@straiffi/archon 1.8.23 → 1.10.0

package/dist/server/lib/run.js

@@ -1,15 +1,20 @@
 import { spawn } from "child_process";
-import { existsSync } from "fs";
-import { join } from "path";
+import { existsSync, realpathSync } from "fs";
+import { isAbsolute, relative, resolve } from "path";
 import { resolveWorktreePath } from "./git.js";
 import { getProjectById, getProjectRunConfig } from "./projects.js";
 import { applyDetectedPreviewTarget, buildPreviewProxyUrl, createIdlePreviewStatus, createRunPreviewStatus, detectPreviewTargets, inferPreviewTargetsFromLogChunk, isPreviewService, normalizePreviewLogText, resolveReachablePreviewTarget, } from "./preview.js";
 import { deactivatePreviewProxyForProject, ensurePreviewProxyForProject, } from "./previewProxy.js";
-import { resolveShell } from "./shell.js";
+import { getHostShellArguments, resolveShell } from "./shell.js";
 import { redactRepositorySecrets } from "./projectMemoryScan.js";
 import { isTicketRunSetupReady } from "./ticketDependencies.js";
 import { listTicketsInRunContext, resolveTicketBranch, resolveTicketContextKey, } from "./tickets.js";
 import { createWorkspaceProcessEnvironment } from "./workspaceProcessEnvironment.js";
+import { resolveWorkloadExecutionEnvironment } from "./buildExecutionEnvironment.js";
+import { getActiveExecutionProfileRevision } from "./executionProfileStore.js";
+import { classifyTicketExecutionTarget, resolveExecutionTarget, } from "./executionTargets.js";
+import { completeServiceRun, createServiceRun, recordServiceRunReleaseFailure, recordServiceRunPlacement, } from "./serviceRuns.js";
+import { transitionExecutionRun } from "./executionRuns.js";
 const runningProcesses = new Map();
 const MAX_PREVIEW_LOG_BUFFER_CHARS = 16_000;
 const getRunConfig = (project) => getProjectRunConfig(project);
@@ -109,6 +114,10 @@ const trackProcess = (state, proc) => {
     proc.on("error", cleanup);
     return proc;
 };
+const trackExecutionHandle = (state, handle) => {
+    state.execution_handles?.push(handle);
+    return trackProcess(state, handle.child);
+};
 const spawnManagedProcess = (cmd, cwd, stdio, state) => {
     const env = createWorkspaceProcessEnvironment(cwd);
     delete env.PORT;
@@ -219,9 +228,8 @@ export const runSetupCommandsInWorkspace = async (project, cwd, execution) => {
         const hostShell = execution.provider.kind === "host" ? resolveShell() : null;
         const command = hostShell ?? "sh";
         const args = hostShell
-            ? process.platform === "win32"
-                ? ["/d", "/s", "/c", cmd]
-                : ["-i", "-c", cmd]
+            ? getHostShellArguments(hostShell, cmd, execution.runtimeEnvironment.kind !== "host"
+                || execution.runtimeEnvironment.inheritance !== "governed")
             : ["-lc", cmd];
         const handle = execution.provider.execute({
             phase: "setup",
@@ -276,7 +284,88 @@ const clearRunState = (contextKey, state, onStopped) => {
     runningProcesses.delete(contextKey);
     onStopped?.();
 };
-const startRun = async ({ activeRun, cwd, logLabelPrefix, onStopped, project, runConfig, skipSetup = false, }) => {
+const canCreateDurableServiceRun = (project, targetDescriptor) => Boolean(targetDescriptor
+    && project.id
+    && project.active_execution_profile_revision_id);
+const getServiceExecutionAgent = (project) => {
+    const profile = getActiveExecutionProfileRevision(project.id)?.profile;
+    return profile?.check_template_policy.mode === "agent_template"
+        ? profile.check_template_policy.agent
+        : "opencode";
+};
+const getExecutionShell = (provider, runtimeEnvironment, cmd) => {
+    const hostShell = provider.kind === "host" ? resolveShell() : null;
+    return {
+        command: hostShell ?? "sh",
+        args: hostShell
+            ? getHostShellArguments(hostShell, cmd, runtimeEnvironment.kind !== "host" || runtimeEnvironment.inheritance !== "governed")
+            : ["-lc", cmd],
+    };
+};
+const resolveServiceCwd = (workspacePath, configuredCwd) => {
+    if (!configuredCwd) {
+        return workspacePath;
+    }
+    if (isAbsolute(configuredCwd)) {
+        throw new Error("Service working directories must be relative to the canonical target");
+    }
+    const serviceCwd = resolve(workspacePath, configuredCwd);
+    const relativePath = relative(workspacePath, serviceCwd);
