stageflow 0.25.0 → 0.27.0

package/dist/runtime/stageSecretDecl.js

@@ -0,0 +1,102 @@
+import { loadFailure, loadSuccess } from "../config/loadOutcome.js";
+import { isForeverDeniedSecret } from "./stageEnvironment.js";
+const GIT_HELPER_DEFAULT_NAMES = new Set([
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+]);
+export function defaultSecretDelivery(name) {
+    return GIT_HELPER_DEFAULT_NAMES.has(name) ? "helper" : "env";
+}
+export function parseStageSecrets(raw, label, stageId) {
+    if (raw === undefined)
+        return loadSuccess(undefined);
+    if (!Array.isArray(raw)) {
+        return loadFailure([
+            {
+                code: "stage.invalid_secrets",
+                message: `Invalid stage ${label}: secrets must be an array`,
+                category: "stage",
+                stageId,
+            },
+        ]);
+    }
+    const decls = [];
+    const seen = new Set();
+    for (const item of raw) {
+        let name;
+        let asEnv = false;
+        if (typeof item === "string") {
+            name = item.trim();
+        }
+        else if (item !== null && typeof item === "object" && !Array.isArray(item)) {
+            const obj = item;
+            if (typeof obj.name !== "string" || obj.name.trim() === "") {
+                return loadFailure([
+                    {
+                        code: "stage.invalid_secrets",
+                        message: `Invalid stage ${label}: secrets entries must be strings or { name, as? }`,
+                        category: "stage",
+                        stageId,
+                    },
+                ]);
+            }
+            name = obj.name.trim();
+            if (obj.as !== undefined) {
+                if (obj.as !== "env") {
+                    return loadFailure([
+                        {
+                            code: "stage.invalid_secrets",
+                            message: `Invalid stage ${label}: secrets as must be "env" when set`,
+                            category: "stage",
+                            stageId,
+                        },
+                    ]);
+                }
+                asEnv = true;
+            }
+        }
+        else {
+            return loadFailure([
+                {
+                    code: "stage.invalid_secrets",
+                    message: `Invalid stage ${label}: secrets entries must be strings or { name, as? }`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        if (name === "") {
+            return loadFailure([
+                {
+                    code: "stage.invalid_secrets",
+                    message: `Invalid stage ${label}: secrets names must be non-empty`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        if (isForeverDeniedSecret(name)) {
+            return loadFailure([
+                {
+                    code: "stage.denied_secret",
+                    message: `Invalid stage ${label}: secret "${name}" is permanently denied and cannot be granted`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        if (seen.has(name)) {
+            return loadFailure([
+                {
+                    code: "stage.invalid_secrets",
+                    message: `Invalid stage ${label}: secrets contains duplicate name "${name}"`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        seen.add(name);
+        decls.push(asEnv ? { name, as: "env" } : { name });
+    }
+    return loadSuccess(decls);
+}

package/dist/runtime/stageSecrets.d.ts

@@ -0,0 +1,40 @@
+import { cleanupCredentialsDir } from "./credentialMaterialisation.js";
+import { type StageSecretDecl } from "./stageSecretDecl.js";
+import type { ResolvedStageGrants } from "./stageEnvironment.js";
+export type SecretRegistryEntry = {
+    kind: "env";
+    name: string;
+} | {
+    kind: "file";
+    name: string;
+    source: string;
+    pointerVar: string;
+};
+export type SecretRegistry = Map<string, SecretRegistryEntry>;
+export declare class SecretUnavailableError extends Error {
+    readonly code: "secret_unavailable";
+    readonly secretName: string;
+    constructor(secretName: string);
+}
+/** Host-owned secret registry: env NAME/_FILE plus file-credentials under $STAGEFLOW_HOME. */
+export declare function loadSecretRegistry(env?: NodeJS.ProcessEnv, home?: string): SecretRegistry;
+export type ResolveStageSecretsInput = {
+    decls: readonly StageSecretDecl[] | undefined;
+    registry: SecretRegistry;
+    hostEnv: NodeJS.ProcessEnv;
+    attemptDir: string;
+    home?: string;
+};
+export type ResolveStageSecretsResult = {
+    grants: ResolvedStageGrants;
+    warnings: string[];
+    knownValues: Array<{
+        name: string;
+        value: string;
+    }>;
+    credentialDirs: string[];
+};
+/** Presence-only check (no materialisation) for preflight / start gates. */
+export declare function assertSecretPresent(name: string, registry: SecretRegistry, hostEnv: NodeJS.ProcessEnv): void;
+export declare function resolveStageSecrets(input: ResolveStageSecretsInput): ResolveStageSecretsResult;
+export { cleanupCredentialsDir };

