stageflow 0.23.0 → 0.27.0

package/dist/config/toolRequires.js

@@ -0,0 +1,115 @@
+import semver from "semver";
+import { loadFailure, loadSuccess } from "./loadOutcome.js";
+const ALLOWED_KEYS = new Set(["tool", "version"]);
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requiresIssue(options, message) {
+    if (options.category === "pipeline") {
+        return {
+            code: options.code,
+            message,
+            category: "pipeline",
+            ...(options.pipelineId !== undefined
+                ? { pipelineId: options.pipelineId }
+                : {}),
+            ...(options.stageId !== undefined ? { stageId: options.stageId } : {}),
+        };
+    }
+    return {
+        code: options.code,
+        message,
+        category: "stage",
+        ...(options.stageId !== undefined ? { stageId: options.stageId } : {}),
+    };
+}
+export function parseToolRequires(raw, label, options) {
+    if (raw === undefined)
+        return loadSuccess(undefined);
+    if (!Array.isArray(raw)) {
+        return loadFailure([
+            requiresIssue(options, `Invalid ${label}: requires must be an array of { tool, version? }`),
+        ]);
+    }
+    const out = [];
+    for (let i = 0; i < raw.length; i++) {
+        const item = raw[i];
+        if (!isPlainObject(item)) {
+            return loadFailure([
+                requiresIssue(options, `Invalid ${label}: requires[${i}] must be an object`),
+            ]);
+        }
+        for (const key of Object.keys(item)) {
+            if (!ALLOWED_KEYS.has(key)) {
+                return loadFailure([
+                    requiresIssue(options, `Invalid ${label}: requires[${i}] unknown key "${key}" (allowed: tool, version)`),
+                ]);
+            }
+        }
+        if (typeof item.tool !== "string" || item.tool.trim() === "") {
+            return loadFailure([
+                requiresIssue(options, `Invalid ${label}: requires[${i}].tool must be a non-empty string`),
+            ]);
+        }
+        const tool = item.tool.trim();
+        if (item.version !== undefined) {
+            if (typeof item.version !== "string" || item.version.trim() === "") {
+                return loadFailure([
+                    requiresIssue(options, `Invalid ${label}: requires[${i}].version must be a non-empty semver range string`),
+                ]);
+            }
+            const range = item.version.trim();
+            if (!semver.validRange(range)) {
+                return loadFailure([
+                    requiresIssue(options, `Invalid ${label}: requires[${i}].version "${range}" is not a valid semver range`),
+                ]);
+            }
+            out.push({ tool, version: range });
+        }
+        else {
+            out.push({ tool });
+        }
+    }
+    return loadSuccess(out);
+}
+/**
+ * Merge requirement lists: same tool → intersect version ranges (stricter).
+ * Non-intersecting ranges fail with pipeline.requires_conflict.
+ */
+export function mergeToolRequires(lists, ctx) {
+    const byTool = new Map();
+    for (const list of lists) {
+        if (!list)
+            continue;
+        for (const req of list) {
+            const prior = byTool.get(req.tool);
+            if (!byTool.has(req.tool)) {
+                byTool.set(req.tool, req.version);
+                continue;
+            }
+            if (prior === undefined && req.version === undefined)
+                continue;
+            if (prior === undefined) {
+                byTool.set(req.tool, req.version);
+                continue;
+            }
+            if (req.version === undefined)
+                continue;
+            if (!semver.intersects(prior, req.version)) {
+                return loadFailure([
+                    {
+                        code: "pipeline.requires_conflict",
+                        message: `Pipeline ${ctx.pipelineId}${ctx.label ? ` (${ctx.label})` : ""}: tool "${req.tool}" has non-intersecting version ranges "${prior}" and "${req.version}"`,
+                        category: "pipeline",
+                        pipelineId: ctx.pipelineId,
+                    },
+                ]);
+            }
+            byTool.set(req.tool, `${prior} ${req.version}`);
+        }
+    }
+    return loadSuccess([...byTool.entries()].map(([tool, version]) => version !== undefined ? { tool, version } : { tool }));
+}
+export function collectEffectiveRequires(options) {
+    return mergeToolRequires([options.pipelineRequires, ...options.stageRequires], { pipelineId: options.pipelineId });
+}

