@viewportai/daemon 0.25.4 → 0.25.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (58) hide show
  1. package/dist/cli/workflow-managed-worker-types.d.ts +10 -0
  2. package/dist/cli/workflow-managed-worker-types.d.ts.map +1 -1
  3. package/dist/cli/workflow-managed-worker.d.ts.map +1 -1
  4. package/dist/cli/workflow-managed-worker.js +268 -57
  5. package/dist/cli/workflow-managed-worker.js.map +1 -1
  6. package/dist/server/http-request-schemas.d.ts +4 -0
  7. package/dist/server/http-request-schemas.d.ts.map +1 -1
  8. package/dist/server/http-request-schemas.js +10 -0
  9. package/dist/server/http-request-schemas.js.map +1 -1
  10. package/dist/server/http-server.d.ts.map +1 -1
  11. package/dist/server/http-server.js +17 -0
  12. package/dist/server/http-server.js.map +1 -1
  13. package/dist/workflows/action-adapters.d.ts +1 -0
  14. package/dist/workflows/action-adapters.d.ts.map +1 -1
  15. package/dist/workflows/action-adapters.js +1 -0
  16. package/dist/workflows/action-adapters.js.map +1 -1
  17. package/dist/workflows/action-provider-adapters.d.ts +5 -2
  18. package/dist/workflows/action-provider-adapters.d.ts.map +1 -1
  19. package/dist/workflows/action-provider-adapters.js +48 -3
  20. package/dist/workflows/action-provider-adapters.js.map +1 -1
  21. package/dist/workflows/action-provider-utils.d.ts +2 -0
  22. package/dist/workflows/action-provider-utils.d.ts.map +1 -1
  23. package/dist/workflows/action-provider-utils.js +19 -0
  24. package/dist/workflows/action-provider-utils.js.map +1 -1
  25. package/dist/workflows/node-executor.d.ts +6 -0
  26. package/dist/workflows/node-executor.d.ts.map +1 -1
  27. package/dist/workflows/node-executor.js +1 -1
  28. package/dist/workflows/node-executor.js.map +1 -1
  29. package/dist/workflows/node-registry.d.ts.map +1 -1
  30. package/dist/workflows/node-registry.js +21 -5
  31. package/dist/workflows/node-registry.js.map +1 -1
  32. package/dist/workflows/platform-command-applier.d.ts +3 -1
  33. package/dist/workflows/platform-command-applier.d.ts.map +1 -1
  34. package/dist/workflows/platform-command-applier.js +77 -1
  35. package/dist/workflows/platform-command-applier.js.map +1 -1
  36. package/dist/workflows/platform-runtime-command.d.ts +18 -1
  37. package/dist/workflows/platform-runtime-command.d.ts.map +1 -1
  38. package/dist/workflows/platform-runtime-command.js +36 -3
  39. package/dist/workflows/platform-runtime-command.js.map +1 -1
  40. package/dist/workflows/run-types.d.ts +9 -0
  41. package/dist/workflows/run-types.d.ts.map +1 -1
  42. package/dist/workflows/runner-scheduler.d.ts +1 -0
  43. package/dist/workflows/runner-scheduler.d.ts.map +1 -1
  44. package/dist/workflows/runner-scheduler.js +1 -0
  45. package/dist/workflows/runner-scheduler.js.map +1 -1
  46. package/dist/workflows/runner.d.ts +7 -0
  47. package/dist/workflows/runner.d.ts.map +1 -1
  48. package/dist/workflows/runner.js +113 -7
  49. package/dist/workflows/runner.js.map +1 -1
  50. package/dist/workflows/workflow-production-schema.d.ts +12 -0
  51. package/dist/workflows/workflow-production-schema.d.ts.map +1 -1
  52. package/dist/workflows/workflow-production-schema.js +9 -0
  53. package/dist/workflows/workflow-production-schema.js.map +1 -1
  54. package/dist/workflows/workflow-production-types.d.ts +6 -0
  55. package/dist/workflows/workflow-production-types.d.ts.map +1 -1
  56. package/dist/workflows/workflow-schema.d.ts +12 -0
  57. package/dist/workflows/workflow-schema.d.ts.map +1 -1
  58. package/package.json +1 -1
@@ -9,6 +9,7 @@ export interface ManagedWorkerOptions {
9
9
  accessMode: ManagedWorkerAccessMode;
10
10
  runnerProfile?: string;
11
11
  runnerPosture?: Record<string, unknown>;
12
+ workerSessionId: string;
12
13
  runnerKeyPair: ManagedWorkerRunnerKeyPair;
13
14
  signingIdentity?: ManagedWorkerSigningIdentity;
14
15
  runnerPool?: string;
@@ -54,13 +55,22 @@ export interface ManagedAssignment {
54
55
  assignment_claim_token?: string | null;
55
56
  runtime_commands?: Array<Record<string, unknown>> | null;
56
57
  schema_versions?: Record<string, unknown> | null;
58
+ target_snapshot?: Record<string, unknown> | null;
59
+ targetSnapshot?: Record<string, unknown> | null;
57
60
  route_snapshot?: Record<string, unknown> | null;
61
+ routeSnapshot?: Record<string, unknown> | null;
58
62
  execution_profile_snapshot?: Record<string, unknown> | null;
63
+ executionProfileSnapshot?: Record<string, unknown> | null;
59
64
  workflow_snapshot?: Record<string, unknown> | null;
65
+ workflowSnapshot?: Record<string, unknown> | null;
60
66
  runner_workspace_snapshot?: Record<string, unknown> | null;
67
+ runnerWorkspaceSnapshot?: Record<string, unknown> | null;
61
68
