stageflow 0.25.0 → 0.30.0

package/dist/runtime/stageRoots.js

@@ -4,8 +4,126 @@ import { isCursorModelRef } from "../agent/cursorProvider.js";
 import { stageDir } from "../runstore/paths.js";
 import { noAttemptContext } from "./stageAttemptContext.js";
 import { resolveCredentialBinding } from "./credentialBinding.js";
+export const STAGEFLOW_CHECKOUT = "STAGEFLOW_CHECKOUT";
 export const STAGEFLOW_RUN_WORKSPACE = "STAGEFLOW_RUN_WORKSPACE";
+export const STAGEFLOW_REPOSITORY = "STAGEFLOW_REPOSITORY";
+export const STAGEFLOW_REF = "STAGEFLOW_REF";
+export const STAGEFLOW_BASE_SHA = "STAGEFLOW_BASE_SHA";
+export const STAGEFLOW_RUN_BRANCH = "STAGEFLOW_RUN_BRANCH";
+export const REPOSITORY_ONLY_STAGEFLOW_VARS = [
+    STAGEFLOW_REPOSITORY,
+    STAGEFLOW_REF,
+    STAGEFLOW_BASE_SHA,
+    STAGEFLOW_RUN_BRANCH,
+];
 export const PI_CODING_AGENT_DIR_ENV = "PI_CODING_AGENT_DIR";
+function nonEmptyTrimmed(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+export function resolveEffectiveGitIdentity(hostEnv, taskIdentity) {
+    const name = nonEmptyTrimmed(taskIdentity?.name) ??
+        nonEmptyTrimmed(hostEnv.STAGEFLOW_GIT_AUTHOR_NAME) ??
+        "Stageflow";
+    const email = nonEmptyTrimmed(taskIdentity?.email) ??
+        nonEmptyTrimmed(hostEnv.STAGEFLOW_GIT_AUTHOR_EMAIL) ??
+        "stageflow@localhost";
+    return { name, email };
+}
+export function buildStageBindingEnv(input) {
+    const hostEnv = input.hostEnv ?? {};
+    const authorName = input.gitIdentity.name;
+    const authorEmail = input.gitIdentity.email;
+    const committerName = nonEmptyTrimmed(hostEnv.STAGEFLOW_GIT_COMMITTER_NAME) ?? authorName;
+    const committerEmail = nonEmptyTrimmed(hostEnv.STAGEFLOW_GIT_COMMITTER_EMAIL) ?? authorEmail;
+    const env = {
+        [STAGEFLOW_RUN_WORKSPACE]: input.runWorkspaceDir,
+        GIT_AUTHOR_NAME: authorName,
+        GIT_AUTHOR_EMAIL: authorEmail,
+        GIT_COMMITTER_NAME: committerName,
+        GIT_COMMITTER_EMAIL: committerEmail,
+    };
+    if (input.checkoutRoot !== undefined && input.kind !== "unbound") {
+        env[STAGEFLOW_CHECKOUT] = input.checkoutRoot;
+        env.GIT_CONFIG_COUNT = "1";
+        env.GIT_CONFIG_KEY_0 = "safe.directory";
+        env.GIT_CONFIG_VALUE_0 = input.checkoutRoot;
+    }
+    if (input.kind === "repository") {
+        if (input.repository !== undefined) {
+            env[STAGEFLOW_REPOSITORY] = input.repository;
+        }
+        if (input.ref !== undefined) {
+            env[STAGEFLOW_REF] = input.ref;
+        }
+        if (input.resolvedSha !== undefined) {
+            env[STAGEFLOW_BASE_SHA] = input.resolvedSha;
+        }
+        if (input.runBranch !== undefined) {
+            env[STAGEFLOW_RUN_BRANCH] = input.runBranch;
+        }
+    }
+    return env;
+}
+export function overlayStageBindingEnv(base, bindingEnv, kind) {
+    const out = { ...base, ...bindingEnv };
+    if (kind !== "repository") {
+        for (const key of REPOSITORY_ONLY_STAGEFLOW_VARS) {
+            delete out[key];
+        }
+    }
+    if (kind === "unbound" || !Object.hasOwn(bindingEnv, STAGEFLOW_CHECKOUT)) {
+        delete out[STAGEFLOW_CHECKOUT];
+    }
+    if (!Object.hasOwn(bindingEnv, "GIT_CONFIG_COUNT")) {
+        delete out.GIT_CONFIG_COUNT;
+        delete out.GIT_CONFIG_KEY_0;
+        delete out.GIT_CONFIG_VALUE_0;
+    }
+    return out;
+}
+export function bindingKindFromMeta(meta) {
+    if (meta.repository != null && meta.repository !== "") {
+        return "repository";
+    }
+    if (meta.checkout_root != null && meta.checkout_root !== "") {
+        return "checkout";
+    }
+    return "unbound";
+}
+export function stageBindingEnvFromRun(options) {
+    const hostEnv = options.hostEnv ?? process.env;
+    const kind = bindingKindFromMeta(options.meta);
+    const identity = options.meta.git_author_name !== undefined &&
+        options.meta.git_author_email !== undefined
+        ? {
+            name: options.meta.git_author_name,
+            email: options.meta.git_author_email,
+        }
+        : resolveEffectiveGitIdentity(hostEnv, options.task.git_identity);
+    const env = buildStageBindingEnv({
+        kind,
+        runWorkspaceDir: options.runWorkspaceDir,
+        ...(options.meta.checkout_root !== undefined
+            ? { checkoutRoot: options.meta.checkout_root }
+            : {}),
+        ...(options.meta.repository !== undefined
+            ? { repository: options.meta.repository }
+            : {}),
+        ...(options.meta.ref !== undefined ? { ref: options.meta.ref } : {}),
+        ...(options.meta.resolved_sha !== undefined
+            ? { resolvedSha: options.meta.resolved_sha }
+            : {}),
+        ...(options.meta.run_branch !== undefined
+            ? { runBranch: options.meta.run_branch }
+            : {}),
+        gitIdentity: identity,
+        hostEnv,
+    });
+    return { kind, env, identity };
+}
 export function withResolvedAuthPath(roots, factoryCwd) {
     if (roots.authPath)
         return roots;