package/dist/runtime/stageSecrets.js

@@ -0,0 +1,181 @@
+import { readFileSync } from "node:fs";
+import { shouldRegisterValue } from "../logging/redact.js";
+import { globalStageflowHome } from "../project/globalHome.js";
+import { attemptCredentialsDir, cleanupCredentialsDir, ensureStageAskpassHelper, materialiseCredentialFile, materialiseSecretBytes, readFileCredentialRegistry, } from "./credentialMaterialisation.js";
+import { defaultSecretDelivery, } from "./stageSecretDecl.js";
+import { isForeverDeniedSecret } from "./stageEnvironment.js";
+export class SecretUnavailableError extends Error {
+    code = "secret_unavailable";
+    secretName;
+    constructor(secretName) {
+        super(`secret_unavailable: registered secret "${secretName}" has no value on this Host`);
+        this.name = "SecretUnavailableError";
+        this.secretName = secretName;
+    }
+}
+function readEnvSecretValue(name, env) {
+    const plain = env[name];
+    const fileKey = `${name}_FILE`;
+    const filePath = env[fileKey];
+    const hasPlain = plain !== undefined && plain.length > 0;
+    const hasFile = filePath !== undefined && filePath.length > 0;
+    if (hasPlain && hasFile) {
+        throw new Error(`Set only one of ${name} or ${fileKey}, not both`);
+    }
+    if (hasFile) {
+        return readFileSync(filePath, "utf8").replace(/\r?\n$/, "");
+    }
+    if (hasPlain)
+        return plain;
+    return undefined;
+}
+/** Host-owned secret registry: env NAME/_FILE plus file-credentials under $STAGEFLOW_HOME. */
+export function loadSecretRegistry(env = process.env, home = globalStageflowHome()) {
+    const registry = new Map();
+    const fileCreds = readFileCredentialRegistry(home);
+    for (const [name, entry] of Object.entries(fileCreds)) {
+        if (isForeverDeniedSecret(name))
+            continue;
+        registry.set(name, {
+            kind: "file",
+            name,
+            source: entry.source,
+            pointerVar: entry.pointerVar,
+        });
+    }
+    // Well-known env secrets are always registered when present or when declared
+    // (presence checked at resolve time). Register common names so validate can
+    // distinguish unknown vs unavailable.
+    for (const name of [
+        "GITHUB_TOKEN",
+        "GH_TOKEN",
+        "NPM_TOKEN",
+        "NODE_AUTH_TOKEN",
+    ]) {
+        if (!registry.has(name)) {
+            registry.set(name, { kind: "env", name });
+        }
+    }
+    // Any Host env var with a sibling `_FILE` or non-empty value that looks like a
+    // registered secret name from STAGEFLOW_SECRET_REGISTRY (comma list) is also
+    // env-kind.
+    const extra = env.STAGEFLOW_SECRET_REGISTRY?.split(",") ?? [];
+    for (const raw of extra) {
+        const name = raw.trim();
+        if (!name || isForeverDeniedSecret(name) || registry.has(name))
+            continue;
+        registry.set(name, { kind: "env", name });
+    }
+    return registry;
+}
+/** Presence-only check (no materialisation) for preflight / start gates. */
+export function assertSecretPresent(name, registry, hostEnv) {
+    if (isForeverDeniedSecret(name)) {
+        throw new Error(`secret "${name}" is permanently denied`);
+    }
+    const entry = registry.get(name);
+    if (entry === undefined) {
+        throw new Error(`stage.unknown_secret: "${name}"`);
+    }
+    if (entry.kind === "file") {
+        try {
+            readFileSync(entry.source, "utf8");
+        }
+        catch {
+            throw new SecretUnavailableError(name);
+        }
+        return;
+    }
+    const value = readEnvSecretValue(name, hostEnv);
