stageflow 0.25.0 → 0.30.0

package/dist/runtime/githubPollSource.js

@@ -0,0 +1,284 @@
+import path from "node:path";
+import { Octokit } from "octokit";
+import { getCatalogScanPaths } from "../config/browseCatalog.js";
+import { loadTriggerOutcome } from "../config/loadTrigger.js";
+import { catalogContextFromStageflow } from "../config/resolveCatalogContext.js";
+import { readSecretFromEnvOrFile } from "../config/secretFromEnvOrFile.js";
+import { resolveStageflowContext } from "../project/resolveStageflowContext.js";
+import { matchesEventFilter } from "./triggerEventMatch.js";
+export const DEFAULT_GITHUB_POLL_INTERVAL_MS = 60_000;
+export const DEFAULT_GITHUB_TOKEN_SECRET = "GITHUB_TOKEN";
+const GITHUB_REPO_RE = /^[^\s/]+\/[^\s/]+$/;
+/** Parse `STAGEFLOW_GITHUB_POLL_INTERVAL_MS`; default 60s; `0` disables. */
+export function githubPollIntervalMsFromEnv(env = process.env) {
+    const raw = env.STAGEFLOW_GITHUB_POLL_INTERVAL_MS;
+    if (raw === undefined || raw.trim() === "")
+        return DEFAULT_GITHUB_POLL_INTERVAL_MS;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed < 0)
+        return DEFAULT_GITHUB_POLL_INTERVAL_MS;
+    return parsed;
+}
+export function defaultCreateGithubClient(token) {
+    const octokit = new Octokit({ auth: token });
+    return {
+        async listPulls({ owner, repo, etag }) {
+            let response;
+            try {
+                response = await octokit.rest.pulls.list({
+                    owner,
+                    repo,
+                    state: "all",
+                    sort: "updated",
+                    direction: "desc",
+                    per_page: 30,
+                    ...(etag !== undefined ? { headers: { "If-None-Match": etag } } : {}),
+                });
+            }
+            catch (err) {
+                if (err !== null && typeof err === "object" && "status" in err && err.status === 304) {
+                    return { status: 304, items: [] };
+                }
+                throw err;
+            }
+            const responseEtag = response.headers.etag;
+            return {
+                status: response.status,
+                ...(typeof responseEtag === "string" ? { etag: responseEtag } : {}),
+                items: response.data.map((pr) => ({
+                    number: pr.number,
+                    title: pr.title,
+                    html_url: pr.html_url,
+                    state: pr.state,
+                    merged_at: pr.merged_at,
+                    created_at: pr.created_at,
+                    updated_at: pr.updated_at,
+                    user: pr.user ? { login: pr.user.login } : null,
+                })),
+            };
+        },
+    };
+}
+function deriveAction(item) {
+    if (item.merged_at)
+        return "merged";
+    if (item.state === "closed")
+        return "closed";
+    if (item.created_at === item.updated_at)
+        return "opened";
+    return "updated";
+}
+function normalizeGithubItem(item, repo) {
+    return {
+        action: deriveAction(item),
+        number: item.number,
+        title: item.title,
+        url: item.html_url,
+        author: item.user?.login ?? "unknown",
+        repo,
+        updatedAt: item.updated_at,
+    };
+}
+function parseCursor(raw) {
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.updatedAt === "string" && typeof parsed.number === "number") {
+            return { updatedAt: parsed.updatedAt, number: parsed.number };
+        }
+    }
+    catch {
+        // Corrupted/foreign value; treat as unset.
+    }
+    return null;
+}
+function isNewerThanCursor(item, cursor) {
+    const itemMs = new Date(item.updated_at).getTime();
+    const cursorMs = new Date(cursor.updatedAt).getTime();
+    if (itemMs !== cursorMs)
+        return itemMs > cursorMs;
+    return item.number > cursor.number;
+}
+function firstSecretRef(matches) {
+    for (const { definition } of matches) {
+        const secretRef = definition.event?.config?.secretRef;
+        if (typeof secretRef === "string" && secretRef.length > 0)
+            return secretRef;
+    }
+    return undefined;
+}
+/**
+ * `TriggerSourcePort` adapter for `event`-kind triggers whose `event.source`
+ * starts with `github.`. Ticks on an interval; each tick re-scans the catalog,
+ * groups triggers by their distinct `event.config.repo` (one API call per repo
+ * per tick regardless of how many triggers watch it), and diffs each repo's
+ * PR list against a persisted ETag + cursor to find genuinely new activity.