package/dist/runtime/stageRunner.d.ts

@@ -1,4 +1,6 @@
 import type { AgentPort, FeedbackLoopContext, StageHandle, StageRunResult, StageSessionMode } from "../agent/port.js";
+import { type HostGateContext } from "../browser/gateHandoff.js";
+import type { StageBrowserSupport } from "../browser/browserHost.js";
 import type { StageEnvelope } from "../types/envelope.js";
 import type { LoadedStageConfig } from "../types/stage.js";
 import type { TaskFile } from "../types/task.js";
@@ -48,6 +50,9 @@ export type RunStageOptions = {
     sessionMode?: StageSessionMode;
     feedbackLoopContext?: FeedbackLoopContext;
     resumeToken?: string;
+    stageEnv?: Record<string, string>;
+    /** Test seam for the Host login check run by a `browser_login` verify item. */
+    browser?: Pick<StageBrowserSupport, "runner" | "loginCheck">;
 };
 /**
  * Yield loop: next() until completed; on wait, coordinator enterWait (KTD6).
@@ -61,5 +66,6 @@ export declare function runStageYieldLoop(options: {
     store?: RunStore;
     attemptCtx?: StageAttemptContext;
     skipGates?: boolean;
+    gateContext?: HostGateContext;
 }): Promise<RunStageYieldLoopResult>;
 export declare function runStage(options: RunStageOptions): Promise<RunStageOutcome>;