+    if (relativePath === ".." || relativePath.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+        throw new Error("Service working directories must remain inside the canonical target");
+    }
+    const realWorkspacePath = realpathSync(workspacePath);
+    const realServiceCwd = realpathSync(serviceCwd);
+    const realRelativePath = relative(realWorkspacePath, realServiceCwd);
+    if (realRelativePath === ".." || realRelativePath.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+        throw new Error("Service working directories must not escape the canonical target through symbolic links");
+    }
+    return serviceCwd;
+};
+const finalizeDurableRun = async (state, status, eventType, message) => {
+    const runId = state.execution_run_id;
+    if (!runId) {
+        return;
+    }
+    const release = state.release_execution_environment;
+    if (release) {
+        try {
+            await release();
+            state.release_execution_environment = null;
+        }
+        catch (error) {
+            recordServiceRunReleaseFailure({
+                projectId: state.execution_project_id,
+                executionRunId: runId,
+                message: getErrorMessage(error),
+                intendedStatus: status,
+                intendedEventType: eventType,
+            });
+            throw error;
+        }
+    }
+    completeServiceRun({
+        projectId: state.execution_project_id,
+        executionRunId: runId,
+        status,
+        code: status === "failed" ? "service_run_failed" : null,
+        message,
+        eventType,
+    });
+};
+const stopRunProcesses = async (state) => {
+    for (const proc of state.processes) {
+        killManagedProcess(proc, "SIGTERM");
+    }
+    await waitForProcessesToExit(state.processes, 1000);
+    for (const proc of state.processes) {
+        if (isProcessAlive(proc)) {
+            killManagedProcess(proc, "SIGKILL");
+        }
+    }
+    await waitForProcessesToExit(state.processes, 1000);
+};
+const startRun = async ({ activeRun, cwd, logLabelPrefix, onStopped, project, runConfig, skipSetup = false, targetDescriptor, }) => {
     const contextKey = activeRun.context_key;
     const state = {
         processes: [],
@@ -284,6 +373,10 @@ const startRun = async ({ activeRun, cwd, logLabelPrefix, onStopped, project, ru
         active_run: activeRun,
         preview_status: createRunPreviewStatus(project, runConfig),
         preview_log_buffer: "",
+        execution_run_id: null,
+        execution_handles: [],
+        release_execution_environment: null,
+        execution_project_id: null,
     };
     runningProcesses.set(contextKey, state);
     if (!existsSync(cwd)) {
@@ -291,12 +384,102 @@ const startRun = async ({ activeRun, cwd, logLabelPrefix, onStopped, project, ru
         clearRunState(contextKey, state, onStopped);
         return;
     }
+    let execution = null;
+    let executionTarget = null;
+    if (canCreateDurableServiceRun(project, targetDescriptor)) {
+        try {
+            const target = await resolveExecutionTarget({
+                project,
+                descriptor: targetDescriptor,
+                expectedWorkspacePath: cwd,
+            });
+            if (!isActiveRunState(contextKey, state)) {
+                return;
+            }
+            executionTarget = target;
+            const source = activeRun.kind === "ticket"
+                ? {
+                    kind: "ticket",
+                    id: activeRun.ticket_id,
+                    bundleId: target.identity.kind === "bundle-worktree"
+                        ? target.identity.bundleId
+                        : null,
+                }
+                : { kind: "project", id: project.id };
+            const durableRun = createServiceRun({
+                projectId: project.id,
+                contextKey,
+                source,
+                target,
+                services: runConfig.services ?? [],
+            });
+            state.execution_run_id = durableRun.id;
+            state.execution_project_id = project.id;
+            if (!isActiveRunState(contextKey, state)) {
+                await finalizeDurableRun(state, "cancelled", "service_run_cancelled");
+                return;
+            }
+            execution = await resolveWorkloadExecutionEnvironment({
+                project,
+                executionRunId: durableRun.id,
+                agent: getServiceExecutionAgent(project),
