stageflow 0.27.0 → 0.31.0

package/dist/runtime/githubPollSource.d.ts

@@ -0,0 +1,86 @@
+import type { RunStore } from "../runstore/port.js";
+import type { TriggerFireEvent, TriggerSourcePort } from "./triggerPort.js";
+export declare const DEFAULT_GITHUB_POLL_INTERVAL_MS = 60000;
+export declare const DEFAULT_GITHUB_TOKEN_SECRET = "GITHUB_TOKEN";
+/** Parse `STAGEFLOW_GITHUB_POLL_INTERVAL_MS`; default 60s; `0` disables. */
+export declare function githubPollIntervalMsFromEnv(env?: NodeJS.ProcessEnv): number;
+export type GithubPullItem = {
+    number: number;
+    title: string;
+    html_url: string;
+    state: string;
+    merged_at: string | null;
+    created_at: string;
+    updated_at: string;
+    user: {
+        login: string;
+    } | null;
+};
+export type GithubPollResponse = {
+    status: number;
+    etag?: string;
+    items: GithubPullItem[];
+};
+/**
+ * Narrow, test-friendly seam over "list PR activity for a repo, conditionally
+ * on an ETag". The default implementation adapts `octokit.rest.pulls.list`;
+ * tests inject a fake so no real GitHub calls happen.
+ */
+export type GithubPollClient = {
+    listPulls(params: {
+        owner: string;
+        repo: string;
+        etag?: string;
+    }): Promise<GithubPollResponse>;
+};
+export declare function defaultCreateGithubClient(token: string): GithubPollClient;
+export type NormalizedGithubEvent = {
+    action: "opened" | "merged" | "closed" | "updated";
+    number: number;
+    title: string;
+    url: string;
+    author: string;
+    repo: string;
+    updatedAt: string;
+};
+export type GithubPollSourceOptions = {
+    store: RunStore;
+    cwd?: string;
+    intervalMs?: number;
+    logError?: (message: string) => void;
+    env?: NodeJS.ProcessEnv;
+    /** Injectable client factory so tests never hit real GitHub. */
+    createGithubClient?: (token: string) => GithubPollClient;
+};
+/**
+ * `TriggerSourcePort` adapter for `event`-kind triggers whose `event.source`
+ * starts with `github.`. Ticks on an interval; each tick re-scans the catalog,
+ * groups triggers by their distinct `event.config.repo` (one API call per repo
+ * per tick regardless of how many triggers watch it), and diffs each repo's
+ * PR list against a persisted ETag + cursor to find genuinely new activity.
+ *
+ * The first tick for a never-before-seen repo only seeds the cursor — it
+ * never fires for a repo's pre-existing PR history, mirroring how
+ * `ScheduleSource` seeds `next_run_at` without firing on first sight.
+ */
+export declare class GithubPollSource implements TriggerSourcePort {
+    private readonly store;
+    private readonly cwd;
+    private readonly intervalMs;
+    private readonly logError;
+    private readonly env;
+    private readonly createGithubClient;
+    private interval;
+    private inFlight;
+    constructor(options: GithubPollSourceOptions);
+    start(onFire: (event: TriggerFireEvent) => Promise<void>): Promise<void>;
+    stop(): Promise<void>;
+    /**
+     * One discovery + poll + fire pass. Public so tests can drive it directly
+     * instead of waiting on real interval timers.
+     */
+    tick(onFire: (event: TriggerFireEvent) => Promise<void>): Promise<void>;
+    private discover;
+    private pollRepo;
+    private fireSafely;
+}