package/dist/runtime/stageRunner.js

@@ -1,8 +1,11 @@
+import { hostGateContextFor, stampGateRequest, } from "../browser/gateHandoff.js";
 import { deriveExecutionPatchFromEvent } from "../runstore/stageExecution.js";
 import { buildStageRoots, withResolvedAuthPath, } from "./stageRoots.js";
 import { createDefaultHitlQaHooks, recordWaitEnter, } from "./stageHitl.js";
 import { openStageAttempt, } from "./stageAttemptBootstrap.js";
 import { createVerifiedStageExecution } from "./verifiedStageExecution.js";
+import { BROWSER_STAGE_PATTERNS, redact } from "../logging/redact.js";
+import { getNamedSecrets } from "../logging/namedSecrets.js";
 import { isStageTimeoutReason } from "../agent/stageTimeout.js";
 export function isRunStageWaiting(outcome) {
     return "waiting" in outcome && outcome.waiting === true;
@@ -44,11 +47,16 @@ async function appendLifecycleEventAndPatchExecution(options) {
     }
 }
 async function finalizeStageResult(options) {
-    const { store, runId, stageId, result, activityChain, attemptCtx } = options;
+    const { store, runId, stageId, result, activityChain, attemptCtx, browser } = options;
     const attemptOpt = attemptCtx?.eventOptions();
     await activityChain;
     if (result.envelope) {
-        await store.writeEnvelope(runId, stageId, result.envelope, attemptOpt);
+        await store.writeEnvelope(runId, stageId, browser
+            ? redact(result.envelope, {
+                patterns: BROWSER_STAGE_PATTERNS,
+                namedSecrets: getNamedSecrets(),
+            })
+            : result.envelope, attemptOpt);
     }
     if (!result.ok) {
         await appendLifecycleEventAndPatchExecution({
@@ -75,10 +83,11 @@ async function finalizeStageResult(options) {
  * Yield loop: next() until completed; on wait, coordinator enterWait (KTD6).
  */
 export async function runStageYieldLoop(options) {
-    const { handle, runId, stageId, hitl, workerMode, store, attemptCtx, skipGates } = options;
+    const { handle, runId, stageId, hitl, workerMode, store, attemptCtx, skipGates, gateContext } = options;
     while (true) {
         const event = await handle.next();
         if (event.status === "waiting_for_input") {
+            const request = stampGateRequest(event.request, gateContext);
             if (skipGates) {
                 return {
                     ok: false,
@@ -96,7 +105,7 @@ export async function runStageYieldLoop(options) {
                     store,
                     runId,
                     stageId,
-                    request: event.request,
+                    request,
                     attemptCtx,
                     qaHooks: createDefaultHitlQaHooks(store),
                 });
@@ -108,14 +117,14 @@ export async function runStageYieldLoop(options) {
                     reason: "stage requested wait but no HITL controller is configured",
                 };
             }
-            await hitl.enterWait(runId, stageId, handle, event.request, attemptCtx);
+            await hitl.enterWait(runId, stageId, handle, request, attemptCtx);
             continue;
         }
         return event.result;
     }
 }
 export async function runStage(options) {
-    const { agent, store, runId, stage, task, dag, checkoutRoot, workspaceDir, hitl, skipStarted, existingHandle, workerMode, roots: rootsOverride, attemptCtx, factoryCwd, operatorCatalog, completedEnvelopes, skipGates, sessionMode, feedbackLoopContext, resumeToken, } = options;
+    const { agent, store, runId, stage, task, dag, checkoutRoot, workspaceDir, hitl, skipStarted, existingHandle, workerMode, roots: rootsOverride, attemptCtx, factoryCwd, operatorCatalog, completedEnvelopes, skipGates, sessionMode, feedbackLoopContext, resumeToken, stageEnv, browser: browserSeams, } = options;
     const stageId = options.stageId ?? stage.id;
     const attemptOpt = attemptCtx?.eventOptions();
     const baseRoots = rootsOverride ??
@@ -143,6 +152,20 @@ export async function runStage(options) {
         stage,
         dag,
         roots,
+        commandEnv: stageEnv ?? process.env,
+        ...(stage.browser?.check !== undefined
+            ? {
+                browserLogin: {
+                    check: stage.browser.check,
+                    ...(browserSeams?.runner !== undefined
+                        ? { runner: browserSeams.runner }
+                        : {}),
+                    ...(browserSeams?.loginCheck !== undefined
+                        ? { options: browserSeams.loginCheck }
+                        : {}),
+                },
+            }
+            : {}),
     });
     await verifiedExecution.prepare();
     console.error(`Running stage ${stageId} (${stage.model})...`);
@@ -179,6 +202,7 @@ export async function runStage(options) {
             ...(sessionMode !== undefined ? { sessionMode } : {}),
             ...(feedbackLoopContext !== undefined ? { feedbackLoopContext } : {}),
             ...(resumeToken !== undefined ? { resumeToken } : {}),
+            ...(stageEnv !== undefined ? { stageEnv } : {}),
             onActivity: (event) => {
                 enqueueActivity(event);
             },
@@ -207,6 +231,7 @@ export async function runStage(options) {
             store: workerMode ? store : undefined,
             attemptCtx,
             skipGates,
+            gateContext: hostGateContextFor(stage.browser),
         });
     }
     catch (err) {
@@ -251,6 +276,7 @@ export async function runStage(options) {
             result,
             activityChain,
             attemptCtx,
+            browser: stage.browser !== undefined,
         });
     }
     finally {

