectAttachments, deleteSpecSessionAttachment, getChatAttachmentForSession, getChatAttachmentLinkedMessageId, getSpecAttachmentForSession, getSpecAttachmentLinkedMessageId, MAX_CHAT_ATTACHMENTS_PER_TURN, MAX_CHAT_ATTACHMENT_SIZE_BYTES, MAX_SPEC_ATTACHMENTS_PER_TURN, MAX_SPEC_ATTACHMENT_SIZE_BYTES, readChatAttachmentContent, readSpecAttachmentContent, validateImageAttachment, } from './lib/attachments.js';
 import { createProjectChatSession, resolveChatTool, resolveProjectChatPlanQuestionSet, stopProjectChatSessionResponse, submitProjectChatSessionMessage, updateProjectChatSessionMode, } from './lib/chatOperations.js';
 import { createProjectSpecSession, deleteProjectSpecSession, resolveProjectSpecPlanQuestionSet, stopProjectSpecSessionResponse, submitProjectSpecSessionMessage, updateProjectSpecSessionMode, } from './lib/specOperations.js';
@@ -81,6 +84,9 @@ import { buildImportedIssueSessionTitle, importProviderHostedIssueImages } from
 import { dispatchGitHubWorkflow, getGitHubWorkflowDispatchConfig, getGitHubWorkflowRun, getGitHubWorkflowRunJobs, listGitHubWorkflows, listGitHubWorkflowRuns, } from './lib/integrations/githubActions.js';
 import { clearAllGitHubActionsSessions, getActiveTrackedRunCount, getTrackedGitHubActionsRuns, startGitHubActionsPolling, trackGitHubActionsRun, } from './lib/integrations/githubActionsSessions.js';
 import { reconcileStartupExecutions } from './lib/executionReconciliation.js';
+import { cleanupProjectExecutionEnvironments, cleanupExecutionEnvironmentsForTarget, ExecutionEnvironmentCleanupError, reconcileOrphanedExecutionEnvironments, reconcileExecutionEnvironments, reconcileProductionExecutionEnvironmentBindings, } from './lib/executionEnvironmentReconciliation.js';
+import { createExecutionTargetKey } from './lib/executionTargets.js';
+import { getExecutionEnvironmentContextForRun } from './lib/executionEnvironmentContexts.js';
 import { PlanningReferenceError, resolveExternalPlanningDescription } from './lib/integrations/planning.js';
 import { refreshIfNeeded as refreshAssignedIssues, clearCachedAssignedIssues } from './lib/integrations/assignedIssuesCache.js';
 import { buildCommitMessagePrompt, normalizeGeneratedCommitMessage } from './lib/commitMessage.js';
@@ -116,7 +122,8 @@ import { parseIncomingExternalSource } from './lib/externalSource.js';
 import { resolveReviewerConfig } from './lib/reviewerConfig.js';
 import { materializeTicketsWithDependencies } from './lib/ticketBatch.js';
 import { IMPLEMENTATION_READY_DESCRIPTION_SECTION_HEADINGS } from './lib/ticketDescriptionContract.js';
-import { buildImplementationResourcesAppendix, buildSpecImplementationDraft, buildVisualizationAppendix } from './lib/specDraft.js';
+import { buildSpecImplementationDraft } from './lib/specDraft.js';
+import { materializeSpecSnapshotTickets } from './lib/specTicketMaterialization.js';
 import { exportSpecToDocs, checkSpecExportCollision, SpecExportCollisionError } from './lib/specExport.js';
 import { createTicketDependency, deleteTicketDependenciesForTicket, deleteTicketDependency, getTicketDependency, isTicketBuildComplete, isTicketRunSetupReady, listTicketDependencies, validateCreateTicketDependency, } from './lib/ticketDependencies.js';
 import { startBuild } from './workers/build.js';
@@ -451,6 +458,7 @@ const buildExecutionRunDetailResponse = async (project, run) => {
         details,
         agent_runs: listAgentRunsForExecutionRun(run.id),
         ...artifacts,
+        environment_context: getExecutionEnvironmentContextForRun(project.id, run.id),
     };
 };
 const formatWorktreeDeleteError = (target, branch, error) => {
@@ -504,6 +512,25 @@ const getBundlePlanBlockerError = () => {
 const hasActiveBundleCheckWork = (projectId, bundleId) => Boolean(getActiveBundleRepairBlocker(bundleId)
     || findActiveCheckBatchForTarget(projectId, 'bundle', bundleId)
     || findActiveCheckAutoFixForTarget(projectId, 'bundle', bundleId));
+const cleanupWorktreeExecutionTarget = async ({ project, targetKind, targetKey, targetLabel, worktreeTarget, branch, }) => {
+    try {
+        await cleanupExecutionEnvironmentsForTarget({
+            projectId: project.id,
+            targetKind,
+            targetKey,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Docker Sandbox cleanup could not be verified.';
+        throw new HttpError(409, `Cannot delete ${targetLabel} until its Docker Sandbox cleanup completes: ${message}`);
+    }
+    try {
+        deleteWorktree(branch, project);
+    }
+    catch (error) {
+        throw new HttpError(500, formatWorktreeDeleteError(worktreeTarget, branch, error));
+    }
+};
 const deleteTicketRecord = async (ticket) => {
     if (ticket.project_id
         && ticket.worktree_bundle_id
@@ -522,19 +549,54 @@ const deleteTicketRecord = async (ticket) => {
         const project = getEffectiveProject(ticket);