package/dist/runtime/githubPollSource.js

@@ -0,0 +1,284 @@
+import path from "node:path";
+import { Octokit } from "octokit";
+import { getCatalogScanPaths } from "../config/browseCatalog.js";
+import { loadTriggerOutcome } from "../config/loadTrigger.js";
+import { catalogContextFromStageflow } from "../config/resolveCatalogContext.js";
+import { readSecretFromEnvOrFile } from "../config/secretFromEnvOrFile.js";
+import { resolveStageflowContext } from "../project/resolveStageflowContext.js";
+import { matchesEventFilter } from "./triggerEventMatch.js";
+export const DEFAULT_GITHUB_POLL_INTERVAL_MS = 60_000;
+export const DEFAULT_GITHUB_TOKEN_SECRET = "GITHUB_TOKEN";
+const GITHUB_REPO_RE = /^[^\s/]+\/[^\s/]+$/;
+/** Parse `STAGEFLOW_GITHUB_POLL_INTERVAL_MS`; default 60s; `0` disables. */
+export function githubPollIntervalMsFromEnv(env = process.env) {
+    const raw = env.STAGEFLOW_GITHUB_POLL_INTERVAL_MS;
+    if (raw === undefined || raw.trim() === "")
+        return DEFAULT_GITHUB_POLL_INTERVAL_MS;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed < 0)
+        return DEFAULT_GITHUB_POLL_INTERVAL_MS;
+    return parsed;
+}
+export function defaultCreateGithubClient(token) {
+    const octokit = new Octokit({ auth: token });
+    return {
+        async listPulls({ owner, repo, etag }) {
+            let response;
+            try {
+                response = await octokit.rest.pulls.list({
+                    owner,
+                    repo,
+                    state: "all",
+                    sort: "updated",
+                    direction: "desc",
+                    per_page: 30,
+                    ...(etag !== undefined ? { headers: { "If-None-Match": etag } } : {}),
+                });
+            }
+            catch (err) {
+                if (err !== null && typeof err === "object" && "status" in err && err.status === 304) {
+                    return { status: 304, items: [] };
+                }
+                throw err;
+            }
+            const responseEtag = response.headers.etag;
+            return {
+                status: response.status,
+                ...(typeof responseEtag === "string" ? { etag: responseEtag } : {}),
+                items: response.data.map((pr) => ({
+                    number: pr.number,
+                    title: pr.title,
+                    html_url: pr.html_url,
+                    state: pr.state,
+                    merged_at: pr.merged_at,
+                    created_at: pr.created_at,
+                    updated_at: pr.updated_at,
+                    user: pr.user ? { login: pr.user.login } : null,
+                })),
+            };
+        },
+    };
+}
+function deriveAction(item) {
+    if (item.merged_at)
+        return "merged";
+    if (item.state === "closed")
+        return "closed";
+    if (item.created_at === item.updated_at)
+        return "opened";
+    return "updated";
+}
+function normalizeGithubItem(item, repo) {
+    return {
+        action: deriveAction(item),
+        number: item.number,
+        title: item.title,
+        url: item.html_url,
+        author: item.user?.login ?? "unknown",
+        repo,
+        updatedAt: item.updated_at,
+    };
+}
+function parseCursor(raw) {
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.updatedAt === "string" && typeof parsed.number === "number") {
+            return { updatedAt: parsed.updatedAt, number: parsed.number };
+        }
+    }
+    catch {
+        // Corrupted/foreign value; treat as unset.
+    }
+    return null;
+}
+function isNewerThanCursor(item, cursor) {
+    const itemMs = new Date(item.updated_at).getTime();
+    const cursorMs = new Date(cursor.updatedAt).getTime();
+    if (itemMs !== cursorMs)
+        return itemMs > cursorMs;
+    return item.number > cursor.number;
+}
+function firstSecretRef(matches) {
+    for (const { definition } of matches) {
+        const secretRef = definition.event?.config?.secretRef;
+        if (typeof secretRef === "string" && secretRef.length > 0)
+            return secretRef;
+    }
+    return undefined;
+}
+/**
+ * `TriggerSourcePort` adapter for `event`-kind triggers whose `event.source`
+ * starts with `github.`. Ticks on an interval; each tick re-scans the catalog,
+ * groups triggers by their distinct `event.config.repo` (one API call per repo
+ * per tick regardless of how many triggers watch it), and diffs each repo's
+ * PR list against a persisted ETag + cursor to find genuinely new activity.
+ *
+ * The first tick for a never-before-seen repo only seeds the cursor — it
+ * never fires for a repo's pre-existing PR history, mirroring how
+ * `ScheduleSource` seeds `next_run_at` without firing on first sight.
+ */
+export class GithubPollSource {
+    store;
+    cwd;
+    intervalMs;
+    logError;
+    env;
+    createGithubClient;
+    interval;
+    inFlight = false;
+    constructor(options) {
+        this.store = options.store;
+        this.cwd = options.cwd ?? process.cwd();
+        this.intervalMs = options.intervalMs ?? DEFAULT_GITHUB_POLL_INTERVAL_MS;
+        this.logError =
+            options.logError ??
+                ((message) => {
+                    console.error(message);
+                });
+        this.env = options.env ?? process.env;
+        this.createGithubClient = options.createGithubClient ?? defaultCreateGithubClient;
+    }
+    async start(onFire) {
+        if (this.intervalMs <= 0)
+            return;
+        this.interval = setInterval(() => {
+            if (this.inFlight)
+                return;
+            this.inFlight = true;
+            void this.tick(onFire)