+    if (value === undefined || value === "") {
+        throw new SecretUnavailableError(name);
+    }
+}
+function materialiseGitAskpassGrant(grantEnv, credentialDirs, opts) {
+    const destDir = attemptCredentialsDir(opts.attemptDir, opts.secretName);
+    const tokenFile = materialiseSecretBytes({
+        contents: opts.value,
+        destDir,
+        destBasename: "token",
+    });
+    credentialDirs.push(destDir);
+    grantEnv.GIT_ASKPASS = ensureStageAskpassHelper(opts.home);
+    grantEnv.GIT_TERMINAL_PROMPT = "0";
+    grantEnv.STAGEFLOW_GIT_ASKPASS_TOKEN_FILE = tokenFile.destPath;
+}
+export function resolveStageSecrets(input) {
+    const decls = input.decls ?? [];
+    const warnings = [];
+    const grantEnv = {};
+    const knownValues = [];
+    const credentialDirs = [];
+    const registeredNames = [...input.registry.keys()];
+    const declaredNames = decls.map((d) => d.name);
+    for (const decl of decls) {
+        if (isForeverDeniedSecret(decl.name)) {
+            throw new Error(`secret "${decl.name}" is permanently denied`);
+        }
+        const entry = input.registry.get(decl.name);
+        if (entry === undefined) {
+            throw new Error(`stage.unknown_secret: "${decl.name}"`);
+        }
+        if (entry.kind === "file") {
+            const destDir = attemptCredentialsDir(input.attemptDir, decl.name);
+            const homeRoot = input.home ?? globalStageflowHome();
+            const copied = materialiseCredentialFile({
+                sourcePath: entry.source,
+                destDir,
+                allowedRoot: homeRoot,
+            });
+            credentialDirs.push(destDir);
+            grantEnv[entry.pointerVar] = copied.destPath;
+            const contents = readFileSync(copied.destPath, "utf8");
+            if (shouldRegisterValue(contents)) {
+                knownValues.push({ name: decl.name, value: contents });
+            }
+            if (decl.as === "env") {
+                warnings.push(`secrets: ${decl.name} granted as: env (value present in stage environment)`);
+                grantEnv[decl.name] = contents;
+            }
+            continue;
+        }
+        const value = readEnvSecretValue(decl.name, input.hostEnv);
+        if (value === undefined || value === "") {
+            throw new SecretUnavailableError(decl.name);
+        }
+        knownValues.push({ name: decl.name, value });
+        const delivery = decl.as === "env" ? "env" : defaultSecretDelivery(decl.name);
+        if (delivery === "env") {
+            if (decl.as === "env") {
+                warnings.push(`secrets: ${decl.name} granted as: env (value present in stage environment)`);
+            }
+            grantEnv[decl.name] = value;
+            if (defaultSecretDelivery(decl.name) === "helper") {
+                materialiseGitAskpassGrant(grantEnv, credentialDirs, {
+                    attemptDir: input.attemptDir,
+                    secretName: decl.name,
+                    value,
+                    home: input.home,
+                });
+            }
+            continue;
+        }
+        materialiseGitAskpassGrant(grantEnv, credentialDirs, {
+            attemptDir: input.attemptDir,
+            secretName: decl.name,
+            value,
+            home: input.home,
+        });
+    }
+    return {
+        grants: {
+            env: grantEnv,
+            registeredSecretNames: registeredNames,
+            declaredSecretNames: declaredNames,
+        },
+        warnings,
+        knownValues,
+        credentialDirs,
+    };
+}
+export { cleanupCredentialsDir };

