agor-live 0.21.2 → 0.22.0

package/dist/daemon/services/branches.js

@@ -187,15 +187,19 @@ var init_unix_group_init = __esm({
 
 // src/services/branches.ts
 import { existsSync as existsSync2 } from "fs";
-import { mkdir } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
 import { analyticsLogger } from "@agor/core/analytics";
-import { ENVIRONMENT, isBranchRbacEnabled, loadConfig, PAGINATION } from "@agor/core/config";
+import {
+  createUserProcessEnvironment,
+  ENVIRONMENT,
+  isBranchRbacEnabled,
+  loadConfig,
+  PAGINATION
+} from "@agor/core/config";
 import {
   BoardRepository,
   BranchRepository as BranchRepository2,
-  KnowledgeNamespaceRepository as KnowledgeNamespaceRepository2
+  KnowledgeNamespaceRepository as KnowledgeNamespaceRepository2,
+  UsersRepository as UsersRepository2
 } from "@agor/core/db";
 import { renderBranchSnapshot } from "@agor/core/environment/render-snapshot";
 import {
@@ -208,7 +212,11 @@ import {
 import { BadRequest, Forbidden as Forbidden2, NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
 import { stripGitUrlCredentials } from "@agor/core/git";
 import { getAssistantConfig as getAssistantConfig2, isAssistant as isAssistant3 } from "@agor/core/types";
-import { getGidFromGroupName, spawnEnvironmentCommand } from "@agor/core/unix";
+import {
+  getGidFromGroupName,
+  resolveUnixUserForImpersonation,
+  validateResolvedUnixUser
+} from "@agor/core/unix";
 import { resolveHostIpAddress } from "@agor/core/utils/host-ip";
 import { isAllowedHealthCheckUrl } from "@agor/core/utils/url";
 
@@ -624,19 +632,19 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
-  const dirname2 = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
+  const dirname = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
-    path.join(dirname2, "../executor/cli.js"),
+    path.join(dirname, "../executor/cli.js"),
     // Bundled in agor-live
-    path.join(dirname2, "../../executor/cli.js"),
+    path.join(dirname, "../../executor/cli.js"),
     // Bundled one level up
-    path.join(dirname2, "../../../packages/executor/bin/agor-executor"),
+    path.join(dirname, "../../../packages/executor/bin/agor-executor"),
     // Development - bin script
-    path.join(dirname2, "../../../packages/executor/dist/cli.js"),
+    path.join(dirname, "../../../packages/executor/dist/cli.js"),
     // Development - built dist
-    path.join(dirname2, "../../../../packages/executor/bin/agor-executor"),
+    path.join(dirname, "../../../../packages/executor/bin/agor-executor"),
     // Development from deeper nesting
-    path.join(dirname2, "../../../../packages/executor/dist/cli.js")
+    path.join(dirname, "../../../../packages/executor/dist/cli.js")
     // Development from deeper nesting
   ];
   const executorPath = possiblePaths.find((p) => existsSync(p));
@@ -796,6 +804,263 @@ function spawnExecutorWithTemplate(payload, options) {
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
 }
+var EXECUTOR_RESULT_PREFIX = "AGOR_EXECUTOR_RESULT ";
+function parseExecutorResultFromStdout(stdout) {
+  const lines = stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    const resultJson = line.startsWith(EXECUTOR_RESULT_PREFIX) ? line.slice(EXECUTOR_RESULT_PREFIX.length) : line.startsWith("{") && line.endsWith("}") ? line : null;
+    if (!resultJson) continue;
+    try {
+      const parsed = JSON.parse(resultJson);
+      if (parsed && typeof parsed === "object" && "success" in parsed) {
+        return parsed;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function logChunkedOutput(prefix, stream, chunk) {
+  const text = chunk.toString();
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    if (line.trim().startsWith(EXECUTOR_RESULT_PREFIX)) continue;
+    if (stream === "stdout") {
+      if (process.env.AGOR_EXECUTOR_DEBUG_STDOUT === "1") {
+        console.log(`${prefix} ${line}`);
+      }
+    } else {
+      console.error(`${prefix} ${line}`);
+    }
+  }
+}
+async function runExecutorCommand(payload, options = {}) {
+  const { templateVariables, logPrefix = "[Executor]", timeoutMs = 6e4 } = options;
+  const executorCommandTemplate = options.executorCommandTemplate !== void 0 ? options.executorCommandTemplate || void 0 : configuredExecutorDefaults.executorCommandTemplate;