         if (project) {
             try {
-                deleteWorktree(branch, project);
+                await cleanupWorktreeExecutionTarget({
+                    project,
+                    targetKind: 'branch-worktree',
+                    targetKey: createExecutionTargetKey(project.id, { kind: 'branch-worktree', bundleId: null, branch }),
+                    targetLabel: 'ticket worktree',
+                    worktreeTarget: 'ticket',
+                    branch,
+                });
             }
             catch (error) {
                 return {
                     ok: false,
-                    status: 500,
-                    error: formatWorktreeDeleteError('ticket', branch, error),
+                    status: error instanceof HttpError ? error.status : 500,
+                    error: error instanceof Error ? error.message : 'Unable to delete the ticket worktree',
                 };
             }
         }
     }
     const bundledProject = isBundledTicket(ticket) ? getEffectiveProject(ticket) : null;
     const deletedBundleId = ticket.worktree_bundle_id;
+    const deletedBundle = bundledProject && deletedBundleId ? getBundle(deletedBundleId, bundledProject.id) : null;
+    const bundleResourcesWereCleaned = Boolean(bundledProject
+        && deletedBundle
+        && !isProjectRootBundle(deletedBundle)
+        && countBundleTickets(deletedBundle.id, bundledProject.id) === 1);
+    if (bundleResourcesWereCleaned && bundledProject && deletedBundle) {
+        try {
+            await cleanupWorktreeExecutionTarget({
+                project: bundledProject,
+                targetKind: 'bundle-worktree',
+                targetKey: createExecutionTargetKey(bundledProject.id, {
+                    kind: 'bundle-worktree',
+                    bundleId: deletedBundle.id,
+                    branch: deletedBundle.branch,
+                }),
+                targetLabel: 'bundle worktree',
+                worktreeTarget: 'bundle',
+                branch: deletedBundle.branch,
+            });
+        }
+        catch (error) {
+            return {
+                ok: false,
+                status: error instanceof HttpError ? error.status : 500,
+                error: error instanceof Error ? error.message : 'Unable to delete the bundle worktree',
+            };
+        }
+    }
     let nextBuildTicketId = null;
     let nextBuildSequenceId = null;
     let affectedTicketIds = [];
@@ -555,7 +617,7 @@ const deleteTicketRecord = async (ticket) => {
     }
     if (bundledProject && deletedBundleId) {
         try {
-            cleanupBundleIfEmpty(deletedBundleId, bundledProject);
+            await cleanupBundleIfEmpty(deletedBundleId, bundledProject, { resourcesAlreadyCleaned: bundleResourcesWereCleaned });
         }
         catch (error) {
             return {
@@ -868,7 +930,7 @@ const createAutoBundleForName = (name, projectId, baseBranch = null) => {
     }
     return bundle;
 };
-const cleanupBundleIfEmpty = (bundleId, project) => {
+const cleanupBundleIfEmpty = async (bundleId, project, options = {}) => {
     if (!bundleId) {
         return;
     }
@@ -882,11 +944,19 @@ const cleanupBundleIfEmpty = (bundleId, project) => {
     if (hasActiveBundleCheckWork(project.id, bundle.id)) {
         throw new HttpError(409, 'Cannot delete a bundle while check work is active');
     }
-    try {
-        deleteWorktree(bundle.branch, project);
-    }
-    catch (error) {
-        throw new HttpError(500, formatWorktreeDeleteError('bundle', bundle.branch, error));
+    if (!options.resourcesAlreadyCleaned) {
+        await cleanupWorktreeExecutionTarget({
+            project,
+            targetKind: 'bundle-worktree',
+            targetKey: createExecutionTargetKey(project.id, {
+                kind: 'bundle-worktree',
+                bundleId: bundle.id,
+                branch: bundle.branch,
+            }),
+            targetLabel: 'bundle worktree',
+            worktreeTarget: 'bundle',
+            branch: bundle.branch,
+        });
     }
     deleteBundle(bundle.id, project.id);
 };
@@ -1356,6 +1426,8 @@ const listDetailedBundleTickets = (projectId, bundleId) => {
     const representative = getBundleRepresentativeTicketContext(projectId, bundleId);
     return representative ? sortBundleTicketsByExecutionOrder(listTicketsInRunContext(representative)) : [];
 };
+const listBoardBundleTickets = (projectId, bundleId) => listTickets(projectId, { detail: 'board' })
+    .filter(ticket => ticket.worktree_bundle_id === bundleId);
 const listBundleConversationTickets = (projectId, bundleId) => {
     const representative = getBundleRepresentativeTicketContext(projectId, bundleId);
     return representative
@@ -2478,6 +2550,12 @@ const emitRunStateForContext = (ticket, isRunningValue) => {
