stageflow 0.27.0 → 0.31.0

package/dist/config/stageBrowser.js

@@ -0,0 +1,118 @@
+import { loadFailure, loadSuccess } from "./loadOutcome.js";
+import { mergeToolRequires } from "./toolRequires.js";
+export const BROWSER_TOOL_NAME = "agent-browser";
+const ALLOWED_KEYS = new Set(["profile", "headed", "allow_domains", "login_url", "check"]);
+const CHECK_KEYS = new Set(["url", "logged_in_url", "logged_out_url"]);
+const REJECTED_KEYS = new Set(["path", "scope", "secret"]);
+const PROFILE_NAME = /^[A-Za-z0-9_-]{1,64}$/;
+const DOMAIN = /^(\*\.)?[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fail(label, stageId, message) {
+    return loadFailure([
+        {
+            code: "stage.invalid_browser",
+            message: `Invalid stage ${label}: browser ${message}`,
+            category: "stage",
+            ...(stageId !== undefined ? { stageId } : {}),
+        },
+    ]);
+}
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim() !== "";
+}
+function parseCheck(raw, label, stageId) {
+    if (!isPlainObject(raw)) {
+        return fail(label, stageId, "check must be an object");
+    }
+    for (const key of Object.keys(raw)) {
+        if (!CHECK_KEYS.has(key)) {
+            return fail(label, stageId, `check unknown key "${key}" (allowed: url, logged_in_url, logged_out_url)`);
+        }
+    }
+    if (!nonEmptyString(raw.url)) {
+        return fail(label, stageId, "check.url must be a non-empty string");
+    }
+    const check = {
+        url: raw.url.trim(),
+    };
+    if (raw.logged_in_url !== undefined) {
+        if (!nonEmptyString(raw.logged_in_url)) {
+            return fail(label, stageId, "check.logged_in_url must be a non-empty string");
+        }
+        check.logged_in_url = raw.logged_in_url.trim();
+    }
+    if (raw.logged_out_url !== undefined) {
+        const list = Array.isArray(raw.logged_out_url)
+            ? raw.logged_out_url
+            : [raw.logged_out_url];
+        if (list.length === 0 || !list.every(nonEmptyString)) {
+            return fail(label, stageId, "check.logged_out_url must be a non-empty string or a non-empty list of strings");
+        }
+        const trimmed = list.map((item) => item.trim());
+        check.logged_out_url = Array.isArray(raw.logged_out_url)
+            ? trimmed
+            : trimmed[0];
+    }
+    return loadSuccess(check);
+}
+export function parseStageBrowser(raw, label, stageId) {
+    if (raw === undefined)
+        return loadSuccess(undefined);
+    if (!isPlainObject(raw)) {
+        return fail(label, stageId, "must be an object");
+    }
+    for (const key of Object.keys(raw)) {
+        if (REJECTED_KEYS.has(key)) {
+            return fail(label, stageId, `"${key}" is not allowed (the Host chooses profile location and scope)`);
+        }
+        if (!ALLOWED_KEYS.has(key)) {
+            return fail(label, stageId, `unknown key "${key}" (allowed: profile, headed, allow_domains, login_url, check)`);
+        }
+    }
+    const browser = {};
+    if (raw.profile !== undefined) {
+        if (typeof raw.profile !== "string" || !PROFILE_NAME.test(raw.profile)) {
+            return fail(label, stageId, "profile must be 1-64 characters of letters, digits, dash, or underscore");
+        }
+        browser.profile = raw.profile;
+    }
+    if (raw.headed !== undefined) {
+        if (typeof raw.headed !== "boolean") {
+            return fail(label, stageId, "headed must be a boolean");
+        }
+        browser.headed = raw.headed;
+    }
+    if (raw.allow_domains !== undefined) {
+        if (!Array.isArray(raw.allow_domains) || raw.allow_domains.length === 0) {
+            return fail(label, stageId, "allow_domains must be a non-empty array of domain names");
+        }
+        const domains = [];
+        for (const item of raw.allow_domains) {
+            if (typeof item !== "string" || !DOMAIN.test(item.trim())) {
+                return fail(label, stageId, `allow_domains entry ${JSON.stringify(item)} must be a bare domain such as "example.com" or "*.example.com" (no scheme, port, or path)`);
+            }
+            domains.push(item.trim());
+        }
+        browser.allow_domains = domains;
+    }
+    if (raw.login_url !== undefined) {
+        if (!nonEmptyString(raw.login_url)) {
+            return fail(label, stageId, "login_url must be a non-empty string");
+        }
+        browser.login_url = raw.login_url.trim();
+    }
+    if (raw.check !== undefined) {
+        const check = parseCheck(raw.check, label, stageId);
+        if (!check.ok)
+            return check;
+        browser.check = check.value;
+    }
+    return loadSuccess(browser);
+}
+export function withBrowserRequires(stage, ctx) {
+    if (stage.browser === undefined)
+        return loadSuccess(stage.requires);
+    return mergeToolRequires([stage.requires, [{ tool: BROWSER_TOOL_NAME }]], { pipelineId: ctx.pipelineId, label: `stage "${ctx.stageId}"` });
+}