  resource_manifest?: SessionResourceManifest | null;
69
+ resourceManifest?: SessionResourceManifest | null;
62
70
  workflow_authority_contract?: Record<string, unknown> | null;
71
+ workflowAuthorityContract?: Record<string, unknown> | null;
63
72
  context_receipts_snapshot?: unknown[] | Record<string, unknown> | null;
73
+ contextReceiptsSnapshot?: unknown[] | Record<string, unknown> | null;
64
74
  yaml_snapshot?: string | null;
65
75
  source_ref?: string | null;
66
76
  directory_path?: string | null;
@@ -1 +1 @@
1
- {"version":3,"file":"workflow-managed-worker-types.d.ts","sourceRoot":"","sources":["../../src/cli/workflow-managed-worker-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,EAAE,0BAA0B,CAAC;IAC1C,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,yBAAyB,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,4BAA4B,CAAC;IACrC,SAAS,EAAE,cAAc,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,gBAAgB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACnD,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACnD,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,yBAAyB,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,IAAI,CAAC;IAC3D,mBAAmB,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QAC9B,SAAS,CAAC,EAAE,UAAU,GAAG,iBAAiB,CAAC;KAC5C,GAAG,IAAI,CAAC;IACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE;QAChB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC1C,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB"}
1
+ {"version":3,"file":"workflow-managed-worker-types.d.ts","sourceRoot":"","sources":["../../src/cli/workflow-managed-worker-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,0BAA0B,CAAC;IAC1C,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,yBAAyB,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,4BAA4B,CAAC;IACrC,SAAS,EAAE,cAAc,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,gBAAgB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/C,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAClD,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAClD,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,yBAAyB,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvE,uBAAuB,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,IAAI,CAAC;IAC3D,mBAAmB,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QAC9B,SAAS,CAAC,EAAE,UAAU,GAAG,iBAAiB,CAAC;KAC5C,GAAG,IAAI,CAAC;IACT,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE;QAChB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC1C,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB"}
@@ -1 +1 @@
1
- {"version":3,"file":"workflow-managed-worker.d.ts","sourceRoot":"","sources":["../../src/cli/workflow-managed-worker.ts"],"names":[],"mappings":"AAuDA,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAsKpD"}
1
+ {"version":3,"file":"workflow-managed-worker.d.ts","sourceRoot":"","sources":["../../src/cli/workflow-managed-worker.ts"],"names":[],"mappings":"AAwDA,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAsKpD"}
@@ -248,6 +248,7 @@ function resolveWorkerOptions() {
248
248
  registrationProfile?.runnerProfile ??
249
249
  undefined,
250
250
  runnerPosture: registrationProfile?.runnerPosture,
251
+ workerSessionId: randomUUID(),
251
252
  runnerKeyPair,
252
253
  signingIdentity,
253
254
  runnerPool: getFlag('runner-pool') ??
@@ -532,7 +533,10 @@ async function heartbeat(options, status, healthStatus) {
532
533
  ...recordValue(options.runnerPosture?.['transport']),
533
534
  mode: options.accessMode,
534
535
  },
535
- execution: recordValue(options.runnerPosture?.['execution']) ?? { kind: 'customer-managed' },
536
+ execution: {
537
+ ...(recordValue(options.runnerPosture?.['execution']) ?? { kind: 'customer-managed' }),
538
+ worker_session_id: options.workerSessionId,
539
+ },
536
540
  secrets: {
537
541
  ...recordValue(options.runnerPosture?.['secrets']),
538
542
  modes: [
@@ -598,11 +602,12 @@ function managedWorkerAccessMode(value) {
598
602
  async function claimAssignment(options) {
599
603
  const response = await platformFetch(options, 'POST', 'claim', {
600
604
  lease_seconds: options.leaseSeconds,
605
+ worker_session_id: options.workerSessionId,
601
606
  });
602
607
  if (response.status === 204)
603
608
  return null;
604
609
  const body = await responseJson(response);
605
- return dataFrom(body);
610
+ return assignmentFrom(body);
606
611
  }
607
612
  async function claimActionReplay(options) {
608
613
  if ((!options.capabilities.actionCommand && !options.capabilities.providerActions) ||
@@ -735,12 +740,13 @@ function normalizeReplayAction(adapter, action) {
735
740
  return action;
736
741
  }
737
742
  function replayProviderReference(response) {
738
- return (stringField(response ?? null, 'htmlUrl') ??