 };
 app.use(express.json({ limit: '5mb' }));
 registerRepositoryGraphRoutes(app, { emitter: io });
+registerExecutionEnvironmentRoutes(app, {
+    emitter: io,
+    runner: dockerSandboxRunner,
+    adapter: dockerSandboxAdapter,
+    runtimeController: dockerSandboxRuntimeController,
+});
 const requireDesktopMobileAccessRequest = (req, res) => {
     const rejectionReason = validateDesktopMobileAccessRequest(req);
     if (!rejectionReason) {
@@ -2596,7 +2674,7 @@ app.post('/projects/:id/chat-sessions', (req, res) => {
     }
     return res.status(result.status).json(result.value);
 });
-app.get('/projects/:id/chat-sessions/:sessionId', (req, res) => {
+app.get('/projects/:id/chat-sessions/:sessionId', async (req, res) => {
     const project = getProjectById(req.params.id);
     if (!project) {
         return res.status(404).json({ error: 'Not found' });
@@ -2605,7 +2683,7 @@ app.get('/projects/:id/chat-sessions/:sessionId', (req, res) => {
     if (!chatSession) {
         return res.status(404).json({ error: 'Not found' });
     }
-    const refreshedChatSession = refreshChatSessionUsageSnapshot(chatSession.id, { includeMessages: true });
+    const refreshedChatSession = await refreshChatSessionUsageSnapshot(chatSession.id, { includeMessages: true });
     if (!refreshedChatSession || refreshedChatSession.project_id !== project.id) {
         return res.json(chatSession);
     }
@@ -2906,7 +2984,7 @@ app.post('/projects/:id/spec-sessions', (req, res) => {
     }
     return res.status(result.status).json(result.value);
 });
-app.get('/projects/:id/spec-sessions/:sessionId', (req, res) => {
+app.get('/projects/:id/spec-sessions/:sessionId', async (req, res) => {
     const project = getProjectById(req.params.id);
     if (!project) {
         return res.status(404).json({ error: 'Not found' });
@@ -2915,7 +2993,7 @@ app.get('/projects/:id/spec-sessions/:sessionId', (req, res) => {
     if (!specSession) {
         return res.status(404).json({ error: 'Not found' });
     }
-    const refreshedSpecSession = refreshSpecSessionUsageSnapshot(specSession.id, { includeMessages: true });
+    const refreshedSpecSession = await refreshSpecSessionUsageSnapshot(specSession.id, { includeMessages: true });
     if (!refreshedSpecSession || refreshedSpecSession.project_id !== project.id) {
         return res.json(specSession);
     }
@@ -3153,50 +3231,17 @@ app.post('/projects/:id/spec-sessions/:sessionId/snapshots/:snapshotId/create-ti
             error: `Spec tickets must include testing or verification guidance in their descriptions before they can be created on the board. Missing guidance in: ${ticketKeys}`,
         });
     }
-    let generatedBundleId = null;
     try {
         const targetResult = resolveSessionTargetForExecution(specSession, project, 'Spec session');
         if (!targetResult.ok) {
             throw new HttpError(409, targetResult.error);
         }
         const target = targetResult.target;
-        const bundleName = specSession.external_source?.external_key ?? '';
-        const bundle = target.target_kind === 'bundle'
-            ? target.target_bundle_id ? getBundle(target.target_bundle_id, project.id) : null
-            : bundleName
-                ? createAutoBundleForName(bundleName, project.id, target.branch)
-                : createAutoPlanningBundle(project.id, target.branch);
-        if (!bundle || isProjectRootBundle(bundle)) {
-            throw new HttpError(409, 'Unable to create a bundle for this Spec snapshot.');
-        }
-        if (target.target_kind === 'repo_root') {
-            generatedBundleId = bundle.id;
-        }
-        const ticketsForMaterialization = snapshot.tickets.map(ticket => {
-            const appendices = [
-                buildVisualizationAppendix(ticket.relevant_visualizations ?? [], snapshot),
-                buildImplementationResourcesAppendix(snapshot.resource_urls),
-            ].filter(Boolean);
-            return {
-                key: ticket.key,
-                title: ticket.title,
-                description: appendices.length > 0 ? `${ticket.description}\n\n${appendices.join('\n\n')}` : ticket.description,
-            };
-        });
-        const { createdTickets, createdDependencies } = materializeTicketsWithDependencies({
-            options: {
-                projectId: project.id,
-                model: specSession.model,
-                variant: specSession.variant,
-                skills: specSession.skills,
-                tool: null,
-                worktreeBundleId: bundle.id,
-                originSpecSessionId: specSession.id,
-                originSpecSnapshotId: snapshot.id,
-                externalSource: specSession.external_source ?? null,
-            },
-            tickets: ticketsForMaterialization,