+ *
+ * The first tick for a never-before-seen repo only seeds the cursor — it
+ * never fires for a repo's pre-existing PR history, mirroring how
+ * `ScheduleSource` seeds `next_run_at` without firing on first sight.
+ */
+export class GithubPollSource {
+    store;
+    cwd;
+    intervalMs;
+    logError;
+    env;
+    createGithubClient;
+    interval;
+    inFlight = false;
+    constructor(options) {
+        this.store = options.store;
+        this.cwd = options.cwd ?? process.cwd();
+        this.intervalMs = options.intervalMs ?? DEFAULT_GITHUB_POLL_INTERVAL_MS;
+        this.logError =
+            options.logError ??
+                ((message) => {
+                    console.error(message);
+                });
+        this.env = options.env ?? process.env;
+        this.createGithubClient = options.createGithubClient ?? defaultCreateGithubClient;
+    }
+    async start(onFire) {
+        if (this.intervalMs <= 0)
+            return;
+        this.interval = setInterval(() => {
+            if (this.inFlight)
+                return;
+            this.inFlight = true;
+            void this.tick(onFire)
+                .catch((err) => {
+                this.logError(`github poll tick failed: ${err instanceof Error ? err.message : String(err)}`);
+            })
+                .finally(() => {
+                this.inFlight = false;
+            });
+        }, this.intervalMs).unref();
+    }
+    async stop() {
+        if (this.interval !== undefined)
+            clearInterval(this.interval);
+        this.interval = undefined;
+    }
+    /**
+     * One discovery + poll + fire pass. Public so tests can drive it directly
+     * instead of waiting on real interval timers.
+     */
+    async tick(onFire) {
+        const ctx = catalogContextFromStageflow(await resolveStageflowContext(this.cwd));
+        const scanPaths = await getCatalogScanPaths(ctx);
+        if (!scanPaths)
+            return;
+        const projectRoot = ctx.projectRoot ?? undefined;
+        const groups = await this.discover(scanPaths.triggerPaths);
+        for (const [repo, matches] of groups) {
+            for (const match of matches) {
+                const definitionRef = projectRoot !== undefined
+                    ? path.relative(projectRoot, match.path).replace(/\\/g, "/")
+                    : match.path;
+                await this.store.upsertTrigger({
+                    id: match.definition.id,
+                    definitionRef,
+                    enabled: true,
+                });
+            }
+            await this.pollRepo(repo, matches, onFire);
+        }
+    }
+    async discover(triggerPaths) {
+        const groups = new Map();
+        for (const triggerPath of triggerPaths) {
+            const outcome = await loadTriggerOutcome(triggerPath);
+            if (!outcome.ok)
+                continue;
+            const definition = outcome.value;
+            if (definition.kind !== "event" || !definition.enabled)
+                continue;
+            const source = definition.event?.source;
+            if (typeof source !== "string" || !source.startsWith("github."))
+                continue;
+            const repo = definition.event?.config?.repo;
+            if (typeof repo !== "string" || !GITHUB_REPO_RE.test(repo)) {
+                this.logError(`github poll: trigger "${definition.id}" has an invalid event.config.repo ` +
+                    `(expected "owner/repo"); skipping`);
+                continue;
+            }
+            const list = groups.get(repo) ?? [];
+            list.push({ path: triggerPath, definition });
+            groups.set(repo, list);
+        }
+        return groups;
+    }
+    async pollRepo(repo, matches, onFire) {
+        const secretRef = firstSecretRef(matches) ?? DEFAULT_GITHUB_TOKEN_SECRET;
+        let token;
+        try {
+            token = readSecretFromEnvOrFile(this.env, secretRef);
+        }
+        catch (err) {
+            this.logError(`github poll: failed to read secret "${secretRef}" for repo "${repo}": ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        if (token === undefined) {
+            this.logError(`github poll: secret "${secretRef}" is not set for repo "${repo}"; skipping this tick`);
+            return;
+        }
+        const adapterId = `github:${repo}`;
+        const etag = await this.store.getTriggerAdapterState(adapterId, "etag");
+        const cursor = parseCursor(await this.store.getTriggerAdapterState(adapterId, "cursor"));
+        const [owner, repoName] = repo.split("/");
+        let response;
+        try {
+            const client = this.createGithubClient(token);