739
- stringField(response ?? null, 'apiUrl') ??
740
- stringField(response ?? null, 'url') ??
741
- stringField(response ?? null, 'channel') ??
743
+ return (numberField(response ?? null, 'number')?.toString() ??
742
744
  stringField(response ?? null, 'ts') ??
743
- numberField(response ?? null, 'number')?.toString());
745
+ stringField(response ?? null, 'id') ??
746
+ stringField(response ?? null, 'channel') ??
747
+ stringField(response ?? null, 'htmlUrl') ??
748
+ stringField(response ?? null, 'apiUrl') ??
749
+ stringField(response ?? null, 'url'));
744
750
  }
745
751
  function replayProviderUrl(response) {
746
752
  return (stringField(response ?? null, 'htmlUrl') ??
@@ -897,38 +903,46 @@ async function runAssignmentLocally(options, assignment) {
897
903
  const existingRun = await readExistingLocalRun(assignment.runtime_run_id);
898
904
  if (existingRun) {
899
905
  if (existingRun.status === 'running' || existingRun.status === 'queued') {
900
- return pollLocalRun(existingRun.id, async (run) => {
906
+ const completed = await pollLocalRun(existingRun.id, async (run) => {
901
907
  await syncLocalRun(options, assignment.id, run, assignment.assignment_claim_token);
902
908
  }, progressSyncEveryMs(options.leaseSeconds));
909
+ if (terminalRunStatus(completed.status)) {
910
+ clearRunCredentialMaterial(assignment.id);
911
+ }
912
+ return completed;
913
+ }
914
+ if (terminalRunStatus(existingRun.status)) {
915
+ clearRunCredentialMaterial(assignment.id);
903
916
  }
904
917
  return existingRun;
905
918
  }
906
919
  const directory = await ensureDirectory(options.workdir ?? assignment.directory_path ?? process.cwd());
907
- const material = await materializeRunCredentials(options, assignment);
920
+ const material = await materializeAndCacheRunCredentials(options, assignment);
908
921
  const started = await daemonJson('POST', '/api/workflows/runs', {
909
922
  workflowYaml: assignment.yaml_snapshot,
910
923
  workflowSourceRef: assignment.source_ref ?? `viewport://managed-executor/${assignment.id}`,
911
924
  directoryId: directory.id,
912
- inputs: assignmentInputs(assignment, material.metadata),
925
+ inputs: assignmentInputs(assignment, material),
913
926
  runtimeSecretEnv: material.runtimeSecretEnv,
927
+ runtimeSecretFiles: material.runtimeSecretFiles,
914
928
  resourceId: options.workspaceId,
915
929
  runtimeTargetId: assignment.runtime_target_id ?? undefined,
916
930
  platformRunId: assignment.id,
917
- resourceManifest: assignment.resource_manifest ?? undefined,
918
- workflowAuthorityContract: assignment.workflow_authority_contract ??
919
- recordChildValue(assignment.route_snapshot, 'workflow_authority_contract') ??
920
- recordChildValue(assignment.execution_profile_snapshot, 'workflow_authority_contract') ??
921
- recordChildValue(assignment.workflow_snapshot, 'workflow_authority_contract') ??
922
- recordChildValue(assignment.runner_workspace_snapshot, 'workflow_authority_contract') ??
931
+ resourceManifest: assignmentResourceManifest(assignment) ?? undefined,
932
+ workflowAuthorityContract: assignmentWorkflowAuthorityContract(assignment) ??
923
933
  recordChildValue(recordChildValue(assignment.input_snapshot, 'viewport'), 'workflowAuthorityContract') ??
