apphx 1.1.0 → 2.0.1

package/dist/runner.js

@@ -1,106 +1,29 @@
-import { ResearchSchema, ReviewSchema, toError } from "./schemas.js";
+import { validateMyGoCommand, validateMyGoPackaging } from "./mygo-build.js";
+import { ReviewSchema, toError, validateJobConfig } from "./schemas.js";
+import { canonicalPath, expandArgv, inside } from "./config.js";
 import { executionEnvironment, processGroupAlive, run } from "./process.js";
-import { pollApple, shipApple } from "./apple.js";
-import { expandArgv, inside } from "./config.js";
+import { closestOwnedGoWorkspace } from "./go-dependencies.js";
+import { dependencyDigest, generatedModulePaths, isGeneratedPath } from "./dependencies.js";
+import { artifactOutputPath, prepareWorkspace, projectDirectory, sourceDigest } from "./workspace.js";
 import { checkPrerequisites } from "./preflight.js";
+import { prepareIsolatedCommand } from "./isolation.js";
 import { flutterEnvironment, prepareFlutter } from "./flutter.js";
-import { prepareExportOptions } from "./export-options.js";
-import { GENERATED_PATHS, dependencyDigest, isGeneratedPath, validateLocalDependencies } from "./dependencies.js";
+import { prepareExportOptions, prepareNativeExportCommands } from "./export-options.js";
+import { parseResearch, researchPrompt, reviewInstructions } from "./policy.js";
+import { assertProject, buildInstructions } from "./project-profiles.js";
+import { validateMacOSArtifact } from "./macos.js";
+import { invalidateVerification } from "./proof.js";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import { createHash, randomUUID } from "node:crypto";
-import { delimiter, join, relative } from "node:path";
-import { constants, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync } from "node:fs";
 // src/runner.ts
-const REQUIRED_POLICY_RULES = [
-	"2.1",
-	"2.3.1",
-	"2.5.19",
-	"4.2",
-	"4.2.6",
-	"4.3",
-	"5.1.1"
-];
-function sourceDigest(root, omitGenerated = true) {
-	if (lstatSync(root).isSymbolicLink()) throw new Error("A source or screenshot root cannot be a symlink");
-	if (omitGenerated) {
-		for (const path of GENERATED_PATHS) inside(root, path);
-		validateLocalDependencies(root);
-	}
-	const hash = createHash("sha256");
-	function visit(directory) {
-		for (const entry of readdirSync(directory).sort()) {
-			const path = join(directory, entry);
-			if (omitGenerated && isGeneratedPath(relative(root, path))) continue;
-			const stat = lstatSync(path);
-			if (stat.isSymbolicLink()) throw new Error(`Source symlink is not permitted: ${relative(root, path)}`);
-			if (stat.isDirectory()) visit(path);
-			else if (stat.isFile()) hash.update(relative(root, path)).update("\0").update(`${stat.size}:${stat.mode & 511}\0`).update(readFileSync(path));
-		}
-	}
-	visit(root);
-	return hash.digest("hex");
-}
 function requireDependencyProof(job) {
 	if (!job.verifiedDependencyDigest) throw Object.assign(/* @__PURE__ */ new Error("Dependency resolution proof is missing; retry this stopped task to re-run verification"), { code: "SETUP_REQUIRED" });
-	if (dependencyDigest(job.workspace) !== job.verifiedDependencyDigest) throw Object.assign(/* @__PURE__ */ new Error("Dependency resolution changed since verification; re-verification is required"), { code: "EVIDENCE_CHANGED" });
-}
-function parseVerdict(text) {
-	const content = text.trim().replace(/^```(?:json)?\s*\n?/, "").replace(/\n?```$/, "");
-	try {
-		return JSON.parse(content);
-	} catch {
-		throw new Error("Host did not return a JSON verdict; no approval was inferred from text or an exit code");
-	}
-}
-function parseResearch(text) {
-	const research = ResearchSchema.parse(parseVerdict(text));
-	const cited = /* @__PURE__ */ new Set();
-	for (const source of Array.isArray(research?.policySources) ? research.policySources : []) {
-		if (typeof source?.url !== "string") continue;
-		try {
-			const url = new URL(source.url);
-			if (url.protocol === "https:" && url.hostname === "developer.apple.com") cited.add(source.rule);
-		} catch {}
-	}
-	if (typeof research?.viable !== "boolean" || !REQUIRED_POLICY_RULES.every((rule) => cited.has(rule)) || typeof research.distinctness !== "string" || !research.distinctness.trim() || !Array.isArray(research.plan) || !research.plan.length || research.plan.some((step) => typeof step !== "string" || !step.trim())) throw new Error("Research verdict requires boolean viability, all required official policy references, distinctness reasoning and a concrete implementation plan");
-	return research;
-}
-function prepareWorkspace(store, job) {
-	if (!job.baseJobId || job.basePrepared) return;
-	const base = store.get(job.baseJobId);
-	if (!job.baseDigest || sourceDigest(base.workspace) !== job.baseDigest) throw Object.assign(/* @__PURE__ */ new Error("Predecessor source changed since intake; refusing to copy unverified code"), { code: "SETUP_REQUIRED" });
-	if (existsSync(job.workspace)) {
-		if (sourceDigest(job.workspace) !== job.baseDigest) throw Object.assign(/* @__PURE__ */ new Error("Uninitialized successor workspace differs from its verified predecessor; inspect it before retrying"), { code: "SETUP_REQUIRED" });
-	} else {
-		mkdirSync(job.config.workspaceRoot, {
-			recursive: true,
-			mode: 448
-		});
-		const staging = mkdtempSync(join(job.config.workspaceRoot, `.${job.id}.base-`));
-		const prepared = join(staging, "source");
-		try {
-			cpSync(base.workspace, prepared, {
-				recursive: true,
-				force: false,
-				errorOnExist: true,
-				mode: constants.COPYFILE_FICLONE,
-				filter: (path) => !isGeneratedPath(relative(base.workspace, path))
-			});