package/dist/config/triggerCatalog.d.ts

@@ -0,0 +1,10 @@
+import type { RunStore } from "../runstore/port.js";
+import type { TriggerFile } from "../types/trigger.js";
+export type TriggerListItem = TriggerFile & {
+    definition_ref: string;
+    last_fired_at?: string;
+    last_run_id?: string;
+    next_run_at?: string;
+};
+/** Catalog-authoritative trigger list, overlaid with each trigger's store-recorded fire state (if any). */
+export declare function loadCatalogTriggers(cwd: string, store: RunStore): Promise<TriggerListItem[] | undefined>;

package/dist/config/triggerCatalog.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+import { catalogContextFromStageflow } from "./resolveCatalogContext.js";
+import { getCatalogScanPaths } from "./browseCatalog.js";
+import { resolveStageflowContext } from "../project/resolveStageflowContext.js";
+import { loadTriggerOutcome } from "./loadTrigger.js";
+/** Catalog-authoritative trigger list, overlaid with each trigger's store-recorded fire state (if any). */
+export async function loadCatalogTriggers(cwd, store) {
+    const ctx = catalogContextFromStageflow(await resolveStageflowContext(cwd));
+    const scanPaths = await getCatalogScanPaths(ctx);
+    if (!scanPaths)
+        return undefined;
+    const projectRoot = ctx.projectRoot ?? undefined;
+    const items = [];
+    for (const filePath of scanPaths.triggerPaths) {
+        const outcome = await loadTriggerOutcome(filePath);
+        if (!outcome.ok)
+            continue;
+        const definitionRef = projectRoot !== undefined
+            ? path.relative(projectRoot, filePath).replace(/\\/g, "/")
+            : filePath;
+        const record = await store.getTrigger(outcome.value.id);
+        items.push({
+            ...outcome.value,
+            definition_ref: definitionRef,
+            ...(record?.last_fired_at !== undefined
+                ? { last_fired_at: record.last_fired_at }
+                : {}),
+            ...(record?.last_run_id !== undefined
+                ? { last_run_id: record.last_run_id }
+                : {}),
+            ...(record?.next_run_at !== undefined
+                ? { next_run_at: record.next_run_at }
+                : {}),
+        });
+    }
+    return items.sort((a, b) => a.id.localeCompare(b.id));
+}