package/dist/runtime/stageWorker.d.ts

@@ -2,5 +2,6 @@ import { type RunStageOutcome } from "./stageRunner.js";
 import { type StageWorkerInput, type StageWorkerResult } from "./stageWorkerProtocol.js";
 export type { StageWorkerInput, StageWorkerResult } from "./stageWorkerProtocol.js";
 export declare function runStageWorker(input: StageWorkerInput): Promise<RunStageOutcome>;
-export declare function sendWorkerResult(result: StageWorkerResult): void;
-export declare function exitForOutcome(outcome: RunStageOutcome): never;
+export declare function sendWorkerResult(result: StageWorkerResult): Promise<void>;
+export declare function exitCodeForOutcome(outcome: RunStageOutcome): number;
+export declare function exitForOutcome(outcome: RunStageOutcome): Promise<number>;

package/dist/runtime/stageWorker.js

@@ -1,16 +1,21 @@
 import { resolveAgentPort } from "../agent/resolveAgentPort.js";
 import { asAgentBackendId } from "../agent/agentBackend.js";
 import { loadStageflowManifestOutcome } from "../config/loadStageflowManifest.js";
+import { loadNamedSecretsFromAttemptDir } from "../logging/namedSecrets.js";
 import { definitionIdForInstance } from "../runstore/stageInstanceId.js";
+import { attemptWorkspaceDir } from "../runstore/workspaceLayout.js";
 import { createRunStore } from "../runstore/createStore.js";
 import { globalStageflowHome } from "../project/globalHome.js";
 import { loadRunContext } from "./resumeReconstruct.js";
-import { bindPiAgentDirEnv, rootsForStageWorker, withResolvedAuthPath, } from "./stageRoots.js";
+import { bindPiAgentDirEnv, overlayStageBindingEnv, rootsForStageWorker, stageBindingEnvFromRun, withResolvedAuthPath, } from "./stageRoots.js";
+import { buildStageEnvironment } from "./stageEnvironment.js";
+import { ensureStageCacheDirs } from "./stageCacheEnv.js";
+import { PACKAGE_VERSION } from "../package-meta.js";
 import { runStage, isRunStageWaiting, } from "./stageRunner.js";
 import { openStageAttempt } from "./stageAttemptBootstrap.js";
 import { attemptContext } from "./stageAttemptContext.js";
 import { loadActiveFeedbackLoopContext } from "./feedbackLoopCoordinator.js";
-import { outcomeToWorkerResult, STAGE_WORKER_EXIT, } from "./stageWorkerProtocol.js";
+import { outcomeToWorkerResult, SF_STAGE_WORKER, STAGE_WORKER_EXIT, } from "./stageWorkerProtocol.js";
 export async function runStageWorker(input) {
     const store = createRunStore({ rootDir: globalStageflowHome() });
     const { meta, task, loaded } = await loadRunContext(store, input.runId, input.rootDir);
@@ -33,8 +38,29 @@ export async function runStageWorker(input) {
     });
     const workspaceDir = store.getWorkspaceDir(input.runId);
     const checkoutRoot = meta.checkout_root;
+    const binding = input.env !== undefined
+        ? {
+            env: input.env,
+            kind: input.bindingKind ?? "unbound",
+        }
+        : stageBindingEnvFromRun({
+            meta,
+            task,
+            runWorkspaceDir: workspaceDir,
+            hostEnv: process.env,
+        });
+    const baseEnv = process.env[SF_STAGE_WORKER] === "1"
+        ? Object.fromEntries(Object.entries(process.env).filter((e) => e[1] !== undefined))
+        : buildStageEnvironment({
+            hostEnv: process.env,
+            cacheVars: ensureStageCacheDirs(),
+            packageVersion: PACKAGE_VERSION,
+        }).env;
+    const stageEnv = Object.fromEntries(Object.entries(overlayStageBindingEnv(baseEnv, binding.env, binding.kind))