+                model: project.helper_model,
+                target,
+                workload: "service",
+                onLeaseAcquired: release => {
+                    state.release_execution_environment = release;
+                },
+            });
+            state.release_execution_environment = execution.release;
+            if (!isActiveRunState(contextKey, state)) {
+                await finalizeDurableRun(state, "cancelled", "service_run_cancelled");
+                return;
+            }
+            state.execution_provider = execution.provider.kind === "docker_sandbox"
+                ? "docker_sandbox"
+                : "host";
+            state.preview_status = createRunPreviewStatus(project, runConfig, state.execution_provider);
+            transitionExecutionRun({
+                projectId: project.id,
+                runId: durableRun.id,
+                status: "running",
+                domainStatus: "starting",
+                eventType: "service_run_starting",
+                eventMessage: "Service execution provider and canonical target authority were resolved.",
+            });
+        }
+        catch (error) {
+            if (state.execution_run_id) {
+                await finalizeDurableRun(state, "failed", "service_run_start_failed", getErrorMessage(error)).catch(releaseError => {
+                    console.error("[run] service environment release failed:", getErrorMessage(releaseError));
+                });
+            }
+            console.error(`[run] durable service start failed for ${logLabelPrefix}:`, getErrorMessage(error));
+            clearRunState(contextKey, state, onStopped);
+            return;
+        }
+    }
     if (!skipSetup) {
         try {
-            for (const cmd of runConfig.setup ?? []) {
-                await runCommand(cmd, cwd, state);
-                if (!isActiveRunState(contextKey, state)) {
-                    return;
+            if (execution) {
+                await runSetupCommandsInWorkspace(project, cwd, {
+                    provider: execution.provider,
+                    target: executionTarget,
+                    launcherEnvironment: execution.launcherEnvironment,
+                    runtimeEnvironment: execution.runtimeEnvironment,
+                    onHandle: handle => {
+                        if (handle) {
+                            trackExecutionHandle(state, handle);
+                        }
+                    },
+                });
+            }
+            else {
+                for (const cmd of runConfig.setup ?? []) {
+                    await runCommand(cmd, cwd, state);
+                    if (!isActiveRunState(contextKey, state)) {
+                        return;
+                    }
                 }
             }
         }
@@ -305,6 +488,7 @@ const startRun = async ({ activeRun, cwd, logLabelPrefix, onStopped, project, ru
                 return;
             }
             console.error(`[run] setup failed for ${logLabelPrefix}:`, getErrorMessage(err));
+            await finalizeDurableRun(state, "failed", "service_setup_failed", getErrorMessage(err)).catch(releaseError => console.error("[run] service environment release failed:", getErrorMessage(releaseError)));
             clearRunState(contextKey, state, onStopped);
             return;
         }
@@ -312,80 +496,175 @@ const startRun = async ({ activeRun, cwd, logLabelPrefix, onStopped, project, ru
     if (!isActiveRunState(contextKey, state)) {
         return;
     }
+    let serviceFailureMessage = null;
+    let startupComplete = false;
     const cleanupIfAllDead = () => {
-        if (runningProcesses.get(contextKey) !== state || state.cancelled) {
+        if (!startupComplete || runningProcesses.get(contextKey) !== state || state.cancelled) {
             return;
         }
         const anyAlive = state.processes.some(isProcessAlive);
         if (!anyAlive) {
-            clearRunState(contextKey, state, onStopped);
+            void finalizeDurableRun(state, serviceFailureMessage ? "failed" : "completed", serviceFailureMessage ? "service_run_failed" : "service_run_completed", serviceFailureMessage ?? undefined)
+                .catch(error => console.error("[run] service environment release failed:", getErrorMessage(error)))
+                .finally(() => clearRunState(contextKey, state, onStopped));
         }
     };