+  const asUser = options.asUser !== void 0 ? options.asUser || void 0 : configuredExecutorDefaults.asUser;
+  const payloadWithConfig = withResolvedConfig(payload);
+  if (executorCommandTemplate) {
+    return runExecutorCommandWithTemplate(payloadWithConfig, {
+      ...options,
+      timeoutMs,
+      asUser,
+      executorCommandTemplate,
+      templateVariables: {
+        command: payloadWithConfig.command,
+        task_id: generateTaskId(),
+        unix_user: asUser,
+        log_level: resolveExecutorLogLevel(options.env ?? process.env),
+        ...templateVariables
+      },
+      logPrefix
+    });
+  }
+  return runExecutorCommandLocal(payloadWithConfig, { ...options, timeoutMs, asUser, logPrefix });
+}
+function runExecutorCommandLocal(payload, options) {
+  const executorPath = findExecutorPath();
+  const executorDir = path.dirname(path.dirname(executorPath));
+  const {
+    cwd = executorDir,
+    env = process.env,
+    logPrefix = "[Executor]",
+    asUser: rawAsUser,
+    preparedEnv,
+    preparedEnvFilePath,
+    timeoutMs = 6e4
+  } = options;
+  const asUser = rawAsUser || void 0;
+  if (cwd && !existsSync(cwd)) {
+    return Promise.resolve({
+      success: false,
+      error: {
+        code: "EXECUTOR_CWD_MISSING",
+        message: `Refusing to spawn: cwd does not exist on disk: ${cwd}`
+      }
+    });
+  }
+  const daemonUrl = getDaemonUrl();
+  const envWithDaemonUrl = preparedEnv ? withDaemonExecutorEnv(preparedEnv, daemonUrl) : asUser ? withDaemonExecutorEnv(
+    Object.fromEntries(
+      Object.entries({
+        PATH: env.PATH || "/usr/local/bin:/usr/bin:/bin",
+        NODE_ENV: env.NODE_ENV,
+        LOG_LEVEL: env.LOG_LEVEL,
+        ANTHROPIC_API_KEY: env.ANTHROPIC_API_KEY,
+        ANTHROPIC_AUTH_TOKEN: env.ANTHROPIC_AUTH_TOKEN,
+        ANTHROPIC_BASE_URL: env.ANTHROPIC_BASE_URL,
+        CLAUDE_CODE_OAUTH_TOKEN: env.CLAUDE_CODE_OAUTH_TOKEN,
+        OPENAI_API_KEY: env.OPENAI_API_KEY,
+        OPENAI_BASE_URL: env.OPENAI_BASE_URL,
+        GEMINI_API_KEY: env.GEMINI_API_KEY,
+        GOOGLE_API_KEY: env.GOOGLE_API_KEY,
+        GIT_CONFIG_PARAMETERS: env.GIT_CONFIG_PARAMETERS
+      }).filter(([_, v]) => v !== void 0)
+    ),
+    daemonUrl
+  ) : withDaemonExecutorEnv(env, daemonUrl);
+  const prepared = asUser ? preparedEnvFilePath ? {
+    inlineEnv: Object.fromEntries(
+      Object.entries(envWithDaemonUrl).filter(([k]) => !isSecretEnvKey(k))
+    ),
+    envFilePath: preparedEnvFilePath
+  } : prepareImpersonationEnv({ asUser, env: envWithDaemonUrl }) : { inlineEnv: void 0, envFilePath: void 0 };
+  const { cmd, args } = buildSpawnArgs("node", [executorPath, "--stdin"], {
+    asUser,
+    env: asUser ? prepared.inlineEnv : void 0,
+    envFilePath: prepared.envFilePath
+  });
+  console.log(`${logPrefix} Running executor command: ${payload.command ?? "?"}`);
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const child = spawn(cmd, args, {
+      cwd,
+      env: asUser ? void 0 : { ...envWithDaemonUrl },
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: false
+    });
+    attachEnvFileCleanup(child, { envFilePath: prepared.envFilePath, asUser });
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill("SIGTERM");
+      resolve({
+        success: false,
+        error: {
+          code: "EXECUTOR_TIMEOUT",
+          message: `Executor command timed out after ${timeoutMs}ms`,
+          details: { command: payload.command }
+        }
+      });
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+      logChunkedOutput(logPrefix, "stdout", chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+      logChunkedOutput(logPrefix, "stderr", chunk);
+    });
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({
+        success: false,
+        error: {
+          code: "EXECUTOR_SPAWN_ERROR",
+          message: error.message,
+          details: { command: payload.command }
+        }
+      });
+    });
+    child.on("exit", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const result = parseExecutorResultFromStdout(stdout);
+      if (result) {
+        resolve(result);
+        return;
+      }
+      resolve({