-            dependencies: snapshot.dependencies,
+        const { createdTickets, createdDependencies } = materializeSpecSnapshotTickets({
+            project,
+            specSession,
+            snapshot,
+            target,
         });
         for (const createdTicket of createdTickets) {
             io.emit('ticket:created', createdTicket);
@@ -3210,9 +3255,6 @@ app.post('/projects/:id/spec-sessions/:sessionId/snapshots/:snapshotId/create-ti
         });
     }
     catch (error) {
-        if (generatedBundleId) {
-            cleanupBundleIfEmpty(generatedBundleId, project);
-        }
         if (error instanceof HttpError) {
             return res.status(error.status).json({ error: error.message });
         }
@@ -3236,6 +3278,9 @@ app.post('/projects/:id/spec-sessions/:sessionId/snapshots/:snapshotId/implement
     if (!targetResult.ok) {
         return res.status(409).json({ error: targetResult.error });
     }
+    if (hasMultipleSpecBundleGroups(snapshot.bundle_groups)) {
+        return res.status(409).json({ error: MULTI_BUNDLE_SPEC_CHAT_UNAVAILABLE_ERROR });
+    }
     const repositoryEvidenceFreshness = await getSpecSnapshotRepositoryEvidenceFreshness(project, snapshot.repository_evidence, { uncached: true });
     const promptSnapshot = projectSpecSnapshotForActionPrompt(snapshot, repositoryEvidenceFreshness);
     const draftText = buildSpecImplementationDraft({
@@ -3879,7 +3924,7 @@ app.post('/bundles', async (req, res) => {
     }
     res.status(201).json(serializeBundleRow(result.project.id, bundle, [], result.project));
 });
-app.delete('/bundles/:id', (req, res) => {
+app.delete('/bundles/:id', async (req, res) => {
     const result = getRequiredProject(req);
     if ('error' in result) {
         return res.status(400).json({ error: result.error });
@@ -3913,11 +3958,22 @@ app.delete('/bundles/:id', (req, res) => {
         .filter(specSession => specSession.target_bundle_id === bundle.id)
         .map(specSession => specSession.id);
     try {
-        deleteWorktree(bundle.branch, result.project);
+        await cleanupWorktreeExecutionTarget({
+            project: result.project,
+            targetKind: 'bundle-worktree',
+            targetKey: createExecutionTargetKey(result.project.id, {
+                kind: 'bundle-worktree',
+                bundleId: bundle.id,
+                branch: bundle.branch,
+            }),
+            targetLabel: 'bundle worktree',
+            worktreeTarget: 'bundle',
+            branch: bundle.branch,
+        });
     }
     catch (error) {
-        return res.status(500).json({
-            error: formatWorktreeDeleteError('bundle', bundle.branch, error),
+        return res.status(error instanceof HttpError ? error.status : 500).json({
+            error: error instanceof Error ? error.message : 'Unable to delete the bundle worktree',
         });
     }
     deleteBundle(bundle.id, result.project.id);
@@ -4202,12 +4258,16 @@ app.post('/bundles/:id/build-open-questions/resolve', async (req, res) => {
                 progressionRunId: accepted.progressionRunId,
                 broadcaster: io,
             });
-            for (const ticket of listDetailedBundleTickets(result.project.id, bundle.id)) {
+            for (const ticket of listBoardBundleTickets(result.project.id, bundle.id)) {
                 io.emit('ticket:updated', ticket);
             }
-            return res.json(serializeBundleDetails(result.project, bundle));
+            return res.json({
+                kind: accepted.kind,
+                batch_id: accepted.batchId,
+                target_ticket_id: null,
+            });
         }
-        const ticketsBeforeReview = listDetailedBundleTickets(result.project.id, bundle.id);
+        const ticketsBeforeReview = listBoardBundleTickets(result.project.id, bundle.id);
         if (!areBundleTicketsReadyForAutomaticReview(ticketsBeforeReview, bundle.id)) {
             completeAutomationProgression({
                 projectId: result.project.id,
@@ -4218,7 +4278,11 @@ app.post('/bundles/:id/build-open-questions/resolve', async (req, res) => {
             for (const ticket of ticketsBeforeReview) {
                 io.emit('ticket:updated', ticket);
             }
-            return res.json(serializeBundleDetails(result.project, bundle));
+            return res.json({
+                kind: accepted.kind,
+                batch_id: accepted.batchId,
+                target_ticket_id: null,
+            });
         }
         let reviewStartFailureStatus = null;
         let reviewStartFailureError = null;
@@ -4249,24 +4313,27 @@ app.post('/bundles/:id/build-open-questions/resolve', async (req, res) => {
             });
             return res.status(reviewStartFailureStatus).json({ error: reviewStartFailureError });
         }
