flowviant 0.125.28 → 0.125.30

package/bin/lib/workAgentTurnExecution.mjs

@@ -71,7 +71,13 @@ import { createIntermediateArtifacts, IntermediateArtifactCapacityError } from '
 import { createUiReview } from './uiReview.mjs';
 import { createVideoRender } from './videoRender.mjs';
 import { createManagedBrowser } from './managedBrowser.mjs';
+import { completeBrowserReview, browserHandoffPrompt } from './browserHandoff.mjs';
 import { withUiReview, appendUiReviewEvidence } from './uiReviewTurn.mjs';
+import { setupRepository } from './repositorySetup.mjs';
+import { readEnvironmentRecipe } from './reviewEnvironmentConfig.mjs';
+import { environmentInstructions, environmentOverlay, holdWorktreeEnvironment } from './reviewEnvironment.mjs';
+import { environmentCredentialNames } from './reviewDatabase.mjs';
+import { createRuntimeReview } from './runtimeReview.mjs';
 
 export function createAgentTurnExecution({
   admit,
@@ -104,6 +110,7 @@ export function createAgentTurnExecution({
   makeUiReview = createUiReview,
   makeVideoRender = createVideoRender,
   makeManagedBrowser = createManagedBrowser,
+  makeRuntimeReview = createRuntimeReview,
 }) {
   const reportDelivery = createDeliveryReporter();
   /** How long the final flush may hold the settle. Bounded because the settle
@@ -125,6 +132,7 @@ export function createAgentTurnExecution({
    *  `interruptAgentTurns`); absent, nothing can interrupt it. */
   const runAgentTurnInPlace = async (job, { turnId, agentId, place, releaseSlot, postAgentTurn, measured, run = { interrupted: false } }) => {
     let repositoryRun = null;
+    const environmentReleases = [];
     const setupController = new AbortController();
     run.abortSetup = () => setupController.abort();
     if (run.interrupted) setupController.abort();
@@ -416,6 +424,8 @@ export function createAgentTurnExecution({
     let browserNote = '';
     let uiReviewNote = '';
     let uiReviewEvidence = '';
+    let environmentNote = '', reviewEnv = null;
+    let runtimeReview = null, runtimeNote = '', runtimeEvidence = '';
     // A video card's render tool (videoRender.mjs), and the words a turn
     // gets when it could not be held, so it stops rather than guesses.
     let videoRender = null;
@@ -429,6 +439,8 @@ export function createAgentTurnExecution({
       args = withUiReview(args, uiReviewNote, uiReview?.env);
       args = withUiReview(args, videoNote);
       args = withUiReview(args, browserNote, managedBrowser?.env);
+      args = withUiReview(args, environmentNote, reviewEnv);
+      args = withUiReview(args, runtimeNote, runtimeReview?.env);
       args.managedBrowser = Boolean(managedBrowser);
       return runTurnImpl(args);
     };
@@ -479,6 +491,22 @@ export function createAgentTurnExecution({
     let orchestrator = null;
     let intermediateDelivery = null;
     try {
+      if (posture === 'build') {
+        const sources = repositoryRun?.sources ?? [{ wt, repoRoot: worktreeRepo, baseRef: baseRef() }];
+        const administrativeNames = new Set();
+        for (const source of sources) {
+          const snapshot = readEnvironmentRecipe(source.repoRoot, source.baseRef);
+          if (!snapshot) continue;
+          const environment = await setupRepository(source.repoRoot, source.wt, { snapshot, signal: setupController.signal,
+            onSpawn: ch => { workChildren.set(ch, agentId); groupKillChildren?.add(ch); },
+            onClose: ch => { workChildren.delete(ch); groupKillChildren?.delete(ch); } });
+          environmentReleases.push(holdWorktreeEnvironment(environment));
+          environmentNote += '\n' + environmentInstructions(environment);