+                .catch((err) => {
+                this.logError(`github poll tick failed: ${err instanceof Error ? err.message : String(err)}`);
+            })
+                .finally(() => {
+                this.inFlight = false;
+            });
+        }, this.intervalMs).unref();
+    }
+    async stop() {
+        if (this.interval !== undefined)
+            clearInterval(this.interval);
+        this.interval = undefined;
+    }
+    /**
+     * One discovery + poll + fire pass. Public so tests can drive it directly
+     * instead of waiting on real interval timers.
+     */
+    async tick(onFire) {
+        const ctx = catalogContextFromStageflow(await resolveStageflowContext(this.cwd));
+        const scanPaths = await getCatalogScanPaths(ctx);
+        if (!scanPaths)
+            return;
+        const projectRoot = ctx.projectRoot ?? undefined;
+        const groups = await this.discover(scanPaths.triggerPaths);
+        for (const [repo, matches] of groups) {
+            for (const match of matches) {
+                const definitionRef = projectRoot !== undefined
+                    ? path.relative(projectRoot, match.path).replace(/\\/g, "/")
+                    : match.path;
+                await this.store.upsertTrigger({
+                    id: match.definition.id,
+                    definitionRef,
+                    enabled: true,
+                });
+            }
+            await this.pollRepo(repo, matches, onFire);
+        }
+    }
+    async discover(triggerPaths) {
+        const groups = new Map();
+        for (const triggerPath of triggerPaths) {
+            const outcome = await loadTriggerOutcome(triggerPath);
+            if (!outcome.ok)
+                continue;
+            const definition = outcome.value;
+            if (definition.kind !== "event" || !definition.enabled)
+                continue;
+            const source = definition.event?.source;
+            if (typeof source !== "string" || !source.startsWith("github."))
+                continue;
+            const repo = definition.event?.config?.repo;
+            if (typeof repo !== "string" || !GITHUB_REPO_RE.test(repo)) {
+                this.logError(`github poll: trigger "${definition.id}" has an invalid event.config.repo ` +
+                    `(expected "owner/repo"); skipping`);
+                continue;
+            }
+            const list = groups.get(repo) ?? [];
+            list.push({ path: triggerPath, definition });
+            groups.set(repo, list);
+        }
+        return groups;
+    }
+    async pollRepo(repo, matches, onFire) {
+        const secretRef = firstSecretRef(matches) ?? DEFAULT_GITHUB_TOKEN_SECRET;
+        let token;
+        try {
+            token = readSecretFromEnvOrFile(this.env, secretRef);
+        }
+        catch (err) {
+            this.logError(`github poll: failed to read secret "${secretRef}" for repo "${repo}": ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        if (token === undefined) {
+            this.logError(`github poll: secret "${secretRef}" is not set for repo "${repo}"; skipping this tick`);
+            return;
+        }
+        const adapterId = `github:${repo}`;
+        const etag = await this.store.getTriggerAdapterState(adapterId, "etag");
+        const cursor = parseCursor(await this.store.getTriggerAdapterState(adapterId, "cursor"));
+        const [owner, repoName] = repo.split("/");
+        let response;
+        try {
+            const client = this.createGithubClient(token);
+            response = await client.listPulls({
+                owner,
+                repo: repoName,
+                ...(etag !== null ? { etag } : {}),
+            });
+        }
+        catch (err) {
+            this.logError(`github poll: request failed for repo "${repo}": ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        if (response.status === 304)
+            return;
+        if (response.etag !== undefined) {
+            await this.store.setTriggerAdapterState(adapterId, "etag", response.etag);
+        }
+        if (response.items.length === 0)
+            return;
+        const newest = response.items[0];
+        if (cursor === null) {
+            await this.store.setTriggerAdapterState(adapterId, "cursor", JSON.stringify({ updatedAt: newest.updated_at, number: newest.number }));
+            return;
+        }
+        const newItems = response.items.filter((item) => isNewerThanCursor(item, cursor)).reverse();
+        for (const item of newItems) {
+            const summary = normalizeGithubItem(item, repo);
+            for (const { definition } of matches) {
+                if (!matchesEventFilter(definition.event?.match, summary))
+                    continue;
+                await this.fireSafely(onFire, definition, summary);
+            }
+        }
+        await this.store.setTriggerAdapterState(adapterId, "cursor", JSON.stringify({ updatedAt: newest.updated_at, number: newest.number }));
+    }
+    async fireSafely(onFire, definition, summary) {
+        try {
+            if (definition.task !== undefined) {
+                await onFire({ triggerId: definition.id });
+                return;
+            }
+            const task = {
+                id: `${definition.id}-pr-${summary.number}`,
+                goal: `Handle PR #${summary.number}: ${summary.title}`,
+                input: summary,
+            };
+            await onFire({ triggerId: definition.id, task });
+        }
+        catch (err) {
+            this.logError(`github poll: firing trigger "${definition.id}" failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}