+        success: false,
+        error: {
+          code: "EXECUTOR_RESULT_MISSING",
+          message: `Executor exited with code ${code} but did not emit a JSON result`,
+          details: {
+            command: payload.command,
+            exitCode: code,
+            stderr: stderr ? "[redacted; enable executor debug logs]" : ""
+          }
+        }
+      });
+    });
+    child.stdin?.write(JSON.stringify(payload));
+    child.stdin?.end();
+  });
+}
+function runExecutorCommandWithTemplate(payload, options) {
+  const {
+    executorCommandTemplate,
+    templateVariables,
+    logPrefix = "[Executor]",
+    timeoutMs = 6e4
+  } = options;
+  const logLevel = templateVariables.log_level ?? getCurrentLogLevel();
+  const command = substituteTemplateVariables(executorCommandTemplate, templateVariables);
+  console.log(`${logPrefix} Running templated executor command: ${payload.command ?? "?"}`);
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const child = spawn("sh", ["-c", command], {
+      env: { ...process.env, LOG_LEVEL: logLevel },
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill("SIGTERM");
+      resolve({
+        success: false,
+        error: {
+          code: "EXECUTOR_TIMEOUT",
+          message: `Executor command timed out after ${timeoutMs}ms`,
+          details: { command: payload.command, taskId: templateVariables.task_id }
+        }
+      });
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+      logChunkedOutput(logPrefix, "stdout", chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+      logChunkedOutput(logPrefix, "stderr", chunk);
+    });
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({
+        success: false,
+        error: {
+          code: "EXECUTOR_SPAWN_ERROR",
+          message: error.message,
+          details: { command: payload.command, taskId: templateVariables.task_id }
+        }
+      });
+    });
+    child.on("exit", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const result = parseExecutorResultFromStdout(stdout);
+      if (result) {
+        resolve(result);
+        return;
+      }
+      resolve({
+        success: false,
+        error: {
+          code: "EXECUTOR_RESULT_MISSING",
+          message: `Executor exited with code ${code} but did not emit a JSON result`,
+          details: {
+            command: payload.command,
+            exitCode: code,
+            stderr: stderr ? "[redacted; enable executor debug logs]" : ""
+          }
+        }
+      });
+    });
+    child.stdin?.write(JSON.stringify(payload));
+    child.stdin?.end();
+  });
+}
 function getDaemonUrl() {
   if (configuredDaemonUrl) return configuredDaemonUrl;
   return `http://localhost:${process.env.PORT || "3030"}`;
@@ -1060,6 +1325,136 @@ var BranchesService = class extends DrizzleService {
       truncated
     };
   }
+  async resolveEnvironmentExecutorContext(branch) {
+    const config = await loadConfig();
+    const unixUserMode = config.execution?.unix_user_mode ?? "simple";
+    let asUser;
+    if (unixUserMode !== "simple") {
+      const usersRepo = new UsersRepository2(this.db);
+      const user = await usersRepo.findById(branch.created_by);
+      const impersonationResult = resolveUnixUserForImpersonation({
+        mode: unixUserMode,
+        userUnixUsername: user?.unix_username,
+        executorUnixUser: config.execution?.executor_unix_user
+      });
+      asUser = impersonationResult.unixUser ?? void 0;
+      if (asUser) {
+        validateResolvedUnixUser(unixUserMode, asUser);
+      }
+    }
+    const env = await createUserProcessEnvironment(branch.created_by, this.db, void 0, !!asUser);
+    return { asUser, env };
+  }
+  async createEnvironmentExecutorPayload(options) {
+    const { branch, action, params } = options;
+    const userId = params?.user?.user_id ?? branch.created_by;
+    const appWithToken = this.app;
+    const sessionToken = await appWithToken.sessionTokenService?.generateToken(
+      `environment-${action}`,
+      userId,
+      { branchId: branch.branch_id, maxUses: -1 }
+    );
+    if (!sessionToken) {
+      throw new Error(`Session token service unavailable; cannot dispatch environment ${action}`);
+    }