-    for (const service of runConfig.services ?? []) {
-        const serviceCwd = service.cwd ? join(cwd, service.cwd) : cwd;
-        const label = service.name ?? service.cmd;
-        const proc = spawnManagedProcess(service.cmd, serviceCwd, ["ignore", "pipe", "pipe"], state);
-        const handleLogChunk = (data) => {
-            if (!isPreviewService(service, state.preview_status)) {
-                return;
-            }
-            state.preview_log_buffer = normalizePreviewLogText(`${state.preview_log_buffer}${data.toString()}`).slice(-MAX_PREVIEW_LOG_BUFFER_CHARS);
-            const detectedTargets = detectPreviewTargets(state.preview_log_buffer, state.preview_status.capability);
-            const previewTargets = detectedTargets.length > 0
-                ? detectedTargets
-                : inferPreviewTargetsFromLogChunk(state.preview_log_buffer, project, service, state.preview_status.capability);
-            if (previewTargets.length === 0) {
-                return;
-            }
-            void (async () => {
-                for (const detectedTarget of previewTargets) {
-                    const reachableTarget = await resolveReachablePreviewTarget(detectedTarget, project.preview_path);
-                    if (!reachableTarget || !isActiveRunState(contextKey, state)) {
-                        continue;
-                    }
-                    if (state.preview_status.detected_url === reachableTarget.url &&
-                        state.preview_status.proxy_url) {
+    let configuredServices;
+    try {
+        configuredServices = (runConfig.services ?? []).map(service => ({
+            service,
+            cwd: resolveServiceCwd(cwd, service.cwd),
+        }));
+    }
+    catch (error) {
+        await finalizeDurableRun(state, "failed", "service_configuration_invalid", getErrorMessage(error)).catch(releaseError => console.error("[run] service environment release failed:", getErrorMessage(releaseError)));
+        clearRunState(contextKey, state, onStopped);
+        return;
+    }
+    try {
+        for (const { service, cwd: serviceCwd } of configuredServices) {
+            const label = service.name ?? service.cmd;
+            let handle = null;
+            const proc = execution
+                ? (() => {
+                    const shell = getExecutionShell(execution.provider, execution.runtimeEnvironment, service.cmd);
+                    handle = execution.provider.execute({
+                        phase: "service",
+                        target: executionTarget,
+                        command: shell.command,
+                        args: shell.args,
+                        cwd: serviceCwd,
+                        stdio: ["ignore", "pipe", "pipe"],
+                        launcherEnvironment: execution.launcherEnvironment,
+                        runtimeEnvironment: execution.runtimeEnvironment,
+                        detached: process.platform !== "win32",
+                    });
+                    return trackExecutionHandle(state, handle);
+                })()
+                : spawnManagedProcess(service.cmd, serviceCwd, ["ignore", "pipe", "pipe"], state);
+            const handleLogChunk = (data) => {
+                if (!isPreviewService(service, state.preview_status)) {
+                    return;
+                }
+                state.preview_log_buffer = normalizePreviewLogText(`${state.preview_log_buffer}${data.toString()}`).slice(-MAX_PREVIEW_LOG_BUFFER_CHARS);
+                const detectedTargets = detectPreviewTargets(state.preview_log_buffer, state.preview_status.capability);
+                const previewTargets = detectedTargets.length > 0
+                    ? detectedTargets
+                    : inferPreviewTargetsFromLogChunk(state.preview_log_buffer, project, service, state.preview_status.capability);
+                if (previewTargets.length === 0) {
+                    return;
+                }
+                void (async () => {
+                    for (const detectedTarget of previewTargets) {
+                        const reachableTarget = await resolveReachablePreviewTarget(detectedTarget, project.preview_path);
+                        if (!reachableTarget || !isActiveRunState(contextKey, state)) {
+                            continue;
+                        }
+                        if (state.preview_status.detected_url === reachableTarget.url &&