package/dist/config/validateCatalog.d.ts

@@ -1,8 +1,9 @@
 import type { InlinePipelineDefinition, LoadedPipeline } from "../types/pipeline.js";
+import type { TriggerFile } from "../types/trigger.js";
 import type { LoadIssue } from "./loadOutcome.js";
 export type ValidationSeverity = "error" | "warning";
-export type ValidationCategory = "pipeline" | "stage" | "catalog" | "task";
-export type ValidationFindingCode = "pipeline.invalid_shape" | "pipeline.dag_error" | "pipeline.missing_stage" | "pipeline.load_error" | "pipeline.string_stage_ref" | "pipeline.stage_uses_inline_conflict" | "pipeline.stage_missing_body" | "pipeline.stage_id_mismatch" | "pipeline.invalid_completion" | "catalog.path_case_mismatch" | "pipeline.invalid_recovery" | "pipeline.include_cycle" | "pipeline.include_invalid" | "pipeline.include_duplicate_stage" | "pipeline.invalid_agent" | "pipeline.invalid_model" | "pipeline.invalid_verify" | "pipeline.io_incompatible" | "pipeline.model_applies" | "pipeline.route_if_invalid" | "pipeline.route_all_gated" | "pipeline.invalid_requires" | "pipeline.requires_conflict" | "stage.invalid_shape" | "stage.invalid_model" | "stage.missing_model" | "stage.invalid_payload_schema" | "stage.invalid_clone_input_schema" | "stage.unresolved_schema_ref" | "stage.invalid_clone_actions" | "stage.invalid_gate_kinds" | "stage.invalid_pre_emit_checks" | "stage.invalid_timeout_ms" | "stage.invalid_skill" | "stage.invalid_mcp" | "stage.invalid_secrets" | "stage.unknown_secret" | "stage.denied_secret" | "stage.invalid_requires" | "stage.invalid_agent" | "stage.invalid_io" | "stage.load_error" | "stage.id_filename_mismatch" | "task.invalid_shape" | "task.load_error" | "task.entry_input_unmet" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "catalog.duplicate_pipeline_id" | "catalog.manifest_missing" | "catalog.manifest_invalid" | "catalog.empty_catalog" | "catalog.manifest_load_error" | "catalog.invalid_mcp" | "catalog.mcp_command_missing" | "catalog.mixed_yaml_dialect" | "catalog.legacy_yaml" | "catalog.stageflow_home_absolute_path";
+export type ValidationCategory = "pipeline" | "stage" | "catalog" | "task" | "trigger";
+export type ValidationFindingCode = "pipeline.invalid_shape" | "pipeline.dag_error" | "pipeline.missing_stage" | "pipeline.load_error" | "pipeline.string_stage_ref" | "pipeline.stage_uses_inline_conflict" | "pipeline.stage_missing_body" | "pipeline.stage_id_mismatch" | "pipeline.invalid_completion" | "catalog.path_case_mismatch" | "pipeline.invalid_recovery" | "pipeline.include_cycle" | "pipeline.include_invalid" | "pipeline.include_duplicate_stage" | "pipeline.invalid_agent" | "pipeline.invalid_model" | "pipeline.invalid_verify" | "pipeline.io_incompatible" | "pipeline.model_applies" | "pipeline.route_if_invalid" | "pipeline.route_all_gated" | "pipeline.invalid_requires" | "pipeline.requires_conflict" | "stage.invalid_shape" | "stage.invalid_model" | "stage.missing_model" | "stage.invalid_payload_schema" | "stage.invalid_clone_input_schema" | "stage.unresolved_schema_ref" | "stage.invalid_clone_actions" | "stage.invalid_gate_kinds" | "stage.invalid_pre_emit_checks" | "stage.invalid_timeout_ms" | "stage.invalid_skill" | "stage.invalid_mcp" | "stage.invalid_browser" | "stage.invalid_secrets" | "stage.unknown_secret" | "stage.denied_secret" | "stage.invalid_requires" | "stage.invalid_agent" | "stage.invalid_io" | "stage.load_error" | "stage.id_filename_mismatch" | "task.invalid_shape" | "task.load_error" | "task.entry_input_unmet" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "trigger.invalid_shape" | "trigger.load_error" | "trigger.unknown_pipeline" | "trigger.unknown_task" | "catalog.duplicate_pipeline_id" | "catalog.manifest_missing" | "catalog.manifest_invalid" | "catalog.empty_catalog" | "catalog.manifest_load_error" | "catalog.invalid_mcp" | "catalog.mcp_command_missing" | "catalog.mixed_yaml_dialect" | "catalog.legacy_yaml" | "catalog.stageflow_home_absolute_path";
 export type ValidationFinding = {
     severity: ValidationSeverity;
     code: ValidationFindingCode | string;
@@ -12,13 +13,14 @@ export type ValidationFinding = {
     pipelineId?: string;
     stageId?: string;
 };
-export type ValidationScope = "full" | "pipeline" | "task";
+export type ValidationScope = "full" | "pipeline" | "task" | "trigger";
 export type ValidateCatalogOptions = {
     cwd?: string;
     projectRoot?: string;
     scope: ValidationScope;
     pipeline?: string;
     task?: string;
+    trigger?: string;
     strict?: boolean;
 };
 export type ValidationResult = {
@@ -59,4 +61,12 @@ export declare function loadPipelineValidated(nameOrPath: string | InlinePipelin
     projectRoot?: string;
     validateStages?: boolean;
 }): Promise<LoadPipelineValidatedResult>;
+export declare function collectPipelineIdsFromPaths(pipelinePaths: string[]): Promise<Map<string, string[]>>;
+export declare function collectTaskIdsFromPaths(taskPaths: string[]): Promise<Set<string>>;
+export type TriggerCatalogRefs = {
+    pipelineIds: ReadonlySet<string>;
+    taskIds: ReadonlySet<string>;
+};
+/** Confirms a trigger's `pipeline`/`task` refs resolve against known catalog ids. */
+export declare function findingsForTriggerRefs(cwd: string, absPath: string, trigger: TriggerFile, refs: TriggerCatalogRefs): ValidationFinding[];
 export declare function validateCatalog(options: ValidateCatalogOptions): Promise<ValidationResult>;