+    const { asUser, env } = await this.resolveEnvironmentExecutorContext(branch);
+    return {
+      asUser,
+      env,
+      payload: {
+        command: "environment.lifecycle",
+        sessionToken,
+        daemonUrl: getDaemonUrl(),
+        env,
+        params: {
+          branchId: branch.branch_id,
+          branchPath: branch.path,
+          action,
+          startCommand: branch.start_command,
+          stopCommand: branch.stop_command,
+          nukeCommand: branch.nuke_command,
+          appUrl: branch.app_url
+        }
+      }
+    };
+  }
+  async dispatchEnvironmentExecutor(options) {
+    const { branch, action } = options;
+    const { payload, asUser, env } = await this.createEnvironmentExecutorPayload(options);
+    spawnExecutor(payload, {
+      logPrefix: `[Environment.${action} ${branch.name}]`,
+      asUser,
+      preparedEnv: env,
+      templateVariables: {
+        branch_id: branch.branch_id
+      }
+    });
+  }
+  async runEnvironmentExecutor(options) {
+    const { branch, action } = options;
+    const { payload, asUser, env } = await this.createEnvironmentExecutorPayload(options);
+    const result = await runExecutorCommand(payload, {
+      logPrefix: `[Environment.${action} ${branch.name}]`,
+      asUser,
+      preparedEnv: env,
+      // Mixed webhook/shell restart needs the daemon to wait for shell stop
+      // before it invokes the daemon-owned webhook start. Keep this generous
+      // enough for docker compose down while still bounding the request.
+      timeoutMs: 10 * 6e4,
+      templateVariables: {
+        branch_id: branch.branch_id
+      }
+    });
+    if (!result.success) {
+      const details = result.error?.details;
+      const error = new Error(
+        result.error?.message || "Executor environment command failed"
+      );
+      error.commandOutput = details?.output;
+      throw error;
+    }
+  }
+  async fetchEnvironmentLogsViaExecutor(branch, logsCommand, params) {
+    const userId = params?.user?.user_id ?? branch.created_by;
+    const appWithToken = this.app;
+    const sessionToken = await appWithToken.sessionTokenService?.generateToken(
+      "environment-logs",
+      userId,
+      { branchId: branch.branch_id, maxUses: -1 }
+    );
+    if (!sessionToken) {
+      throw new Error("Session token service unavailable; cannot fetch environment logs");
+    }
+    const { asUser, env } = await this.resolveEnvironmentExecutorContext(branch);
+    const result = await runExecutorCommand(
+      {
+        command: "environment.logs",
+        sessionToken,
+        daemonUrl: getDaemonUrl(),
+        env,
+        params: {
+          branchId: branch.branch_id,
+          branchPath: branch.path,
+          logsCommand
+        }
+      },
+      {
+        logPrefix: `[Environment.logs ${branch.name}]`,
+        asUser,
+        preparedEnv: env,
+        timeoutMs: ENVIRONMENT.LOGS_TIMEOUT_MS,
+        templateVariables: {
+          branch_id: branch.branch_id
+        }
+      }
+    );
+    if (!result.success) {
+      const details = result.error?.details;
+      throw new Error(result.error?.message || details?.output || "Failed to fetch logs");
+    }
+    const data = result.data ?? {};
+    return { stdout: data.logs ?? "", stderr: "", truncated: data.truncated ?? false };
+  }
   /**
    * Extract caller identity for audit logging. Internal/daemon-initiated
    * calls (no params.provider, no user) return undefined which the audit
@@ -1913,8 +2308,18 @@ var BranchesService = class extends DrizzleService {
   /**
    * Custom method: Update environment status
    */
-  async updateEnvironment(id, environmentUpdate, params) {
-    const existing = await this.get(id, params);
+  async updateEnvironment(idOrData, environmentUpdateOrParams, params) {
+    const isRpcEnvelope = typeof idOrData === "object";
+    const id = isRpcEnvelope ? idOrData.branch_id ?? idOrData.branchId : idOrData;
+    const environmentUpdate = isRpcEnvelope ? idOrData.environment_update ?? idOrData.environmentUpdate : environmentUpdateOrParams;
+    const resolvedParams = isRpcEnvelope ? environmentUpdateOrParams : params;
+    if (!id) {
+      throw new Error("Branch ID is required to update environment status");