package/dist/runtime/pipelineRunner.d.ts

@@ -7,6 +7,7 @@ import type { StageHitlController } from "./stageHitl.js";
 import type { InlinePipelineDefinition, LoadedPipeline } from "../types/pipeline.js";
 import type { TaskFile } from "../types/task.js";
 import { type StageExecutionMode } from "./stageConcurrency.js";
+import type { StageBrowserSupport } from "../browser/browserHost.js";
 import { StageProcessLauncher } from "./stageProcessLauncher.js";
 import type { OperatorCatalog } from "./stageAttemptBootstrap.js";
 import { type SkillsPayload } from "./runSkills.js";
@@ -59,6 +60,7 @@ export type PreparedPipeline = {
     hitl?: StageHitlController;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    browser?: StageBrowserSupport;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
     findings?: ValidationFinding[];
@@ -89,6 +91,7 @@ export declare function runPipeline(options: {
     maxActiveStagesPerRun?: number;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    browser?: StageBrowserSupport;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
 }): Promise<PipelineRunResult>;
@@ -117,6 +120,7 @@ export declare function startPipeline(options: {
     maxActiveStagesPerRun?: number;
     executionMode?: StageExecutionMode;
     stageProcessLauncher?: StageProcessLauncher;
+    browser?: StageBrowserSupport;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
     schedulingHalt?: {

package/dist/runtime/pipelineRunner.js

@@ -242,6 +242,7 @@ async function preparePipeline(options) {
         hitl: options.hitl,
         executionMode,
         stageProcessLauncher,
+        browser: options.browser,
         operatorCatalog: options.operatorCatalog,
         skipGates: options.skipGates,
         ...(warningFindings.length > 0 ? { findings: warningFindings } : {}),
@@ -283,6 +284,7 @@ export async function runPipeline(options) {
         hitl: options.hitl,
         executionMode: options.executionMode,
         stageProcessLauncher: options.stageProcessLauncher,
+        browser: options.browser,
         operatorCatalog: options.operatorCatalog,
         skipGates: options.skipGates,
     });
@@ -319,6 +321,7 @@ export async function startPipeline(options) {
         hitl: options.hitl,
         executionMode: options.executionMode,
         stageProcessLauncher: options.stageProcessLauncher,
+        browser: options.browser,
         operatorCatalog: options.operatorCatalog,
         skipGates: options.skipGates,
         callerId: options.callerId,