+            response = await client.listPulls({
+                owner,
+                repo: repoName,
+                ...(etag !== null ? { etag } : {}),
+            });
+        }
+        catch (err) {
+            this.logError(`github poll: request failed for repo "${repo}": ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        if (response.status === 304)
+            return;
+        if (response.etag !== undefined) {
+            await this.store.setTriggerAdapterState(adapterId, "etag", response.etag);
+        }
+        if (response.items.length === 0)
+            return;
+        const newest = response.items[0];
+        if (cursor === null) {
+            await this.store.setTriggerAdapterState(adapterId, "cursor", JSON.stringify({ updatedAt: newest.updated_at, number: newest.number }));
+            return;
+        }
+        const newItems = response.items.filter((item) => isNewerThanCursor(item, cursor)).reverse();
+        for (const item of newItems) {
+            const summary = normalizeGithubItem(item, repo);
+            for (const { definition } of matches) {
+                if (!matchesEventFilter(definition.event?.match, summary))
+                    continue;
+                await this.fireSafely(onFire, definition, summary);
+            }
+        }
+        await this.store.setTriggerAdapterState(adapterId, "cursor", JSON.stringify({ updatedAt: newest.updated_at, number: newest.number }));
+    }
+    async fireSafely(onFire, definition, summary) {
+        try {
+            if (definition.task !== undefined) {
+                await onFire({ triggerId: definition.id });
+                return;
+            }
+            const task = {
+                id: `${definition.id}-pr-${summary.number}`,
+                goal: `Handle PR #${summary.number}: ${summary.title}`,
+                input: summary,
+            };
+            await onFire({ triggerId: definition.id, task });
+        }
+        catch (err) {
+            this.logError(`github poll: firing trigger "${definition.id}" failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}

package/dist/runtime/pipelineRunner.d.ts

@@ -7,10 +7,31 @@ import type { StageHitlController } from "./stageHitl.js";
 import type { InlinePipelineDefinition, LoadedPipeline } from "../types/pipeline.js";
 import type { TaskFile } from "../types/task.js";
 import { type StageExecutionMode } from "./stageConcurrency.js";
+import type { StageBrowserSupport } from "../browser/browserHost.js";
 import { StageProcessLauncher } from "./stageProcessLauncher.js";
 import type { OperatorCatalog } from "./stageAttemptBootstrap.js";
+import { type SkillsPayload } from "./runSkills.js";
+import { runPipelinePreflight } from "../preflight/pipelinePreflight.js";
 export { PipelineValidationError } from "./pipelineValidationError.js";
-export type PipelineRunOutcome = "succeeded" | "failed" | "waiting";
+export declare class PipelinePreflightError extends Error {
+    readonly code: string;
+    readonly preflight: Awaited<ReturnType<typeof runPipelinePreflight>>;
+    constructor(code: string, preflight: Awaited<ReturnType<typeof runPipelinePreflight>>);
+    toNetworkBody(): import("../errors/codes.js").NetworkErrorBody;
+}
+export type PipelineRunOutcome = "succeeded" | "failed" | "waiting" | "cancelled";
+export declare class InlinePipelineTooLargeError extends Error {
+    readonly code: "inline_pipeline_too_large";
+    readonly bytes: number;
+    readonly maxBytes: number;
+    constructor(bytes: number, maxBytes: number);
+}
+/** Thrown when queued→running CAS fails (e.g. cancel won the race). */
+export declare class QueuedRunActivationAborted extends Error {
+    readonly runId: string;
+    readonly currentStatus?: string;
+    constructor(runId: string, currentStatus?: string);
+}
 export type PipelineRunResult = {
     ok: boolean;
     outcome: PipelineRunOutcome;
@@ -39,6 +60,7 @@ export type PreparedPipeline = {
     hitl?: StageHitlController;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    browser?: StageBrowserSupport;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
     findings?: ValidationFinding[];
@@ -51,6 +73,9 @@ export type ExecuteStagesOptions = {
     startAtStageIndex?: number;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    schedulingHalt?: {
+        halted: boolean;
+    };
 };
 export declare function executeStages(prepared: PreparedPipeline, options?: ExecuteStagesOptions): Promise<PipelineRunResult>;
 export declare function runPipeline(options: {
@@ -66,6 +91,7 @@ export declare function runPipeline(options: {
     maxActiveStagesPerRun?: number;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    browser?: StageBrowserSupport;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
