stageflow 0.33.0 → 0.36.0

package/dist/runtime/runManager.js

@@ -21,6 +21,7 @@ import { hydrateScheduleFromStore, hydratedScheduleHasRunnableWork, resumeRun, r
 import { resolveFeedbackLoopDecision, } from "./feedbackLoopDecision.js";
 import { RunRetryCoordinator, readRetryRootWaitTimeoutMs, } from "./runRetryCoordinator.js";
 import { readMaxActiveStageProcesses, readMaxActiveStagesPerRun, readStageExecutionMode, } from "./stageConcurrency.js";
+import { runOwnerScope } from "../browser/ownerScope.js";
 import { isHumanLoginStage } from "../browser/humanLogin.js";
 import { defaultStageBrowserSupport, resolveStageBrowserEnv, } from "../browser/stageBrowserEnv.js";
 import { teardownRunBrowsers, teardownStageBrowser, } from "../browser/browserTeardown.js";
@@ -40,6 +41,7 @@ import { getContainerLimits } from "./containerLimits.js";
 import { stageflowCacheRoot } from "./stageCacheEnv.js";
 import { assertClaudeNotRoot, ClaudeRootError } from "../preflight/claudeRoot.js";
 import { preflightFailureCode, runPipelinePreflight, } from "../preflight/pipelinePreflight.js";
+import { channelFailureSummary } from "../preflight/channelChecks.js";
 import { asAgentBackendId } from "../agent/agentBackend.js";
 import { INVALID_SLOT_COUNT_MESSAGE, parseSlotCount, readMaxConcurrentFromGlobal, writeMaxConcurrentToGlobal, } from "./settingsFile.js";
 import { StageHitlController, waitKey, } from "./stageHitl.js";
@@ -267,6 +269,9 @@ export class RunManager {
     queuedDone = new Map();
     admissionDrainInFlight = false;
     resumeInFlight = new Set();
+    gateClosedListeners = new Set();
+    beforeBrowserTeardownListeners = new Set();
+    shutdownListeners = new Set();
     retryInFlight = new Set();
     retryStartOwner = new Map();
     retryStartWaiters = new Map();
@@ -357,7 +362,18 @@ export class RunManager {
         return this.active.size;
     }
     stopAcceptingWork() {
+        const wasAccepting = this.acceptingWork;
         this.acceptingWork = false;
+        if (wasAccepting) {
+            for (const listener of [...this.shutdownListeners]) {
+                try {
+                    listener();
+                }
+                catch {
+                    // listeners must not affect shutdown
+                }
+            }
+        }
         for (const halt of this.schedulingHalts.values()) {
             halt.halted = true;
             halt.hostShutdown = true;
@@ -592,13 +608,14 @@ export class RunManager {
             .some((entry) => entry.runId === runId && entry.stageId === stageId);
     }
     async sweepBrowserSessions() {
-        const support = this.options.browser ?? defaultStageBrowserSupport();
+        const support = this.browserSupport();
         const isRunLive = createRunLiveness(this.options.store);
         await stageProfileLock(support)
             .reclaimStale(isRunLive)
             .catch(() => 0);
         return sweepOrphanBrowserSessions({
             isRunLive,
+            host: support.host,
             ...(support.runner !== undefined ? { runner: support.runner } : {}),
             ...(support.closeWaitMs !== undefined
                 ? { closeWaitMs: support.closeWaitMs }
@@ -833,6 +850,64 @@ export class RunManager {
         }
         await this.drainAdmissionQueue();
     }
+    /** Called when a stage's gate stops accepting operator input (answered, abandoned) or a run is cancelled (no stage id). */
+    onGateClosed(listener) {
+        this.gateClosedListeners.add(listener);
+        return () => {
+            this.gateClosedListeners.delete(listener);
+        };
+    }
+    /** Awaited (bounded by the browser support) before a stage's or run's browser is torn down; stageId absent means the whole run. */