-        const updatedTickets = listDetailedBundleTickets(result.project.id, bundle.id);
+        const updatedTickets = listBoardBundleTickets(result.project.id, bundle.id);
         for (const ticket of updatedTickets) {
             io.emit('ticket:updated', ticket);
         }
         const reviewOwner = reviewStarted
             ? updatedTickets.find(ticket => ticket.state === 'review' && ticket.parked_at === null)
             : null;
-        return res.json(serializeBundleDetails(result.project, bundle, {
-            review_owner_ticket_id: reviewOwner?.id,
-            target_ticket_id: reviewOwner?.id,
-        }));
+        return res.json({
+            kind: accepted.kind,
+            batch_id: accepted.batchId,
+            target_ticket_id: reviewOwner?.id ?? null,
+        });
     }
-    for (const ticket of listDetailedBundleTickets(result.project.id, bundle.id)) {
+    for (const ticket of listBoardBundleTickets(result.project.id, bundle.id)) {
         io.emit('ticket:updated', ticket);
     }
-    return res.status(accepted.status).json(serializeBundleDetails(result.project, bundle, {
+    return res.status(accepted.status).json({
+        kind: accepted.kind,
+        batch_id: accepted.batchId,
         target_ticket_id: accepted.targetTicket.id,
-    }));
+    });
 });
 app.post('/bundles/:id/undo-review', (req, res) => {
     const result = getRequiredProject(req);
@@ -6033,7 +6100,7 @@ app.post('/projects', (req, res) => {
         return res.status(400).json({ error: validation.error });
     }
     const projectCount = Number(db.prepare('SELECT COUNT(*) AS count FROM projects').get()?.count ?? 0);
-    const { name, repo_path, linked_project_ids, run_setup, run_services, check_definitions, required_check_definition_ids, pre_review_check_definition_ids, post_build_check_definition_ids, auto_fix_check_definition_ids, test_commands, run_ide, preview_service_name, preview_path, preview_capability_mode, helper_model, helper_variant, reviewer_model, reviewer_variant, commit_message_rules, commit_after_each_ticket, auto_park_stale_tickets, memory_enabled, scan_include_globs_json, scan_exclude_globs_json, worktree_sync, spec_aware_code_review_enabled, automation_depth, automation_review_fix_enabled, automation_pause_on_open_questions, automation_review_severity, automation_review_max_iterations, } = validation.values;
+    const { name, repo_path, build_execution_provider, linked_project_ids, run_setup, run_services, check_definitions, required_check_definition_ids, pre_review_check_definition_ids, post_build_check_definition_ids, auto_fix_check_definition_ids, test_commands, run_ide, preview_service_name, preview_path, preview_capability_mode, helper_model, helper_variant, reviewer_model, reviewer_variant, commit_message_rules, commit_after_each_ticket, auto_park_stale_tickets, memory_enabled, scan_include_globs_json, scan_exclude_globs_json, worktree_sync, spec_aware_code_review_enabled, automation_depth, automation_review_fix_enabled, automation_pause_on_open_questions, automation_review_severity, automation_review_max_iterations, } = validation.values;
     if (!repo_path) {
         return res.status(400).json({ error: 'repo_path must be a non-empty string' });
     }
@@ -6051,6 +6118,7 @@ app.post('/projects', (req, res) => {
       id,
       name,
       repo_path,
+      build_execution_provider,
       run_setup,
       run_services,
       check_definitions,
@@ -6081,8 +6149,8 @@ app.post('/projects', (req, res) => {
       automation_review_severity,
       automation_review_max_iterations
     )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(id, name, normalizedRepoPath, run_setup, run_services, check_definitions, required_check_definition_ids ?? '[]', pre_review_check_definition_ids ?? '[]', post_build_check_definition_ids ?? '[]', auto_fix_check_definition_ids ?? '[]', test_commands, run_ide ?? null, preview_service_name ?? null, preview_path ?? null, preview_capability_mode ?? null, helper_model ?? null, helper_variant ?? null, reviewer_model ?? null, reviewer_model ? reviewer_variant ?? null : null, commit_message_rules ?? null, commit_after_each_ticket ?? 0, auto_park_stale_tickets ?? 0, memory_enabled ?? 0, scan_include_globs_json ?? null, scan_exclude_globs_json ?? null, worktree_sync ?? null, spec_aware_code_review_enabled ?? 0, automation_depth ?? 'manual', automation_review_fix_enabled ?? 0, automation_pause_on_open_questions ?? 0, automation_review_severity ?? 'medium', automation_review_max_iterations ?? 3);