 }): Promise<PipelineRunResult>;
@@ -80,14 +106,27 @@ export declare function startPipeline(options: {
     cwd?: string;
     projectRoot?: string;
     checkoutOverride?: string;
+    runId?: string;
+    checkoutRoot?: string;
+    repository?: string;
+    ref?: string;
+    resolvedSha?: string;
+    runBranch?: string;
     gitSha?: string;
     ciPrUrl?: string;
     ciJobUrl?: string;
+    reuseExistingRun?: boolean;
     hitl?: StageHitlController;
     maxActiveStagesPerRun?: number;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    browser?: StageBrowserSupport;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
+    schedulingHalt?: {
+        halted: boolean;
+    };
+    callerId?: string | null;
+    skills?: SkillsPayload;
 }): Promise<StartedPipeline>;
 export declare function resolveTaskPath(taskArg: string, cwd?: string): string;

package/dist/runtime/pipelineRunner.js

@@ -2,7 +2,7 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { buildValidationResult, loadPipelineValidated, } from "../config/validateCatalog.js";
 import { loadTaskFromYaml } from "../config/loadTask.js";
-import { resolveAndValidateCheckout } from "./stageRoots.js";
+import { resolveAndValidateCheckout, resolveEffectiveGitIdentity, } from "./stageRoots.js";
 import { buildPipelineDagSnapshotFromLoaded } from "../runstore/pipelineDagSnapshot.js";
 import { normalizeCatalogPath } from "../runstore/normalizeCatalogPath.js";
 import { runPipelineDag } from "./pipelineScheduler.js";
@@ -10,7 +10,55 @@ import { readMaxActiveStagesPerRun, readStageExecutionMode, } from "./stageConcu
 import { StageProcessLauncher } from "./stageProcessLauncher.js";
 import { PipelineValidationError } from "./pipelineValidationError.js";
 import { checkTaskEntryInput } from "./taskInput.js";
+import { pipelinePersistenceForStart } from "./startPayload.js";
+import { materializeRunSkills, } from "./runSkills.js";
+import { preflightFailureCode, runPipelinePreflight, } from "../preflight/pipelinePreflight.js";
+import { networkError } from "../errors/codes.js";
+import { newRunId } from "../runstore/paths.js";
+import { bindingFromFields, buildInitialRunManifest, collectDeclaredSecretValues, finaliseStoredRunManifest, } from "../runstore/runManifest.js";
+import { getRequestAuth, } from "../server/requestAuthContext.js";
+import { registerNamedSecrets } from "../logging/namedSecrets.js";
+import { shouldRegisterValue } from "../logging/redact.js";
 export { PipelineValidationError } from "./pipelineValidationError.js";
+export class PipelinePreflightError extends Error {
+    code;
+    preflight;
+    constructor(code, preflight) {
+        super(`Pipeline preflight failed: ${code}`);
+        this.name = "PipelinePreflightError";
+        this.code = code;
+        this.preflight = preflight;
+    }
+    toNetworkBody() {
+        return networkError(this.code, this.message, {
+            checks: this.preflight.checks,
+        });
+    }
+}
+export class InlinePipelineTooLargeError extends Error {
+    code = "inline_pipeline_too_large";
+    bytes;
+    maxBytes;
+    constructor(bytes, maxBytes) {
+        super(`Inline pipeline body is ${bytes} bytes; max is ${maxBytes} (inline_pipeline_too_large)`);
+        this.name = "InlinePipelineTooLargeError";
+        this.bytes = bytes;
+        this.maxBytes = maxBytes;
+    }
+}
+/** Thrown when queued→running CAS fails (e.g. cancel won the race). */
+export class QueuedRunActivationAborted extends Error {
+    runId;
+    currentStatus;
+    constructor(runId, currentStatus) {
+        super(currentStatus === undefined
+            ? `Queued run ${runId} could not be activated`
+            : `Queued run ${runId} could not be activated (status=${currentStatus})`);
+        this.name = "QueuedRunActivationAborted";
+        this.runId = runId;
+        this.currentStatus = currentStatus;
+    }
+}
 let defaultStageProcessLauncher;
 function resolveStageProcessLauncher(executionMode, override) {
     if (executionMode !== "process") {
@@ -34,6 +82,14 @@ async function preparePipeline(options) {
         throw new PipelineValidationError(buildValidationResult("pipeline", loadResult.findings, false));
     }
     const loaded = loadResult.loaded;
+    const preflight = await runPipelinePreflight(loaded, {
+        projectRoot: options.projectRoot ?? options.cwd,
+        forStart: true,
+    });
+    if (!preflight.ok) {
+        const code = preflightFailureCode(preflight, { forStart: true }) ?? "missing_tool";
+        throw new PipelinePreflightError(code, preflight);
+    }
     const taskYaml = options.taskYaml ??