package/dist/runtime/stageSecretDecl.d.ts

@@ -0,0 +1,9 @@
+import { type LoadOutcome } from "../config/loadOutcome.js";
+export type StageSecretAs = "env" | "helper" | "file";
+export type StageSecretDecl = {
+    name: string;
+    /** Default: helper for git/gh token names, else env for env-kind registry entries / file for file-kind. */
+    as?: "env";
+};
+export declare function defaultSecretDelivery(name: string): "helper" | "env";
+export declare function parseStageSecrets(raw: unknown, label: string, stageId?: string): LoadOutcome<StageSecretDecl[] | undefined>;

package/dist/runtime/stageSecretDecl.js

@@ -0,0 +1,102 @@
+import { loadFailure, loadSuccess } from "../config/loadOutcome.js";
+import { isForeverDeniedSecret } from "./stageEnvironment.js";
+const GIT_HELPER_DEFAULT_NAMES = new Set([
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+]);
+export function defaultSecretDelivery(name) {
+    return GIT_HELPER_DEFAULT_NAMES.has(name) ? "helper" : "env";
+}
+export function parseStageSecrets(raw, label, stageId) {
+    if (raw === undefined)
+        return loadSuccess(undefined);
+    if (!Array.isArray(raw)) {
+        return loadFailure([
+            {
+                code: "stage.invalid_secrets",
+                message: `Invalid stage ${label}: secrets must be an array`,
+                category: "stage",
+                stageId,
+            },
+        ]);
+    }
+    const decls = [];
+    const seen = new Set();
+    for (const item of raw) {
+        let name;
+        let asEnv = false;
+        if (typeof item === "string") {
+            name = item.trim();
+        }
+        else if (item !== null && typeof item === "object" && !Array.isArray(item)) {
+            const obj = item;
+            if (typeof obj.name !== "string" || obj.name.trim() === "") {
+                return loadFailure([
+                    {
+                        code: "stage.invalid_secrets",
+                        message: `Invalid stage ${label}: secrets entries must be strings or { name, as? }`,
+                        category: "stage",
+                        stageId,
+                    },
+                ]);
+            }
+            name = obj.name.trim();
+            if (obj.as !== undefined) {
+                if (obj.as !== "env") {
+                    return loadFailure([
+                        {
+                            code: "stage.invalid_secrets",
+                            message: `Invalid stage ${label}: secrets as must be "env" when set`,
+                            category: "stage",
+                            stageId,
+                        },
+                    ]);
+                }
+                asEnv = true;
+            }
+        }
+        else {
+            return loadFailure([
+                {
+                    code: "stage.invalid_secrets",
+                    message: `Invalid stage ${label}: secrets entries must be strings or { name, as? }`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        if (name === "") {
+            return loadFailure([
+                {
+                    code: "stage.invalid_secrets",
+                    message: `Invalid stage ${label}: secrets names must be non-empty`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        if (isForeverDeniedSecret(name)) {
+            return loadFailure([
+                {
+                    code: "stage.denied_secret",
+                    message: `Invalid stage ${label}: secret "${name}" is permanently denied and cannot be granted`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        if (seen.has(name)) {
+            return loadFailure([
+                {
+                    code: "stage.invalid_secrets",
+                    message: `Invalid stage ${label}: secrets contains duplicate name "${name}"`,
+                    category: "stage",
+                    stageId,
+                },
+            ]);
+        }
+        seen.add(name);
+        decls.push(asEnv ? { name, as: "env" } : { name });
+    }
+    return loadSuccess(decls);
+}