+        .filter((e) => e[1] !== undefined));
     const mode = input.mode ?? "run";
     const attempt = input.attempt ?? 1;
+    loadNamedSecretsFromAttemptDir(attemptWorkspaceDir(workspaceDir, input.stageId, attempt));
     const attemptCtx = input.attempt !== undefined ? attemptContext(input.attempt) : undefined;
     const eventOptions = { attempt };
     const roots = withResolvedAuthPath(rootsForStageWorker(workspaceDir, input.stageId, stage.model, checkoutRoot, attemptCtx), input.rootDir);
@@ -57,6 +83,7 @@ export async function runStageWorker(input) {
                 roots,
                 resumeToken: input.sessionFilePath,
                 sessionMode: "waiting_resume",
+                stageEnv,
                 onActivity: (event) => {
                     void store.appendStageEvent(input.runId, input.stageId, event, eventOptions);
                 },
@@ -83,6 +110,7 @@ export async function runStageWorker(input) {
                 factoryCwd: input.rootDir,
                 operatorCatalog: input.operatorCatalog,
                 skipGates: input.skipGates,
+                stageEnv,
             });
             return outcome;
         }
@@ -116,6 +144,7 @@ export async function runStageWorker(input) {
                 ...(resumeToken !== undefined ? { resumeToken } : {}),
                 sessionMode: mode,
                 ...(feedbackLoopContext !== undefined ? { feedbackLoopContext } : {}),
+                stageEnv,
                 onActivity: (event) => {
                     void store.appendStageEvent(input.runId, input.stageId, event, eventOptions);
                 },
@@ -140,6 +169,7 @@ export async function runStageWorker(input) {
                 factoryCwd: input.rootDir,
                 operatorCatalog: input.operatorCatalog,
                 skipGates: input.skipGates,
+                stageEnv,
             });
         }
         return runStage({
@@ -158,6 +188,7 @@ export async function runStageWorker(input) {
             factoryCwd: input.rootDir,
             operatorCatalog: input.operatorCatalog,
             skipGates: input.skipGates,
+            stageEnv,
         });
     }
     finally {
@@ -165,18 +196,35 @@ export async function runStageWorker(input) {
     }
 }
 export function sendWorkerResult(result) {
-    if (typeof process.send === "function") {
-        process.send(result);
+    if (typeof process.send !== "function") {
+        return Promise.resolve();
     }
+    return new Promise((resolve) => {
+        try {
+            const ok = process.send(result, (err) => {
+                void err;
+                resolve();
+            });
+            if (ok === false) {
+                resolve();
+            }
+        }
+        catch {
+            resolve();
+        }
+    });
 }
-export function exitForOutcome(outcome) {
-    const message = outcomeToWorkerResult(outcome);
-    sendWorkerResult(message);
+export function exitCodeForOutcome(outcome) {
     if (isRunStageWaiting(outcome)) {
-        process.exit(STAGE_WORKER_EXIT.WAITING);
+        return STAGE_WORKER_EXIT.WAITING;
     }
     if (outcome.ok) {
-        process.exit(STAGE_WORKER_EXIT.SUCCEEDED);
+        return STAGE_WORKER_EXIT.SUCCEEDED;
     }
-    process.exit(STAGE_WORKER_EXIT.FAILED);
+    return STAGE_WORKER_EXIT.FAILED;
+}
+export async function exitForOutcome(outcome) {
+    const message = outcomeToWorkerResult(outcome);
+    await sendWorkerResult(message);
+    return exitCodeForOutcome(outcome);
 }