-			if (sourceDigest(prepared) !== job.baseDigest || sourceDigest(base.workspace) !== job.baseDigest) throw new Error("Predecessor changed while copying; no successor was initialized");
-			renameSync(prepared, job.workspace);
-		} finally {
-			rmSync(staging, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-	store.update(job.id, { basePrepared: true });
+	if (dependencyDigest(job.workspace, job.spec.framework, job.spec.project?.directory) !== job.verifiedDependencyDigest) throw Object.assign(/* @__PURE__ */ new Error("Dependency resolution changed since verification; re-verification is required"), { code: "EVIDENCE_CHANGED" });
 }
 function taskPrompt(job) {
-	return `You are the native host of an embedded Flutter app Harness. Use your own context, tools and native delegation in ${job.workspace}; never launch another coding-agent CLI. Implement only this product. Never hide functionality from App Review or use obfuscation to imitate distinct utility. Do not upload, submit, push, read publisher credentials or change factory state. These instructions constrain this workflow, not arbitrary host tools: the workspace is not a security sandbox. Complete real implementations, not placeholders.\nImmutable product requirements:\n${JSON.stringify(job.spec, null, 2)}\nPrevious verification/review failure (repair the mechanism, never weaken acceptance):\n${job.feedback ?? job.error ?? "none"}\nPersisted execution logs:\n${JSON.stringify(job.logs.slice(-3))}\nContinue existing work. Only actual deterministic checks performed by the Harness establish verification; host claims do not.\n`;
-}
-function assertTurnPermission(job, options) {
-	if (options.buildOnly && (job.config.allowSubmit || job.config.allowRelease)) throw new Error("--build-only refuses this task with snapshotted publication permission");
+	return `You are the native host of an embedded multi-stack app Harness. Use your own context, tools and native delegation in ${projectDirectory(job)}; never launch another coding-agent CLI. Preserve the requested framework and existing architecture. Implement only this product. Never hide functionality from users or reviewers. Do not upload, submit, push, read publisher credentials or change factory state. Remote build commands belong only to the explicitly authorized Harness packaging profile, not host turns. The workspace is not a security sandbox. Complete real implementations, not placeholders.\nImmutable product requirements:\n${JSON.stringify(job.spec, null, 2)}\nPrevious verification/review failure (repair the mechanism, never weaken acceptance):\n${job.feedback ?? job.error ?? "none"}\nPersisted execution logs:\n${JSON.stringify(job.logs.slice(-3))}\nContinue existing work. Only actual deterministic checks performed by the Harness establish verification; host claims do not.\n`;
 }
 function contextDigest(job) {
 	return createHash("sha256").update(JSON.stringify({
@@ -123,9 +46,9 @@ function deadlineExpired(job) {
 }
 function requireReviewProof(job) {
 	try {
-		if (!job.verifiedDigest || sourceDigest(job.workspace) !== job.verifiedDigest) throw new Error("Source changed since verification; stale evidence cannot approve a release");
+		if (!job.verifiedDigest || sourceDigest(job.workspace, true, job.spec.framework, job.spec.project?.directory) !== job.verifiedDigest) throw new Error("Source changed since verification; stale evidence cannot approve a handoff");
 		requireDependencyProof(job);
-		if (job.spec.apple?.screenshotsDir && sourceDigest(inside(job.workspace, job.spec.apple.screenshotsDir), false) !== job.screenshotDigest) throw new Error("Screenshots changed since runtime verification; stale evidence cannot approve a release");
+		if (job.spec.screenshotsDir && sourceDigest(inside(projectDirectory(job), job.spec.screenshotsDir), false) !== job.screenshotDigest) throw new Error("Screenshots changed since runtime verification; stale evidence cannot approve a handoff");
 	} catch (cause) {
 		const error = toError(cause);
 		if (error.code !== "SETUP_REQUIRED") error.code = "EVIDENCE_CHANGED";
@@ -136,17 +59,27 @@ function hostAction(store, job) {
 	const turn = job.turn;
 	let instruction;
 	if (turn.stage === "research") {
-		const portfolio = store.list().filter((value) => value.id !== job.id).map((value) => ({
+		const portfolio = store.list().filter((value) => value.id !== job.id && value.spec.channel === job.spec.channel && value.spec.id !== job.spec.id).map((value) => ({
 			id: value.spec.id,
 			purpose: value.spec.purpose,
 			audience: value.spec.audience,
 			differentiators: value.spec.differentiators
 		}));
-		instruction = `Research only with your own host tools. Retrieve the current official Apple review guidelines at https://developer.apple.com/app-store/review/guidelines/ and assess rules ${REQUIRED_POLICY_RULES.join(", ")}, offline persistence/backup and distinct utility against portfolio ${JSON.stringify(portfolio)}. Assess content ownership and submitting account compliance with rule 4.2.6; report unknowns rather than inventing attestations. Return a typed JSON result {"viable":boolean,"policySources":[{"rule":"4.2","url":"https://developer.apple.com/..."}],"distinctness":"specific reasoning","risks":["..."],"plan":["concrete step"]}. Cite all required rules. These host-supplied citations are not independently verified policy evidence. Do not promise App Store approval.`;