package/dist/runtime/stageSecrets.d.ts

@@ -0,0 +1,40 @@
+import { cleanupCredentialsDir } from "./credentialMaterialisation.js";
+import { type StageSecretDecl } from "./stageSecretDecl.js";
+import type { ResolvedStageGrants } from "./stageEnvironment.js";
+export type SecretRegistryEntry = {
+    kind: "env";
+    name: string;
+} | {
+    kind: "file";
+    name: string;
+    source: string;
+    pointerVar: string;
+};
+export type SecretRegistry = Map<string, SecretRegistryEntry>;
+export declare class SecretUnavailableError extends Error {
+    readonly code: "secret_unavailable";
+    readonly secretName: string;
+    constructor(secretName: string);
+}
+/** Host-owned secret registry: env NAME/_FILE plus file-credentials under $STAGEFLOW_HOME. */
+export declare function loadSecretRegistry(env?: NodeJS.ProcessEnv, home?: string): SecretRegistry;
+export type ResolveStageSecretsInput = {
+    decls: readonly StageSecretDecl[] | undefined;
+    registry: SecretRegistry;
+    hostEnv: NodeJS.ProcessEnv;
+    attemptDir: string;
+    home?: string;
+};
+export type ResolveStageSecretsResult = {
+    grants: ResolvedStageGrants;
+    warnings: string[];
+    knownValues: Array<{
+        name: string;
+        value: string;
+    }>;
+    credentialDirs: string[];
+};
+/** Presence-only check (no materialisation) for preflight / start gates. */
+export declare function assertSecretPresent(name: string, registry: SecretRegistry, hostEnv: NodeJS.ProcessEnv): void;
+export declare function resolveStageSecrets(input: ResolveStageSecretsInput): ResolveStageSecretsResult;
+export { cleanupCredentialsDir };