package/dist/config/validateCatalog.js

@@ -3,6 +3,7 @@ import { globalStageflowHome } from "../project/globalHome.js";
 import { INLINE_PIPELINE_PATH, loadPipelineFromObjectOutcome, loadPipelineOutcome, resolvePipelinePath, } from "./loadPipeline.js";
 import { loadStageOutcome } from "./loadStage.js";
 import { loadTaskOutcome } from "./loadTask.js";
+import { loadTriggerOutcome } from "./loadTrigger.js";
 import { readYamlObject } from "./readYamlObject.js";
 import { resolveCatalogContext } from "./resolveCatalogContext.js";
 import { getCatalogScanPaths } from "./browseCatalog.js";
@@ -103,6 +104,15 @@ function findingTaskError(cwd, absPath, message, code) {
         category: "task",
     }, "error");
 }
+function findingTriggerError(cwd, absPath, message, code) {
+    return baseFinding({
+        cwd,
+        absPath,
+        message,
+        code,
+        category: "trigger",
+    }, "error");
+}
 function findingCatalog(cwd, absPath, message, code, severity) {
     return baseFinding({
         cwd,
@@ -142,6 +152,11 @@ export function findingsFromLoadIssues(cwd, absPath, issues) {
                 findingTaskError(cwd, absPath, issue.message, issue.code),
             ];
         }
+        if (issue.category === "trigger") {
+            return [
+                findingTriggerError(cwd, absPath, issue.message, issue.code),
+            ];
+        }
         if (issue.category === "catalog") {
             const code = issue.code;
             const severity = code === "catalog.manifest_missing" ||
@@ -469,7 +484,7 @@ function findingManifestMissing(cwd, projectRoot) {
 function findingEmptyCatalog(cwd, manifestPath, kind) {
     return findingCatalog(cwd, manifestPath, `Manifest catalog.${kind} is empty`, "catalog.empty_catalog", "warning");
 }
-async function collectPipelineIdsFromPaths(pipelinePaths) {
+export async function collectPipelineIdsFromPaths(pipelinePaths) {
     const idToPaths = new Map();
     for (const filePath of pipelinePaths) {
         try {
@@ -486,6 +501,20 @@ async function collectPipelineIdsFromPaths(pipelinePaths) {
     }
     return idToPaths;
 }
+export async function collectTaskIdsFromPaths(taskPaths) {
+    const ids = new Set();
+    for (const filePath of taskPaths) {
+        try {
+            const raw = await readYamlObject(filePath);
+            if (typeof raw?.id === "string")
+                ids.add(raw.id);
+        }
+        catch {
+            // unreadable files handled by task validation loop
+        }
+    }
+    return ids;
+}
 function findingsForDuplicatePipelineIds(cwd, idToPaths) {
     const findings = [];
     for (const [pipelineId, paths] of idToPaths) {
@@ -530,7 +559,7 @@ async function validateManifestAll(invocationCwd) {
     if (!scanPaths) {
         return findings;
     }
-    const { pipelinePaths, taskPaths } = scanPaths;
+    const { pipelinePaths, taskPaths, triggerPaths } = scanPaths;
     for (const pipelinePath of pipelinePaths) {
         const core = await runPipelineValidation(pipelinePath, {
             cwd: projectRoot,
@@ -548,6 +577,32 @@ async function validateManifestAll(invocationCwd) {
     }
     const idToPaths = await collectPipelineIdsFromPaths(pipelinePaths);
     findings.push(...findingsForDuplicatePipelineIds(projectRoot, idToPaths));
+    if (triggerPaths.length > 0) {