-	} else if (turn.stage === "build") instruction = `Research plan: ${JSON.stringify(job.research)}\nCreate a complete iOS Flutter project in this cwd if absent. Implement the entire product, persistence and validated backup/restore, accessibility and realistic empty/error states. Include real integration_test and test_driver acceptance workflows and real simulator screenshots under the requested screenshots directory; never fake screenshots or bypass tests. Use the returned environment with your own tools. The configured SDK, if any, is external to source; keep development caches task-local. Frozen checks: ${JSON.stringify(job.config.verification)}. Complete this turn without a result payload when source is ready; the Harness will then run verification, not infer success.`;
-	else instruction = `Use a native independent reviewer with a fresh context when your host supports one. Review actual source and acceptance tests read-only; do not edit files. If independent review is unavailable, disclose that limitation rather than claim a separate reviewer. Verified source: ${job.verifiedDigest}; dependency resolution: ${job.verifiedDependencyDigest}; actual checks: ${JSON.stringify(job.config.verification)}. Reject incomplete workflows, data loss, untested backup/corrupt import, fake screenshots, accessibility failures, placeholders, misleading legal claims, weak tests, hidden features and repetitive products. Return typed JSON {"approved":boolean,"findings":["blocking issue"],"acceptanceEvidence":[{"requirement":"exact acceptance string","evidence":"file/symbol + observed command or scenario"}]}. Cover every acceptance requirement. Host reviewer identity is advisory; the Harness gates only typed results and unchanged deterministic evidence.`;
-	const environment = flutterEnvironment(job.config, job.workspace, { CI: "1" });
-	if (job.config.toolchain) {
+		instruction = researchPrompt(job, portfolio);
+	} else if (turn.stage === "build") instruction = `Research plan: ${JSON.stringify(job.research)}\n${buildInstructions(job.spec)} Implement the entire requested product, accessibility and realistic empty/error states. Add genuine device/simulator acceptance workflows and real screenshots when requested; never fake screenshots or bypass tests. Do not add unrequested offline/backup/account features. Use the returned environment with your tools. Frozen verification and packaging: ${JSON.stringify({
+		verification: job.config.verification,
+		packaging: job.config.packaging,
+		packageTarget: job.config.packageTarget
+	})}. Complete this turn without a result payload when source is ready; the Harness will then execute verification, not infer success.`;
+	else instruction = reviewInstructions(job);
+	const environment = job.spec.framework === "flutter" ? flutterEnvironment(job.config, job.workspace, { CI: "1" }) : { CI: "1" };
+	if (job.spec.framework === "mygo") Object.assign(environment, {
+		GOENV: "off",
+		GOTOOLCHAIN: "local",
+		GOFLAGS: "-mod=readonly",
+		GOWORK: closestOwnedGoWorkspace(job.workspace, job.spec.project?.directory) ?? "off"
+	});
+	if (job.spec.framework === "flutter" && job.config.toolchain) {
 		environment.FLUTTER_ROOT = job.config.toolchain.flutterSdk;
 		environment.PATH = `${join(job.config.toolchain.flutterSdk, "bin")}${process.env.PATH ? `${delimiter}${process.env.PATH}` : ""}`;
 	}
@@ -157,7 +90,7 @@ function hostAction(store, job) {
 			id: turn.id,
 			stage: turn.stage,
 			prompt: taskPrompt(job) + instruction,
-			cwd: job.workspace,
+			cwd: projectDirectory(job),
 			environment: Object.fromEntries(Object.entries(environment).filter((entry) => entry[1] !== void 0))
 		}
 	};
@@ -166,15 +99,8 @@ function repair(job, message) {
 	return {
 		stage: "build",
 		status: (job.attempts[job.stage] ?? 0) >= job.config.maxAttempts ? "failed" : "waiting",
+		...invalidateVerification(),
 		turn: null,
-		review: null,
-		verifiedDigest: null,
-		verifiedDependencyDigest: null,
-		screenshotDigest: null,
-		verifiedAt: void 0,
-		artifact: null,
-		ipaPath: null,
-		archiveDigest: null,
 		feedback: message,
 		error: message,
 		nextAt: Date.now() + job.config.retryDelayMs
@@ -184,13 +110,11 @@ async function nextTurn(store, id, options = {}) {
 	store.acquire();
 	try {
 		let job = store.get(id);
-		assertTurnPermission(job, options);
 		if (job.turn) {
 			if (job.status !== "running" || job.stage !== job.turn.stage || contextDigest(job) !== job.turn.contextDigest) throw new Error("Active host turn context changed; abandon its token before requesting another turn");
 			if (deadlineExpired(job)) {
 				const claimed = job.turn;
 				job = store.transition(id, (current) => {
-					assertTurnPermission(current, options);
 					if (current.turn?.id !== claimed.id || contextDigest(current) !== claimed.contextDigest) throw new Error("Host turn changed while checking its deadline; inspect the current task");
 					return {
 						turn: null,
@@ -212,9 +136,7 @@ async function nextTurn(store, id, options = {}) {
 		if ([
 			"failed",
 			"ready",
-			"built",
-			"approved",
-			"released"
+			"built"
 		].includes(job.status)) return {
 			job,
 			action: "done"
@@ -233,7 +155,6 @@ async function nextTurn(store, id, options = {}) {
 		};
 		if (deadlineExpired(job) || job.hostTurns >= job.config.maxHostTurns || (job.attempts[job.stage] ?? 0) >= job.config.maxAttempts) {
 			job = store.transition(id, (current) => {
-				assertTurnPermission(current, options);
 				return {
 					status: "failed",
 					error: "Host turn, stage attempt or task wall-clock limit reached; no further host work will start"
@@ -247,7 +168,7 @@ async function nextTurn(store, id, options = {}) {
 		try {
 			if (job.stage === "review") requireReviewProof(job);
 			prepareWorkspace(store, job);
-			mkdirSync(job.workspace, {