package/dist/config/validateCatalog.d.ts

@@ -2,7 +2,7 @@ import type { InlinePipelineDefinition, LoadedPipeline } from "../types/pipeline
 import type { LoadIssue } from "./loadOutcome.js";
 export type ValidationSeverity = "error" | "warning";
 export type ValidationCategory = "pipeline" | "stage" | "catalog" | "task";
-export type ValidationFindingCode = "pipeline.invalid_shape" | "pipeline.dag_error" | "pipeline.missing_stage" | "pipeline.load_error" | "pipeline.string_stage_ref" | "pipeline.stage_uses_inline_conflict" | "pipeline.stage_missing_body" | "pipeline.stage_id_mismatch" | "pipeline.invalid_completion" | "pipeline.invalid_recovery" | "pipeline.include_cycle" | "pipeline.include_invalid" | "pipeline.include_duplicate_stage" | "pipeline.invalid_agent" | "pipeline.invalid_model" | "pipeline.invalid_verify" | "pipeline.io_incompatible" | "pipeline.model_applies" | "pipeline.route_if_invalid" | "pipeline.route_all_gated" | "stage.invalid_shape" | "stage.invalid_model" | "stage.missing_model" | "stage.invalid_payload_schema" | "stage.invalid_clone_input_schema" | "stage.unresolved_schema_ref" | "stage.invalid_clone_actions" | "stage.invalid_gate_kinds" | "stage.invalid_pre_emit_checks" | "stage.invalid_timeout_ms" | "stage.invalid_skill" | "stage.invalid_mcp" | "stage.invalid_agent" | "stage.invalid_io" | "stage.load_error" | "stage.id_filename_mismatch" | "task.invalid_shape" | "task.load_error" | "task.entry_input_unmet" | "catalog.duplicate_pipeline_id" | "catalog.manifest_missing" | "catalog.manifest_invalid" | "catalog.empty_catalog" | "catalog.manifest_load_error" | "catalog.invalid_mcp" | "catalog.mixed_yaml_dialect" | "catalog.legacy_yaml";
+export type ValidationFindingCode = "pipeline.invalid_shape" | "pipeline.dag_error" | "pipeline.missing_stage" | "pipeline.load_error" | "pipeline.string_stage_ref" | "pipeline.stage_uses_inline_conflict" | "pipeline.stage_missing_body" | "pipeline.stage_id_mismatch" | "pipeline.invalid_completion" | "catalog.path_case_mismatch" | "pipeline.invalid_recovery" | "pipeline.include_cycle" | "pipeline.include_invalid" | "pipeline.include_duplicate_stage" | "pipeline.invalid_agent" | "pipeline.invalid_model" | "pipeline.invalid_verify" | "pipeline.io_incompatible" | "pipeline.model_applies" | "pipeline.route_if_invalid" | "pipeline.route_all_gated" | "pipeline.invalid_requires" | "pipeline.requires_conflict" | "stage.invalid_shape" | "stage.invalid_model" | "stage.missing_model" | "stage.invalid_payload_schema" | "stage.invalid_clone_input_schema" | "stage.unresolved_schema_ref" | "stage.invalid_clone_actions" | "stage.invalid_gate_kinds" | "stage.invalid_pre_emit_checks" | "stage.invalid_timeout_ms" | "stage.invalid_skill" | "stage.invalid_mcp" | "stage.invalid_secrets" | "stage.unknown_secret" | "stage.denied_secret" | "stage.invalid_requires" | "stage.invalid_agent" | "stage.invalid_io" | "stage.load_error" | "stage.id_filename_mismatch" | "task.invalid_shape" | "task.load_error" | "task.entry_input_unmet" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "catalog.duplicate_pipeline_id" | "catalog.manifest_missing" | "catalog.manifest_invalid" | "catalog.empty_catalog" | "catalog.manifest_load_error" | "catalog.invalid_mcp" | "catalog.mcp_command_missing" | "catalog.mixed_yaml_dialect" | "catalog.legacy_yaml" | "catalog.stageflow_home_absolute_path";
 export type ValidationFinding = {
     severity: ValidationSeverity;
     code: ValidationFindingCode | string;
@@ -35,6 +35,10 @@ export declare function effectiveSeverity(finding: ValidationFinding, strict: bo
 export declare function buildValidationResult(scope: ValidationScope, findings: ValidationFinding[], strict: boolean): ValidationResult;
 export declare function findingsFromLoadIssues(cwd: string, absPath: string, issues: LoadIssue[]): ValidationFinding[];
 export declare function findingStageIdFilenameMismatch(cwd: string, absPath: string, fileStem: string, declaredId: string): ValidationFinding;
+/** Parent readdir case check — warn by default; error under --strict. */
+export declare function findingPathCaseMismatch(cwd: string, referencedPath: string): Promise<ValidationFinding | null>;
+export declare function collectAbsolutePathCandidates(text: string): string[];
+export declare function isPathUnderStageflowHome(candidate: string, home: string): boolean;
 export type ValidatePipelineOptions = {
     cwd?: string;
     projectRoot?: string;