+    beforeBrowserTeardown(listener) {
+        this.beforeBrowserTeardownListeners.add(listener);
+        return () => {
+            this.beforeBrowserTeardownListeners.delete(listener);
+        };
+    }
+    /** Called once the Host stops accepting work (drain start). */
+    onShutdown(listener) {
+        this.shutdownListeners.add(listener);
+        return () => {
+            this.shutdownListeners.delete(listener);
+        };
+    }
+    browserSupport() {
+        const base = this.options.browser ?? defaultStageBrowserSupport();
+        if (this.beforeBrowserTeardownListeners.size === 0)
+            return base;
+        return {
+            ...base,
+            beforeTeardown: async (input) => {
+                await Promise.all([
+                    base.beforeTeardown?.(input),
+                    ...[...this.beforeBrowserTeardownListeners].map(async (listener) => {
+                        try {
+                            await listener(input);
+                        }
+                        catch {
+                            // listeners must not block teardown
+                        }
+                    }),
+                ]);
+            },
+        };
+    }
+    browserOption() {
+        if (this.options.browser === undefined && this.beforeBrowserTeardownListeners.size === 0) {
+            return {};
+        }
+        return { browser: this.browserSupport() };
+    }
+    notifyGateClosed(runId, stageId) {
+        for (const listener of [...this.gateClosedListeners]) {
+            try {
+                listener(runId, stageId);
+            }
+            catch {
+                // listeners must not affect run control
+            }
+        }
+    }
     async abandonStage(runId, stageId) {
         let detail;
         try {
@@ -863,6 +938,7 @@ export class RunManager {
                 status: 409,
             };
         }
+        this.notifyGateClosed(runId, stageId);
         if (this.stageProcessLauncher !== undefined) {
             const hasActive = this.stageProcessLauncher
                 .getActiveStageProcesses()
@@ -871,7 +947,7 @@ export class RunManager {
                 await this.stageProcessLauncher.cancelRun(runId);
             }
         }
-        await teardownStageBrowser(this.options.browser ?? defaultStageBrowserSupport(), {
+        await teardownStageBrowser(this.browserSupport(), {
             runId,
             runDir: this.options.store.getWorkspaceDir(runId),
             stageId,
@@ -893,7 +969,7 @@ export class RunManager {
         const hasWaiting = after.stages.some((s) => s.status === "waiting_for_input");
         if (!hasWaiting &&
             !(await createRunLiveness(this.options.store)(runId).catch(() => true))) {
-            await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+            await teardownRunBrowsers(this.browserSupport(), {
                 runId,
                 runDir: this.options.store.getWorkspaceDir(runId),
                 events: (stageId) => this.options.store.listStageEvents(runId, stageId),
@@ -931,6 +1007,7 @@ export class RunManager {
             };
         }
         await this.options.store.updateRunStatus(runId, "cancelled");
+        this.notifyGateClosed(runId);
         await this.options.store.setCancelReason(runId, trimmedReason);
         await finaliseStoredRunManifest(this.options.store, runId).catch(() => undefined);
         await this.refreshRunDiskBytes(runId).catch(() => undefined);
@@ -950,7 +1027,7 @@ export class RunManager {
         if (this.stageProcessLauncher !== undefined) {
             await this.stageProcessLauncher.cancelRun(runId);
         }
-        await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+        await teardownRunBrowsers(this.browserSupport(), {
             runId,
             runDir: this.options.store.getWorkspaceDir(runId),
             events: (stageId) => this.options.store.listStageEvents(runId, stageId),
@@ -1530,9 +1607,7 @@ export class RunManager {
                 agent: this.options.agent,
                 cwd: meta.project_root ?? this.projectRoot,
                 operatorCatalog: this.options.operatorCatalog,
-                ...(this.options.browser !== undefined
-                    ? { browser: this.options.browser }
-                    : {}),
+                ...this.browserOption(),
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 executionMode: this.executionMode,
                 stageProcessLauncher: this.stageProcessLauncher,
@@ -1757,6 +1832,7 @@ export class RunManager {
                 }
                 return prefix;
             }
+            this.notifyGateClosed(runId, stageId);
             return await orchestrateAnswerResume({
                 prefixMode: prefix.mode,
                 executionMode: this.executionMode,
@@ -1896,9 +1972,7 @@ export class RunManager {
                     checkoutRoot: meta.checkout_root,
                     hitl: this.hitl,
                     operatorCatalog: this.options.operatorCatalog,
-                    ...(this.options.browser !== undefined
-                        ? { browser: this.options.browser }
-                        : {}),
+                    ...this.browserOption(),
                 },
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 executionMode: this.executionMode,
@@ -1957,7 +2031,8 @@ export class RunManager {
             });
             const resumedStage = loaded.stages.find((s) => s.id === definitionIdForInstance(meta.pipeline_dag, stageId));
             if (resumedStage?.browser?.profile !== undefined) {
-                await acquireStageProfile(this.options.browser ?? defaultStageBrowserSupport(), {
+                await acquireStageProfile(this.browserSupport(), {
+                    scope: runOwnerScope(this.browserSupport(), { runId }),
                     profile: resumedStage.browser.profile,
                     owner: { runId, stageId },
                     isRunLive: createRunLiveness(store),
@@ -1968,9 +2043,10 @@ export class RunManager {
                     }
                 });
             }
-            const browserEnv = await resolveStageBrowserEnv(this.options.browser ?? defaultStageBrowserSupport(), {
+            const browserEnv = await resolveStageBrowserEnv(this.browserSupport(), {
                 runId,
                 stageId,
+                scope: runOwnerScope(this.browserSupport(), { runId }),
                 runDir: workspaceDir,
                 browser: resumedStage?.browser,
                 attempt,
@@ -1999,7 +2075,7 @@ export class RunManager {
             if (launchResult.type === "waiting") {
                 return { ok: true };
             }
-            await teardownStageBrowser(this.options.browser ?? defaultStageBrowserSupport(), {
+            await teardownStageBrowser(this.browserSupport(), {
                 runId,
                 runDir: workspaceDir,
                 stageId,
@@ -2021,9 +2097,7 @@ export class RunManager {
                             checkoutRoot: meta.checkout_root,
                             hitl: this.hitl,
                             operatorCatalog: this.options.operatorCatalog,
-                            ...(this.options.browser !== undefined
-                                ? { browser: this.options.browser }
-                                : {}),
+                            ...this.browserOption(),
                         },
                         retryRoots: new Map([[stageId, nextRepairAttempt]]),
                         maxActiveStagesPerRun: this.maxActiveStagesPerRun,
@@ -2041,7 +2115,7 @@ export class RunManager {
                     reason: launchResult.reason,
                 }, eventOptions);
                 await store.updateRunStatus(runId, "failed");
-                await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+                await teardownRunBrowsers(this.browserSupport(), {
                     runId,
                     runDir: workspaceDir,
                     events: (stageId) => store.listStageEvents(runId, stageId),
@@ -2067,9 +2141,7 @@ export class RunManager {
                     checkoutRoot: meta.checkout_root,
                     hitl: this.hitl,
                     operatorCatalog: this.options.operatorCatalog,
-                    ...(this.options.browser !== undefined
-                        ? { browser: this.options.browser }
-                        : {}),
+                    ...this.browserOption(),
                 },
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 resumeFromStageId: stageId,
@@ -2093,7 +2165,7 @@ export class RunManager {
                     reason,
                 }, eventOptions);
                 await store.updateRunStatus(runId, "failed");
-                await teardownRunBrowsers(this.options.browser ?? defaultStageBrowserSupport(), {
+                await teardownRunBrowsers(this.browserSupport(), {
                     runId,
                     runDir: store.getWorkspaceDir(runId),
                     events: (stageId) => store.listStageEvents(runId, stageId),
@@ -2260,7 +2332,9 @@ export class RunManager {
                     "missing_tool";
                 return {
                     ok: false,
-                    reason: `Pipeline preflight failed: ${code}`,
+                    reason: `Pipeline preflight failed: ${code}${code === "channel_check_failed" && channelFailureSummary(preflight.checks)
+                        ? `: ${channelFailureSummary(preflight.checks)}`
+                        : ""}`,
                     status: 400,
                     code,
                 };
@@ -2406,9 +2480,7 @@ export class RunManager {
             const started = await startPipeline({
                 dispatchKey,
                 submission,
-                ...(this.options.browser !== undefined
-                    ? { browser: this.options.browser }
-                    : {}),
+                ...this.browserOption(),
                 agent: this.options.agent,
                 store: this.options.store,
                 taskYaml,
@@ -2911,9 +2983,7 @@ export class RunManager {
             const schedulingHalt = this.ensureSchedulingHalt(runId);
             const started = await startPipeline({
                 submission,
-                ...(this.options.browser !== undefined
-                    ? { browser: this.options.browser }
-                    : {}),
+                ...this.browserOption(),
                 agent: this.options.agent,
                 store: this.options.store,
                 taskYaml,
@@ -3018,9 +3088,7 @@ export class RunManager {
                     checkoutRoot: loadedMeta.checkout_root,
                     hitl: this.hitl,
                     operatorCatalog: this.options.operatorCatalog,
-                    ...(this.options.browser !== undefined
-                        ? { browser: this.options.browser }
-                        : {}),
+                    ...this.browserOption(),
                 },
                 maxActiveStagesPerRun: this.maxActiveStagesPerRun,
                 executionMode: this.executionMode,

package/dist/runtime/runRetryCoordinator.d.ts

@@ -1,4 +1,4 @@
-import type { AgentPort } from "../agent/port.js";
+import type { StagePort } from "../agent/port.js";
 import { type RunDetail, type RunPipelineDagSnapshot, type RunStatus, type RunStore, type StageSnapshot } from "../runstore/port.js";
 import type { PipelineRunResult } from "./pipelineRunner.js";
 import { type SchedulerPreparedPipeline } from "./pipelineScheduler.js";
@@ -56,7 +56,7 @@ export type RetryStageRequest = {
     runId: string;
     stageId: string;
     store: RunStore;
-    agent: AgentPort;
+    agent: StagePort;
     cwd: string;
     operatorCatalog?: OperatorCatalog;
     browser?: StageBrowserSupport;

package/dist/runtime/scheduleSource.js

@@ -1,9 +1,5 @@
-import path from "node:path";
 import { Cron } from "croner";
-import { getCatalogScanPaths } from "../config/browseCatalog.js";
-import { loadTriggerOutcome } from "../config/loadTrigger.js";
-import { catalogContextFromStageflow } from "../config/resolveCatalogContext.js";
-import { resolveStageflowContext } from "../project/resolveStageflowContext.js";
+import { listCatalogTriggerMatches, readTriggerStoreRecord, triggerStoreId, } from "../config/triggerCatalog.js";
 export const DEFAULT_TRIGGER_TICK_INTERVAL_MS = 30_000;
 /** Parse `STAGEFLOW_TRIGGER_TICK_INTERVAL_MS`; default 30s; `0` disables. */
 export function triggerTickIntervalMsFromEnv(env = process.env) {
@@ -72,17 +68,14 @@ export class ScheduleSource {
      * against an injected clock instead of waiting on real interval timers.
      */
     async tick(onFire) {
-        const ctx = catalogContextFromStageflow(await resolveStageflowContext(this.cwd));
-        const scanPaths = await getCatalogScanPaths(ctx);
-        if (!scanPaths)
-            return;
         const now = this.now();
-        const projectRoot = ctx.projectRoot ?? undefined;
-        for (const triggerPath of scanPaths.triggerPaths) {
-            const outcome = await loadTriggerOutcome(triggerPath);
-            if (!outcome.ok)
-                continue;
-            const definition = outcome.value;
+        const catalogTriggers = await listCatalogTriggerMatches({
+            store: this.store,
+            bootCwd: this.cwd,
+            sourceRootsOnly: true,
+        });
+        for (const match of catalogTriggers) {
+            const definition = match.definition;
             if (definition.kind !== "schedule" || !definition.enabled || !definition.schedule) {
                 continue;
             }
@@ -94,25 +87,23 @@ export class ScheduleSource {
                 this.logError(`invalid schedule for trigger "${definition.id}": ${err instanceof Error ? err.message : String(err)}`);
                 continue;
             }
-            const definitionRef = projectRoot !== undefined
-                ? path.relative(projectRoot, triggerPath).replace(/\\/g, "/")
-                : triggerPath;
+            const storeId = triggerStoreId(match.project_root, definition.id);
             await this.store.upsertTrigger({
-                id: definition.id,
-                definitionRef,
+                id: storeId,
+                definitionRef: match.definition_ref,
                 enabled: true,
             });
-            const record = await this.store.getTrigger(definition.id);
+            const record = await readTriggerStoreRecord(this.store, match.project_root, definition.id);
             if (!record?.next_run_at) {
                 if (next)
-                    await this.store.setTriggerNextRun(definition.id, next.toISOString());
+                    await this.store.setTriggerNextRun(storeId, next.toISOString());
                 continue;
             }
             const dueAt = new Date(record.next_run_at);
             if (dueAt.getTime() <= now.getTime()) {
-                await onFire({ triggerId: definition.id });
+                await onFire({ triggerId: definition.id, project_root: match.project_root });
                 if (next)
-                    await this.store.setTriggerNextRun(definition.id, next.toISOString());
+                    await this.store.setTriggerNextRun(storeId, next.toISOString());
             }
         }
     }

package/dist/runtime/stageAttemptBootstrap.d.ts

@@ -1,4 +1,4 @@
-import type { AgentPort, FeedbackLoopContext, StageHandle, StageRunInput, StageSessionMode } from "../agent/port.js";
+import type { StagePort, FeedbackLoopContext, StageHandle, StageRunInput, StageSessionMode } from "../agent/port.js";
 import { type StageStreamLogWriter } from "./stageStreamLog.js";
 import type { RunStore } from "../runstore/port.js";
 import type { StageEnvelope } from "../types/envelope.js";
@@ -12,7 +12,7 @@ export type OperatorCatalog = {
     agentDir?: string;
 };
 export type StageAttemptOpenInput = {
-    agent: Pick<AgentPort, "openStage">;
+    agent: Pick<StagePort, "openStage">;
     store: RunStore;
     runId: string;
     stage: LoadedStageConfig;

package/dist/runtime/stageAttemptBootstrap.js

@@ -1,7 +1,10 @@
 import { emailHostFor, stageEmail, workerStageEmail, validateStageEmailAccounts } from "../email/host.js";
+import { ChannelError } from "../channels/errors.js";
+import { channelHostFor, stageChannels, validateStageChannelConnections, workerStageChannels } from "../channels/host.js";
 import { EmailError } from "../email/port.js";
 import { bindingKindForOrigin, catalogOrSeededOrigin, decideWorkspaceConfigTrust, } from "../config/configOrigin.js";
 import { loginCheckPromptBlock, readStageLoginCheck, } from "../browser/loginCheck.js";
+import { stageGateHandoff } from "../browser/stageHandoff.js";
 import { humanLoginPromptBlock, isHumanLoginStage } from "../browser/humanLogin.js";
 import { BROWSER_SKILL_NAME, resolveBuiltinSkillFile, } from "../config/builtinSkills.js";
 import { resolveSkillByName, } from "../config/listSkills.js";
@@ -239,12 +242,20 @@ async function openStageWithOperatorCatalog(agent, input, catalog, factoryCwd, a
             return { ok: false, reason: "browser login check result is missing" };
         }
     }
+    const humanLoginHandoff = humanLogin
+        ? await stageGateHandoff({
+            runDir: resolveOptions.workspaceDir,
+            runId: resolveOptions.runId,
+            stageId: input.stage.id,
+            dirStageId: stageIdForManifest,
+        })
+        : undefined;
     try {
         const handle = agent.openStage({
             ...input,
             stage: {
                 ...input.stage,
-                system_prompt: `${stampStagePromptArtifactsDir(input.stage.system_prompt, artifactsDir)}${loginCheck !== undefined ? `\n\n${loginCheckPromptBlock(loginCheck)}` : ""}${humanLogin ? `\n\n${humanLoginPromptBlock(input.stage.browser?.login_url ?? input.stage.browser?.check?.url)}` : ""}`,
+                system_prompt: `${stampStagePromptArtifactsDir(input.stage.system_prompt, artifactsDir)}${loginCheck !== undefined ? `\n\n${loginCheckPromptBlock(loginCheck)}` : ""}${humanLogin ? `\n\n${humanLoginPromptBlock(input.stage.browser?.login_url ?? input.stage.browser?.check?.url, humanLoginHandoff?.kind === "live_view" ? "live_view" : "local_window")}` : ""}`,
                 ...(loginCheck !== undefined
                     ? {
                         pre_emit_checks: [
@@ -441,6 +452,16 @@ export async function openStageAttempt(input) {
             throw error;
         }
     }
+    if (process.env.SF_STAGE_WORKER !== "1" && input.stage.channels?.length) {
+        try {
+            validateStageChannelConnections(channelHostFor(input.factoryCwd ?? process.cwd()), input.stage);
+        }
+        catch (error) {
+            if (error instanceof ChannelError)
+                return { ok: false, reason: error.code };
+            throw error;
+        }
+    }
     const opened = await openStageWithOperatorCatalog(input.agent, {
         roots,
         stage: input.stage,
@@ -456,6 +477,10 @@ export async function openStageAttempt(input) {
         resumeToken,
         email: input.stage.email?.length ? (process.env.SF_STAGE_WORKER === "1" ? workerStageEmail()
             : stageEmail(emailHostFor(input.factoryCwd ?? process.cwd()).mailbox, input.stage, input.runId, { workspaceDir: input.workspaceDir, attempt })) : undefined,
+        ...(input.stage.channels?.length ? {
+            channels: process.env.SF_STAGE_WORKER === "1" ? workerStageChannels()
+                : stageChannels(channelHostFor(input.factoryCwd ?? process.cwd()), input.stage, input.runId),
+        } : {}),
         ...(input.sessionMode !== undefined ? { sessionMode: input.sessionMode } : {}),
         onActivity: (event) => {
             input.onActivity?.(input.stage.browser !== undefined

package/dist/runtime/stageProcessLauncher.js

@@ -4,7 +4,7 @@ import { logger as rootLogger, resolveLogMaxLineBytes, } from "../logging/logger
 import { isCursorModelRef, readCursorApiKey } from "../agent/cursorProvider.js";
 import { BROWSER_ENV_PREFIX } from "../browser/browserHost.js";
 import { PACKAGE_VERSION } from "../package-meta.js";
-import { PI_HOME_AUTH_PATH_ENV, stageflowAgentAuthPath } from "./credentialBinding.js";
+import { PI_HOME_AUTH_PATH_ENV, sfOwnedAuthPath } from "./credentialBinding.js";
 import { redactString } from "../logging/redact.js";
 import { getNamedSecrets } from "../logging/namedSecrets.js";
 import { readMaxActiveStageProcesses, } from "./stageConcurrency.js";
@@ -13,6 +13,8 @@ import { buildStageEnvironment, isAmbientBlockedEnv, isForeverDeniedSecret, } fr
 import { ensureStageCacheDirs } from "./stageCacheEnv.js";
 import { SF_STAGE_WORKER, STAGE_WORKER_EXIT, } from "./stageWorkerProtocol.js";
 import { emailHostFor, emailWorkerEnvironment, stageEmail, validateStageEmailAccounts } from "../email/host.js";
+import { ChannelError } from "../channels/errors.js";
+import { channelFault, channelHostFor, channelsWorkerEnvironment, stageChannels, validateStageChannelConnections } from "../channels/host.js";
 import { EmailError } from "../email/port.js";
 import { overlayStageBindingEnv, } from "./stageRoots.js";
 function defaultStageCliEntry() {
@@ -189,6 +191,15 @@ export class StageProcessLauncher {
                 return { type: "failed", reason: error.code };
             throw error;
         }
+        try {
+            if (input.stage?.channels?.length)
+                validateStageChannelConnections(channelHostFor(input.factoryCwd ?? input.operatorCatalog?.cwd ?? input.rootDir), input.stage);
+        }
+        catch (error) {
+            if (error instanceof ChannelError)
+                return { type: "failed", reason: error.code };
+            throw error;
+        }
         input = { ...input, stage: input.stage ? structuredClone(input.stage) : undefined };
         const acquired = await this.waitForCapacity(input.runId);
         if (!acquired) {
@@ -352,7 +363,7 @@ export class StageProcessLauncher {
             : overlaid;
         const childEnv = {
             ...withBrowser,
-            [PI_HOME_AUTH_PATH_ENV]: stageflowAgentAuthPath(),
+            [PI_HOME_AUTH_PATH_ENV]: sfOwnedAuthPath(),
         };
         const cursorApiKey = readCursorApiKey(hostEnv);
         if (isCursorModelRef(input.model ?? "") &&
@@ -363,7 +374,7 @@ export class StageProcessLauncher {
         }
         const child = this.forkFn(this.cliEntry, args, {
             cwd: input.rootDir,
-            env: emailWorkerEnvironment({ ...childEnv, [SF_STAGE_WORKER]: "1" }, emailHostFor(factoryCwd).accounts),
+            env: channelsWorkerEnvironment(emailWorkerEnvironment({ ...childEnv, [SF_STAGE_WORKER]: "1" }, emailHostFor(factoryCwd).accounts), factoryCwd),
             stdio: ["pipe", "pipe", "pipe", "ipc"],
             detached: true,
             // Explicit: do not inherit Host execArgv; set heap from cgroup budget.
@@ -432,6 +443,25 @@ export class StageProcessLauncher {
                     })();
                     return;
                 }
+                if (!settled && request?.type === "channel.send") {
+                    void (async () => {
+                        if (typeof request.requestId !== "string" || request.requestId.length > 100)
+                            return;
+                        let response;
+                        try {
+                            const stage = input.stage;
+                            if (!stage || settled)
+                                throw new ChannelError("CHANNEL_UNAUTHORIZED");
+                            response = { receipt: await stageChannels(channelHostFor(factoryCwd), stage, input.runId).send(request.input) };
+                        }
+                        catch (error) {
+                            response = { error: channelFault(error) };
+                        }
+                        if (child.connected && !settled)
+                            child.send({ type: "channel.response", requestId: request.requestId, ...response });
+                    })();
+                    return;
+                }
                 if (!isStageWorkerResult(message))
                     return;
                 finish(resultFromWorkerMessage(message));