package/dist/runtime/pipelineScheduler.d.ts

@@ -1,5 +1,6 @@
 import type { AgentPort } from "../agent/port.js";
 import type { RunPipelineDagSnapshot, RunStore, StageSnapshot } from "../runstore/port.js";
+import type { StageBrowserSupport } from "../browser/browserHost.js";
 import type { StageEnvelope } from "../types/envelope.js";
 import type { LoadedPipeline, ResolvedPipelineDag } from "../types/pipeline.js";
 import type { TaskFile } from "../types/task.js";
@@ -24,6 +25,7 @@ type SchedulerPreparedPipeline = {
     hitl?: StageHitlController;
     operatorCatalog?: OperatorCatalog;
     skipGates?: boolean;
+    browser?: StageBrowserSupport;
 };
 export type { SchedulerPreparedPipeline };
 type RetryContext = {

package/dist/runtime/pipelineScheduler.js

@@ -1,6 +1,11 @@
 import { normalizeForkChoice } from "../envelope/forkChoice.js";
 import { refreshRunDiskUsage } from "../runstore/diskUsage.js";
 import { buildPipelineDagSnapshotFromLoaded } from "../runstore/pipelineDagSnapshot.js";
+import { defaultStageBrowserSupport, resolveStageBrowserEnv, } from "../browser/stageBrowserEnv.js";
+import { teardownRunBrowsers, teardownStageBrowser, } from "../browser/browserTeardown.js";
+import { isHumanLoginStage } from "../browser/humanLogin.js";
+import { createRunLiveness } from "../browser/runLiveness.js";
+import { acquireStageProfile, profileWaitingMessage, } from "../browser/stageProfileLock.js";
 import { definitionIdForInstance } from "../runstore/stageInstanceId.js";
 import { cloneFailureContinuesSchedule, cloneRetryDownstream, cloneFailFastSkipIds, cloneScheduleAllowsRun, failureIsAccepted, isCloneInstance, mint, protectedClonableChildIds, sequentialLaterCloneIds, skipRejectedNeedDependents, } from "./cloneSchedule.js";
 import { buildCompletedEnvelopesFromRun, buildStageConfigById, } from "./envelopeRouting.js";
@@ -386,6 +391,7 @@ export async function runPipelineDag(options) {
         hostEnv: process.env,
     });
     const stageById = buildStageConfigById(loaded);
+    const runUsesBrowser = [...stageById.values()].some((s) => s.browser !== undefined);
     const retryContext = options.retryContext;
     const feedbackSchedule = createReplaySchedule();
     await hydrateFromStore(feedbackSchedule, store, run.runId, dag);
@@ -842,6 +848,40 @@ export async function runPipelineDag(options) {
             return;
         }
         const attempt = await resolveLaunchAttempt(stageId);
+        if (stage.browser?.profile !== undefined) {
+            const profile = stage.browser.profile;
+            // A stage queued behind another run's lease must not hold one of this
+            // run's active slots; it takes the slot back once it joins the lease.
+            let slotReleased = false;
+            let acquired;
+            try {
+                acquired = await acquireStageProfile(prepared.browser ?? defaultStageBrowserSupport(), {
+                    profile,
+                    owner: { runId: run.runId, stageId },
+                    isRunLive: createRunLiveness(store),
+                    halted: () => options.schedulingHalt?.halted === true,
+                    onWaiting: async (holder) => {
+                        if (!slotReleased) {
+                            slotReleased = true;
+                            activeCount -= 1;
+                        }
+                        await store.appendStageEvent(run.runId, stageId, {
+                            event: "message",
+                            role: "host",
+                            text: profileWaitingMessage(profile, holder),
+                        }, { attempt });
+                    },
+                });
+            }
+            finally {
+                if (slotReleased)
+                    activeCount += 1;
+            }
+            if (acquired === "halted") {
+                states.set(stageId, "skipped");
+                return;
+            }
+        }
         const attemptCtx = attemptContext(attempt);
         const prep = launchFor(feedbackSchedule, stageId);
         const feedbackLoopContext = prep?.feedbackLoopContext;