924
934
  undefined,
925
935
  initiation: 'cli',
926
936
  dataCapturePolicy: assignment.data_capture_policy ?? undefined,
927
937
  });
928
938
  const runId = readRun(started).id;
929
- return pollLocalRun(runId, async (run) => {
939
+ const completed = await pollLocalRun(runId, async (run) => {
930
940
  await syncLocalRun(options, assignment.id, run, assignment.assignment_claim_token);
931
941
  }, progressSyncEveryMs(options.leaseSeconds));
942
+ if (terminalRunStatus(completed.status)) {
943
+ clearRunCredentialMaterial(assignment.id);
944
+ }
945
+ return completed;
932
946
  }
933
947
  function recordChildValue(value, key) {
934
948
  if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -938,26 +952,88 @@ function recordChildValue(value, key) {
938
952
  return undefined;
939
953
  return entry;
940
954
  }
941
- function assignmentInputs(assignment, credentialMetadata = []) {
955
+ function assignmentInputs(assignment, material = {
956
+ runtimeSecretEnv: {},
957
+ runtimeSecretFiles: {},
958
+ metadata: [],
959
+ }) {
942
960
  const inputs = { ...(assignment.input_snapshot ?? {}) };
943
961
  inputs['viewport'] = {
944
962
  ...(isRecord(inputs['viewport']) ? inputs['viewport'] : {}),
945
963
  platformRunId: assignment.id,
946
964
  schemaVersions: assignment.schema_versions ?? null,
947
- route: assignment.route_snapshot ?? null,
948
- executionProfile: assignment.execution_profile_snapshot ?? null,
949
- workflow: assignment.workflow_snapshot ?? null,
950
- runnerWorkspace: assignment.runner_workspace_snapshot ?? null,
951
- contextReceipts: assignment.context_receipts_snapshot ?? null,
952
- credentials: credentialMetadata,
965
+ target: assignmentTargetSnapshot(assignment) ?? null,
966
+ route: assignmentRouteSnapshot(assignment) ?? null,
967
+ executionProfile: assignmentExecutionProfileSnapshot(assignment) ?? null,
968
+ workflow: assignmentWorkflowSnapshot(assignment) ?? null,
969
+ runnerWorkspace: assignmentRunnerWorkspaceSnapshot(assignment) ?? null,
970
+ contextReceipts: assignmentContextReceiptsSnapshot(assignment) ?? null,
971
+ credentials: material.metadata,
953
972
  };
954
973
  return inputs;
955
974
  }
975
+ const runCredentialMaterialCache = new Map();
976
+ const runCredentialProcessEnvCache = new Map();
977
+ function terminalRunStatus(status) {
978
+ return status === 'completed' || status === 'failed' || status === 'canceled';
979
+ }
980
+ async function materializeAndCacheRunCredentials(options, assignment) {
981
+ const material = await materializeRunCredentials(options, assignment);
982
+ runCredentialMaterialCache.set(assignment.id, material);
983
+ installRunCredentialProcessEnv(assignment.id, material.runtimeSecretEnv);
984
+ return material;
985
+ }
986
+ function installRunCredentialProcessEnv(runId, runtimeSecretEnv) {
987
+ const entries = Object.entries(runtimeSecretEnv);
988
+ if (entries.length === 0)
989
+ return;
990
+ const previous = runCredentialProcessEnvCache.get(runId) ?? {};
991
+ for (const [key, value] of entries) {
992
+ if (!(key in previous)) {
993
+ previous[key] = process.env[key];
994
+ }
995
+ process.env[key] = value;
996
+ }
997
+ runCredentialProcessEnvCache.set(runId, previous);
998
+ }
999
+ function clearRunCredentialMaterial(runId) {
1000
+ const material = runCredentialMaterialCache.get(runId);
1001
+ runCredentialMaterialCache.delete(runId);
1002
+ if (material) {
1003
+ for (const filePath of Object.values(material.runtimeSecretFiles)) {
1004
+ try {
1005
+ fs.rmSync(filePath, { force: true });
1006
+ }
1007
+ catch {
1008
+ // Best-effort cleanup; the run-scoped directory is removed next.
1009
+ }
1010
+ }
1011
+ }
1012
+ try {
1013
+ fs.rmSync(path.join(process.env['VIEWPORT_HOME'] ?? path.join(os.homedir(), '.viewport'), 'run-secrets', runId), { recursive: true, force: true });
1014
+ }
1015
+ catch {
1016
+ // Best-effort cleanup.
1017
+ }
1018
+ const previous = runCredentialProcessEnvCache.get(runId);
1019
+ if (!previous)
1020
+ return;
1021
+ for (const [key, value] of Object.entries(previous)) {
1022
+ if (value === undefined) {
1023
+ delete process.env[key];
1024
+ }
1025
+ else {
1026
+ process.env[key] = value;
1027
+ }
1028
+ }
1029
+ runCredentialProcessEnvCache.delete(runId);
1030
+ }
956
1031
  async function materializeRunCredentials(options, assignment) {