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(id, name, normalizedRepoPath, build_execution_provider ?? 'host', run_setup, run_services, check_definitions, required_check_definition_ids ?? '[]', pre_review_check_definition_ids ?? '[]', post_build_check_definition_ids ?? '[]', auto_fix_check_definition_ids ?? '[]', test_commands, run_ide ?? null, preview_service_name ?? null, preview_path ?? null, preview_capability_mode ?? null, helper_model ?? null, helper_variant ?? null, reviewer_model ?? null, reviewer_model ? reviewer_variant ?? null : null, commit_message_rules ?? null, commit_after_each_ticket ?? 0, auto_park_stale_tickets ?? 0, memory_enabled ?? 0, scan_include_globs_json ?? null, scan_exclude_globs_json ?? null, worktree_sync ?? null, spec_aware_code_review_enabled ?? 0, automation_depth ?? 'manual', automation_review_fix_enabled ?? 0, automation_pause_on_open_questions ?? 0, automation_review_severity ?? 'medium', automation_review_max_iterations ?? 3);
     replaceProjectLinks(id, linked_project_ids ?? []);
     ensureProjectRootBundle(id);
     if (projectCount === 0) {
@@ -7289,11 +7357,12 @@ app.patch('/projects/:id', (req, res) => {
             });
         }
     }
-    const { name, repo_path, linked_project_ids, run_setup, run_services, check_definitions, required_check_definition_ids, pre_review_check_definition_ids, post_build_check_definition_ids, auto_fix_check_definition_ids, test_commands, run_ide, preview_service_name, preview_path, preview_capability_mode, helper_model, helper_variant, reviewer_model, reviewer_variant, commit_message_rules, commit_after_each_ticket, auto_park_stale_tickets, memory_enabled, scan_include_globs_json, scan_exclude_globs_json, worktree_sync, spec_aware_code_review_enabled, automation_depth, automation_review_fix_enabled, automation_pause_on_open_questions, automation_review_severity, automation_review_max_iterations, } = validation.values;
+    const { name, repo_path, build_execution_provider, linked_project_ids, run_setup, run_services, check_definitions, required_check_definition_ids, pre_review_check_definition_ids, post_build_check_definition_ids, auto_fix_check_definition_ids, test_commands, run_ide, preview_service_name, preview_path, preview_capability_mode, helper_model, helper_variant, reviewer_model, reviewer_variant, commit_message_rules, commit_after_each_ticket, auto_park_stale_tickets, memory_enabled, scan_include_globs_json, scan_exclude_globs_json, worktree_sync, spec_aware_code_review_enabled, automation_depth, automation_review_fix_enabled, automation_pause_on_open_questions, automation_review_severity, automation_review_max_iterations, } = validation.values;
     const updateProject = db.prepare(`
     UPDATE projects SET
       name = ?,
       repo_path = ?,
+      build_execution_provider = ?,
       run_setup = ?,
       run_services = ?,
       check_definitions = ?,
@@ -7355,7 +7424,7 @@ app.patch('/projects/:id', (req, res) => {
         if ('error' in policyReferences) {
             return policyReferences;
         }
-        updateProject.run(name ?? project.name, repo_path ?? project.repo_path, hasOwn(validation.values, 'run_setup') ? run_setup : project.run_setup, hasOwn(validation.values, 'run_services') ? run_services : project.run_services, nextCheckDefinitions, nextRequiredCheckDefinitionIds, nextPreReviewCheckDefinitionIds, nextPostBuildCheckDefinitionIds, nextAutoFixCheckDefinitionIds, hasOwn(validation.values, 'test_commands') ? test_commands : project.test_commands, hasOwn(validation.values, 'run_ide') ? run_ide : project.run_ide, hasOwn(validation.values, 'preview_service_name') ? preview_service_name : project.preview_service_name, hasOwn(validation.values, 'preview_path') ? preview_path : project.preview_path, hasOwn(validation.values, 'preview_capability_mode') ? preview_capability_mode : project.preview_capability_mode, hasOwn(validation.values, 'helper_model') ? helper_model : project.helper_model, hasOwn(validation.values, 'helper_variant') ? helper_variant : project.helper_variant, nextReviewerModel, nextReviewerVariant, hasOwn(validation.values, 'commit_message_rules') ? commit_message_rules : project.commit_message_rules, hasOwn(validation.values, 'commit_after_each_ticket') ? commit_after_each_ticket : project.commit_after_each_ticket, hasOwn(validation.values, 'auto_park_stale_tickets') ? auto_park_stale_tickets : project.auto_park_stale_tickets, hasOwn(validation.values, 'memory_enabled') ? memory_enabled : project.memory_enabled, hasOwn(validation.values, 'scan_include_globs_json') ? scan_include_globs_json : project.scan_include_globs_json, hasOwn(validation.values, 'scan_exclude_globs_json') ? scan_exclude_globs_json : project.scan_exclude_globs_json, hasOwn(validation.values, 'worktree_sync') ? worktree_sync : project.worktree_sync, hasOwn(validation.values, 'spec_aware_code_review_enabled') ? spec_aware_code_review_enabled : project.spec_aware_code_review_enabled, hasOwn(validation.values, 'automation_depth') ? automation_depth : project.automation_depth, hasOwn(validation.values, 'automation_review_fix_enabled') ? automation_review_fix_enabled : project.automation_review_fix_enabled, hasOwn(validation.values, 'automation_pause_on_open_questions') ? automation_pause_on_open_questions : project.automation_pause_on_open_questions, hasOwn(validation.values, 'automation_review_severity') ? automation_review_severity : project.automation_review_severity, hasOwn(validation.values, 'automation_review_max_iterations') ? automation_review_max_iterations : project.automation_review_max_iterations, req.params.id);