@@ -899,6 +939,22 @@ export async function runPipelineDag(options) {
                 // best-effort Host cleanup
             }
         };
+        let browserEnv;
+        try {
+            browserEnv = await resolveStageBrowserEnv(prepared.browser ?? defaultStageBrowserSupport(), {
+                runId: run.runId,
+                stageId,
+                runDir: run.workspaceDir,
+                browser: stage.browser,
+                attempt,
+                humanLogin: isHumanLoginStage(dag, definitionId, stage.browser),
+            });
+        }
+        catch (err) {
+            cleanupAttemptCredentials();
+            await onStageFailure(stageId, err instanceof Error ? err.message : String(err));
+            return;
+        }
         if (executionMode === "process") {
             const launcher = options.stageProcessLauncher;
             if (!launcher) {
@@ -915,8 +971,10 @@ export async function runPipelineDag(options) {
                     attempt,
                     env: stageBinding.env,
                     bindingKind: stageBinding.kind,
+                    model: stage.model,
                     grants,
                     attemptHome,
+                    ...(browserEnv !== undefined ? { browserEnv } : {}),
                     ...(sessionMode !== undefined
                         ? {
                             mode: sessionMode === "feedback_resume"
@@ -955,6 +1013,10 @@ export async function runPipelineDag(options) {
                 states.set(stageId, "waiting");
                 return;
             }
+            const recorded = await store.listStageEvents(run.runId, stageId, attempt);
+            if (!recorded.some((event) => event.event === "failed")) {
+                await store.appendStageEvent(run.runId, stageId, { event: "failed", reason: launchResult.reason }, { attempt });
+            }
             await onStageFailure(stageId, launchResult.reason);
             return;
         }
@@ -974,9 +1036,11 @@ export async function runPipelineDag(options) {
             operatorCatalog: prepared.operatorCatalog,
             completedEnvelopes,
             skipGates: prepared.skipGates,
+            ...(prepared.browser !== undefined ? { browser: prepared.browser } : {}),
             stageEnv: {
                 ...stageBinding.env,
                 ...grants.env,
+                ...browserEnv,
                 HOME: attemptHome,
             },
             ...(sessionMode !== undefined ? { sessionMode } : {}),
@@ -1016,7 +1080,19 @@ export async function runPipelineDag(options) {
         states.set(stageId, "active");
         launchedIds.add(stageId);
         activeCount += 1;
-        const taskPromise = launchStage(stageId).finally(() => {
+        const taskPromise = launchStage(stageId)
+            .then(async () => {
+            const state = states.get(stageId);
+            if (runUsesBrowser && (state === "succeeded" || state === "failed")) {
+                await teardownStageBrowser(prepared.browser ?? defaultStageBrowserSupport(), {
+                    runId: run.runId,
+                    runDir: run.workspaceDir,
+                    stageId,
+                    events: () => store.listStageEvents(run.runId, stageId),
+                }).catch(() => undefined);
+            }
+        })
+            .finally(() => {
             activeCount -= 1;
             inFlight.delete(taskPromise);
         });
@@ -1084,6 +1160,15 @@ export async function runPipelineDag(options) {
         await Promise.all(inFlight);
     }
     const hasWaiting = [...states.values()].some((s) => s === "waiting");
+    if (runUsesBrowser &&
+        !(hasWaiting && !schedulingHalted) &&
+        !options.schedulingHalt?.hostShutdown) {
+        await teardownRunBrowsers(prepared.browser ?? defaultStageBrowserSupport(), {
+            runId: run.runId,
+            runDir: run.workspaceDir,
+            events: (stageId) => store.listStageEvents(run.runId, stageId),
+        });
+    }
     if (hasWaiting && !schedulingHalted) {
         return {
             ok: false,