package/dist/runtime/stageWorkerProtocol.d.ts

@@ -1,11 +1,14 @@
 import type { RunStageOutcome } from "./stageRunner.js";
 import type { OperatorCatalog } from "./stageAttemptBootstrap.js";
+import type { DerivedBindingKind } from "./stageRoots.js";
 export declare const SF_STAGE_WORKER = "SF_STAGE_WORKER";
 export declare const STAGE_WORKER_EXIT: {
     readonly SUCCEEDED: 0;
     readonly FAILED: 1;
     readonly WAITING: 2;
 };
+export declare const PROCESS_EXIT_FORCE_MS = 1000;
+export declare function scheduleExitWithDrain(code: number): void;
 export type StageWorkerInput = {
     runId: string;
     stageId: string;
@@ -16,6 +19,8 @@ export type StageWorkerInput = {
     sessionFilePath?: string;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
+    env?: Record<string, string>;
+    bindingKind?: DerivedBindingKind;
 };
 export type StageWorkerResult = {
     type: "succeeded";

package/dist/runtime/stageWorkerProtocol.js

@@ -4,6 +4,14 @@ export const STAGE_WORKER_EXIT = {
     FAILED: 1,
     WAITING: 2,
 };
+export const PROCESS_EXIT_FORCE_MS = 1_000;
+export function scheduleExitWithDrain(code) {
+    process.exitCode = code;
+    const timer = setTimeout(() => {
+        process.exit(code);
+    }, PROCESS_EXIT_FORCE_MS);
+    timer.unref();
+}
 export function outcomeToWorkerResult(outcome) {
     if ("waiting" in outcome && outcome.waiting) {
         return { type: "waiting" };

package/dist/runtime/startPayload.d.ts

@@ -0,0 +1,32 @@
+import type { InlinePipelineDefinition } from "../types/pipeline.js";
+/** Cap for inline pipeline body + skills start payload (1 MiB). */
+export declare const START_PAYLOAD_MAX_BYTES = 1048576;
+export declare const START_TOKEN_REJECTED: "start.token_rejected";
+export declare const INLINE_PIPELINE_TOO_LARGE: "inline_pipeline_too_large";
+export type PipelinePersistenceFields = {
+    pipelineSource: "inline" | "path";
+    pipelineBody?: string;
+};
+export declare function pipelineBodyBytes(fields: PipelinePersistenceFields): number;
+export type PipelinePersistenceResult = {
+    ok: true;
+    fields: PipelinePersistenceFields;
+} | {
+    ok: false;
+    code: typeof INLINE_PIPELINE_TOO_LARGE;
+    bytes: number;
+    maxBytes: number;
+};
+export declare function pipelinePersistenceForStart(pipeline: string | InlinePipelineDefinition): PipelinePersistenceResult;
+/** MCP prefers `checkout`; `checkout_override` remains a temporary alias. */
+export declare function pickCheckoutOverride(args: {
+    checkout?: string;
+    checkout_override?: string;
+}): string | undefined;
+export declare function isTokenShapedKey(key: string): boolean;
+export declare function findTokenShapedField(value: unknown, pathPrefix?: string): string | undefined;
+export declare function tokenRejectedPayload(field: string): {
+    error: string;
+    code: typeof START_TOKEN_REJECTED;
+    field: string;
+};

package/dist/runtime/startPayload.js

@@ -0,0 +1,59 @@
+/** Cap for inline pipeline body + skills start payload (1 MiB). */
+export const START_PAYLOAD_MAX_BYTES = 1_048_576;
+export const START_TOKEN_REJECTED = "start.token_rejected";
+export const INLINE_PIPELINE_TOO_LARGE = "inline_pipeline_too_large";
+export function pipelineBodyBytes(fields) {
+    if (fields.pipelineBody === undefined)
+        return 0;
+    return Buffer.byteLength(fields.pipelineBody, "utf8");
+}
+export function pipelinePersistenceForStart(pipeline) {
+    if (typeof pipeline === "string") {
+        return { ok: true, fields: { pipelineSource: "path" } };
+    }
+    const body = JSON.stringify(pipeline);
+    const bytes = Buffer.byteLength(body, "utf8");
+    if (bytes > START_PAYLOAD_MAX_BYTES) {
+        return {
+            ok: false,
+            code: INLINE_PIPELINE_TOO_LARGE,
+            bytes,
+            maxBytes: START_PAYLOAD_MAX_BYTES,
+        };
+    }
+    return {
+        ok: true,
+        fields: { pipelineSource: "inline", pipelineBody: body },
+    };
+}
+/** MCP prefers `checkout`; `checkout_override` remains a temporary alias. */
+export function pickCheckoutOverride(args) {
+    return args.checkout ?? args.checkout_override;
+}
+const TOKEN_SHAPED_KEY = /^(token|github_token|gh_token|access_token|personal_access_token|pat|clone_token|git_token|api_token|auth_token)$/i;
+export function isTokenShapedKey(key) {
+    return TOKEN_SHAPED_KEY.test(key);
+}
+export function findTokenShapedField(value, pathPrefix = "") {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        const path = pathPrefix ? `${pathPrefix}.${key}` : key;
+        if (isTokenShapedKey(key))
+            return path;
+        if (key === "task" && child !== null && typeof child === "object") {
+            const nested = findTokenShapedField(child, path);
+            if (nested !== undefined)
+                return nested;
+        }
+    }
+    return undefined;
+}
+export function tokenRejectedPayload(field) {
+    return {
+        error: `Clone credentials must stay on the Host; reject token-shaped start field "${field}"`,
+        code: START_TOKEN_REJECTED,
+        field,
+    };
+}