+    }
+    if (!environmentUpdate) {
+      throw new Error("Environment update is required");
+    }
+    const existing = await this.get(id, resolvedParams);
     const updatedEnvironment = {
       ...existing.environment_instance,
       ...environmentUpdate
@@ -1939,7 +2344,7 @@ var BranchesService = class extends DrizzleService {
         environment_instance: updatedEnvironment,
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
-      params
+      resolvedParams
     );
     return branch;
   }
@@ -1955,6 +2360,9 @@ var BranchesService = class extends DrizzleService {
     if (branch.environment_instance?.status === "running") {
       throw new Error("Environment is already running");
     }
+    const command = branch.start_command;
+    const execution = await this.resolveEnvironmentCommand(command, "start");
+    const access_urls = branch.app_url ? [{ name: "App", url: branch.app_url }] : void 0;
     await this.updateEnvironment(
       id,
       {
@@ -1963,26 +2371,16 @@ var BranchesService = class extends DrizzleService {
           ...branch.environment_instance?.process,
           started_at: (/* @__PURE__ */ new Date()).toISOString()
         },
+        access_urls,
         last_health_check: void 0,
         last_error: void 0
       },
       params
     );
     try {
-      const command = branch.start_command;
-      const execution = await this.resolveEnvironmentCommand(command, "start");
       console.log(
         `\u{1F680} Starting environment for branch ${branch.name}: ${execution.kind === "webhook" ? redactManagedEnvWebhookUrlForAudit(execution.url) : execution.command}`
       );
-      const logPath = join(
-        homedir(),
-        ".agor",
-        "logs",
-        "branches",
-        branch.branch_id,
-        "environment.log"
-      );
-      await mkdir(dirname(logPath), { recursive: true });
       if (execution.kind === "webhook") {
         await this.executeEnvironmentWebhook({
           url: execution.url,
@@ -1993,61 +2391,9 @@ var BranchesService = class extends DrizzleService {
         });
         console.log(`\u2705 Start webhook completed successfully for ${branch.name}`);
       } else {
-        const childProcess = await spawnEnvironmentCommand({
-          command: execution.command,
-          branch,
-          db: this.db,
-          commandType: "start",
-          stdio: "pipe",
-          triggeredBy: this.extractTriggeredBy(params)
-        });
-        const outputChunks = [];
-        const MAX_OUTPUT_LINES = 100;
-        const collectOutput = (stream, prefix) => {
-          if (!stream) return;
-          stream.on("data", (chunk) => {
-            const text = chunk.toString();
-            if (prefix) {
-              process.stderr.write(text);
-            } else {
-              process.stdout.write(text);
-            }
-            outputChunks.push(text);
-          });
-        };
-        collectOutput(childProcess.stdout);
-        collectOutput(childProcess.stderr, "stderr");
-        await new Promise((resolve, reject) => {
-          childProcess.on("exit", (code) => {
-            if (code === 0) {
-              console.log(`\u2705 Start command completed successfully for ${branch.name}`);
-              resolve();
-            } else {
-              const fullOutput = outputChunks.join("");
-              const lines = fullOutput.split("\n");
-              const truncated = lines.length > MAX_OUTPUT_LINES ? `... (truncated ${lines.length - MAX_OUTPUT_LINES} lines)
-${lines.slice(-MAX_OUTPUT_LINES).join("\n")}` : fullOutput;
-              const output = truncated.trim();
-              const err = new Error(`Start command exited with code ${code}`);
-              err.commandOutput = output || void 0;
-              reject(err);
-            }
-          });
-          childProcess.on("error", (error) => reject(error));
-        });
-      }
-      let access_urls;
-      if (branch.app_url) {
-        access_urls = [{ name: "App", url: branch.app_url }];
+        await this.dispatchEnvironmentExecutor({ branch, action: "start", params });
       }
-      return await this.updateEnvironment(
-        id,
-        {