+        const pipelineIds = new Set(idToPaths.keys());
+        const taskIds = await collectTaskIdsFromPaths(taskPaths);
+        for (const triggerPath of triggerPaths) {
+            const outcome = await loadTriggerOutcome(triggerPath);
+            if (!outcome.ok) {
+                findings.push(...findingsFromLoadIssues(projectRoot, triggerPath, outcome.issues));
+                continue;
+            }
+            findings.push(...findingsForTriggerRefs(projectRoot, triggerPath, outcome.value, {
+                pipelineIds,
+                taskIds,
+            }));
+        }
+    }
+    return findings;
+}
+/** Confirms a trigger's `pipeline`/`task` refs resolve against known catalog ids. */
+export function findingsForTriggerRefs(cwd, absPath, trigger, refs) {
+    const findings = [];
+    if (!refs.pipelineIds.has(trigger.pipeline)) {
+        findings.push(findingTriggerError(cwd, absPath, `Trigger "${trigger.id}" references unknown pipeline "${trigger.pipeline}"`, "trigger.unknown_pipeline"));
+    }
+    if (trigger.task !== undefined && !refs.taskIds.has(trigger.task)) {
+        findings.push(findingTriggerError(cwd, absPath, `Trigger "${trigger.id}" references unknown task "${trigger.task}"`, "trigger.unknown_task"));
+    }
     return findings;
 }
 async function validateSingleTask(invocationCwd, taskArg) {
@@ -560,6 +615,26 @@ async function validateSingleTask(invocationCwd, taskArg) {
     }
     return [];
 }
+async function validateSingleTrigger(invocationCwd, triggerArg) {
+    const ctx = await resolveCatalogContext(invocationCwd);
+    const relCwd = ctx.projectRoot ?? invocationCwd;
+    const triggerPath = path.resolve(invocationCwd, triggerArg);
+    const outcome = await loadTriggerOutcome(triggerPath);
+    if (!outcome.ok) {
+        return findingsFromLoadIssues(relCwd, triggerPath, outcome.issues);
+    }
+    const scanPaths = await getCatalogScanPaths(ctx);
+    const pipelineIds = scanPaths
+        ? new Set((await collectPipelineIdsFromPaths(scanPaths.pipelinePaths)).keys())
+        : new Set();
+    const taskIds = scanPaths
+        ? await collectTaskIdsFromPaths(scanPaths.taskPaths)
+        : new Set();
+    return findingsForTriggerRefs(relCwd, triggerPath, outcome.value, {
+        pipelineIds,
+        taskIds,
+    });
+}
 export async function validateCatalog(options) {
     const cwd = options.cwd ?? process.cwd();
     const strict = options.strict ?? false;
@@ -569,6 +644,9 @@ export async function validateCatalog(options) {
     if (options.scope === "task" && !options.task) {
         throw new Error("validateCatalog: task is required when scope is \"task\"");
     }
+    if (options.scope === "trigger" && !options.trigger) {
+        throw new Error("validateCatalog: trigger is required when scope is \"trigger\"");
+    }
     const allFindings = [];
     if (options.scope === "pipeline") {
         return validatePipeline(options.pipeline, {
@@ -581,6 +659,9 @@ export async function validateCatalog(options) {
     else if (options.scope === "task") {
         allFindings.push(...(await validateSingleTask(cwd, options.task)));
     }
+    else if (options.scope === "trigger") {
+        allFindings.push(...(await validateSingleTrigger(cwd, options.trigger)));
+    }
     else {
         allFindings.push(...(await validateManifestAll(cwd)));
     }