+        updateProject.run(name ?? project.name, repo_path ?? project.repo_path, hasOwn(validation.values, 'build_execution_provider') ? build_execution_provider : project.build_execution_provider, hasOwn(validation.values, 'run_setup') ? run_setup : project.run_setup, hasOwn(validation.values, 'run_services') ? run_services : project.run_services, nextCheckDefinitions, nextRequiredCheckDefinitionIds, nextPreReviewCheckDefinitionIds, nextPostBuildCheckDefinitionIds, nextAutoFixCheckDefinitionIds, hasOwn(validation.values, 'test_commands') ? test_commands : project.test_commands, hasOwn(validation.values, 'run_ide') ? run_ide : project.run_ide, hasOwn(validation.values, 'preview_service_name') ? preview_service_name : project.preview_service_name, hasOwn(validation.values, 'preview_path') ? preview_path : project.preview_path, hasOwn(validation.values, 'preview_capability_mode') ? preview_capability_mode : project.preview_capability_mode, hasOwn(validation.values, 'helper_model') ? helper_model : project.helper_model, hasOwn(validation.values, 'helper_variant') ? helper_variant : project.helper_variant, nextReviewerModel, nextReviewerVariant, hasOwn(validation.values, 'commit_message_rules') ? commit_message_rules : project.commit_message_rules, hasOwn(validation.values, 'commit_after_each_ticket') ? commit_after_each_ticket : project.commit_after_each_ticket, hasOwn(validation.values, 'auto_park_stale_tickets') ? auto_park_stale_tickets : project.auto_park_stale_tickets, hasOwn(validation.values, 'memory_enabled') ? memory_enabled : project.memory_enabled, hasOwn(validation.values, 'scan_include_globs_json') ? scan_include_globs_json : project.scan_include_globs_json, hasOwn(validation.values, 'scan_exclude_globs_json') ? scan_exclude_globs_json : project.scan_exclude_globs_json, hasOwn(validation.values, 'worktree_sync') ? worktree_sync : project.worktree_sync, hasOwn(validation.values, 'spec_aware_code_review_enabled') ? spec_aware_code_review_enabled : project.spec_aware_code_review_enabled, hasOwn(validation.values, 'automation_depth') ? automation_depth : project.automation_depth, hasOwn(validation.values, 'automation_review_fix_enabled') ? automation_review_fix_enabled : project.automation_review_fix_enabled, hasOwn(validation.values, 'automation_pause_on_open_questions') ? automation_pause_on_open_questions : project.automation_pause_on_open_questions, hasOwn(validation.values, 'automation_review_severity') ? automation_review_severity : project.automation_review_severity, hasOwn(validation.values, 'automation_review_max_iterations') ? automation_review_max_iterations : project.automation_review_max_iterations, req.params.id);
         if (hasOwn(validation.values, 'linked_project_ids')) {
             replaceProjectLinks(project.id, linked_project_ids ?? []);
         }
@@ -7404,15 +7473,23 @@ const assertProjectDeletionEligible = (projectId, claimId) => {
     }
 };
 const completeClaimedProjectDeletion = async (projectId, claimId) => {
+    const marked = db.prepare(`
+    UPDATE projects
+    SET deletion_cleanup_started_at = COALESCE(deletion_cleanup_started_at, CURRENT_TIMESTAMP)
+    WHERE id = ? AND deletion_claim_id = ?
+  `).run(projectId, claimId);
+    if (marked.changes !== 1) {
+        throw new ProjectDeletionError(409, 'Project deletion ownership was lost');
+    }
+    await cleanupProjectExecutionEnvironments(projectId, claimId);
     await runExclusiveExecutionArtifactMaintenance(() => reconcileProjectExecutionArtifacts(projectId, {
         emitter: io,
         beginCleanup: () => {
-            const marked = db.prepare(`
-        UPDATE projects
-        SET deletion_cleanup_started_at = COALESCE(deletion_cleanup_started_at, CURRENT_TIMESTAMP)
-        WHERE id = ? AND deletion_claim_id = ?
-      `).run(projectId, claimId);
-            if (marked.changes !== 1) {
+            const owned = db.prepare(`
+        SELECT 1 FROM projects
+        WHERE id = ? AND deletion_claim_id = ? AND deletion_cleanup_started_at IS NOT NULL
+      `).get(projectId, claimId);
+            if (!owned) {
                 throw new ProjectDeletionError(409, 'Project deletion ownership was lost');
             }
         },
@@ -7457,6 +7534,7 @@ const completeClaimedProjectDeletion = async (projectId, claimId) => {
           SET parent_run_id = NULL, retry_of_run_id = NULL
           WHERE project_id = ?