         (options.taskPath
             ? await readFile(options.taskPath, "utf8")
@@ -56,29 +112,122 @@ async function preparePipeline(options) {
     for (const finding of warningFindings) {
         console.error(`${finding.code}: ${finding.message}`);
     }
-    const checkoutRoot = await resolveAndValidateCheckout(task, options.checkoutOverride, options.cwd);
+    // Materialization is owned by RunManager (KTD1). When checkoutRoot is supplied,
+    // do not re-resolve or fetch here.
+    const checkoutRoot = options.checkoutRoot !== undefined
+        ? options.checkoutRoot
+        : await resolveAndValidateCheckout(task, options.checkoutOverride, options.cwd);
     const pipelinePath = typeof options.pipeline === "string"
         ? normalizeCatalogPath(loaded.pipelinePath)
         : undefined;
+    const persistence = pipelinePersistenceForStart(options.pipeline);
+    if (!persistence.ok) {
+        throw new InlinePipelineTooLargeError(persistence.bytes, persistence.maxBytes);
+    }
     const taskPath = options.taskPath
         ? normalizeCatalogPath(path.resolve(options.cwd, options.taskPath))
         : undefined;
     const projectRoot = normalizeCatalogPath(options.projectRoot ?? options.cwd);
-    const run = await options.store.createRun({
-        submission: options.submission,
-        pipelineId: loaded.pipeline.id,
-        taskYaml,
-        taskId: task.id,
-        checkoutRoot,
-        gitSha: options.gitSha,
-        ciPrUrl: options.ciPrUrl,
-        ciJobUrl: options.ciJobUrl,
-        pipelineDag: buildPipelineDagSnapshotFromLoaded(loaded),
-        pipelinePath,
-        taskPath,
-        projectRoot,
-        inlinePipeline: typeof options.pipeline === "string" ? undefined : options.pipeline,
-    });
+    const gitIdentity = resolveEffectiveGitIdentity(process.env, task.git_identity);
+    let run;
+    if (options.reuseExistingRun === true) {
+        const runId = options.runId;
+        if (runId === undefined || runId.trim() === "") {
+            throw new Error("reuseExistingRun requires a preallocated runId");
+        }
+        await options.store.patchRunWorkspaceBinding(runId, {
+            ...(checkoutRoot !== undefined ? { checkoutRoot } : {}),
+            ...(options.repository !== undefined
+                ? { repository: options.repository }
+                : {}),
+            ...(options.ref !== undefined ? { ref: options.ref } : {}),
+            ...(options.resolvedSha !== undefined
+                ? { resolvedSha: options.resolvedSha }
+                : {}),
+            ...(options.runBranch !== undefined
+                ? { runBranch: options.runBranch }
+                : {}),
+        });
+        const activated = await options.store.tryUpdateRunStatus(runId, "running", "queued");
+        if (!activated) {
+            let currentStatus;
+            try {
+                currentStatus = (await options.store.readRunMeta(runId)).status;
+            }
+            catch {
+                currentStatus = undefined;
+            }
+            throw new QueuedRunActivationAborted(runId, currentStatus);
+        }
+        run = { runId, workspaceDir: options.store.getWorkspaceDir(runId) };
+    }
+    else {
+        const runId = options.runId ?? newRunId();
+        const createdAt = new Date().toISOString();
+        const auth = getRequestAuth();
+        const surface = auth?.surface ?? "cli";
+        const callerId = options.callerId !== undefined && options.callerId !== null
+            ? options.callerId
+            : null;
+        const secretNames = loaded.stages.flatMap((s) => (s.secrets ?? []).map((d) => d.name));
+        const namedSecrets = collectDeclaredSecretValues(secretNames).filter((s) => shouldRegisterValue(s.value));
+        if (namedSecrets.length > 0) {
+            registerNamedSecrets(namedSecrets);
+        }
+        const runManifest = buildInitialRunManifest({
+            runId,
+            createdAt,
+            callerId,
+            surface,
+            binding: bindingFromFields({
+                repository: options.repository,
+                ref: options.ref,
+                resolvedSha: options.resolvedSha,
+                runBranch: options.runBranch,
+                checkoutRoot,
+            }),
+            pipelineSource: persistence.fields.pipelineSource,