package/dist/config/validateCatalog.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { globalStageflowHome } from "../project/globalHome.js";
 import { INLINE_PIPELINE_PATH, loadPipelineFromObjectOutcome, loadPipelineOutcome, resolvePipelinePath, } from "./loadPipeline.js";
 import { loadStageOutcome } from "./loadStage.js";
 import { loadTaskOutcome } from "./loadTask.js";
@@ -7,6 +8,9 @@ import { resolveCatalogContext } from "./resolveCatalogContext.js";
 import { getCatalogScanPaths } from "./browseCatalog.js";
 import { manifestPathForProject } from "./loadStageflowManifest.js";
 import { MCP_CATALOG_FILENAME, StageMcpError, assertMcpAllowlistKnown, loadMcpCatalog, mcpCatalogPath, } from "./resolveStageMcpServers.js";
+import { loadSecretRegistry } from "../runtime/stageSecrets.js";
+import { isForeverDeniedSecret } from "../runtime/stageEnvironment.js";
+import { findMissingMcpCommands } from "../preflight/mcpCommands.js";
 export function relPath(cwd, absPath) {
     return path.relative(cwd, absPath).replace(/\\/g, "/");
 }
@@ -160,6 +164,35 @@ export function findingStageIdFilenameMismatch(cwd, absPath, fileStem, declaredI
         stageId: declaredId,
     }, "error");
 }
+/** Parent readdir case check — warn by default; error under --strict. */
+export async function findingPathCaseMismatch(cwd, referencedPath) {
+    const { readdir } = await import("node:fs/promises");
+    const abs = path.isAbsolute(referencedPath)
+        ? referencedPath
+        : path.resolve(cwd, referencedPath);
+    const parent = path.dirname(abs);
+    const base = path.basename(abs);
+    let entries;
+    try {
+        entries = await readdir(parent);
+    }
+    catch {
+        return null;
+    }
+    const exact = entries.includes(base);
+    if (exact)
+        return null;
+    const match = entries.find((e) => e.toLowerCase() === base.toLowerCase());
+    if (match === undefined)
+        return null;
+    return baseFinding({
+        cwd,
+        absPath: abs,
+        message: `Path casing differs on disk: referenced "${base}" but found "${match}"`,
+        code: "catalog.path_case_mismatch",
+        category: "catalog",
+    }, "warning");
+}
 async function checkStageIdFilename(cwd, stagePath) {
     const fileStem = path.basename(stagePath, ".yaml");
     try {
@@ -197,6 +230,100 @@ function collectMcpAllowlistNames(loaded) {
     }
     return [...names];
 }
+function findingsForStageSecrets(cwd, pipelinePath, loaded) {
+    const registry = loadSecretRegistry(process.env);
+    const findings = [];
+    for (const stage of loaded.stages) {
+        for (const decl of stage.secrets ?? []) {
+            if (isForeverDeniedSecret(decl.name)) {
+                findings.push(findingStageError(cwd, pipelinePath, `secret "${decl.name}" is permanently denied and cannot be granted`, "stage.denied_secret", stage.id));
+                continue;
+            }
+            if (!registry.has(decl.name)) {
+                findings.push(findingStageError(cwd, pipelinePath, `unknown secret "${decl.name}" is not in the Host secret registry`, "stage.unknown_secret", stage.id));
+            }
+        }
+    }
+    return findings;
+}
+const ABSOLUTE_PATH_IN_TEXT_RE = /(?:^|[\s"'`=:(])(\/(?:[^\s"'`;|&<>()]+))/g;
+const TRAILING_PATH_PUNCT_RE = /[.,:;!?)\]]+$/;
+export function collectAbsolutePathCandidates(text) {
+    const found = [];
+    const seen = new Set();
+    ABSOLUTE_PATH_IN_TEXT_RE.lastIndex = 0;
+    let match;
+    while ((match = ABSOLUTE_PATH_IN_TEXT_RE.exec(text)) !== null) {
+        const raw = match[1]?.replace(TRAILING_PATH_PUNCT_RE, "") ?? "";
+        if (!raw || !path.isAbsolute(raw) || seen.has(raw))
+            continue;
+        seen.add(raw);
+        found.push(raw);
+    }
+    return found;
+}
+export function isPathUnderStageflowHome(candidate, home) {
+    if (!path.isAbsolute(candidate))
+        return false;
+    const resolved = path.resolve(candidate);