-          // Don't change status - keep as 'starting' until first successful health check
-          access_urls
-        },
-        params
-      );
+      return await this.get(id, params);
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : "Unknown error";
       const commandOutput = error instanceof Error ? error.commandOutput : void 0;
@@ -2073,17 +2419,10 @@ ${lines.slice(-MAX_OUTPUT_LINES).join("\n")}` : fullOutput;
   async stopEnvironment(id, params) {
     await this.ensureCanTriggerEnv(id, params, "stop branch environments");
     const branch = await this.get(id, params);
-    await this.updateEnvironment(
-      id,
-      {
-        status: "stopping"
-      },
-      params
-    );
+    await this.updateEnvironment(id, { status: "stopping" }, params);
     try {
       if (branch.stop_command) {
-        const command = branch.stop_command;
-        const execution = await this.resolveEnvironmentCommand(command, "stop");
+        const execution = await this.resolveEnvironmentCommand(branch.stop_command, "stop");
         console.log(
           `\u{1F6D1} Stopping environment for branch ${branch.name}: ${execution.kind === "webhook" ? redactManagedEnvWebhookUrlForAudit(execution.url) : execution.command}`
         );
@@ -2096,23 +2435,8 @@ ${lines.slice(-MAX_OUTPUT_LINES).join("\n")}` : fullOutput;
             maxBytes: 16 * 1024
           });
         } else {
-          const stopProcess = await spawnEnvironmentCommand({
-            command: execution.command,
-            branch,
-            db: this.db,
-            commandType: "stop",
-            triggeredBy: this.extractTriggeredBy(params)
-          });
-          await new Promise((resolve, reject) => {
-            stopProcess.on("exit", (code) => {
-              if (code === 0) {
-                resolve();
-              } else {
-                reject(new Error(`Down command exited with code ${code}`));
-              }
-            });
-            stopProcess.on("error", (error) => reject(error));
-          });
+          await this.dispatchEnvironmentExecutor({ branch, action: "stop", params });
+          return await this.get(id, params);
         }
       } else {
         const managedProcess = this.processes.get(id);
@@ -2164,11 +2488,42 @@ ${lines.slice(-MAX_OUTPUT_LINES).join("\n")}` : fullOutput;
   async restartEnvironment(id, params) {
     await this.ensureCanTriggerEnv(id, params, "restart branch environments");
     const branch = await this.get(id, params);
-    if (branch.environment_instance?.status === "running") {
+    if (!branch.start_command) {
+      throw new Error("No start command configured for this branch");
+    }
+    if (branch.environment_instance?.status !== "running") {
+      return await this.startEnvironment(id, params);
+    }
+    const startExecution = await this.resolveEnvironmentCommand(branch.start_command, "start");
+    const stopExecution = branch.stop_command ? await this.resolveEnvironmentCommand(branch.stop_command, "stop") : void 0;
+    if (!branch.stop_command || stopExecution?.kind === "webhook") {
       await this.stopEnvironment(id, params);
-      await new Promise((resolve) => setTimeout(resolve, 1e3));
+      return await this.startEnvironment(id, params);
+    }
+    if (startExecution.kind === "webhook") {
+      await this.updateEnvironment(id, { status: "stopping" }, params);
+      await this.runEnvironmentExecutor({ branch, action: "stop", params });
+      return await this.startEnvironment(id, params);
+    }
+    await this.updateEnvironment(id, { status: "stopping" }, params);
+    try {
+      await this.dispatchEnvironmentExecutor({ branch, action: "restart", params });
+      return await this.get(id, params);
+    } catch (error) {
+      await this.updateEnvironment(
+        id,
+        {
+          status: "error",
+          last_health_check: {
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            status: "unhealthy",
+            message: error instanceof Error ? error.message : "Unknown error during restart"
+          }
+        },
+        params
+      );
+      throw error;
     }
-    return await this.startEnvironment(id, params);
   }
   /**