package/dist/config/validateCompletionContract.js

@@ -45,6 +45,14 @@ export function validateCompletionContractForStage(stage, completion) {
             !stage.gate_kinds?.includes(check.kind)) {
             return failure(stage.id, `gate check "${check.id}" requires gate_kinds to include "${check.kind}"`);
         }
+        if (check.type === "browser_login") {
+            if (stage.browser?.check === undefined) {
+                return failure(stage.id, `check "${check.id}" requires the stage to declare browser.check`);
+            }
+            if (stage.browser.headed === false) {
+                return failure(stage.id, `check "${check.id}" is a human login check and needs a visible browser (browser.headed must not be false)`);
+            }
+        }
         if (check.type === "checkout_changes") {
             for (const field of check.path_fields ?? []) {
                 if (!isRequiredStringArrayField(stage.payload_schema, field)) {

package/dist/envelope/preEmitChecks.d.ts

@@ -26,4 +26,4 @@ export declare function declaredArtifactIssue(artifacts: readonly string[], chec
  * `gate` check with no `readQaTrail` fails closed (cannot be verified). No
  * `checks` (or an empty list) is a no-op.
  */
-export declare function assertPreEmitChecks(envelope: Pick<StageEnvelope, "artifacts">, options: PreEmitCheckOptions | undefined): Promise<void>;
+export declare function assertPreEmitChecks(envelope: Pick<StageEnvelope, "artifacts" | "payload">, options: PreEmitCheckOptions | undefined): Promise<void>;

package/dist/envelope/preEmitChecks.js

@@ -10,6 +10,7 @@
  * why this stays separate from `CompletionCheck`'s `artifact`/`gate` runners.
  */
 import { preEmitGateIssue } from "../hitl/qaTrail.js";
+import { loginCheckIssue } from "../browser/loginCheck.js";
 import { EnvelopeError } from "../types/envelope.js";
 function artifactListsBasename(artifact, basename) {
     return artifact === basename || artifact.endsWith(`/${basename}`);
@@ -42,6 +43,13 @@ export async function assertPreEmitChecks(envelope, options) {
             }
             continue;
         }
+        if (check.type === "browser_login_check") {
+            const issue = loginCheckIssue(envelope.payload, check);
+            if (issue !== undefined) {
+                throw new EnvelopeError(issue);
+            }
+            continue;
+        }
         // check.type === "gate"
         if (options?.readQaTrail === undefined) {
             throw new EnvelopeError("declared gate kinds cannot be verified without a QA trail reader");

package/dist/logging/redact.d.ts

@@ -1,3 +1,7 @@
+/** Cookie/storage/header/token shapes from browser commands; applied only to browser stages. */
+export declare const BROWSER_SECRET_PATTERNS: RegExp[];
+/** Default patterns plus browser patterns, for `RedactOptions.patterns` on browser stages. */
+export declare const BROWSER_STAGE_PATTERNS: RegExp[];
 export type NamedSecret = {
     name: string;
     value: string;

package/dist/logging/redact.js

@@ -6,6 +6,23 @@ const SECRET_PATTERNS = [
     /\bBearer\s+[A-Za-z0-9\-._~+/]+=*/gi,
     /\b[A-Za-z_]*KEY[A-Za-z_]*\s*[:=]\s*['"]?[A-Za-z0-9+/_-]{16,}['"]?/gi,
 ];
+/** Cookie/storage/header/token shapes from browser commands; applied only to browser stages. */
+export const BROWSER_SECRET_PATTERNS = [
+    /\b(?:Set-Cookie|Cookie)["']?\s*:\s*["']?[^\r\n"']+/gi,
+    /\b(?:Proxy-)?Authorization["']?\s*[:=]\s*["']?[^\r\n"']+/gi,
+    /\b(?:X-Api-Key|X-Auth-Token|X-CSRF-Token|X-Xsrf-Token)["']?\s*[:=]\s*["']?[^\s"']+/gi,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+    /"name"\s*:\s*"[^"]*"\s*,\s*"value"\s*:\s*"[^"]*"/g,
+    /"value"\s*:\s*"[^"]*"(?=\s*,\s*"domain")/g,
+    /\b(?:li_at|li_rm|JSESSIONID|sessionid|session_id|sessid|csrftoken|auth_token|access_token|refresh_token|id_token)\b["']?\s*[:=]\s*["']?[A-Za-z0-9%+/_.=-]{8,}/gi,
+    /\b(?:li_at|li_rm|JSESSIONID|sessionid)\b[ \t|]+[A-Za-z0-9%+/_.=-]{16,}/g,
+    /"[^"\s]*(?:token|secret|authorization|jwt|session|password|passwd|api_?key|credential|csrf)[^"\s]*"\s*:\s*"[^"]{8,}"/gi,
+];
+/** Default patterns plus browser patterns, for `RedactOptions.patterns` on browser stages. */
+export const BROWSER_STAGE_PATTERNS = [
+    ...SECRET_PATTERNS,
+    ...BROWSER_SECRET_PATTERNS,
+];
 const REDACTED = "[redacted]";
 export function shouldRegisterValue(value) {
     if (value.length < 8)