+    const homeResolved = path.resolve(home);
+    return (resolved === homeResolved || resolved.startsWith(`${homeResolved}${path.sep}`));
+}
+function stageSourcePath(loaded, stageId) {
+    const source = loaded.stageSources?.[stageId];
+    if (source?.kind === "file")
+        return source.path;
+    return loaded.pipelinePath;
+}
+function stageflowHomeAbsolutePathMessage(stageId, location, absolutePath) {
+    return (`Stage "${stageId}" ${location} contains absolute path under STAGEFLOW_HOME ` +
+        `("${absolutePath}"). Use STAGEFLOW_CHECKOUT / STAGEFLOW_RUN_WORKSPACE ` +
+        `(and related binding env vars) instead of durable-home paths`);
+}
+function findingsForStageflowHomeAbsolutePaths(cwd, loaded) {
+    const home = globalStageflowHome();
+    const findings = [];
+    const seen = new Set();
+    const pushFinding = (stageId, absPath, location, absolutePath) => {
+        const key = `${stageId}\0${location}\0${absolutePath}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        findings.push(baseFinding({
+            cwd,
+            absPath,
+            message: stageflowHomeAbsolutePathMessage(stageId, location, absolutePath),
+            code: "catalog.stageflow_home_absolute_path",
+            category: "catalog",
+            pipelineId: loaded.pipeline.id,
+            stageId,
+        }, "error"));
+    };
+    const scanText = (stageId, absPath, location, text) => {
+        for (const candidate of collectAbsolutePathCandidates(text)) {
+            if (isPathUnderStageflowHome(candidate, home)) {
+                pushFinding(stageId, absPath, location, candidate);
+            }
+        }
+    };
+    for (const stage of loaded.stages) {
+        const absPath = stageSourcePath(loaded, stage.id);
+        scanText(stage.id, absPath, "system_prompt", stage.system_prompt);
+    }
+    for (const node of loaded.dag.nodes) {
+        const checks = node.completion?.checks ?? [];
+        for (const check of checks) {
+            if (check.type !== "command")
+                continue;
+            const absPath = stageSourcePath(loaded, node.id);
+            scanText(node.id, absPath, `verify command "${check.id}" run`, check.run);
+            if (typeof check.cwd === "string") {
+                scanText(node.id, absPath, `verify command "${check.id}" cwd`, check.cwd);
+            }
+        }
+    }
+    return findings;
+}
 async function findingsForStageMcpCatalog(cwd, loaded) {
     const allowlist = collectMcpAllowlistNames(loaded);
     const ctx = await resolveCatalogContext(cwd);
@@ -235,7 +362,17 @@ async function findingsForStageMcpCatalog(cwd, loaded) {
         }
         throw err;
     }
-    return [];
+    const findings = [];
+    const serversForPath = {};
+    for (const name of allowlist) {
+        const entry = catalog.servers[name];
+        if (entry)
+            serversForPath[name] = entry;
+    }
+    for (const missing of findMissingMcpCommands(serversForPath, process.env)) {
+        findings.push(findingCatalog(cwd, catalogAbsPath, `MCP server "${missing.serverName}" command "${missing.command}" was not found on PATH`, "catalog.mcp_command_missing", "error"));
+    }
+    return findings;
 }
 async function runPipelineValidation(nameOrPath, options) {
     const { cwd, validateStages } = options;
@@ -274,6 +411,8 @@ async function runPipelineValidation(nameOrPath, options) {
         findings.push(...findingsFromLoadIssues(cwd, pipelinePath, outcome.issues));
     }
     findings.push(...(await findingsForStageMcpCatalog(cwd, outcome.value)));
+    findings.push(...findingsForStageSecrets(cwd, pipelinePath, outcome.value));
+    findings.push(...findingsForStageflowHomeAbsolutePaths(cwd, outcome.value));
     if (validateStages && outcome.value.stageSources) {
         for (const source of Object.values(outcome.value.stageSources)) {
             if (source.kind === "file") {