+          for (const name of environmentCredentialNames(snapshot.recipe)) administrativeNames.add(name);
+          if (source.wt === wt) reviewEnv = environmentOverlay(environment);
+        }
+        if (administrativeNames.size) reviewEnv = { ...reviewEnv, ...Object.fromEntries([...administrativeNames].map(name => [name, undefined])) };
+      }
       if (posture === 'build' && job.kind !== 'merge_resolve' && ['claude', 'codex'].includes(rt)) {
         try {
           managedBrowser = await makeManagedBrowser({ wt, turnId, signal: setupController.signal, onChild: ch => {
@@ -489,6 +517,14 @@ export function createAgentTurnExecution({
         } catch (error) { browserNote = `The managed browser could not start: ${envScrub(error.message)}. Report interactive browser checks unavailable.`; }
       }
       if (posture === 'build' && job.kind !== 'merge_resolve') {
+        try {
+          runtimeReview = await makeRuntimeReview({ wt, repoRoot: worktreeRepo, baseRef: baseRef(), sources: repositoryRun?.sources ?? [],
+            browser: managedBrowser, signal: setupController.signal, onChild: ch => {
+              workChildren.set(ch, agentId); groupKillChildren?.add(ch);
+              return () => { workChildren.delete(ch); groupKillChildren?.delete(ch); };
+            } });
+          runtimeNote = runtimeReview?.instructions ?? '';
+        } catch (error) { runtimeNote = `Configured runtime review is unavailable: ${envScrub(error.message)}. Use the repository’s existing checks and report unavailable runtime verification.`; }
         try {
           uiReview = await makeUiReview({ wt, signal: setupController.signal, onChild: ch => {
             workChildren.set(ch, agentId); groupKillChildren?.add(ch);
@@ -514,10 +550,13 @@ export function createAgentTurnExecution({
           notify: message => liveInput ? run.live?.inject(message) === true : false,
           taken: id => run.live?.onTaken(id) });
       }
-      const tools = prepareCardTools({ rt, posture, wt, repoRoot, baseRef, sources: repositoryRun?.sources ?? [], repositoryTool: repositoryRun?.tool ?? null, orchestratorConfig: orchestrator?.config ?? null, uiReviewConfig: uiReview?.config, videoConfig: videoRender?.config ?? null, browserConfig: managedBrowser?.config, orchestrated: Boolean(orchestrator), codexHome: agentResume.codexHome });
+      const tools = prepareCardTools({ rt, posture, wt, repoRoot, baseRef, sources: repositoryRun?.sources ?? [], repositoryTool: repositoryRun?.tool ?? null, orchestratorConfig: orchestrator?.config ?? null, uiReviewConfig: uiReview?.config, videoConfig: videoRender?.config ?? null, browserConfig: managedBrowser?.config, orchestrated: Boolean(orchestrator), codexHome: agentResume.codexHome,
+        runtimeConfig: runtimeReview?.config,
+        ...(reviewEnv ? { env: { ...process.env, ...reviewEnv } } : {}) });
       projectTools = tools.projectTools;
       localCleanup?.begin(turnId);
       const { toolsNote } = tools;
+      let browserThread = agentResume.resumeThreadId;
       const agentTurnArgs = {
         ...((liveInput || orchestrator) ? { liveMessages: (run.live = makeLiveMessages({
           scope: 'agent', turnId, cwd: wt, sessionMetaPath, interrupted: () => run.interrupted,
@@ -565,12 +604,14 @@ export function createAgentTurnExecution({
         resume: agentResume.resume,
         resumeThreadId: agentResume.resumeThreadId,
         onInit: (init) => {
+          if (rt === 'claude' && typeof init.sessionId === 'string') browserThread = init.sessionId;
           orchestrator?.root(init.sessionId);
           // A server that did not connect, as the CLI said (unknown: nothing).