package/dist/mcp/catalogTools.js

@@ -9,6 +9,8 @@ import { validateCatalog } from "../config/validateCatalog.js";
 import { writeAudit } from "../logging/audit.js";
 import { logger as rootLogger } from "../logging/logger.js";
 import { PACKAGE_VERSION, BUILD_SHA } from "../package-meta.js";
+import { globalStageflowHome } from "../project/globalHome.js";
+import { getAuthStatus, } from "../agent/providerAuth.js";
 import { PipelineValidationError } from "../runtime/pipelineValidationError.js";
 import { PipelinePreflightError } from "../runtime/pipelineRunner.js";
 import { EnvelopeRefError, resolveEnvelopeRefsToTask, } from "../runtime/resolveEnvelopeRef.js";
@@ -144,7 +146,7 @@ const runStatusSchema = z.enum([
     "cancelled",
 ]);
 export function registerCatalogTools(server, deps) {
-    const { manager, store, cwd } = deps;
+    const { manager, store, cwd, providerAuthContext, providerBoot } = deps;
     const agentDir = deps.agentDir ?? getAgentDir();
     server.registerTool("list_skills", {
         description: "List skills with name, description, and origin (run|checkout|host). Optional runId scopes to that run's resolution view (run-tier skills first, then checkout .pi/skills, then host).",
@@ -201,6 +203,7 @@ export function registerCatalogTools(server, deps) {
         return textResult({
             pipelines: result.items,
             root_errors: result.root_errors,
+            ...(result.tip !== undefined ? { tip: result.tip } : {}),
         });
     });
     server.registerTool("list_tasks", {
@@ -225,6 +228,7 @@ export function registerCatalogTools(server, deps) {
         return textResult({
             tasks: result.items,
             root_errors: result.root_errors,
+            ...(result.tip !== undefined ? { tip: result.tip } : {}),
         });
     });
     server.registerTool("list_models", {
@@ -278,14 +282,45 @@ export function registerCatalogTools(server, deps) {
         return textResult({ runs });
     });
     server.registerTool("get_health", {
-        description: "Server health and soft-max run capacity: activeRunIds, activeCount, maxConcurrent, slotsAvailable, activeStageProcesses, version, plus disk breakdown (disk.runs_bytes, worktrees_bytes, repos_bytes, state_db_bytes, a2a_artifacts_bytes, free_bytes) for the durable root. Start until slotsAvailable is 0; then wait for a run to finish or raise STAGEFLOW_MAX_CONCURRENT_RUNS.",
+        description: "Server health and soft-max run capacity: activeRunIds, activeCount, maxConcurrent, slotsAvailable, activeStageProcesses, version, stageflow_home, boot_providers (Host boot snapshot), providers_live (or pointer to list_providers), plus disk breakdown for the durable root. Start until slotsAvailable is 0; then wait for a run to finish or raise STAGEFLOW_MAX_CONCURRENT_RUNS.",
         inputSchema: z.object({}),
-    }, async () => textResult({
-        ...(await manager.getHealthWithDisk()),
-        version: PACKAGE_VERSION,
-        build_sha: BUILD_SHA,
-        toolchain: toolchainHealthMap(),
-    }));
+    }, async () => {
+        const boot_providers = providerBoot
+            ? {
+                configured: providerBoot.configured,
+                failures: providerBoot.failures,
+            }
+            : { configured: [], failures: [] };
+        let providers_live = {
+            configured: [],
+            note: "Live auth inspect — prefer list_providers / sf providers status. boot_providers is Host boot env only and may be empty when CLI credentials are configured.",
+        };
+        if (providerAuthContext !== undefined) {
+            try {
+                const status = await getAuthStatus(cwd, undefined, providerAuthContext);
+                const rows = Array.isArray(status) ? status : [status];
+                providers_live = {
+                    configured: rows
+                        .filter((r) => r.configured)
+                        .map((r) => r.providerId),
+                    note: providers_live.note,
+                };
+            }
+            catch {
+                /* keep empty configured + note */
+            }
+        }
+        return textResult({
+            ...(await manager.getHealthWithDisk()),
+            version: PACKAGE_VERSION,
+            build_sha: BUILD_SHA,
+            toolchain: toolchainHealthMap(),
+            stageflow_home: globalStageflowHome(),
+            boot_providers,
+            providers_live,
+            providers: boot_providers,
+        });
+    });
     server.registerTool("preflight", {
         description: "Check pipeline requires:/secrets:/mcp against the Host toolchain manifest and curated stage env before start_run. Accepts pipeline path or inline definition (same union as start_run). Returns { ok, checks } with status ok|missing_tool|tool_version_mismatch|unknown_version|secret_unavailable|unresolved_var. Does not create a Run. unknown_version is ok unless strict:true.",
         inputSchema: z.object({