package/dist/diagnostics/checks.d.ts

@@ -0,0 +1,39 @@
+import type { RunStore } from "../runstore/port.js";
+export type DiagnosticSeverity = "error" | "warn" | "skipped";
+export type DiagnosticCheckResult = {
+    id: string;
+    ok: boolean;
+    severity: DiagnosticSeverity;
+    message: string;
+    code?: string;
+    detail?: Record<string, unknown>;
+};
+export type ReadyzChecks = {
+    store_openable: boolean;
+    home_writable: boolean;
+    migrations_complete: boolean;
+    git_present: boolean;
+};
+export type ReadyzResult = {
+    ready: boolean;
+    checks: ReadyzChecks;
+    code?: string;
+};
+export declare function resetReadyzCacheForTests(): void;
+export declare function livezBody(): {
+    ok: true;
+    status: "live";
+};
+export declare function probeGitVersion(): Promise<string | undefined>;
+export declare function runReadyzChecks(options: {
+    store: RunStore;
+    homeDir?: string;
+    now?: number;
+    bypassCache?: boolean;
+}): Promise<ReadyzResult>;
+export type SchemaHealthStub = {
+    user_version: number | null;
+    schema_migrations: "present" | "absent" | "unknown";
+    note?: string;
+};
+export declare function readSchemaHealth(store: RunStore): SchemaHealthStub;