+			mkdirSync(projectDirectory(job), {
 				recursive: true,
 				mode: 448
 			});
@@ -263,7 +184,6 @@ async function nextTurn(store, id, options = {}) {
 			};
 		}
 		job = store.transition(id, (current) => {
-			assertTurnPermission(current, options);
 			const eligible = ["queued", "waiting"].includes(current.status) || current.status === "blocked" && current.blockedReason?.kind === "prerequisite";
 			if (current.turn || contextDigest(current) !== contextDigest(job) || current.nextAt > Date.now() || !eligible || current.groups.length || current.manualRecovery) throw new Error("Task changed before the host turn could be claimed");
 			if (deadlineExpired(current) || current.hostTurns >= current.config.maxHostTurns || (current.attempts[current.stage] ?? 0) >= current.config.maxAttempts) return {
@@ -298,7 +218,6 @@ async function nextTurn(store, id, options = {}) {
 }
 function completeTurn(store, id, turnId, result, options = {}) {
 	return store.transition(id, (job) => {
-		assertTurnPermission(job, options);
 		if (!job.turn || job.turn.id !== turnId || job.turn.stage !== job.stage || job.status !== "running") throw new Error("Stale, replayed or wrong-phase host turn; use next to inspect the active token");
 		if (contextDigest(job) !== job.turn.contextDigest) throw new Error("Host turn context changed; abandon this stale token before continuing");
 		if (job.groups.length || job.manualRecovery) throw new Error("Command recovery must finish before completing a host turn");
@@ -309,29 +228,21 @@ function completeTurn(store, id, turnId, result, options = {}) {
 		};
 		let patch;
 		if (job.stage === "research") {
-			const research = parseResearch(JSON.stringify(ResearchSchema.parse(result)));
+			const research = parseResearch(JSON.stringify(result), job.spec.channel);
 			patch = research.viable ? {
 				stage: "build",
 				research
 			} : {
 				status: "failed",
 				research,
-				error: "Research rejected this product; no replacement product or review evasion will be attempted"
+				error: "Research rejected this product; no replacement product will be attempted"
 			};
 		} else if (job.stage === "build") {
 			if (result !== void 0) throw new Error("Build completion accepts no result payload; actual deterministic verification is required");
-			const project = inside(job.workspace, "pubspec.yaml");
-			if (!lstatSync(project).isFile()) throw new Error("Build completion requires a regular pubspec.yaml in the task workspace");
+			assertProject(projectDirectory(job), job.spec);
 			patch = {
-				stage: "verify",
-				verifiedDigest: null,
-				verifiedDependencyDigest: null,
-				screenshotDigest: null,
-				verifiedAt: void 0,
-				review: null,
-				artifact: null,
-				ipaPath: null,
-				archiveDigest: null
+				...invalidateVerification(),
+				stage: job.config.obfuscation ? "obfuscate" : "verify"
 			};
 		} else {
 			const review = ReviewSchema.parse(result);
@@ -365,7 +276,6 @@ function completeTurn(store, id, turnId, result, options = {}) {
 }
 function abandonTurn(store, id, turnId, options = {}) {
 	return store.transition(id, (job) => {
-		assertTurnPermission(job, options);
 		if (!job.turn || job.turn.id !== turnId) throw new Error("Stale or replayed host turn; no active claim was abandoned");
 		if (job.groups.length || job.manualRecovery) throw new Error("Command recovery must finish before abandoning a host turn");
 		store.event(id, {
@@ -406,30 +316,46 @@ async function executeStep(store, job, { signal } = {}) {
 		status: "blocked",
 		error: config.executionWarning ?? "Local execution is disabled. Explicitly enable allowLocalExecution only for trusted deterministic commands in a dedicated account or VM."
 	});
-	if (deadlineExpired(job) && !["publish", "monitor"].includes(job.stage)) return store.update(job.id, {
+	if (deadlineExpired(job)) return store.update(job.id, {
 		status: "failed",
 		error: "Task wall-clock limit reached; no further work will start"
 	});
 	const attemptNumber = (job.attempts[job.stage] ?? 0) + 1;
 	let attempts = { ...job.attempts };
 	let attemptCharged = false;
-	const developerEnv = flutterEnvironment(config, job.workspace, executionEnvironment(config));
-	const verifierEnv = flutterEnvironment(config, job.workspace, executionEnvironment(config), true);
+	const developerEnv = job.spec.framework === "flutter" ? flutterEnvironment(config, job.workspace, executionEnvironment(config)) : executionEnvironment(config);
+	const verifierEnv = job.spec.framework === "flutter" ? flutterEnvironment(config, job.workspace, executionEnvironment(config), true) : developerEnv;
 	const environment = ["verify", "package"].includes(job.stage) ? verifierEnv : developerEnv;
 	const logPath = join(config.stateDir, "logs", job.id, `${job.stage}-${attemptNumber}-${Date.now()}.log`);
 	store.update(job.id, { logs: [...job.logs, logPath] });
-	const exec = async (argv, options = {}) => {
+	const readableFiles = /* @__PURE__ */ new Set();
+	const trackedRun = async (argv, options = {}, capabilities = {}) => {
 		let pid;
+		let isolated;
 		try {
 			const effectiveEnv = options.env ?? environment;
+			if (job.spec.framework === "mygo") validateMyGoCommand(config, argv);
 			const command = effectiveEnv.FLUTTER_ROOT && ["flutter", "dart"].includes(argv[0]) ? [join(effectiveEnv.FLUTTER_ROOT, "bin", argv[0]), ...argv.slice(1)] : argv;
-			const result = await run(command, {
-				cwd: job.workspace,
+			const cwd = options.cwd ?? projectDirectory(job);
+			if (config.isolation && [
+				"obfuscate",
+				"verify",
+				"package"
+			].includes(job.stage)) isolated = prepareIsolatedCommand(command, {