+                            state.preview_status.proxy_url) {
+                            return;
+                        }
+                        try {
+                            const proxyOrigin = await ensurePreviewProxyForProject(project.id, reachableTarget.url);
+                            state.preview_status = {
+                                ...applyDetectedPreviewTarget(state.preview_status, reachableTarget),
+                                proxy_url: buildPreviewProxyUrl(proxyOrigin, reachableTarget.url),
+                            };
+                        }
+                        catch (error) {
+                            state.preview_status = {
+                                ...state.preview_status,
+                                state: "error",
+                                proxy_url: null,
+                                message: getErrorMessage(error) || "Preview proxy failed",
+                            };
+                        }
                         return;
                     }
-                    try {
-                        const proxyOrigin = await ensurePreviewProxyForProject(project.id, reachableTarget.url);
-                        state.preview_status = {
-                            ...applyDetectedPreviewTarget(state.preview_status, reachableTarget),
-                            proxy_url: buildPreviewProxyUrl(proxyOrigin, reachableTarget.url),
-                        };
-                    }
-                    catch (error) {
-                        state.preview_status = {
-                            ...state.preview_status,
-                            state: "error",
-                            proxy_url: null,
-                            message: getErrorMessage(error) || "Preview proxy failed",
-                        };
-                    }
+                })();
+            };
+            proc.stdout?.on("data", (data) => {
+                console.log(`[run:${logLabelPrefix}:${label}] ${data.toString().trimEnd()}`);
+                handleLogChunk(data);
+            });
+            proc.stderr?.on("data", (data) => {
+                console.error(`[run:${logLabelPrefix}:${label}] ${data.toString().trimEnd()}`);
+                handleLogChunk(data);
+            });
+            proc.on("close", (code) => {
+                console.log(`[run:${logLabelPrefix}:${label}] exited with code ${code}`);
+                if (code !== 0 && !state.cancelled) {
+                    serviceFailureMessage = `Service ${label} exited with code ${code ?? "unknown"}.`;
+                }
+                cleanupIfAllDead();
+            });
+            proc.on("error", (err) => {
+                console.error(`[run:${logLabelPrefix}:${label}] error: ${getErrorMessage(err)}`);
+                if (!state.cancelled) {
+                    serviceFailureMessage = `Service ${label} failed: ${getErrorMessage(err)}`;
+                }
+                cleanupIfAllDead();
+            });
+            if (handle) {
+                const placementFailure = await handle.placementFailure;
+                if (!isActiveRunState(contextKey, state)) {
                     return;
                 }
-            })();
-        };
-        proc.stdout?.on("data", (data) => {
-            console.log(`[run:${logLabelPrefix}:${label}] ${data.toString().trimEnd()}`);
-            handleLogChunk(data);
-        });
-        proc.stderr?.on("data", (data) => {
-            console.error(`[run:${logLabelPrefix}:${label}] ${data.toString().trimEnd()}`);
-            handleLogChunk(data);
-        });
-        proc.on("close", (code) => {
-            console.log(`[run:${logLabelPrefix}:${label}] exited with code ${code}`);
-            cleanupIfAllDead();
-        });
-        proc.on("error", (err) => {
-            console.error(`[run:${logLabelPrefix}:${label}] error: ${getErrorMessage(err)}`);
-            cleanupIfAllDead();
+                if (placementFailure) {
+                    throw placementFailure;
+                }
+                const placement = await handle.placementIdentity;
+                if (!isActiveRunState(contextKey, state)) {
+                    return;
+                }
+                recordServiceRunPlacement({
+                    projectId: project.id,
+                    executionRunId: state.execution_run_id,
+                    provider: state.execution_provider,