    * Custom method: Nuke environment (destructive operation)
@@ -2179,16 +2534,9 @@ ${lines.slice(-MAX_OUTPUT_LINES).join("\n")}` : fullOutput;
     if (!branch.nuke_command) {
       throw new Error("No nuke_command configured for this branch");
     }
-    await this.updateEnvironment(
-      id,
-      {
-        status: "stopping"
-      },
-      params
-    );
+    await this.updateEnvironment(id, { status: "stopping" }, params);
     try {
-      const command = branch.nuke_command;
-      const execution = await this.resolveEnvironmentCommand(command, "nuke");
+      const execution = await this.resolveEnvironmentCommand(branch.nuke_command, "nuke");
       console.log(
         `\u{1F4A3} NUKING environment for branch ${branch.name}: ${execution.kind === "webhook" ? redactManagedEnvWebhookUrlForAudit(execution.url) : execution.command}`
       );
@@ -2202,23 +2550,8 @@ ${lines.slice(-MAX_OUTPUT_LINES).join("\n")}` : fullOutput;
           maxBytes: 16 * 1024
         });
       } else {
-        const nukeProcess = await spawnEnvironmentCommand({
-          command: execution.command,
-          branch,
-          db: this.db,
-          commandType: "nuke",
-          triggeredBy: this.extractTriggeredBy(params)
-        });
-        await new Promise((resolve, reject) => {
-          nukeProcess.on("exit", (code) => {
-            if (code === 0) {
-              resolve();
-            } else {
-              reject(new Error(`Nuke command exited with code ${code}`));
-            }
-          });
-          nukeProcess.on("error", (error) => reject(error));
-        });
+        await this.dispatchEnvironmentExecutor({ branch, action: "nuke", params });
+        return await this.get(id, params);
       }
       const managedProcess = this.processes.get(id);
       if (managedProcess) {
@@ -2376,54 +2709,7 @@ ${lines.slice(-MAX_OUTPUT_LINES).join("\n")}` : fullOutput;
         commandType: "logs",
         triggeredBy: this.extractTriggeredBy(params),
         maxBytes: ENVIRONMENT.LOGS_MAX_BYTES
-      }).then(({ body, truncated: truncated2 }) => ({ stdout: body, stderr: "", truncated: truncated2 })) : await new Promise((resolve, reject) => {
-        spawnEnvironmentCommand({
-          command: execution.command,
-          branch,
-          db: this.db,
-          commandType: "logs",
-          stdio: "pipe",
-          // Need to capture output for logs
-          triggeredBy: this.extractTriggeredBy(params)
-        }).then((childProcess) => {
-          let stdout = "";
-          let stderr = "";
-          let truncated2 = false;
-          const timeout = setTimeout(() => {
-            childProcess.kill("SIGTERM");
-            reject(
-              new Error(
-                `Logs command timed out after ${ENVIRONMENT.LOGS_TIMEOUT_MS / 1e3}s`
-              )
-            );
-          }, ENVIRONMENT.LOGS_TIMEOUT_MS);
-          childProcess.stdout?.on("data", (data) => {
-            const chunk = data.toString();
-            if (stdout.length + chunk.length <= ENVIRONMENT.LOGS_MAX_BYTES) {
-              stdout += chunk;
-            } else {
-              stdout += chunk.substring(0, ENVIRONMENT.LOGS_MAX_BYTES - stdout.length);
-              truncated2 = true;
-              childProcess.kill("SIGTERM");
-            }
-          });
-          childProcess.stderr?.on("data", (data) => {
-            stderr += data.toString();
-          });
-          childProcess.on("exit", (code) => {
-            clearTimeout(timeout);
-            if (code === 0 || stdout.length > 0) {
-              resolve({ stdout, stderr, truncated: truncated2 });
-            } else {
-              reject(new Error(stderr || `Logs command exited with code ${code}`));
-            }
-          });
-          childProcess.on("error", (error) => {
-            clearTimeout(timeout);
-            reject(error);
-          });
-        }).catch(reject);
-      });
+      }).then(({ body, truncated: truncated2 }) => ({ stdout: body, stderr: "", truncated: truncated2 })) : await this.fetchEnvironmentLogsViaExecutor(branch, execution.command, params);
       const allLines = result.stdout.split("\n");
       let finalLines = allLines;
       let wasTruncatedByLines = false;