+				config,
+				workspace: job.workspace,
+				cwd,
 				env: effectiveEnv,
+				readableFiles: [...readableFiles, ...capabilities.readableFiles ?? []],
+				writableDirectories: capabilities.writableDirectories
+			});
+			const result = await run(isolated?.argv ?? command, {
 				timeoutMs: config.timeoutMs,
 				signal,
 				logPath,
 				...options,
+				cwd,
+				env: isolated?.env ?? effectiveEnv,
 				onSpawn: (value, metadata) => {
 					pid = value;
 					const current = store.get(job.id);
@@ -452,33 +378,93 @@ async function executeStep(store, job, { signal } = {}) {
 			}
 			return result;
 		} finally {
-			const current = store.get(job.id);
-			const groups = current.groups.filter(processGroupAlive);
-			const commands = Object.fromEntries(Object.entries(current.commands ?? {}).filter(([pid]) => groups.includes(Number(pid))));
-			store.update(job.id, {
-				groups,
-				commands,
-				recoveryStage: groups.length ? current.recoveryStage ?? job.stage : void 0
+			try {
+				const current = store.get(job.id);
+				const groups = current.groups.filter(processGroupAlive);
+				const commands = Object.fromEntries(Object.entries(current.commands ?? {}).filter(([pid]) => groups.includes(Number(pid))));
+				store.update(job.id, {
+					groups,
+					commands,
+					recoveryStage: groups.length ? current.recoveryStage ?? job.stage : void 0
+				});
+			} finally {
+				isolated?.cleanup();
+			}
+		}
+	};
+	const exec = (argv, options) => trackedRun(argv, options);
+	const utilityExec = (argv, options) => {
+		if (!config.isolation) return trackedRun(argv, options);
+		if (argv[0] !== "/usr/bin/plutil") throw Object.assign(/* @__PURE__ */ new Error("Unexpected isolated export utility"), { code: "SETUP_REQUIRED" });
+		const file = resolve(options?.cwd ?? projectDirectory(job), argv[argv.length - 1]);
+		const actual = canonicalPath(file), state = canonicalPath(config.stateDir), directory = dirname(actual);
+		const within = (root, target) => {
+			const path = relative(root, target);
+			return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+		};
+		if (within(job.workspace, file) && !within(job.workspace, actual) && !config.isolation.readOnlyPaths.some((root) => within(root, actual))) throw Object.assign(/* @__PURE__ */ new Error("Workspace export options cannot grant access to an unapproved external file"), { code: "SETUP_REQUIRED" });
+		const snapshot = dirname(directory) === state && basename(directory).startsWith("export-options-") && basename(actual) === "ExportOptions.plist";
+		if (within(state, actual) && !snapshot || within(canonicalPath(config.workspaceRoot), actual) && !within(job.workspace, actual) || config.configPath && actual === canonicalPath(config.configPath)) throw Object.assign(/* @__PURE__ */ new Error("Export utility cannot read protected control state or another task"), { code: "SETUP_REQUIRED" });
+		const writing = argv[1] === "-convert" && argv[2] === "xml1";
+		if (writing && !snapshot) throw Object.assign(/* @__PURE__ */ new Error("Export utility writes require a harness-owned snapshot"), { code: "SETUP_REQUIRED" });
+		return trackedRun([...argv.slice(0, -1), actual], options, {
+			readableFiles: within(job.workspace, actual) ? [] : [actual],
+			writableDirectories: writing ? [directory] : []
+		});
+	};
+	const removeArtifact = async (output) => {
+		if (!config.isolation) {
+			rmSync(output, {
+				recursive: true,
+				force: true
 			});
+			return;
 		}
+		const result = await exec([
+			"/bin/rm",
+			"-rf",
+			"--",
+			output
+		]);
+		if (result.code !== 0) throw Object.assign(/* @__PURE__ */ new Error(`Isolated artifact cleanup was denied: ${result.stderr || result.stdout}`), { code: "SETUP_REQUIRED" });
 	};
 	try {
+		validateJobConfig(job.spec, config);
+		if (job.spec.framework === "mygo") validateMyGoPackaging(config);
 		prepareWorkspace(store, job);
-		mkdirSync(job.workspace, {
+		mkdirSync(projectDirectory(job), {
 			recursive: true,
 			mode: 448
 		});
+		if (job.spec.framework === "mygo") {
+			Object.assign(developerEnv, {
+				GOENV: "off",
+				GOTOOLCHAIN: "local",
+				GOFLAGS: "-mod=readonly",
+				GOWORK: closestOwnedGoWorkspace(job.workspace, job.spec.project?.directory) ?? "off",
+				GOCACHE: developerEnv.GOCACHE ?? join(config.stateDir, "verification-cache", "go-build"),
+				GOMODCACHE: developerEnv.GOMODCACHE ?? join(config.stateDir, "verification-cache", "go-mod")
+			});
+			for (const key of [
+				"MYGO_UPDATER_PRIVATE_KEY",
+				"MYGO_WINDOWS_CERTIFICATE_PASSWORD",
+				"MYGO_CLI_BINARY",
+				"MYGO_LDFLAGS",
+				"MYGO_GENERATE",
+				"MYGO_INSPECTOR"
+			]) delete developerEnv[key];
+		}
 		if (job.stage === "verify" || job.stage === "package") await checkPrerequisites(config.verification.prerequisites ?? [], {
-			cwd: job.workspace,
+			cwd: projectDirectory(job),
 			env: environment,
 			run: exec,
 			signal
 		});
-		if ((job.attempts[job.stage] ?? 0) >= config.maxAttempts && !["publish", "monitor"].includes(job.stage)) return store.update(job.id, {
+		if ((job.attempts[job.stage] ?? 0) >= config.maxAttempts) return store.update(job.id, {
 			status: "failed",
 			error: `Attempt limit reached at ${job.stage}`
 		});
-		if (config.toolchain && ["verify", "package"].includes(job.stage)) {
+		if (job.spec.framework === "flutter" && config.toolchain && ["verify", "package"].includes(job.stage)) {
 			const toolchain = await prepareFlutter(job, {
 				run: exec,
 				env: developerEnv,
@@ -493,7 +479,7 @@ async function executeStep(store, job, { signal } = {}) {
 		store.update(job.id, { attempts });