+                    environmentId: execution?.environment?.id ?? null,
+                    environmentRevision: execution?.environment?.environment_revision ?? null,
+                    placement,
+                });
+            }
+        }
+    }
+    catch (error) {
+        await stopRunProcesses(state);
+        await finalizeDurableRun(state, "failed", "service_placement_failed", getErrorMessage(error)).catch(releaseError => console.error("[run] service environment release failed:", getErrorMessage(releaseError)));
+        clearRunState(contextKey, state, onStopped);
+        return;
+    }
+    if (state.execution_run_id && execution && (runConfig.services ?? []).length === 0) {
+        recordServiceRunPlacement({
+            projectId: project.id,
+            executionRunId: state.execution_run_id,
+            provider: state.execution_provider,
+            environmentId: execution.environment?.id ?? null,
+            environmentRevision: execution.environment?.environment_revision ?? null,
         });
     }
     if (!isActiveRunState(contextKey, state)) {
         return;
     }
+    if (state.execution_run_id) {
+        transitionExecutionRun({
+            projectId: project.id,
+            runId: state.execution_run_id,
+            status: "running",
+            domainStatus: "active",
+            eventType: "service_run_active",
+            eventMessage: state.execution_provider === "docker_sandbox"
+                ? "Services are active in a shared Docker Sandbox environment; interruption applies to the whole environment."
+                : "Services are active as verified host processes.",
+        });
+    }
+    if ((runConfig.services ?? []).length === 0) {
+        await finalizeDurableRun(state, "completed", "service_run_completed").catch(error => console.error("[run] service environment release failed:", getErrorMessage(error)));
+        clearRunState(contextKey, state, onStopped);
+        return;
+    }
+    startupComplete = true;
+    cleanupIfAllDead();
 };
 export const stopAllTickets = async () => {
     const contextKeys = [...runningProcesses.keys()];
@@ -401,17 +680,10 @@ export const stopTicket = async (ticketOrKey) => {
         return;
     }
     state.cancelled = true;
-    const { processes } = state;
-    for (const proc of processes) {
-        killManagedProcess(proc, "SIGTERM");
-    }
-    await waitForProcessesToExit(processes, 5000);
-    for (const proc of processes) {
-        if (isProcessAlive(proc)) {
-            killManagedProcess(proc, "SIGKILL");
-        }
-    }
-    await waitForProcessesToExit(processes, 1000);
+    await stopRunProcesses(state);
+    await finalizeDurableRun(state, "cancelled", "service_run_cancelled", state.execution_provider === "docker_sandbox"
+        ? "The service run was stopped. Docker Sandbox interruption stops the whole environment and every attached service."
+        : "The service run host processes were stopped.").catch(error => console.error("[run] service environment release failed:", getErrorMessage(error)));
     if (runningProcesses.get(contextKey) === state) {
         deactivatePreviewProxyForProject(state.active_run.project_id);
         state.preview_log_buffer = "";
@@ -445,6 +717,13 @@ export const runTicketInWorkspace = async (ticket, io, project = null, workspace
         project: project,
         runConfig,
         skipSetup: isTicketRunSetupReady(ticket),
+        targetDescriptor: branch
+            ? classifyTicketExecutionTarget({
+                branch,
+                bundleId: ticket.worktree_bundle_id ?? null,
+                bundleKind: ticket.bundle?.kind ?? null,
+            })
+            : undefined,
     });
 };
 export const runProject = async (project, options = {}) => {
@@ -469,6 +748,17 @@ export const runProject = async (project, options = {}) => {
         logLabelPrefix: `project:${project.id}`,
         project,
         runConfig,
+        targetDescriptor: targetKind === "bundle" && targetBundleId
+            ? {
+                kind: "bundle-worktree",
+                bundleId: targetBundleId,
+                branch: options.targetBranch ?? "",
+            }
+            : {
+                kind: "project-root",
+                bundleId: null,
+                branch: options.targetBranch ?? null,
+            },
     });
 };
 export const stopProjectRun = async (projectId, target = {}) => {