+            pipelinePath,
+            pipelineBody: persistence.fields.pipelineBody ?? null,
+            taskYaml,
+            taskPath,
+            skills: options.skills,
+            stages: loaded.stages,
+            toolchain: preflight.toolchain.checks,
+            namedSecrets,
+        });
+        run = await options.store.createRun({
+            submission: options.submission,
+            runId,
+            pipelineId: loaded.pipeline.id,
+            taskYaml,
+            taskId: task.id,
+            checkoutRoot,
+            gitSha: options.gitSha,
+            ciPrUrl: options.ciPrUrl,
+            ciJobUrl: options.ciJobUrl,
+            pipelineDag: buildPipelineDagSnapshotFromLoaded(loaded),
+            pipelinePath,
+            taskPath,
+            projectRoot,
+            repository: options.repository,
+            ref: options.ref,
+            resolvedSha: options.resolvedSha,
+            runBranch: options.runBranch,
+            gitAuthorName: gitIdentity.name,
+            gitAuthorEmail: gitIdentity.email,
+            pipelineSource: persistence.fields.pipelineSource,
+            ...(persistence.fields.pipelineBody !== undefined
+                ? { pipelineBody: persistence.fields.pipelineBody }
+                : {}),
+            ...(callerId !== null ? { callerId } : {}),
+            runManifest,
+            skipGates: options.skipGates,
+        });
+    }
+    if (options.skills !== undefined && Object.keys(options.skills).length > 0) {
+        await materializeRunSkills(run.workspaceDir, options.skills);
+    }
     const executionMode = readStageExecutionMode(process.env, options.executionMode);
     const stageProcessLauncher = resolveStageProcessLauncher(executionMode, options.stageProcessLauncher);
     return {
@@ -93,6 +242,7 @@ async function preparePipeline(options) {
         hitl: options.hitl,
         executionMode,
         stageProcessLauncher,
+        browser: options.browser,
         operatorCatalog: options.operatorCatalog,
         skipGates: options.skipGates,
         ...(warningFindings.length > 0 ? { findings: warningFindings } : {}),
@@ -112,6 +262,7 @@ export async function executeStages(prepared, options) {
         startAtStageIndex: options?.startAtStageIndex,
         executionMode,
         stageProcessLauncher,
+        schedulingHalt: options?.schedulingHalt,
     });
     if (prepared.findings !== undefined && prepared.findings.length > 0) {
         return { ...result, findings: prepared.findings };
@@ -133,6 +284,7 @@ export async function runPipeline(options) {
         hitl: options.hitl,
         executionMode: options.executionMode,
         stageProcessLauncher: options.stageProcessLauncher,
+        browser: options.browser,
         operatorCatalog: options.operatorCatalog,
         skipGates: options.skipGates,
     });
@@ -156,21 +308,33 @@ export async function startPipeline(options) {
         cwd,
         projectRoot,
         checkoutOverride: options.checkoutOverride,
+        runId: options.runId,
+        reuseExistingRun: options.reuseExistingRun,
+        checkoutRoot: options.checkoutRoot,
+        repository: options.repository,
+        ref: options.ref,
+        resolvedSha: options.resolvedSha,
+        runBranch: options.runBranch,
         gitSha: options.gitSha,
         ciPrUrl: options.ciPrUrl,
         ciJobUrl: options.ciJobUrl,
         hitl: options.hitl,
         executionMode: options.executionMode,
         stageProcessLauncher: options.stageProcessLauncher,
+        browser: options.browser,
         operatorCatalog: options.operatorCatalog,
         skipGates: options.skipGates,
+        callerId: options.callerId,
+        ...(options.skills !== undefined ? { skills: options.skills } : {}),
     });
     const done = executeStages(prepared, {
         maxActiveStagesPerRun: options.maxActiveStagesPerRun,
         executionMode: prepared.executionMode,
         stageProcessLauncher: prepared.stageProcessLauncher,
+        schedulingHalt: options.schedulingHalt,
     }).catch(async (err) => {
         await prepared.store.updateRunStatus(prepared.run.runId, "failed").catch(() => undefined);
+        await finaliseStoredRunManifest(prepared.store, prepared.run.runId).catch(() => undefined);
         return {
             ok: false,
             outcome: "failed",