package/dist/runtime/taskInput.js

@@ -1,11 +1,11 @@
 import path from "node:path";
 import { stringify as stringifyYaml } from "yaml";
-import { parseTaskFile } from "../config/loadTask.js";
+import { coerceTaskFile } from "../config/loadTask.js";
 import { relPath } from "../config/validateCatalog.js";
 import { payloadInstanceMismatch } from "../envelope/payloadSchema.js";
 import { resolveTaskPath } from "./pipelineRunner.js";
 export function isTaskFile(value) {
-    return parseTaskFile(value, "task").ok;
+    return coerceTaskFile(value) !== undefined;
 }
 export function taskFileToYaml(task) {
     const doc = {
@@ -18,6 +18,15 @@ export function taskFileToYaml(task) {
         doc.constraints = task.constraints;
     if (task.checkout !== undefined)
         doc.checkout = task.checkout;
+    if (task.repository !== undefined)
+        doc.repository = task.repository;
+    if (task.ref !== undefined)
+        doc.ref = task.ref;
+    if (task.run_branch_template !== undefined) {
+        doc.run_branch_template = task.run_branch_template;
+    }
+    if (task.git_identity !== undefined)
+        doc.git_identity = task.git_identity;
     if (task.input !== undefined)
         doc.input = task.input;
     return stringifyYaml(doc);
@@ -78,9 +87,9 @@ export function resolveStartTaskInput(input, cwd) {
         }
         return { kind: "path", taskPath: resolveTaskPath(input.task, cwd) };
     }
-    const parsed = parseTaskFile(input.task, "task");
-    if (parsed.ok) {
-        return { kind: "yaml", taskYaml: taskFileToYaml(parsed.value) };
+    const coerced = coerceTaskFile(input.task);
+    if (coerced !== undefined) {
+        return { kind: "yaml", taskYaml: taskFileToYaml(coerced) };
     }
     throw new Error("task path, task object, or taskYaml is required");
 }

package/dist/runtime/verifiedStageExecution.d.ts

@@ -28,4 +28,5 @@ export declare function createVerifiedStageExecution(options: {
     stage: StageConfig;
     dag?: ResolvedPipelineDag;
     roots: StageRoots;
+    commandEnv?: NodeJS.ProcessEnv;
 }): VerifiedStageExecution;

package/dist/runtime/verifiedStageExecution.js

@@ -42,7 +42,7 @@ function gateDecisionsForAttempt(options) {
  * module in stageRunner.
  */
 export function createVerifiedStageExecution(options) {
-    const { store, runId, stageId, attempt, stage, dag, roots } = options;
+    const { store, runId, stageId, attempt, stage, dag, roots, commandEnv } = options;
     const contract = dag?.nodes.find((node) => node.id === stageId)?.completion;
     let checkout;
     let checkoutBefore;
@@ -82,6 +82,7 @@ export function createVerifiedStageExecution(options) {
                     payloadSchema: stage.payload_schema,
                     artifactsDir,
                     commandWorkingDirectory: roots.cwd,
+                    ...(commandEnv !== undefined ? { commandEnv } : {}),
                     gates: gateDecisionsForAttempt({ store, runId, stageId, attempt }),
                     checkout,
                     checkoutBefore,