package/dist/runtime/stageSecrets.js

@@ -0,0 +1,181 @@
+import { readFileSync } from "node:fs";
+import { shouldRegisterValue } from "../logging/redact.js";
+import { globalStageflowHome } from "../project/globalHome.js";
+import { attemptCredentialsDir, cleanupCredentialsDir, ensureStageAskpassHelper, materialiseCredentialFile, materialiseSecretBytes, readFileCredentialRegistry, } from "./credentialMaterialisation.js";
+import { defaultSecretDelivery, } from "./stageSecretDecl.js";
+import { isForeverDeniedSecret } from "./stageEnvironment.js";
+export class SecretUnavailableError extends Error {
+    code = "secret_unavailable";
+    secretName;
+    constructor(secretName) {
+        super(`secret_unavailable: registered secret "${secretName}" has no value on this Host`);
+        this.name = "SecretUnavailableError";
+        this.secretName = secretName;
+    }
+}
+function readEnvSecretValue(name, env) {
+    const plain = env[name];
+    const fileKey = `${name}_FILE`;
+    const filePath = env[fileKey];
+    const hasPlain = plain !== undefined && plain.length > 0;
+    const hasFile = filePath !== undefined && filePath.length > 0;
+    if (hasPlain && hasFile) {
+        throw new Error(`Set only one of ${name} or ${fileKey}, not both`);
+    }
+    if (hasFile) {
+        return readFileSync(filePath, "utf8").replace(/\r?\n$/, "");
+    }
+    if (hasPlain)
+        return plain;
+    return undefined;
+}
+/** Host-owned secret registry: env NAME/_FILE plus file-credentials under $STAGEFLOW_HOME. */
+export function loadSecretRegistry(env = process.env, home = globalStageflowHome()) {
+    const registry = new Map();
+    const fileCreds = readFileCredentialRegistry(home);
+    for (const [name, entry] of Object.entries(fileCreds)) {
+        if (isForeverDeniedSecret(name))
+            continue;
+        registry.set(name, {
+            kind: "file",
+            name,
+            source: entry.source,
+            pointerVar: entry.pointerVar,
+        });
+    }
+    // Well-known env secrets are always registered when present or when declared
+    // (presence checked at resolve time). Register common names so validate can
+    // distinguish unknown vs unavailable.
+    for (const name of [
+        "GITHUB_TOKEN",
+        "GH_TOKEN",
+        "NPM_TOKEN",
+        "NODE_AUTH_TOKEN",
+    ]) {
+        if (!registry.has(name)) {
+            registry.set(name, { kind: "env", name });
+        }
+    }
+    // Any Host env var with a sibling `_FILE` or non-empty value that looks like a
+    // registered secret name from STAGEFLOW_SECRET_REGISTRY (comma list) is also
+    // env-kind.
+    const extra = env.STAGEFLOW_SECRET_REGISTRY?.split(",") ?? [];
+    for (const raw of extra) {
+        const name = raw.trim();
+        if (!name || isForeverDeniedSecret(name) || registry.has(name))
+            continue;
+        registry.set(name, { kind: "env", name });
+    }
+    return registry;
+}
+/** Presence-only check (no materialisation) for preflight / start gates. */
+export function assertSecretPresent(name, registry, hostEnv) {
+    if (isForeverDeniedSecret(name)) {
+        throw new Error(`secret "${name}" is permanently denied`);
+    }
+    const entry = registry.get(name);
+    if (entry === undefined) {
+        throw new Error(`stage.unknown_secret: "${name}"`);
+    }
+    if (entry.kind === "file") {
+        try {
+            readFileSync(entry.source, "utf8");
+        }
+        catch {
+            throw new SecretUnavailableError(name);
+        }
+        return;
+    }
+    const value = readEnvSecretValue(name, hostEnv);
+    if (value === undefined || value === "") {
+        throw new SecretUnavailableError(name);
+    }
+}
+function materialiseGitAskpassGrant(grantEnv, credentialDirs, opts) {
+    const destDir = attemptCredentialsDir(opts.attemptDir, opts.secretName);
+    const tokenFile = materialiseSecretBytes({
+        contents: opts.value,
+        destDir,
+        destBasename: "token",
+    });
+    credentialDirs.push(destDir);
+    grantEnv.GIT_ASKPASS = ensureStageAskpassHelper(opts.home);
+    grantEnv.GIT_TERMINAL_PROMPT = "0";
+    grantEnv.STAGEFLOW_GIT_ASKPASS_TOKEN_FILE = tokenFile.destPath;
+}
+export function resolveStageSecrets(input) {
+    const decls = input.decls ?? [];
+    const warnings = [];
+    const grantEnv = {};
+    const knownValues = [];
+    const credentialDirs = [];
+    const registeredNames = [...input.registry.keys()];
+    const declaredNames = decls.map((d) => d.name);
+    for (const decl of decls) {
+        if (isForeverDeniedSecret(decl.name)) {
+            throw new Error(`secret "${decl.name}" is permanently denied`);
+        }
+        const entry = input.registry.get(decl.name);
+        if (entry === undefined) {
+            throw new Error(`stage.unknown_secret: "${decl.name}"`);
+        }
+        if (entry.kind === "file") {
+            const destDir = attemptCredentialsDir(input.attemptDir, decl.name);
+            const homeRoot = input.home ?? globalStageflowHome();
+            const copied = materialiseCredentialFile({
+                sourcePath: entry.source,
+                destDir,
+                allowedRoot: homeRoot,
+            });
+            credentialDirs.push(destDir);
+            grantEnv[entry.pointerVar] = copied.destPath;
+            const contents = readFileSync(copied.destPath, "utf8");
+            if (shouldRegisterValue(contents)) {
+                knownValues.push({ name: decl.name, value: contents });
+            }
+            if (decl.as === "env") {
+                warnings.push(`secrets: ${decl.name} granted as: env (value present in stage environment)`);
+                grantEnv[decl.name] = contents;
+            }
+            continue;
+        }
+        const value = readEnvSecretValue(decl.name, input.hostEnv);
+        if (value === undefined || value === "") {
+            throw new SecretUnavailableError(decl.name);
+        }
+        knownValues.push({ name: decl.name, value });
+        const delivery = decl.as === "env" ? "env" : defaultSecretDelivery(decl.name);
+        if (delivery === "env") {
+            if (decl.as === "env") {
+                warnings.push(`secrets: ${decl.name} granted as: env (value present in stage environment)`);
+            }
+            grantEnv[decl.name] = value;
+            if (defaultSecretDelivery(decl.name) === "helper") {
+                materialiseGitAskpassGrant(grantEnv, credentialDirs, {
+                    attemptDir: input.attemptDir,
+                    secretName: decl.name,
+                    value,
+                    home: input.home,
+                });
+            }
+            continue;
+        }
+        materialiseGitAskpassGrant(grantEnv, credentialDirs, {
+            attemptDir: input.attemptDir,
+            secretName: decl.name,
+            value,
+            home: input.home,
+        });
+    }
+    return {
+        grants: {
+            env: grantEnv,
+            registeredSecretNames: registeredNames,
+            declaredSecretNames: declaredNames,
+        },
+        warnings,
+        knownValues,
+        credentialDirs,
+    };
+}
+export { cleanupCredentialsDir };