           trace.mcpStatus(init.mcpServers);
           agentResume.sawSession(init.sessionId);
         },
         onThreadId: (id) => {
+          browserThread = id;
           orchestrator?.root(id);
           agentResume.sawThread(id);
         },
@@ -741,6 +782,7 @@ export function createAgentTurnExecution({
           runtime: rt,
           beforeFresh: () => {
             agentResume.forgetThread();
+            browserThread = undefined;
             lastAnswer = null;
             model = null;
           },
@@ -751,19 +793,34 @@ export function createAgentTurnExecution({
           void postAgentActivity(agentId, 'resuming after an internal wait');
         } }
       );
-      out = await finishRepositoryDelivery({
-        job, run: repositoryRun, out, answer: () => lastAnswer,
-        resume: async (prompt) => {
+      out = await completeBrowserReview(out, {
+        browser: managedBrowser, signal: setupController.signal,
+        resume: async (handoff) => {
+          const thread = agentResume.threadNow() ?? browserThread;
+          if (!thread) throw new Error('The browser handoff could not resume: the CLI reported no conversation id. Interactive verification is incomplete.');
           lastAnswer = null;
           const counted = usage;
-          return runCli({
-            ...agentTurnArgs, prompt, liveContinuation: true,
-            onUsage: (next) => agentTurnArgs.onUsage(addUsage(counted, next)),
-            writableDirs: repositoryRun.sourcesNow().filter((r) => r.wt !== wt).map((r) => r.wt),
-            resume: true,
-            resumeThreadId: agentResume.threadNow() ?? agentTurnArgs.resumeThreadId,
+          trace.prose('text', handoff.reason === 'returned' ? 'Browser control returned. Resuming verification.' : 'The browser handoff ended. Resuming to report incomplete interactive checks.');
+          return runAgentWithInternalWaits(args => runCli(args), {
+            ...agentTurnArgs, prompt: browserHandoffPrompt(handoff), resume: true, resumeThreadId: thread, liveContinuation: true,
+            ...(repositoryRun ? { writableDirs: repositoryRun.sourcesNow().filter(r => r.wt !== wt).map(r => r.wt) } : {}),
+            onUsage: next => agentTurnArgs.onUsage(addUsage(counted, next)),
           });
         },
+        finish: current => finishRepositoryDelivery({
+          job, run: repositoryRun, out: current, answer: () => lastAnswer,
+          resume: async (prompt) => {
+            lastAnswer = null;
+            const counted = usage;
+            return runCli({
+              ...agentTurnArgs, prompt, liveContinuation: true,
+              onUsage: (next) => agentTurnArgs.onUsage(addUsage(counted, next)),
+              writableDirs: repositoryRun.sourcesNow().filter((r) => r.wt !== wt).map((r) => r.wt),
+              resume: true,
+              resumeThreadId: agentResume.threadNow() ?? browserThread,
+            });
+          },
+        }),
       });
     } finally {
       // The loopback capability stays registered until every retained CLI
@@ -774,12 +831,15 @@ export function createAgentTurnExecution({
       // owned by its review tool, then bind evidence to the final source
       // before the existing artifact upload and delivery settlement.
       try { await videoRender?.close(); } catch { /* a closed listener */ }
+      try { await runtimeReview?.close(); } catch { /* turn teardown continues */ }
       try { await managedBrowser?.close(); } catch { /* turn teardown continues */ }
       try { await uiReview?.close(); }
       finally {
         try { uiReviewEvidence = uiReview?.finalize() ?? uiReviewEvidence; }
         catch (error) { uiReviewEvidence = `Local UI review final source/evidence measurement unavailable: ${envScrub(error.message)}. Earlier checks do not establish the final source.`; }
       }
+      try { runtimeEvidence = runtimeReview?.finalize() ?? ''; }
+      catch { runtimeEvidence = 'Runtime review final source could not be measured; earlier results do not verify final source.'; }
       await run.live?.stop();
       await orchestrator?.close(run.interrupted);
       await brief?.stop();
@@ -890,6 +950,7 @@ export function createAgentTurnExecution({
       modelExports: intermediateDelivery?.modelExports,
     });
     appendUiReviewEvidence(body, uiReviewEvidence);
+    appendUiReviewEvidence(body, runtimeEvidence);
     // The agent's own account of what it did not deliver, for the pre-review.
     if (job.kind === 'task' && job.task && body.outcome === 'delivered' && res?.gaps)
       stashGaps(sessionMetaPath(wt, 'flowviant-agent-cards', agentId), job.task.id, res.gaps);
@@ -945,7 +1006,10 @@ export function createAgentTurnExecution({
     // hold the lock on — see `runReviewEntry`. Only after the settle that may
     // say delivered: the three `nothing` settles never opened it.
     if (final && reply?.review === true) await runReviewEntry(agentId, wt, job.agentName, undefined, job);
-    } finally { await repositoryRun?.tool?.close(); }
+    } finally {
+      for (const release of environmentReleases) release();
+      await repositoryRun?.tool?.close();
+    }
   };
 
   return { runAgentTurnInPlace };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.125.28",
+  "version": "0.125.30",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {