stageflow 0.32.0 → 0.35.0

package/dist/runtime/runManager.js

@@ -21,6 +21,7 @@ import { hydrateScheduleFromStore, hydratedScheduleHasRunnableWork, resumeRun, r
 import { resolveFeedbackLoopDecision, } from "./feedbackLoopDecision.js";
 import { RunRetryCoordinator, readRetryRootWaitTimeoutMs, } from "./runRetryCoordinator.js";
 import { readMaxActiveStageProcesses, readMaxActiveStagesPerRun, readStageExecutionMode, } from "./stageConcurrency.js";
+import { runOwnerScope } from "../browser/ownerScope.js";
 import { isHumanLoginStage } from "../browser/humanLogin.js";
 import { defaultStageBrowserSupport, resolveStageBrowserEnv, } from "../browser/stageBrowserEnv.js";
 import { teardownRunBrowsers, teardownStageBrowser, } from "../browser/browserTeardown.js";
@@ -267,6 +268,9 @@ export class RunManager {
     queuedDone = new Map();
     admissionDrainInFlight = false;
     resumeInFlight = new Set();
+    gateClosedListeners = new Set();
+    beforeBrowserTeardownListeners = new Set();
+    shutdownListeners = new Set();
     retryInFlight = new Set();
     retryStartOwner = new Map();
     retryStartWaiters = new Map();
@@ -357,7 +361,18 @@ export class RunManager {
         return this.active.size;
     }
     stopAcceptingWork() {
+        const wasAccepting = this.acceptingWork;
         this.acceptingWork = false;
+        if (wasAccepting) {
+            for (const listener of [...this.shutdownListeners]) {
+                try {
+                    listener();
+                }
+                catch {
+                    // listeners must not affect shutdown
+                }
+            }
+        }
         for (const halt of this.schedulingHalts.values()) {
             halt.halted = true;
             halt.hostShutdown = true;
@@ -592,13 +607,14 @@ export class RunManager {
             .some((entry) => entry.runId === runId && entry.stageId === stageId);
     }
     async sweepBrowserSessions() {
-        const support = this.options.browser ?? defaultStageBrowserSupport();
+        const support = this.browserSupport();
         const isRunLive = createRunLiveness(this.options.store);
         await stageProfileLock(support)
             .reclaimStale(isRunLive)
             .catch(() => 0);
         return sweepOrphanBrowserSessions({
             isRunLive,
+            host: support.host,
             ...(support.runner !== undefined ? { runner: support.runner } : {}),
             ...(support.closeWaitMs !== undefined
                 ? { closeWaitMs: support.closeWaitMs }
@@ -833,6 +849,64 @@ export class RunManager {
         }
         await this.drainAdmissionQueue();
     }
+    /** Called when a stage's gate stops accepting operator input (answered, abandoned) or a run is cancelled (no stage id). */
+    onGateClosed(listener) {
+        this.gateClosedListeners.add(listener);
+        return () => {
+            this.gateClosedListeners.delete(listener);
+        };
+    }
+    /** Awaited (bounded by the browser support) before a stage's or run's browser is torn down; stageId absent means the whole run. */
+    beforeBrowserTeardown(listener) {
+        this.beforeBrowserTeardownListeners.add(listener);
+        return () => {
+            this.beforeBrowserTeardownListeners.delete(listener);
+        };
+    }
+    /** Called once the Host stops accepting work (drain start). */
+    onShutdown(listener) {
+        this.shutdownListeners.add(listener);
+        return () => {
+            this.shutdownListeners.delete(listener);
+        };
+    }
+    browserSupport() {
+        const base = this.options.browser ?? defaultStageBrowserSupport();
+        if (this.beforeBrowserTeardownListeners.size === 0)
+            return base;
+        return {
+            ...base,
+            beforeTeardown: async (input) => {
+                await Promise.all([
+                    base.beforeTeardown?.(input),
+                    ...[...this.beforeBrowserTeardownListeners].map(async (listener) => {
+                        try {
+                            await listener(input);
+                        }
+                        catch {
+                            // listeners must not block teardown
+                        }
+                    }),
+                ]);
+            },
+        };
+    }
+    browserOption() {
+        if (this.options.browser === undefined && this.beforeBrowserTeardownListeners.size === 0) {
+            return {};
+        }
+        return { browser: this.browserSupport() };
+    }
+    notifyGateClosed(runId, stageId) {
+        for (const listener of [...this.gateClosedListeners]) {
+            try {
+                listener(runId, stageId);
+            }
+            catch {
+                // listeners must not affect run control
+            }
+        }
+    }
     async abandonStage(runId, stageId) {
         let detail;
         try {
@@ -863,6 +937,7 @@ export class RunManager {
                 status: 409,
             };
         }
+        this.notifyGateClosed(runId, stageId);
         if (this.stageProcessLauncher !== undefined) {
             const hasActive = this.stageProcessLauncher
                 .getActiveStageProcesses()
@@ -871,7 +946,7 @@ export class RunManager {
                 await this.stageProcessLauncher.cancelRun(runId);
             }
         }
-        await teardownStageBrowser(this.options.browser ?? defaultStageBrowserSupport(), {
+        await teardownStageBrowser(this.browserSupport(), {
             runId,
             runDir: this.options.store.getWorkspaceDir(runId),
             stageId,
@@ -893,7 +968,7 @@ export class RunManager {
         const hasWaiting = after.stages.some((s) => s.status === "waiting_for_input");
         if (!hasWaiting &&
             !(await createRunLiveness(this.options.store)(runId).catch(() => true))) {
-            await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+            await teardownRunBrowsers(this.browserSupport(), {
                 runId,
                 runDir: this.options.store.getWorkspaceDir(runId),
                 events: (stageId) => this.options.store.listStageEvents(runId, stageId),
@@ -931,6 +1006,7 @@ export class RunManager {
             };
         }
         await this.options.store.updateRunStatus(runId, "cancelled");
+        this.notifyGateClosed(runId);
         await this.options.store.setCancelReason(runId, trimmedReason);
         await finaliseStoredRunManifest(this.options.store, runId).catch(() => undefined);
         await this.refreshRunDiskBytes(runId).catch(() => undefined);
@@ -950,7 +1026,7 @@ export class RunManager {
         if (this.stageProcessLauncher !== undefined) {
             await this.stageProcessLauncher.cancelRun(runId);
         }
-        await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+        await teardownRunBrowsers(this.browserSupport(), {
             runId,
             runDir: this.options.store.getWorkspaceDir(runId),
             events: (stageId) => this.options.store.listStageEvents(runId, stageId),
@@ -1530,9 +1606,7 @@ export class RunManager {
                 agent: this.options.agent,
                 cwd: meta.project_root ?? this.projectRoot,
                 operatorCatalog: this.options.operatorCatalog,
-                ...(this.options.browser !== undefined
-                    ? { browser: this.options.browser }
-                    : {}),
+                ...this.browserOption(),
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 executionMode: this.executionMode,
                 stageProcessLauncher: this.stageProcessLauncher,
@@ -1757,6 +1831,7 @@ export class RunManager {
                 }
                 return prefix;
             }
+            this.notifyGateClosed(runId, stageId);
             return await orchestrateAnswerResume({
                 prefixMode: prefix.mode,
                 executionMode: this.executionMode,
@@ -1896,9 +1971,7 @@ export class RunManager {
                     checkoutRoot: meta.checkout_root,
                     hitl: this.hitl,
                     operatorCatalog: this.options.operatorCatalog,
-                    ...(this.options.browser !== undefined
-                        ? { browser: this.options.browser }
-                        : {}),
+                    ...this.browserOption(),
                 },
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 executionMode: this.executionMode,
@@ -1957,7 +2030,8 @@ export class RunManager {
             });
             const resumedStage = loaded.stages.find((s) => s.id === definitionIdForInstance(meta.pipeline_dag, stageId));
             if (resumedStage?.browser?.profile !== undefined) {
-                await acquireStageProfile(this.options.browser ?? defaultStageBrowserSupport(), {
+                await acquireStageProfile(this.browserSupport(), {
+                    scope: runOwnerScope(this.browserSupport(), { runId }),
                     profile: resumedStage.browser.profile,
                     owner: { runId, stageId },
                     isRunLive: createRunLiveness(store),
@@ -1968,9 +2042,10 @@ export class RunManager {
                     }
                 });
             }
-            const browserEnv = await resolveStageBrowserEnv(this.options.browser ?? defaultStageBrowserSupport(), {
+            const browserEnv = await resolveStageBrowserEnv(this.browserSupport(), {
                 runId,
                 stageId,
+                scope: runOwnerScope(this.browserSupport(), { runId }),
                 runDir: workspaceDir,
                 browser: resumedStage?.browser,
                 attempt,
@@ -1999,7 +2074,7 @@ export class RunManager {
             if (launchResult.type === "waiting") {
                 return { ok: true };
             }
-            await teardownStageBrowser(this.options.browser ?? defaultStageBrowserSupport(), {
+            await teardownStageBrowser(this.browserSupport(), {
                 runId,
                 runDir: workspaceDir,
                 stageId,
@@ -2021,9 +2096,7 @@ export class RunManager {
                             checkoutRoot: meta.checkout_root,
                             hitl: this.hitl,
                             operatorCatalog: this.options.operatorCatalog,
-                            ...(this.options.browser !== undefined
-                                ? { browser: this.options.browser }
-                                : {}),
+                            ...this.browserOption(),
                         },
                         retryRoots: new Map([[stageId, nextRepairAttempt]]),
                         maxActiveStagesPerRun: this.maxActiveStagesPerRun,
@@ -2041,7 +2114,7 @@ export class RunManager {
                     reason: launchResult.reason,
                 }, eventOptions);
                 await store.updateRunStatus(runId, "failed");
-                await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+                await teardownRunBrowsers(this.browserSupport(), {
                     runId,
                     runDir: workspaceDir,
                     events: (stageId) => store.listStageEvents(runId, stageId),
@@ -2067,9 +2140,7 @@ export class RunManager {
                     checkoutRoot: meta.checkout_root,
                     hitl: this.hitl,
                     operatorCatalog: this.options.operatorCatalog,
-                    ...(this.options.browser !== undefined
-                        ? { browser: this.options.browser }
-                        : {}),
+                    ...this.browserOption(),
                 },
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 resumeFromStageId: stageId,
@@ -2093,7 +2164,7 @@ export class RunManager {
                     reason,
                 }, eventOptions);
                 await store.updateRunStatus(runId, "failed");
-                await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+                await teardownRunBrowsers(this.browserSupport(), {
                     runId,
                     runDir: store.getWorkspaceDir(runId),
                     events: (stageId) => store.listStageEvents(runId, stageId),
@@ -2406,9 +2477,7 @@ export class RunManager {
             const started = await startPipeline({
                 dispatchKey,
                 submission,
-                ...(this.options.browser !== undefined
-                    ? { browser: this.options.browser }
-                    : {}),
+                ...this.browserOption(),
                 agent: this.options.agent,
                 store: this.options.store,
                 taskYaml,
@@ -2911,9 +2980,7 @@ export class RunManager {
             const schedulingHalt = this.ensureSchedulingHalt(runId);
             const started = await startPipeline({
                 submission,
-                ...(this.options.browser !== undefined
-                    ? { browser: this.options.browser }
-                    : {}),
+                ...this.browserOption(),
                 agent: this.options.agent,
                 store: this.options.store,
                 taskYaml,
@@ -3018,9 +3085,7 @@ export class RunManager {
                     checkoutRoot: loadedMeta.checkout_root,
                     hitl: this.hitl,
                     operatorCatalog: this.options.operatorCatalog,
-                    ...(this.options.browser !== undefined
-                        ? { browser: this.options.browser }
-                        : {}),
+                    ...this.browserOption(),
                 },
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 executionMode: this.executionMode,

package/dist/runtime/runRetentionSweep.d.ts

@@ -15,8 +15,6 @@ export type RunRetentionSweepOptions = {
     artifactMaxBytes?: number;
     bareCacheTtlMs?: number;
 };
-export declare function getSlimWalkCallCount(): number;
-export declare function resetSlimWalkCallCount(): void;
 /**
  * Walk attempt + legacy artifact trees and remove SLIM-eligible paths.
  * Never removes envelope.json, log.jsonl, or under-threshold artifacts.

package/dist/runtime/runRetentionSweep.js

@@ -7,13 +7,6 @@ import { reclaimWorkspaceBinding, worktreePathForRun, } from "./repositoryMateri
 import { deleteRunEverywhere } from "./runDeletion.js";
 const SLIM_ATTEMPT_FILES = ["pi-session.jsonl", "stream.log"];
 const SLIM_ATTEMPT_DIRS = [".pi-agent"];
-let slimWalkCallCount = 0;
-export function getSlimWalkCallCount() {
-    return slimWalkCallCount;
-}
-export function resetSlimWalkCallCount() {
-    slimWalkCallCount = 0;
-}
 async function pathExists(target) {
     try {
         await stat(target);
@@ -84,7 +77,6 @@ async function slimAttemptDir(attemptDir, maxBytes) {
  * Never removes envelope.json, log.jsonl, or under-threshold artifacts.
  */
 export async function slimRunWorkspaceArtifacts(workspaceDir, maxBytes) {
-    slimWalkCallCount += 1;
     const stagesRoot = path.join(workspaceDir, "stages");
     if (!(await pathExists(stagesRoot)))
         return;

package/dist/runtime/runRetryCoordinator.d.ts

@@ -1,4 +1,4 @@
-import type { AgentPort } from "../agent/port.js";
+import type { StagePort } from "../agent/port.js";
 import { type RunDetail, type RunPipelineDagSnapshot, type RunStatus, type RunStore, type StageSnapshot } from "../runstore/port.js";
 import type { PipelineRunResult } from "./pipelineRunner.js";
 import { type SchedulerPreparedPipeline } from "./pipelineScheduler.js";
@@ -56,7 +56,7 @@ export type RetryStageRequest = {
     runId: string;
     stageId: string;
     store: RunStore;
-    agent: AgentPort;
+    agent: StagePort;
     cwd: string;
     operatorCatalog?: OperatorCatalog;
     browser?: StageBrowserSupport;

package/dist/runtime/scheduleSource.js

@@ -1,9 +1,5 @@
-import path from "node:path";
 import { Cron } from "croner";
-import { getCatalogScanPaths } from "../config/browseCatalog.js";
-import { loadTriggerOutcome } from "../config/loadTrigger.js";
-import { catalogContextFromStageflow } from "../config/resolveCatalogContext.js";
-import { resolveStageflowContext } from "../project/resolveStageflowContext.js";
+import { listCatalogTriggerMatches, readTriggerStoreRecord, triggerStoreId, } from "../config/triggerCatalog.js";
 export const DEFAULT_TRIGGER_TICK_INTERVAL_MS = 30_000;
 /** Parse `STAGEFLOW_TRIGGER_TICK_INTERVAL_MS`; default 30s; `0` disables. */
 export function triggerTickIntervalMsFromEnv(env = process.env) {
@@ -72,17 +68,14 @@ export class ScheduleSource {
      * against an injected clock instead of waiting on real interval timers.
      */
     async tick(onFire) {
-        const ctx = catalogContextFromStageflow(await resolveStageflowContext(this.cwd));
-        const scanPaths = await getCatalogScanPaths(ctx);
-        if (!scanPaths)
-            return;
         const now = this.now();
-        const projectRoot = ctx.projectRoot ?? undefined;
-        for (const triggerPath of scanPaths.triggerPaths) {
-            const outcome = await loadTriggerOutcome(triggerPath);
-            if (!outcome.ok)
-                continue;
-            const definition = outcome.value;
+        const catalogTriggers = await listCatalogTriggerMatches({
+            store: this.store,
+            bootCwd: this.cwd,
+            sourceRootsOnly: true,
+        });
+        for (const match of catalogTriggers) {
+            const definition = match.definition;
             if (definition.kind !== "schedule" || !definition.enabled || !definition.schedule) {
                 continue;
             }
@@ -94,25 +87,23 @@ export class ScheduleSource {
                 this.logError(`invalid schedule for trigger "${definition.id}": ${err instanceof Error ? err.message : String(err)}`);
                 continue;
             }
-            const definitionRef = projectRoot !== undefined
-                ? path.relative(projectRoot, triggerPath).replace(/\\/g, "/")
-                : triggerPath;
+            const storeId = triggerStoreId(match.project_root, definition.id);
             await this.store.upsertTrigger({
-                id: definition.id,
-                definitionRef,
+                id: storeId,
+                definitionRef: match.definition_ref,
                 enabled: true,
             });
-            const record = await this.store.getTrigger(definition.id);
+            const record = await readTriggerStoreRecord(this.store, match.project_root, definition.id);
             if (!record?.next_run_at) {
                 if (next)
-                    await this.store.setTriggerNextRun(definition.id, next.toISOString());
+                    await this.store.setTriggerNextRun(storeId, next.toISOString());
                 continue;
             }
             const dueAt = new Date(record.next_run_at);
             if (dueAt.getTime() <= now.getTime()) {
-                await onFire({ triggerId: definition.id });
+                await onFire({ triggerId: definition.id, project_root: match.project_root });
                 if (next)
-                    await this.store.setTriggerNextRun(definition.id, next.toISOString());
+                    await this.store.setTriggerNextRun(storeId, next.toISOString());
             }
         }
     }

package/dist/runtime/stageAttemptBootstrap.d.ts

@@ -1,4 +1,4 @@
-import type { AgentPort, FeedbackLoopContext, StageHandle, StageRunInput, StageSessionMode } from "../agent/port.js";
+import type { StagePort, FeedbackLoopContext, StageHandle, StageRunInput, StageSessionMode } from "../agent/port.js";
 import { type StageStreamLogWriter } from "./stageStreamLog.js";
 import type { RunStore } from "../runstore/port.js";
 import type { StageEnvelope } from "../types/envelope.js";
@@ -12,7 +12,7 @@ export type OperatorCatalog = {
     agentDir?: string;
 };
 export type StageAttemptOpenInput = {
-    agent: Pick<AgentPort, "openStage">;
+    agent: Pick<StagePort, "openStage">;
     store: RunStore;
     runId: string;
     stage: LoadedStageConfig;

package/dist/runtime/stageAttemptBootstrap.js

@@ -2,6 +2,7 @@ import { emailHostFor, stageEmail, workerStageEmail, validateStageEmailAccounts
 import { EmailError } from "../email/port.js";
 import { bindingKindForOrigin, catalogOrSeededOrigin, decideWorkspaceConfigTrust, } from "../config/configOrigin.js";
 import { loginCheckPromptBlock, readStageLoginCheck, } from "../browser/loginCheck.js";
+import { stageGateHandoff } from "../browser/stageHandoff.js";
 import { humanLoginPromptBlock, isHumanLoginStage } from "../browser/humanLogin.js";
 import { BROWSER_SKILL_NAME, resolveBuiltinSkillFile, } from "../config/builtinSkills.js";
 import { resolveSkillByName, } from "../config/listSkills.js";
@@ -239,12 +240,20 @@ async function openStageWithOperatorCatalog(agent, input, catalog, factoryCwd, a
             return { ok: false, reason: "browser login check result is missing" };
         }
     }
+    const humanLoginHandoff = humanLogin
+        ? await stageGateHandoff({
+            runDir: resolveOptions.workspaceDir,
+            runId: resolveOptions.runId,
+            stageId: input.stage.id,
+            dirStageId: stageIdForManifest,
+        })
+        : undefined;
     try {
         const handle = agent.openStage({
             ...input,
             stage: {
                 ...input.stage,
-                system_prompt: `${stampStagePromptArtifactsDir(input.stage.system_prompt, artifactsDir)}${loginCheck !== undefined ? `\n\n${loginCheckPromptBlock(loginCheck)}` : ""}${humanLogin ? `\n\n${humanLoginPromptBlock(input.stage.browser?.login_url ?? input.stage.browser?.check?.url)}` : ""}`,
+                system_prompt: `${stampStagePromptArtifactsDir(input.stage.system_prompt, artifactsDir)}${loginCheck !== undefined ? `\n\n${loginCheckPromptBlock(loginCheck)}` : ""}${humanLogin ? `\n\n${humanLoginPromptBlock(input.stage.browser?.login_url ?? input.stage.browser?.check?.url, humanLoginHandoff?.kind === "live_view" ? "live_view" : "local_window")}` : ""}`,
                 ...(loginCheck !== undefined
                     ? {
                         pre_emit_checks: [

package/dist/runtime/stageProcessLauncher.js

@@ -4,7 +4,7 @@ import { logger as rootLogger, resolveLogMaxLineBytes, } from "../logging/logger
 import { isCursorModelRef, readCursorApiKey } from "../agent/cursorProvider.js";
 import { BROWSER_ENV_PREFIX } from "../browser/browserHost.js";
 import { PACKAGE_VERSION } from "../package-meta.js";
-import { PI_HOME_AUTH_PATH_ENV, stageflowAgentAuthPath } from "./credentialBinding.js";
+import { PI_HOME_AUTH_PATH_ENV, sfOwnedAuthPath } from "./credentialBinding.js";
 import { redactString } from "../logging/redact.js";
 import { getNamedSecrets } from "../logging/namedSecrets.js";
 import { readMaxActiveStageProcesses, } from "./stageConcurrency.js";
@@ -352,7 +352,7 @@ export class StageProcessLauncher {
             : overlaid;
         const childEnv = {
             ...withBrowser,
-            [PI_HOME_AUTH_PATH_ENV]: stageflowAgentAuthPath(),
+            [PI_HOME_AUTH_PATH_ENV]: sfOwnedAuthPath(),
         };
         const cursorApiKey = readCursorApiKey(hostEnv);
         if (isCursorModelRef(input.model ?? "") &&

package/dist/runtime/stageRoots.js

@@ -3,7 +3,8 @@ import path from "node:path";
 import { isCursorModelRef } from "../agent/cursorProvider.js";
 import { stageDir } from "../runstore/paths.js";
 import { noAttemptContext } from "./stageAttemptContext.js";
-import { resolveCredentialBinding } from "./credentialBinding.js";
+import { resolveCredentialBinding, STAGEFLOW_AGENT_AUTH_PATH_ENV, currentExplicitAuthPath, } from "./credentialBinding.js";
+import { SF_STAGE_WORKER } from "./stageWorkerProtocol.js";
 export const STAGEFLOW_CHECKOUT = "STAGEFLOW_CHECKOUT";
 export const STAGEFLOW_RUN_WORKSPACE = "STAGEFLOW_RUN_WORKSPACE";
 export const STAGEFLOW_REPOSITORY = "STAGEFLOW_REPOSITORY";
@@ -127,6 +128,16 @@ export function stageBindingEnvFromRun(options) {
 export function withResolvedAuthPath(roots, factoryCwd) {
     if (roots.authPath)
         return roots;
+    const explicit = currentExplicitAuthPath();
+    if (explicit !== undefined) {
+        return { ...roots, authPath: explicit };
+    }
+    if (process.env[SF_STAGE_WORKER] === "1") {
+        const stamped = process.env[STAGEFLOW_AGENT_AUTH_PATH_ENV]?.trim();
+        if (!stamped)
+            return roots;
+        return { ...roots, authPath: path.resolve(stamped) };
+    }
     const binding = resolveCredentialBinding(factoryCwd);
     return { ...roots, authPath: binding.authPath };
 }

package/dist/runtime/stageRunner.d.ts

@@ -1,4 +1,4 @@
-import type { AgentPort, FeedbackLoopContext, StageHandle, StageRunResult, StageSessionMode } from "../agent/port.js";
+import type { StagePort, FeedbackLoopContext, StageHandle, StageRunResult, StageSessionMode } from "../agent/port.js";
 import { type HostGateContext } from "../browser/gateHandoff.js";
 import type { StageBrowserSupport } from "../browser/browserHost.js";
 import type { StageEnvelope } from "../types/envelope.js";
@@ -20,7 +20,7 @@ export declare function isRunStageWaiting(outcome: RunStageOutcome): outcome is
     waiting: true;
 };
 export type RunStageOptions = {
-    agent: AgentPort;
+    agent: StagePort;
     store: RunStore;
     runId: string;
     stage: LoadedStageConfig;

package/dist/runtime/stageRunner.js

@@ -1,4 +1,5 @@
-import { hostGateContextFor, stampGateRequest, } from "../browser/gateHandoff.js";
+import { stampGateRequest } from "../browser/gateHandoff.js";
+import { stageGateContext } from "../browser/stageHandoff.js";
 import { deriveExecutionPatchFromEvent } from "../runstore/stageExecution.js";
 import { buildStageRoots, withResolvedAuthPath, } from "./stageRoots.js";
 import { createDefaultHitlQaHooks, recordWaitEnter, } from "./stageHitl.js";
@@ -231,7 +232,12 @@ export async function runStage(options) {
             store: workerMode ? store : undefined,
             attemptCtx,
             skipGates,
-            gateContext: hostGateContextFor(stage.browser),
+            gateContext: await stageGateContext({
+                runDir: workspaceDir ?? store.getWorkspaceDir(runId),
+                runId,
+                stageId,
+                browser: stage.browser,
+            }),
         });
     }
     catch (err) {

package/dist/runtime/stageWorker.js

@@ -1,4 +1,4 @@
-import { resolveAgentPort } from "../agent/resolveAgentPort.js";
+import { resolveStagePort } from "../agent/resolveStagePort.js";
 import { asAgentBackendId } from "../agent/agentBackend.js";
 import { loadStageflowManifestOutcome } from "../config/loadStageflowManifest.js";
 import { loadNamedSecretsFromAttemptDir } from "../logging/namedSecrets.js";
@@ -29,7 +29,7 @@ export async function runStageWorker(input) {
     }
     const dag = meta.pipeline_dag ?? loaded.dag;
     const manifestOutcome = await loadStageflowManifestOutcome(input.rootDir);
-    const agent = resolveAgentPort({
+    const agent = resolveStagePort({
         global: manifestOutcome.ok
             ? asAgentBackendId(manifestOutcome.value.manifest.agent)
             : undefined,

package/dist/runtime/triggerPort.d.ts

@@ -1,12 +1,14 @@
 import type { TaskFile } from "../types/task.js";
 export type TriggerFireEvent = {
     triggerId: string;
+    project_root?: string;
     task?: TaskFile;
 };
 /**
- * Abstract seam for anything that decides "fire trigger X now" — a croner-backed
- * schedule loop, a GitHub/email poller, a webhook receiver. No adapter implements
- * this yet; it exists so those later adapters build against a locked contract.
+ * Long-running sources that decide "fire trigger X now". ScheduleSource,
+ * GithubPollSource, and EmailSource implement this. Webhook deliveries are
+ * request-driven: acceptWebhook shares TriggerFireEvent's optional task, and
+ * the HTTP route fires; a webhook is not a start/stop loop.
  */
 export interface TriggerSourcePort {
     start(onFire: (event: TriggerFireEvent) => Promise<void>): Promise<void>;

package/dist/runtime/triggerRunner.d.ts

@@ -13,5 +13,6 @@ import type { TaskFile } from "../types/task.js";
  */
 export declare function fireTrigger(triggerId: string, store: RunStore, runManager: RunManager, options?: {
     cwd?: string;
+    project_root?: string;
     task?: TaskFile;
 }): Promise<StartRunResult>;