957
1032
  const handles = collectCredentialHandles(assignment);
958
1033
  if (handles.length === 0)
959
- return { runtimeSecretEnv: {}, metadata: [] };
1034
+ return { runtimeSecretEnv: {}, runtimeSecretFiles: {}, metadata: [] };
960
1035
  const runtimeSecretEnv = {};
1036
+ const runtimeSecretFiles = {};
961
1037
  const metadata = [];
962
1038
  for (const handle of handles) {
963
1039
  const response = await materializeCredential(options, assignment, handle);
@@ -965,10 +1041,13 @@ async function materializeRunCredentials(options, assignment) {
965
1041
  const secret = stringField(response, 'secret');
966
1042
  if (secret) {
967
1043
  runtimeSecretEnv[envName] = secret;
1044
+ runtimeSecretFiles[envName] = await writeRunCredentialSecretFile(assignment.id, envName, secret);
968
1045
  }
969
1046
  const wrappedSecret = recordField(response, 'wrapped_secret');
970
1047
  if (wrappedSecret) {
971
- runtimeSecretEnv[envName] = decryptRunnerWrappedSecret(options.runnerKeyPair, wrappedSecret);
1048
+ const decrypted = decryptRunnerWrappedSecret(options.runnerKeyPair, wrappedSecret);
1049
+ runtimeSecretEnv[envName] = decrypted;
1050
+ runtimeSecretFiles[envName] = await writeRunCredentialSecretFile(assignment.id, envName, decrypted);
972
1051
  }
973
1052
  metadata.push({
974
1053
  handle,
@@ -976,13 +1055,26 @@ async function materializeRunCredentials(options, assignment) {
976
1055
  kind: stringField(response, 'kind') ?? null,
977
1056
  storagePosture: stringField(response, 'storage_posture') ?? null,
978
1057
  materialAvailable: response['material_available'] === true,
1058
+ runtimeSecretAvailable: typeof runtimeSecretEnv[envName] === 'string',
979
1059
  runnerLocalRequired: response['runner_local_required'] === true,
980
1060
  provider: stringField(response, 'provider') ?? null,
981
1061
  credentialId: stringField(response, 'credential_id') ?? numberField(response, 'credential_id') ?? null,
982
1062
  scopes: response['scopes'],
983
1063
  });
984
1064
  }
985
- return { runtimeSecretEnv, metadata };
1065
+ const missingRuntimeSecrets = metadata.filter((entry) => entry.materialAvailable && !entry.runnerLocalRequired && !entry.runtimeSecretAvailable);
1066
+ if (missingRuntimeSecrets.length > 0) {
1067
+ const handles = missingRuntimeSecrets.map((entry) => entry.handle).join(', ');
1068
+ throw new Error(`Credential materialization for ${assignment.id} returned material_available without runtime secret material for: ${handles}`);
1069
+ }
1070
+ return { runtimeSecretEnv, runtimeSecretFiles, metadata };
1071
+ }
1072
+ async function writeRunCredentialSecretFile(runId, envName, secret) {
1073
+ const root = path.join(process.env['VIEWPORT_HOME'] ?? path.join(os.homedir(), '.viewport'), 'run-secrets', runId);
1074
+ await fs.promises.mkdir(root, { recursive: true, mode: 0o700 });
1075
+ const filePath = path.join(root, envName);
1076
+ await fs.promises.writeFile(filePath, secret, { mode: 0o600 });
1077
+ return filePath;
986
1078
  }
987
1079
  async function materializeCredential(options, assignment, handle) {
988
1080
  if (!assignment.assignment_claim_token) {
@@ -1024,19 +1116,7 @@ function repositoryForCredentialMaterialization(assignment, handle) {
1024
1116
  return allowed.length === 1 && allowed[0] ? { repository: allowed[0] } : {};
1025
1117
  }
1026
1118
  function allowedRepositoriesFromAssignment(assignment) {
1027
- const candidates = [
1028
- pathValue(assignment.workflow_authority_contract ?? {}, ['repos', 'allowed']),
1029
- pathValue(recordChildValue(assignment.route_snapshot, 'workflow_authority_contract') ?? {}, [
1030
- 'repos',
1031
- 'allowed',
1032
- ]),
1033
- pathValue(recordChildValue(assignment.execution_profile_snapshot, 'workflow_authority_contract') ?? {}, ['repos', 'allowed']),
1034
- pathValue(recordChildValue(assignment.workflow_snapshot, 'workflow_authority_contract') ?? {}, [
1035
- 'repos',
1036
- 'allowed',
1037
- ]),
1038
- pathValue(recordChildValue(assignment.runner_workspace_snapshot, 'workflow_authority_contract') ?? {}, ['repos', 'allowed']),
1039
- ];
1119
+ const candidates = assignmentWorkflowAuthorityContracts(assignment).map((contract) => pathValue(contract, ['repos', 'allowed']));
1040
1120
  return [
1041
1121
  ...new Set(candidates
1042
1122