         `).run(projectId);
+                db.prepare("DELETE FROM execution_environments WHERE project_id = ? AND lifecycle_state = 'retired'").run(projectId);
                 const deleted = db.prepare('DELETE FROM projects WHERE id = ? AND deletion_claim_id = ?').run(projectId, claimId);
                 if (deleted.changes !== 1) {
                     throw new ProjectDeletionError(409, 'Project deletion ownership was lost');
@@ -7508,6 +7586,9 @@ app.delete('/projects/:id', async (req, res) => {
         if (error instanceof ExecutionArtifactCleanupError) {
             return res.status(409).json({ error: error.message });
         }
+        if (error instanceof ExecutionEnvironmentCleanupError) {
+            return res.status(409).json({ error: error.message });
+        }
         if (error instanceof ProjectDeletionError) {
             return res.status(error.status).json({ error: error.message });
         }
@@ -7574,7 +7655,7 @@ app.post('/tickets', (req, res) => {
         return res.status(500).json({ error: getErrorMessage(error) || 'Unable to create ticket' });
     }
 });
-app.patch('/tickets/:id', (req, res) => {
+app.patch('/tickets/:id', async (req, res) => {
     const ticket = getTicket(req.params.id);
     if (!ticket) {
         return res.status(404).json({ error: 'Not found' });
@@ -7701,16 +7782,46 @@ app.patch('/tickets/:id', (req, res) => {
             return res.status(404).json({ error: 'Bundle not found' });
         }
     }
+    const bundleChanged = previousBundleId !== resolvedBundleId || ticket.project_id !== nextProjectId;
+    let previousBundleResourcesCleaned = false;
+    if (bundleChanged && previousBundleId && previousProject) {
+        const previousBundle = getBundle(previousBundleId, previousProject.id);
+        if (previousBundle
+            && !isProjectRootBundle(previousBundle)
+            && countBundleTickets(previousBundle.id, previousProject.id) === 1) {
+            try {
+                await cleanupWorktreeExecutionTarget({
+                    project: previousProject,
+                    targetKind: 'bundle-worktree',
+                    targetKey: createExecutionTargetKey(previousProject.id, {
+                        kind: 'bundle-worktree',
+                        bundleId: previousBundle.id,
+                        branch: previousBundle.branch,
+                    }),
+                    targetLabel: 'bundle worktree',
+                    worktreeTarget: 'bundle',
+                    branch: previousBundle.branch,
+                });
+                previousBundleResourcesCleaned = true;
+            }
+            catch (error) {
+                return res.status(error instanceof HttpError ? error.status : 500).json({
+                    error: error instanceof Error ? error.message : 'Unable to clean up the empty bundle',
+                });
+            }
+        }
+    }
     if (isProjectChanging) {
         deleteTicketDependenciesForTicket(ticket.id);
     }
     db.prepare('UPDATE tickets SET title = ?, description = ?, model = ?, variant = ?, skills_json = ?, worktree_bundle_id = ?, project_id = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(title?.trim() ?? ticket.title, description ?? ticket.description, resolvedModel, resolvedVariant, JSON.stringify(resolvedSkills), resolvedBundleId, nextProjectId, req.params.id);
     upsertTicketDescriptionMessage(req.params.id, description ?? ticket.description);
     const updated = getTicket(req.params.id);
-    const bundleChanged = previousBundleId !== resolvedBundleId || ticket.project_id !== nextProjectId;
     if (bundleChanged && previousBundleId && previousProject) {
         try {
-            cleanupBundleIfEmpty(previousBundleId, previousProject);
+            await cleanupBundleIfEmpty(previousBundleId, previousProject, {
+                resourcesAlreadyCleaned: previousBundleResourcesCleaned,
+            });
         }
         catch (error) {
             return res.status(error instanceof HttpError ? error.status : 500).json({
@@ -7942,6 +8053,10 @@ app.post('/tickets/:id/retry', (req, res) => {
                     if (!acceptance.sequenceId) {
                         throw new Error('Build sequence no longer exists');
                     }
+                    const project = getEffectiveProject(acceptance.ticket);
+                    if (!project) {
+                        throw new Error('Build project no longer exists');
+                    }
                     transaction.createExecutionRun({
                         projectId: ticket.project_id,
                         kind: 'build',
@@ -7951,6 +8066,9 @@ app.post('/tickets/:id/retry', (req, res) => {
                             { entityType: 'bundle', entityId: ticket.worktree_bundle_id, relationship: 'context' },
                             { entityType: 'build_sequence', entityId: acceptance.sequenceId, relationship: 'context' },
                         ],
+                        metadata: {
+                            build_execution_provider: project.build_execution_provider ?? 'host',
+                        },
                         initiatedBy: 'user',
                         retryOfRunId: retrySource?.id ?? null,
                         eventType: 'build_created',
@@ -9292,6 +9410,10 @@ export const runExecutionArtifactCleanup = (mode) => {
         if (mode === 'periodic') {
             await resumeInterruptedProjectDeletions();
         }
+        const orphanedEnvironments = await reconcileOrphanedExecutionEnvironments();
+        if (orphanedEnvironments.scanned > 0) {
+            console.log(`Reconciled ${orphanedEnvironments.cleaned} orphaned execution environment(s); ${orphanedEnvironments.failed} cleanup(s) retained for retry`);
+        }
         await runExclusiveExecutionArtifactMaintenance(async () => {
             const intents = await reconcileExecutionArtifactRegistrationIntents({ mode });
             const artifacts = await reconcileFinalizedExecutionArtifacts({ emitter: io });
@@ -9347,8 +9469,10 @@ export const startServer = ({ port = DEFAULT_PORT, host } = {}) => {
     }
     startServerPromise = (async () => {
         releaseInterruptedProjectDeletionClaims();
-        await resumeInterruptedProjectDeletions();
+        await reconcileProductionExecutionEnvironmentBindings();
+        await reconcileExecutionEnvironments();
         await reconcileStartupExecutions({ getGitHubConfig: getGitHubConnectionConfig });
+        await resumeInterruptedProjectDeletions();
         const repositoryGraphSchemaExists = db.prepare(`
       SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'repository_graph_scans'
     `).get();