 		attemptCharged = true;
 		if (job.stage === "verify") {
-			if (config.toolchain) {
+			if (job.spec.framework === "flutter" && config.toolchain) {
 				const dependencies = await exec([
 					"flutter",
 					"pub",
@@ -501,147 +487,163 @@ async function executeStep(store, job, { signal } = {}) {
 				]);
 				if (dependencies.code !== 0) throw new Error(`Verification dependency resolution failed: ${dependencies.stderr.slice(-4e3)}`);
 			}
-			const before = sourceDigest(job.workspace);
-			const dependenciesBefore = dependencyDigest(job.workspace);
+			const before = sourceDigest(job.workspace, true, job.spec.framework, job.spec.project?.directory);
+			const dependenciesBefore = dependencyDigest(job.workspace, job.spec.framework, job.spec.project?.directory);
 			for (const argv of [...config.verification.checks, ...config.verification.runtime]) {
 				const result = await exec(expandArgv(argv, executionEnvironment(config)));
 				if (result.code !== 0) throw new Error(`Verification failed (${result.code}) ${JSON.stringify(argv)}:\n${result.stderr.slice(-5e3)}\n${result.stdout.slice(-5e3)}`);
 			}
-			if (sourceDigest(job.workspace) !== before) throw new Error("Verification changed source files; the new revision must be verified again");
-			if (dependencyDigest(job.workspace) !== dependenciesBefore) throw new Error("Verification changed dependency resolution; the new resolution must be verified again");
+			if (sourceDigest(job.workspace, true, job.spec.framework, job.spec.project?.directory) !== before) throw new Error("Verification changed source files; the new revision must be verified again");
+			if (dependencyDigest(job.workspace, job.spec.framework, job.spec.project?.directory) !== dependenciesBefore) throw new Error("Verification changed dependency resolution; the new resolution must be verified again");
 			return next(store, job, "review", {
 				verifiedDigest: before,
 				verifiedDependencyDigest: dependenciesBefore,
-				screenshotDigest: job.spec.apple?.screenshotsDir ? sourceDigest(inside(job.workspace, job.spec.apple.screenshotsDir), false) : null,
+				screenshotDigest: job.spec.screenshotsDir ? sourceDigest(inside(projectDirectory(job), job.spec.screenshotsDir), false) : null,
 				verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		}
+		if (job.stage === "obfuscate") {
+			const obfuscation = job.config.obfuscation;
+			if (!obfuscation) throw Object.assign(/* @__PURE__ */ new Error("Obfuscation stage requires config.obfuscation"), { code: "SETUP_REQUIRED" });
+			const expanded = expandArgv(obfuscation.command, environment);
+			const bundled = fileURLToPath(new URL("./vendor/obfuscator/dist/cli.js", import.meta.url));
+			const argv = [
+				...expanded[0] === "obfuscator" && existsSync(bundled) ? [
+					process.execPath,
+					bundled,
+					...expanded.slice(1)
+				] : expanded,
+				"--project",
+				projectDirectory(job),
+				"--config",
+				obfuscation.configPath,
+				"--framework",
+				job.spec.framework,
+				...obfuscation.seed ? ["--seed", obfuscation.seed] : []
+			];
+			const result = await trackedRun(argv, {}, { readableFiles: [obfuscation.configPath] });
+			if (result.code !== 0) throw new Error(`Obfuscation failed (${result.code}) ${JSON.stringify(argv)}:\n${result.stderr.slice(-5e3)}\n${result.stdout.slice(-5e3)}`);
+			return next(store, job, "verify");
+		}
 		if (job.stage === "package") {
 			requireReviewProof(job);
 			if (!job.review?.approved || job.review.findings.length) throw new Error("Packaging requires an approved host review");
-			if (process.platform !== "darwin") throw Object.assign(/* @__PURE__ */ new Error("iOS packaging requires the Mac worker; use the SSH controller from Linux"), { code: "SETUP_REQUIRED" });
 			const target = config.packageTarget;
-			if (config.allowSubmit && target !== "ipa") throw Object.assign(/* @__PURE__ */ new Error("Only a verified IPA can enter publication"), { code: "SETUP_REQUIRED" });
-			const output = inside(job.workspace, target === "ipa" ? "build/ios/ipa" : "build/ios/iphonesimulator");
-			if (target === "ipa" && !config.apple?.exportOptionsPlist) throw Object.assign(/* @__PURE__ */ new Error("Configure apple.exportOptionsPlist and valid local signing before IPA packaging"), { code: "SETUP_REQUIRED" });
-			const apple = job.spec.apple;
-			if (target === "ipa" && (!apple?.version || !apple.buildNumber)) throw Object.assign(/* @__PURE__ */ new Error("apple.version and apple.buildNumber are required for signing"), { code: "SETUP_REQUIRED" });
-			let exportOptions;
-			let built;
-			try {
-				if (target === "ipa") exportOptions = await prepareExportOptions(config.apple.exportOptionsPlist, config.stateDir, exec);
-				store.update(job.id, {
-					artifact: null,
-					ipaPath: null,
-					archiveDigest: null
-				});
-				rmSync(output, {
-					recursive: true,
-					force: true
-				});
-				built = await exec(target === "ipa" ? [
-					"flutter",
-					"build",
-					"ipa",
-					"--release",
-					"--build-name",
-					apple.version,
-					"--build-number",
-					apple.buildNumber,
-					"--export-options-plist",
-					exportOptions.path
-				] : [
-					"flutter",
-					"build",
-					"ios",
-					"--simulator",
-					"--debug",
-					"--no-pub"
-				]);
-			} finally {
-				if (exportOptions) rmSync(exportOptions.directory, {
-					recursive: true,
-					force: true
-				});
+			const project = projectDirectory(job);
+			const profile = config.packaging;
+			if (job.cloudBuildPending) throw Object.assign(/* @__PURE__ */ new Error("A previous cloud build may have remote effects. Reconcile it with the provider before creating a new task; this build will not be replayed."), { code: "SETUP_REQUIRED" });