package/dist/diagnostics/checks.js

@@ -0,0 +1,135 @@
+import { accessSync, constants, writeFileSync, unlinkSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { globalStageflowHome } from "../project/globalHome.js";
+const execFileAsync = promisify(execFile);
+const READYZ_TTL_MS = 4_000;
+let readyzCache;
+export function resetReadyzCacheForTests() {
+    readyzCache = undefined;
+}
+export function livezBody() {
+    return { ok: true, status: "live" };
+}
+async function checkGitPresent() {
+    try {
+        await execFileAsync("git", ["--version"], {
+            timeout: 5_000,
+            windowsHide: true,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function probeGitVersion() {
+    try {
+        const { stdout } = await execFileAsync("git", ["--version"], {
+            timeout: 5_000,
+            windowsHide: true,
+        });
+        return stdout.trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function checkHomeWritable(home) {
+    try {
+        accessSync(home, constants.W_OK);
+        const probe = `${home}/.stageflow-write-probe-${process.pid}`;
+        writeFileSync(probe, "ok");
+        unlinkSync(probe);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function checkStoreOpenable(store) {
+    try {
+        await store.listRuns();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function checkMigrationsComplete(store) {
+    const connection = store.connection;
+    if (connection === undefined || typeof connection.pragma !== "function") {
+        return true;
+    }
+    try {
+        const version = connection.pragma("user_version", { simple: true });
+        return typeof version === "number" && version >= 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function runReadyzChecks(options) {
+    const now = options.now ?? Date.now();
+    if (!options.bypassCache &&
+        readyzCache !== undefined &&
+        readyzCache.expiresAt > now) {
+        return readyzCache.result;
+    }
+    const home = options.homeDir ?? globalStageflowHome();
+    const checks = {
+        store_openable: await checkStoreOpenable(options.store),
+        home_writable: checkHomeWritable(home),
+        migrations_complete: checkMigrationsComplete(options.store),
+        git_present: await checkGitPresent(),
+    };
+    let code;
+    if (!checks.store_openable)
+        code = "store_not_openable";
+    else if (!checks.home_writable)
+        code = "home_not_writable";
+    else if (!checks.migrations_complete)
+        code = "migrations_incomplete";
+    else if (!checks.git_present)
+        code = "git_not_present";
+    const result = {
+        ready: code === undefined,
+        checks,
+        ...(code !== undefined ? { code } : {}),
+    };
+    readyzCache = { expiresAt: now + READYZ_TTL_MS, result };
+    return result;
+}
+export function readSchemaHealth(store) {
+    const connection = store.connection;
+    if (connection === undefined || typeof connection.pragma !== "function") {
+        return {
+            user_version: null,
+            schema_migrations: "unknown",
+            note: "Slot 1 schema reporting stub — store has no sqlite connection",
+        };
+    }
+    try {
+        const user_version = connection.pragma("user_version", {
+            simple: true,
+        });
+        let schema_migrations = "unknown";
+        if (typeof connection.prepare === "function") {
+            try {
+                connection.prepare(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'`).get();
+                schema_migrations = "present";
+            }
+            catch {
+                schema_migrations = "absent";
+            }
+        }
+        return { user_version, schema_migrations };
+    }
+    catch {
+        return {
+            user_version: null,
+            schema_migrations: "unknown",
+            note: "Slot 1 schema reporting stub — pragma failed",
+        };
+    }
+}

package/dist/errors/codes.d.ts

@@ -0,0 +1,14 @@
+/** Stable network-facing error codes (snake_case). Keep strings unchanged once shipped. */
+export declare const BUSY_CAPACITY: "busy_capacity";
+export declare const BUSY_CHECKOUT: "busy_checkout";
+/** Per-caller concurrency quota: queued when under global capacity; reject when queue full. */
+export declare const BUSY_CALLER_QUOTA: "busy_caller_quota";
+export declare const ABORTED: "aborted";
+export declare const NETWORK_ERROR_CODES: readonly ["busy_capacity", "busy_checkout", "busy_caller_quota", "aborted", "unknown_project_root", "absolute_path_not_allowed", "path_outside_project_root", "catalog_root_unreadable", "ensure_project_not_allowed", "config_invalid", "config_unknown_key", "provider_not_configured", "a2a_configuration_error", "untrusted_config_origin", "command_not_on_path", "missing_tool", "tool_version_mismatch", "unknown_version", "secret_unavailable", "not_ready", "internal_error", "retry_in_progress", "hitl_not_retriable", "run_not_retryable", "stage_not_failed", "manual_recovery_required", "run_not_found", "stage_not_found", "artifact_not_found", "artifact_path_denied", "envelope_not_found", "insufficient_disk", "disk_check_failed", "shutting_down", "start.token_rejected", "inline_pipeline_too_large", "skills_invalid_name", "skills_invalid_path", "skills_missing_skill_md", "skills_payload_too_large", "pinned_sha_unavailable", "store_integrity_failed", "store_unsupported_filesystem", "tmpdir_unusable", "backup_insufficient_disk"];
+export type NetworkErrorCode = (typeof NETWORK_ERROR_CODES)[number] | string;
+export type NetworkErrorBody = {
+    code: NetworkErrorCode;
+    error: string;
+} & Record<string, unknown>;
+export declare function networkError(code: NetworkErrorCode, error: string, detail?: Record<string, unknown>): NetworkErrorBody;
+export declare function codeOrInternal(code: string | undefined): NetworkErrorCode;