package/dist/runtime/repositoryMaterialize.d.ts

@@ -1,7 +1,7 @@
 import type { RunMeta, RunStore } from "../runstore/port.js";
 import type { TaskFile } from "../types/task.js";
 import type { WorkspaceBinding } from "./workspaceBinding.js";
-export type StartFailureCode = "busy_capacity" | "busy_checkout" | "busy_caller_quota" | "repository_auth_failed" | "repository_not_found" | "ref_not_found" | "repository_fetch_failed" | "worktree_create_failed" | "git_missing" | "insufficient_disk" | "disk_check_failed" | "pinned_sha_unavailable" | "invalid_run_branch" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "task.invalid_shape" | "task.load_error" | "start.token_rejected" | "inline_pipeline_too_large" | "skills_invalid_name" | "skills_invalid_path" | "skills_missing_skill_md" | "skills_payload_too_large" | "missing_tool" | "tool_version_mismatch" | "unknown_version" | "secret_unavailable" | "unresolved_var" | "shutting_down" | "autostart_disabled" | "ensure_project_not_allowed" | "claude_as_root";
+export type StartFailureCode = "busy_capacity" | "busy_checkout" | "busy_caller_quota" | "repository_auth_failed" | "repository_not_found" | "ref_not_found" | "repository_fetch_failed" | "worktree_create_failed" | "git_missing" | "insufficient_disk" | "disk_check_failed" | "pinned_sha_unavailable" | "invalid_run_branch" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "task.invalid_shape" | "task.load_error" | "trigger.task_override_not_allowed" | "trigger.task_required" | "start.token_rejected" | "inline_pipeline_too_large" | "skills_invalid_name" | "skills_invalid_path" | "skills_missing_skill_md" | "skills_payload_too_large" | "missing_tool" | "tool_version_mismatch" | "unknown_version" | "secret_unavailable" | "unresolved_var" | "shutting_down" | "autostart_disabled" | "ensure_project_not_allowed" | "claude_as_root";
 export type MaterializedBinding = {
     runId: string;
     checkoutRoot?: string;

package/dist/runtime/runManager.d.ts

@@ -9,6 +9,7 @@ import { type SkillsPayload } from "./runSkills.js";
 import { type FeedbackLoopDecisionKind } from "./feedbackLoopDecision.js";
 import { type RetryStageResult } from "./runRetryCoordinator.js";
 import { type StageExecutionMode } from "./stageConcurrency.js";
+import type { StageBrowserSupport } from "../browser/browserHost.js";
 import { StageProcessLauncher } from "./stageProcessLauncher.js";
 import { StageHitlController, type DeliverAnswerResult, type HitlSeams } from "./stageHitl.js";
 import { type StartTaskInput } from "./taskInput.js";
@@ -190,6 +191,7 @@ export declare class RunManager {
         maxActiveStagesPerRun?: number;
         executionMode?: StageExecutionMode;
         stageProcessLauncher?: StageProcessLauncher;
+        browser?: StageBrowserSupport;
         a2aStore?: A2aStore;
         knownWritableProjectRoots?: () => Iterable<string> | Promise<Iterable<string>>;
         freeSpaceReader?: FreeSpaceReader;
@@ -235,6 +237,9 @@ export declare class RunManager {
         stageId: string;
     }>>;
     hasActiveWorker(runId: string, stageId: string): boolean;
+    sweepBrowserSessions(): Promise<{
+        closed: string[];
+    }>;
     reconcileOrphanedStages(): Promise<{
         reconciled: Array<{
             runId: string;
@@ -344,6 +349,12 @@ export declare class RunManager {
         reason?: string;
     }): Promise<DecideFeedbackLoopResult>;
     private resumeViaSubprocess;
+    /**
+     * A resumed stage whose after-phase verification failed is repaired by the
+     * same policy the scheduler applies to a first-launch failure. Returns the
+     * freshly created attempt, or undefined when the failure is final.
+     */
+    private scheduleRepairAfterVerifyFailure;
     private reconstructAndContinue;
     private reserveAndStartPipeline;
     private busyFailure;