+			if (["ios", "macos"].includes(job.spec.platform) && profile?.provider !== "cloud" && process.platform !== "darwin") throw Object.assign(/* @__PURE__ */ new Error(`Local ${job.spec.platform} packaging requires a macOS worker`), { code: "SETUP_REQUIRED" });
+			let path;
+			store.update(job.id, {
+				artifact: null,
+				ipaPath: null,
+				archiveDigest: null
+			});
+			if (profile) {
+				const output = artifactOutputPath(project, profile.artifactPath);
+				const outputRelative = relative(job.workspace, output).split(sep).join("/");
+				let generated = isGeneratedPath(profile.artifactPath, job.spec.framework);
+				if (!generated) {
+					for (const module of generatedModulePaths(job.workspace, job.spec.framework, job.spec.project?.directory)) if (outputRelative.startsWith(`${module}/`)) {
+						generated = true;
+						break;
+					}
+				}
+				if (!generated || !/(?:^|\/)(?:build|dist|unpackage)(?:\/|$)/.test(profile.artifactPath) || /(?:^|\/)(?:node_modules|\.git|\.gradle|\.factory-cache|Pods)(?:\/|$)/.test(profile.artifactPath)) throw Object.assign(/* @__PURE__ */ new Error("packaging.artifactPath must name an exact generated build/dist/unpackage artifact, never source or dependency caches"), { code: "SETUP_REQUIRED" });
+				if (!output.endsWith(target === "simulator" || target === "app" ? ".app" : `.${target}`)) throw Object.assign(/* @__PURE__ */ new Error(`packaging.artifactPath must end in ${target === "simulator" || target === "app" ? ".app" : `.${target}`}`), { code: "SETUP_REQUIRED" });
+				const prepared = await prepareNativeExportCommands(profile.commands.map((argv) => expandArgv(argv, executionEnvironment(config))), project, config.stateDir, utilityExec);
+				try {
+					for (const file of prepared.readableFiles) readableFiles.add(file);
+					await removeArtifact(output);
+					if (profile.provider === "cloud") store.update(job.id, { cloudBuildPending: true });
+					for (const argv of prepared.commands) {
+						const result = await exec(argv);
+						if (result.code !== 0) throw new Error(`Packaging failed (${result.code}) ${JSON.stringify(argv)}:\n${result.stderr.slice(-5e3)}\n${result.stdout.slice(-5e3)}`);
+					}
+					path = artifactOutputPath(project, profile.artifactPath);
+				} finally {
+					for (const file of prepared.readableFiles) readableFiles.delete(file);
+					prepared.cleanup();
+				}
+			} else {
+				const output = artifactOutputPath(project, target === "ipa" ? "build/ios/ipa" : target === "simulator" ? "build/ios/iphonesimulator" : target === "apk" ? "build/app/outputs/flutter-apk" : "build/app/outputs/bundle/release");
+				if (target === "ipa" && !config.apple?.exportOptionsPlist) throw Object.assign(/* @__PURE__ */ new Error("Configure apple.exportOptionsPlist and valid local signing before IPA packaging"), { code: "SETUP_REQUIRED" });
+				if (target === "ipa" && !job.spec.apple?.buildNumber) throw Object.assign(/* @__PURE__ */ new Error("apple.buildNumber is required for IPA signing"), { code: "SETUP_REQUIRED" });
+				let exportOptions;
+				try {
+					if (target === "ipa") {
+						exportOptions = await prepareExportOptions(config.apple.exportOptionsPlist, config.stateDir, utilityExec);
+						readableFiles.add(exportOptions.path);
+					}
+					await removeArtifact(output);
+					const built = await exec(target === "ipa" ? [
+						"flutter",
+						"build",
+						"ipa",
+						"--release",
+						"--build-name",
+						job.spec.version,
+						"--build-number",
+						job.spec.apple.buildNumber,
+						"--export-options-plist",
+						exportOptions.path
+					] : target === "simulator" ? [
+						"flutter",
+						"build",
+						"ios",
+						"--simulator",
+						"--debug",
+						"--no-pub"
+					] : [
+						"flutter",
+						"build",
+						target === "apk" ? "apk" : "appbundle",
+						"--release",
+						"--no-pub",
+						"--build-name",
+						job.spec.version
+					]);
+					if (built.code !== 0) throw new Error(`${job.spec.framework} ${target} build failed: ${built.stderr.slice(-5e3)}`);
+				} finally {
+					if (exportOptions) {
+						readableFiles.delete(exportOptions.path);
+						rmSync(exportOptions.directory, {
+							recursive: true,
+							force: true
+						});
+					}
+				}
+				const products = readdirSync(output).filter((name) => name.endsWith(target === "simulator" ? ".app" : `.${target}`));
+				if (products.length !== 1) throw new Error(`Expected exactly one ${target} artifact in ${relative(job.workspace, output)}`);
+				path = artifactOutputPath(project, join(relative(project, output), products[0]));
 			}
-			if (built.code !== 0) throw new Error(`iOS ${target} build failed: ${built.stderr.slice(-5e3)}`);
-			if (sourceDigest(job.workspace) !== job.verifiedDigest) throw Object.assign(/* @__PURE__ */ new Error("Packaging changed source; re-verification is required"), { code: "EVIDENCE_CHANGED" });
-			requireDependencyProof(job);
-			const products = readdirSync(output).filter((name) => name.endsWith(target === "ipa" ? ".ipa" : ".app"));
-			if (products.length !== 1) throw new Error(`Expected exactly one ${target === "ipa" ? "IPA" : "simulator app"} in ${relative(job.workspace, output)}`);
-			const path = inside(job.workspace, join(relative(job.workspace, output), products[0]));
-			const digest = target === "ipa" ? createHash("sha256").update(readFileSync(path)).digest("hex") : sourceDigest(path, false);
+			requireReviewProof(job);
+			const stat = lstatSync(path);
+			const bundle = target === "simulator" || target === "app";