package/dist/runtime/stageStreamLog.d.ts

@@ -14,4 +14,5 @@ export type StageStreamLogWriter = {
 export declare function createStageStreamLogWriter(streamLogPath: string, options?: {
     flushThrottleMs?: number;
     capBytes?: number;
+    redact?: (text: string) => string;
 }): StageStreamLogWriter;

package/dist/runtime/stageStreamLog.js

@@ -54,6 +54,7 @@ async function appendChunk(streamLogPath, chunk, capBytes) {
 export function createStageStreamLogWriter(streamLogPath, options = {}) {
     const flushThrottleMs = options.flushThrottleMs ?? STREAM_FLUSH_THROTTLE_MS;
     const capBytes = options.capBytes ?? DEFAULT_CAP_BYTES;
+    const scrub = options.redact ?? redactSecrets;
     let buffer = "";
     let timer = null;
     // Serializes disk writes so the throttle timer and an eager flush() never race.
@@ -65,7 +66,7 @@ export function createStageStreamLogWriter(streamLogPath, options = {}) {
         }
         if (!buffer)
             return writeChain;
-        const chunk = redactSecrets(buffer);
+        const chunk = scrub(buffer);
         buffer = "";
         writeChain = writeChain.then(() => appendChunk(streamLogPath, chunk, capBytes));
         return writeChain;

package/dist/runtime/stageWorker.d.ts

@@ -2,5 +2,6 @@ import { type RunStageOutcome } from "./stageRunner.js";
 import { type StageWorkerInput, type StageWorkerResult } from "./stageWorkerProtocol.js";
 export type { StageWorkerInput, StageWorkerResult } from "./stageWorkerProtocol.js";
 export declare function runStageWorker(input: StageWorkerInput): Promise<RunStageOutcome>;
-export declare function sendWorkerResult(result: StageWorkerResult): void;
-export declare function exitForOutcome(outcome: RunStageOutcome): never;
+export declare function sendWorkerResult(result: StageWorkerResult): Promise<void>;
+export declare function exitCodeForOutcome(outcome: RunStageOutcome): number;
+export declare function exitForOutcome(outcome: RunStageOutcome): Promise<number>;