  .flatMap((value) => (Array.isArray(value) ? value : []))
@@ -1066,8 +1146,9 @@ function decryptRunnerWrappedSecret(keyPair, wrapped) {
1066
1146
  }
1067
1147
  function collectCredentialHandles(assignment) {
1068
1148
  const snapshots = [
1069
- assignment.execution_profile_snapshot,
1070
- assignment.workflow_snapshot,
1149
+ assignmentTargetSnapshot(assignment),
1150
+ assignmentExecutionProfileSnapshot(assignment),
1151
+ assignmentWorkflowSnapshot(assignment),
1071
1152
  yamlSnapshotDocument(assignment),
1072
1153
  ].filter(isRecord);
1073
1154
  const handles = new Set();
@@ -1076,25 +1157,35 @@ function collectCredentialHandles(assignment) {
1076
1157
  ...credentialRefsFrom(pathValue(snapshot, ['credentials', 'include'])),
1077
1158
  ...credentialRefsFrom(pathValue(snapshot, ['credentials', 'repo_checkout'])),
1078
1159
  ...credentialRefsFrom(pathValue(snapshot, ['credentials', 'mcp_api'])),
1160
+ ...credentialRefsFromCredentialMap(snapshot['credentials']),
1079
1161
  ...credentialRefsFrom(snapshot['credential_refs']),
1080
1162
  ...actionCredentialRefs(snapshot['nodes']),
1081
1163
  ]) {
1082
1164
  handles.add(handle);
1083
1165
  }
1084
1166
  }
1085
- for (const contract of [
1086
- assignment.workflow_authority_contract,
1087
- recordChildValue(assignment.route_snapshot, 'workflow_authority_contract'),
1088
- recordChildValue(assignment.execution_profile_snapshot, 'workflow_authority_contract'),
1089
- recordChildValue(assignment.workflow_snapshot, 'workflow_authority_contract'),
1090
- recordChildValue(assignment.runner_workspace_snapshot, 'workflow_authority_contract'),
1091
- ]) {
1167
+ for (const contract of assignmentWorkflowAuthorityContracts(assignment)) {
1092
1168
  for (const handle of credentialRefsFrom(pathValue(asRecord(contract), ['credentials', 'provider_actions']))) {
1093
1169
  handles.add(handle);
1094
1170
  }
1095
1171
  }
1096
1172
  return [...handles].sort();
1097
1173
  }
1174
+ function credentialRefsFromCredentialMap(entries) {
1175
+ if (!isRecord(entries))
1176
+ return [];
1177
+ return Object.values(entries).flatMap((entry) => {
1178
+ if (!isRecord(entry))
1179
+ return [];
1180
+ const mode = stringField(entry, 'mode') ?? stringField(entry, 'storage_posture');
1181
+ if (mode && !['viewport_brokered', 'viewport_managed'].includes(mode))
1182
+ return [];
1183
+ const handle = stringField(entry, 'handle') ??
1184
+ stringField(entry, 'ref') ??
1185
+ stringField(entry, 'credential_ref');
1186
+ return handle ? [handle] : [];
1187
+ });
1188
+ }
1098
1189
  function credentialRefsFrom(entries) {
1099
1190
  return credentialEntriesFrom(entries).flatMap((entry) => {
1100
1191
  if (typeof entry === 'string' && entry.trim() !== '')
@@ -1198,6 +1289,13 @@ async function waitForApprovalAndResume(options, platformRunId, localRunId, assi
1198
1289
  while (true) {
1199
1290
  await heartbeat(options, 'online', 'busy');
1200
1291
  const assignment = await getAssignment(options, platformRunId, assignmentClaimToken);
1292
+ const commandRun = await applyBrokerActionCompletedCommands(options, platformRunId, assignment, localRunId, assignmentClaimToken);
1293
+ if (commandRun) {
1294
+ if (commandRun.status !== 'blocked')
1295
+ return commandRun;
1296
+ await delay(options.commandSleepSeconds * 1000);
1297
+ continue;
1298
+ }
1201
1299
  const approved = await approvedNodeForAssignment(options, platformRunId, assignmentClaimToken, localRunId);
1202
1300
  if (approved) {
1203
1301
  const resumed = await resumeApprovedLocalRun(options, platformRunId, localRunId, approved, assignmentClaimToken);
@@ -1229,9 +1327,39 @@ async function waitForApprovalAndResume(options, platformRunId, localRunId, assi
1229
1327
  await syncLocalRun(options, platformRunId, run, assignmentClaimToken);
1230
1328
  return run;
1231
1329
  }
1330
+ const current = await readExistingLocalRun(localRunId);
1331
+ if (current) {
1332
+ await syncLocalRun(options, platformRunId, current, assignmentClaimToken);
1333
+ }
1232
1334
  await delay(options.commandSleepSeconds * 1000);
1233
1335
  }
1234
1336
  }
1337
+ async function applyBrokerActionCompletedCommands(options, platformRunId, assignment, localRunId, assignmentClaimToken) {
1338
+ const localRun = await readExistingLocalRun(localRunId);
1339