+			if (stat.isSymbolicLink() || (bundle ? !stat.isDirectory() || readdirSync(path).length === 0 : !stat.isFile() || stat.size === 0)) throw new Error("Packaging did not produce a nonempty regular artifact of the requested kind");
+			if (target === "app" || target === "dmg") await validateMacOSArtifact(path, target, exec);
+			const digest = bundle ? sourceDigest(path, false) : createHash("sha256").update(readFileSync(path)).digest("hex");
 			const artifact = {
-				kind: target === "ipa" ? "ipa" : "ios-simulator",
+				kind: target === "simulator" ? "ios-simulator" : target === "app" ? "macos-app" : target,
 				path,
 				digest,
 				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			};
-			if (!config.allowSubmit) return store.update(job.id, {
+			return store.update(job.id, {
 				status: "built",
 				artifact,
-				error: null
-			});
-			return next(store, job, "publish", {
-				artifact,
-				ipaPath: path,
-				archiveDigest: digest
-			});
-		}
-		if (job.stage === "publish") {
-			if (!config.allowSubmit) throw Object.assign(/* @__PURE__ */ new Error("This task has no upload/submission permission"), { code: "SETUP_REQUIRED" });
-			if (!job.ipaPath || !job.archiveDigest) throw new Error("Publication requires a completed verified IPA artifact");
-			if (sourceDigest(job.workspace) !== job.verifiedDigest || createHash("sha256").update(readFileSync(job.ipaPath)).digest("hex") !== job.archiveDigest) throw new Error("Source or archive changed after verification; refusing publication");
-			requireDependencyProof(job);
-			const spec = structuredClone(job.spec);
-			if (spec.apple?.screenshotsDir) spec.apple.screenshotsDir = inside(job.workspace, spec.apple.screenshotsDir);
-			if (spec.apple?.screenshotsDir && sourceDigest(spec.apple.screenshotsDir, false) !== job.screenshotDigest) throw new Error("Screenshots changed after runtime verification; refusing to upload different assets");
-			return next(store, job, "monitor", {
-				receipt: await shipApple({
-					spec,
-					ipaPath: job.ipaPath,
-					state: store.get(job.id).receipt,
-					save: (receipt) => {
-						store.update(job.id, { receipt });
-					},
-					run: exec,
-					signal,
-					allowRelease: config.allowRelease
-				}),
-				status: "waiting",
-				nextAt: Date.now() + config.pollMs
-			});
-		}
-		if (job.stage === "monitor") {
-			const result = await pollApple({
-				spec: job.spec,
-				state: job.receipt,
-				signal
-			});
-			if (result.status === "approved" && (result.available || !config.allowRelease)) return store.update(job.id, {
-				status: result.available ? "released" : "approved",
-				appleReview: result,
-				error: null
-			});
-			if (result.status === "rejected") return store.update(job.id, {
-				status: "blocked",
-				appleReview: result,
-				error: "Apple rejected this version. Rejection message details are not available through this API; do not invent feedback. Supply the actual App Review message with the feedback command to resume repairs."
-			});
-			return store.update(job.id, {
-				status: "waiting",
-				appleReview: result,
-				attempts: {
-					...attempts,
-					monitor: 0
-				},
-				nextAt: Date.now() + config.pollMs,
+				cloudBuildPending: false,
 				error: null
 			});
 		}
 		throw new Error(`Unknown task stage ${job.stage}`);
 	} catch (cause) {
 		const error = toError(cause);
+		if (store.get(job.id).cloudBuildPending) return store.update(job.id, {
+			status: "blocked",
+			blockedReason: null,
+			error: `Cloud build outcome requires provider reconciliation; automatic replay is forbidden. ${error.message}`
+		});
 		if (error.code === "PROCESS_CLEANUP_BLOCKED") return store.update(job.id, {
 			status: "blocked",
 			blockedReason: null,
@@ -675,27 +677,7 @@ async function executeStep(store, job, { signal } = {}) {
 			nextAt: Date.now(),
 			error: error.message
 		});
-		if (error.code === "ENOENT" && error.syscall?.startsWith("spawn") || /SETUP_REQUIRED|UNSUPPORTED|APPLE_WRITE_UNCERTAIN|APPLE_STATE_|PROCESS_CLEANUP_BLOCKED/.test(error.code ?? "")) return store.update(job.id, {
-			status: "blocked",
-			error: error.message
-		});
-		if (error.code === "APPLE_PROCESSING" || error.code === "APPLE_RATE_LIMIT") return store.update(job.id, {
-			status: "waiting",
-			attempts: {
-				...attempts,
-				[job.stage]: Math.max(0, (attempts[job.stage] ?? 0) - 1)
-			},
-			error: error.message,
-			nextAt: Date.now() + config.pollMs
-		});
-		const receipt = store.get(job.id).receipt;
-		const publicationRecovery = ["publish", "monitor"].includes(job.stage) && (job.stage === "monitor" || !!(receipt.upload || receipt.pending || receipt.buildId || receipt.submissionId || receipt.versionId || Object.keys(receipt.effects ?? {}).length));
-		if (publicationRecovery && error.transient === true) return store.update(job.id, {
-			status: "waiting",
-			error: error.message,
-			nextAt: Date.now() + config.pollMs
-		});
-		if (job.stage === "monitor" || publicationRecovery && error.code?.startsWith("APPLE_")) return store.update(job.id, {
+		if (error.code === "ENOENT" && error.syscall?.startsWith("spawn") || /SETUP_REQUIRED|UNSUPPORTED|PROCESS_CLEANUP_BLOCKED/.test(error.code ?? "")) return store.update(job.id, {
 			status: "blocked",
 			error: error.message
 		});
@@ -717,6 +699,6 @@ async function executeStep(store, job, { signal } = {}) {
 		});
 	}
 }
-export { abandonTurn, completeTurn, executeStep, nextTurn, parseResearch, parseVerdict, sourceDigest };
+export { abandonTurn, completeTurn, executeStep, nextTurn };
 
 //# sourceMappingURL=runner.js.map