package/dist/errors/codes.js

@@ -0,0 +1,59 @@
+/** Stable network-facing error codes (snake_case). Keep strings unchanged once shipped. */
+export const BUSY_CAPACITY = "busy_capacity";
+export const BUSY_CHECKOUT = "busy_checkout";
+/** Per-caller concurrency quota: queued when under global capacity; reject when queue full. */
+export const BUSY_CALLER_QUOTA = "busy_caller_quota";
+export const ABORTED = "aborted";
+export const NETWORK_ERROR_CODES = [
+    BUSY_CAPACITY,
+    BUSY_CHECKOUT,
+    BUSY_CALLER_QUOTA,
+    ABORTED,
+    "unknown_project_root",
+    "absolute_path_not_allowed",
+    "path_outside_project_root",
+    "catalog_root_unreadable",
+    "ensure_project_not_allowed",
+    "config_invalid",
+    "config_unknown_key",
+    "provider_not_configured",
+    "a2a_configuration_error",
+    "untrusted_config_origin",
+    "command_not_on_path",
+    "missing_tool",
+    "tool_version_mismatch",
+    "unknown_version",
+    "secret_unavailable",
+    "not_ready",
+    "internal_error",
+    "retry_in_progress",
+    "hitl_not_retriable",
+    "run_not_retryable",
+    "stage_not_failed",
+    "manual_recovery_required",
+    "run_not_found",
+    "stage_not_found",
+    "artifact_not_found",
+    "artifact_path_denied",
+    "envelope_not_found",
+    "insufficient_disk",
+    "disk_check_failed",
+    "shutting_down",
+    "start.token_rejected",
+    "inline_pipeline_too_large",
+    "skills_invalid_name",
+    "skills_invalid_path",
+    "skills_missing_skill_md",
+    "skills_payload_too_large",
+    "pinned_sha_unavailable",
+    "store_integrity_failed",
+    "store_unsupported_filesystem",
+    "tmpdir_unusable",
+    "backup_insufficient_disk",
+];
+export function networkError(code, error, detail) {
+    return { code, error, ...detail };
+}
+export function codeOrInternal(code) {
+    return code && code.length > 0 ? code : "internal_error";
+}

package/dist/git/cache.d.ts

@@ -0,0 +1,14 @@
+export declare function setBareCacheRemoteUrlOverrideForTests(override: ((repository: string) => string | undefined) | null): void;
+export declare function resetBareCacheStateForTests(): void;
+export declare function githubHttpsRemoteUrl(repository: string): string;
+export declare function bareCachePath(repository: string): string;
+export declare function remoteUrlForRepository(repository: string): string;
+export type EnsureBareCacheResult = {
+    cachePath: string;
+    fetched: boolean;
+};
+export type EnsureBareCacheOptions = {
+    env?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+};
+export declare function ensureBareCache(repository: string, ref: string, options?: EnsureBareCacheOptions): Promise<EnsureBareCacheResult>;