+ const commands = (assignment.runtime_commands ?? []).filter((command) => command['type'] === 'workflow.action_completed' &&
1340
+ !brokerActionCommandAlreadyApplied(localRun, command));
1341
+ if (commands.length === 0)
1342
+ return null;
1343
+ const response = await daemonJson('POST', `/api/workflows/runs/${encodeURIComponent(localRunId)}/runtime-commands`, { runtime_commands: commands });
1344
+ const run = readRun(response);
1345
+ await syncLocalRun(options, platformRunId, run, assignmentClaimToken);
1346
+ if (terminalRunStatus(run.status)) {
1347
+ clearRunCredentialMaterial(platformRunId);
1348
+ }
1349
+ return run;
1350
+ }
1351
+ function brokerActionCommandAlreadyApplied(run, command) {
1352
+ const nodeKey = stringValue(command['workflow_node_id']);
1353
+ if (!nodeKey)
1354
+ return false;
1355
+ const node = run?.nodes?.[nodeKey];
1356
+ if (!node || node.status !== 'completed')
1357
+ return false;
1358
+ const receipt = recordValue(node.metadata?.['executionReceipt']);
1359
+ const receiptKey = stringValue(receipt?.['receipt_key']);
1360
+ const commandReceiptKey = stringValue(command['receipt_key']);
1361
+ return Boolean(receiptKey && commandReceiptKey && receiptKey === commandReceiptKey);
1362
+ }
1235
1363
  const alreadyResolvedApprovalRuns = new WeakSet();
1236
1364
  async function approvedNodeForAssignment(options, platformRunId, assignmentClaimToken, localRunId) {
1237
1365
  const assignment = await getAssignment(options, platformRunId, assignmentClaimToken);
@@ -1292,6 +1420,18 @@ function blockedNodeIds(run) {
1292
1420
  .map((node) => node.id));
1293
1421
  }
1294
1422
  async function resumeApprovedLocalRun(options, platformRunId, localRunId, approved, assignmentClaimToken) {
1423
+ const assignment = await getAssignment(options, platformRunId, assignmentClaimToken);
1424
+ const localRun = await readExistingLocalRun(localRunId);
1425
+ const materialAssignment = localRun
1426
+ ? assignmentWithLocalRunSnapshot(assignment, localRun, assignmentClaimToken)
1427
+ : {
1428
+ ...assignment,
1429
+ assignment_claim_token: assignment.assignment_claim_token ?? assignmentClaimToken ?? null,
1430
+ };
1431
+ const cachedMaterial = runCredentialMaterialCache.get(platformRunId);
1432
+ const material = cachedMaterial && hasRuntimeSecrets(cachedMaterial)
1433
+ ? cachedMaterial
1434
+ : await materializeAndCacheRunCredentials(options, materialAssignment);
1295
1435
  try {
1296
1436
  await daemonJson('POST', `/api/workflows/runs/${encodeURIComponent(localRunId)}/approvals/${encodeURIComponent(approved.node_key)}`, {
1297
1437
  approved: managedApprovalApproved(approved),
@@ -1301,6 +1441,8 @@ async function resumeApprovedLocalRun(options, platformRunId, localRunId, approv
1301
1441
  expectedActionDigest: approvalExpectedActionDigest(approved),
1302
1442
  executionGrant: approvalExecutionGrant(approved),
1303
1443
  feedback: approvalFeedback(approved),
1444
+ runtimeSecretEnv: material.runtimeSecretEnv,
1445
+ runtimeSecretFiles: material.runtimeSecretFiles,
1304
1446
  });
1305
1447
  }
1306
1448
  catch (error) {
@@ -1317,14 +1459,75 @@ async function resumeApprovedLocalRun(options, platformRunId, localRunId, approv
1317
1459
  await syncLocalRun(options, platformRunId, run, assignmentClaimToken);
1318
1460
  }, progressSyncEveryMs(options.leaseSeconds));
1319
1461
  await syncLocalRun(options, platformRunId, resumed, assignmentClaimToken);
1462
+ if (terminalRunStatus(resumed.status)) {
1463
+ clearRunCredentialMaterial(platformRunId);
1464
+ }
1320
1465
  return resumed;
1321
1466
  }
1467
+ function hasRuntimeSecrets(material) {
1468
+ return Object.keys(material.runtimeSecretEnv).length > 0;
1469
+ }
1470
+ function assignmentWithLocalRunSnapshot(assignment, localRun, assignmentClaimToken) {
1471
+ return {
1472
+ ...assignment,
1473
+ assignment_claim_token: assignment.assignment_claim_token ?? assignmentClaimToken ?? null,
1474
+ yaml_snapshot: localRun.yamlSnapshot || assignment.yaml_snapshot,
1475
+ directory_path: localRun.directoryPath || assignment.directory_path,
1476
+ input_snapshot: localRun.inputs ?? assignment.input_snapshot,
1477
+ resource_manifest: localRun.resourceManifest ?? assignmentResourceManifest(assignment),
1478
+ workflow_authority_contract: localRun.workflowAuthorityContract ??
1479
+ assignmentWorkflowAuthorityContract(assignment) ??