package/dist/mcp/controlTools.js

@@ -82,7 +82,9 @@ export function registerControlTools(server, deps) {
             target_run_id: runId,
             outcome: "ok",
         });
-        return textResult({ ok: true });
+        return textResult(result.verification !== undefined
+            ? { ok: true, verification: result.verification }
+            : { ok: true });
     });
     server.registerTool("decide_feedback_loop", {
         description: "Resolve a feedback-loop wait_for_human decision (extend, continue, or abandon). Same semantics as POST /api/runs/:id/stages/:stageId/feedback-decision.",

package/dist/mcp/deps.d.ts

@@ -1,3 +1,4 @@
+import type { BootProviderResult } from "../agent/bootProviderConfig.js";
 import type { ProviderAuthContext } from "../agent/providerAuth.js";
 import type { RunStore } from "../runstore/port.js";
 import type { RunChangeBus } from "../runtime/runChangeBus.js";
@@ -9,6 +10,7 @@ export type McpToolDeps = {
     agentDir?: string;
     providerAuthContext?: ProviderAuthContext;
     projectRoot?: string;
+    providerBoot?: BootProviderResult;
 };
 export type McpHttpDeps = McpToolDeps & {
     runChangeBus: RunChangeBus;

package/dist/mcp/server.js

@@ -43,6 +43,7 @@ function toolDepsFrom(deps) {
             ? { providerAuthContext: deps.providerAuthContext }
             : {}),
         ...(deps.projectRoot !== undefined ? { projectRoot: deps.projectRoot } : {}),
+        ...(deps.providerBoot !== undefined ? { providerBoot: deps.providerBoot } : {}),
     };
 }
 function attachBusNotifications(server, bus) {

package/dist/mcp/tools.js

@@ -4,6 +4,7 @@ import { registerCheckoutTools } from "./checkoutTools.js";
 import { registerControlTools } from "./controlTools.js";
 import { registerProjectMcpTools } from "./projectMcpTools.js";
 import { registerProviderTools } from "./providerTools.js";
+import { registerTriggerTools } from "./triggerTools.js";
 import { textResult } from "./toolResults.js";
 import { DEFAULT_TIMEOUT_MS, waitRun } from "./waitRun.js";
 import { registerGetStartedTool } from "./getStartedTool.js";
@@ -15,6 +16,7 @@ export function registerMcpTools(server, deps) {
     registerCheckoutTools(server, deps);
     registerProviderTools(server, deps);
     registerProjectMcpTools(server, deps);
+    registerTriggerTools(server, deps);
     server.registerTool("wait_run", {
         description: "Long-poll until a run is waiting for HITL input and/or terminal (succeeded/failed), or until timeout_ms. Default until=any wakes on waiting OR terminal. Abort cancels only this wait (not the run). Optional notifications/progress when the client supplies _meta.progressToken. Compose: wait_run → answer_gate → wait_run.",
         inputSchema: z.object({

package/dist/mcp/triggerTools.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import type { McpToolDeps } from "./deps.js";
+export declare function registerTriggerTools(server: McpServer, deps: McpToolDeps): void;