1480
+ undefined,
1481
+ };
1482
+ }
1483
+ function assignmentTargetSnapshot(assignment) {
1484
+ return assignment.target_snapshot ?? assignment.targetSnapshot ?? null;
1485
+ }
1486
+ function assignmentRouteSnapshot(assignment) {
1487
+ return assignment.route_snapshot ?? assignment.routeSnapshot ?? null;
1488
+ }
1489
+ function assignmentExecutionProfileSnapshot(assignment) {
1490
+ return assignment.execution_profile_snapshot ?? assignment.executionProfileSnapshot ?? null;
1491
+ }
1492
+ function assignmentWorkflowSnapshot(assignment) {
1493
+ return assignment.workflow_snapshot ?? assignment.workflowSnapshot ?? null;
1494
+ }
1495
+ function assignmentRunnerWorkspaceSnapshot(assignment) {
1496
+ return assignment.runner_workspace_snapshot ?? assignment.runnerWorkspaceSnapshot ?? null;
1497
+ }
1498
+ function assignmentResourceManifest(assignment) {
1499
+ return assignment.resource_manifest ?? assignment.resourceManifest ?? null;
1500
+ }
1501
+ function assignmentContextReceiptsSnapshot(assignment) {
1502
+ return assignment.context_receipts_snapshot ?? assignment.contextReceiptsSnapshot ?? null;
1503
+ }
1504
+ function assignmentWorkflowAuthorityContract(assignment) {
1505
+ return assignmentWorkflowAuthorityContracts(assignment)[0] ?? null;
1506
+ }
1507
+ function assignmentWorkflowAuthorityContracts(assignment) {
1508
+ return [
1509
+ assignment.workflow_authority_contract ?? null,
1510
+ assignment.workflowAuthorityContract ?? null,
1511
+ recordChildValue(assignmentTargetSnapshot(assignment), 'workflow_authority_contract'),
1512
+ recordChildValue(assignmentTargetSnapshot(assignment), 'workflowAuthorityContract'),
1513
+ recordChildValue(assignmentRouteSnapshot(assignment), 'workflow_authority_contract'),
1514
+ recordChildValue(assignmentRouteSnapshot(assignment), 'workflowAuthorityContract'),
1515
+ recordChildValue(assignmentExecutionProfileSnapshot(assignment), 'workflow_authority_contract'),
1516
+ recordChildValue(assignmentExecutionProfileSnapshot(assignment), 'workflowAuthorityContract'),
1517
+ recordChildValue(assignmentWorkflowSnapshot(assignment), 'workflow_authority_contract'),
1518
+ recordChildValue(assignmentWorkflowSnapshot(assignment), 'workflowAuthorityContract'),
1519
+ recordChildValue(assignmentRunnerWorkspaceSnapshot(assignment), 'workflow_authority_contract'),
1520
+ recordChildValue(assignmentRunnerWorkspaceSnapshot(assignment), 'workflowAuthorityContract'),
1521
+ recordChildValue(recordChildValue(asRecord(assignment.input_snapshot), 'viewport'), 'workflow_authority_contract'),
1522
+ recordChildValue(recordChildValue(asRecord(assignment.input_snapshot), 'viewport'), 'workflowAuthorityContract'),
1523
+ ].filter(isRecord);
1524
+ }
1322
1525
  function isAlreadyResolvedApprovalError(error) {
1323
1526
  const message = error instanceof Error ? error.message : String(error);
1324
1527
  return message.includes('Workflow node is not awaiting approval');
1325
1528
  }
1326
1529
  function isResolvedManagedGateNode(node) {
1327
- if (!['approval', 'gate', 'plan', 'action'].includes(String(node.type ?? '')))
1530
+ if (!['approval', 'gate', 'plan'].includes(String(node.type ?? '')))
1328
1531
  return false;
1329
1532
  if (node.status === 'completed')
1330
1533
  return true;
@@ -1336,11 +1539,7 @@ function isResolvedManagedGateNode(node) {
1336
1539
  'approved' in approval) {
1337
1540
  return true;
1338
1541
  }
1339
- if (node.type !== 'action' || node.status !== 'queued')
1340
- return false;
1341
- return (!!approval &&
1342
- typeof approval === 'object' &&
1343
- approval.approved === true);
1542
+ return false;
1344
1543
  }
1345
1544
  function managedApprovalApproved(node) {
1346
1545
  const approval = node.metadata?.['approval'];
@@ -1364,11 +1563,23 @@ function managedApprovalDecision(node) {
1364
1563
  }
1365
1564
  async function getAssignment(options, platformRunId, assignmentClaimToken) {
1366
1565
  const body = await platformJson(options, 'GET', `workflow-runs/${encodeURIComponent(platformRunId)}`, undefined, assignmentClaimToken);
1367
- return dataFrom(body);
1566
+ return assignmentFrom(body);
1368
1567
  }
1369
1568
  async function syncLocalRun(options, platformRunId, run, assignmentClaimToken) {
1370
1569
  const body = await platformJson(options, 'PATCH', `workflow-runs/${encodeURIComponent(platformRunId)}/sync`, localRunToSyncPayload(run, { includeApprovalDecisions: false }), assignmentClaimToken);
1371
- return dataFrom(body);
1570
+ return assignmentFrom(body);
1571
+ }
1572
+ function assignmentFrom(body) {
1573
+ const data = dataFrom(body);
1574
+ if (!isRecord(data))
1575
+ return data;
1576
+ if (isRecord(body) && Array.isArray(body['runtime_commands'])) {
1577
+ return {
1578
+ ...data,
1579
+ runtime_commands: body['runtime_commands'],
1580
+ };
1581
+ }
1582
+ return data;
1372
1583
  }
1373
1584
  async function ensureDirectory(directoryPath) {
1374
1585
  const resolvedPath = path.resolve(directoryPath);