package/dist/runtime/stageRoots.js

@@ -3,7 +3,8 @@ import path from "node:path";
 import { isCursorModelRef } from "../agent/cursorProvider.js";
 import { stageDir } from "../runstore/paths.js";
 import { noAttemptContext } from "./stageAttemptContext.js";
-import { resolveCredentialBinding, currentExplicitAuthPath } from "./credentialBinding.js";
+import { resolveCredentialBinding, STAGEFLOW_AGENT_AUTH_PATH_ENV, currentExplicitAuthPath, } from "./credentialBinding.js";
+import { SF_STAGE_WORKER } from "./stageWorkerProtocol.js";
 export const STAGEFLOW_CHECKOUT = "STAGEFLOW_CHECKOUT";
 export const STAGEFLOW_RUN_WORKSPACE = "STAGEFLOW_RUN_WORKSPACE";
 export const STAGEFLOW_REPOSITORY = "STAGEFLOW_REPOSITORY";
@@ -131,6 +132,12 @@ export function withResolvedAuthPath(roots, factoryCwd) {
     if (explicit !== undefined) {
         return { ...roots, authPath: explicit };
     }
+    if (process.env[SF_STAGE_WORKER] === "1") {
+        const stamped = process.env[STAGEFLOW_AGENT_AUTH_PATH_ENV]?.trim();
+        if (!stamped)
+            return roots;
+        return { ...roots, authPath: path.resolve(stamped) };
+    }
     const binding = resolveCredentialBinding(factoryCwd);
     return { ...roots, authPath: binding.authPath };
 }

package/dist/runtime/stageRunner.d.ts

@@ -1,4 +1,4 @@
-import type { AgentPort, FeedbackLoopContext, StageHandle, StageRunResult, StageSessionMode } from "../agent/port.js";
+import type { StagePort, FeedbackLoopContext, StageHandle, StageRunResult, StageSessionMode } from "../agent/port.js";
 import { type HostGateContext } from "../browser/gateHandoff.js";
 import type { StageBrowserSupport } from "../browser/browserHost.js";
 import type { StageEnvelope } from "../types/envelope.js";
@@ -20,7 +20,7 @@ export declare function isRunStageWaiting(outcome: RunStageOutcome): outcome is
     waiting: true;
 };
 export type RunStageOptions = {
-    agent: AgentPort;
+    agent: StagePort;
     store: RunStore;
     runId: string;
     stage: LoadedStageConfig;

package/dist/runtime/stageRunner.js

@@ -1,4 +1,5 @@
-import { hostGateContextFor, stampGateRequest, } from "../browser/gateHandoff.js";
+import { stampGateRequest } from "../browser/gateHandoff.js";
+import { stageGateContext } from "../browser/stageHandoff.js";
 import { deriveExecutionPatchFromEvent } from "../runstore/stageExecution.js";
 import { buildStageRoots, withResolvedAuthPath, } from "./stageRoots.js";
 import { createDefaultHitlQaHooks, recordWaitEnter, } from "./stageHitl.js";
@@ -231,7 +232,12 @@ export async function runStage(options) {
             store: workerMode ? store : undefined,
             attemptCtx,
             skipGates,
-            gateContext: hostGateContextFor(stage.browser),
+            gateContext: await stageGateContext({
+                runDir: workspaceDir ?? store.getWorkspaceDir(runId),
+                runId,
+                stageId,
+                browser: stage.browser,
+            }),
         });
     }
     catch (err) {

package/dist/runtime/stageWorker.js

@@ -1,4 +1,4 @@
-import { resolveAgentPort } from "../agent/resolveAgentPort.js";
+import { resolveStagePort } from "../agent/resolveStagePort.js";
 import { asAgentBackendId } from "../agent/agentBackend.js";
 import { loadStageflowManifestOutcome } from "../config/loadStageflowManifest.js";
 import { loadNamedSecretsFromAttemptDir } from "../logging/namedSecrets.js";
@@ -29,7 +29,7 @@ export async function runStageWorker(input) {
     }
     const dag = meta.pipeline_dag ?? loaded.dag;
     const manifestOutcome = await loadStageflowManifestOutcome(input.rootDir);
-    const agent = resolveAgentPort({
+    const agent = resolveStagePort({
         global: manifestOutcome.ok
             ? asAgentBackendId(manifestOutcome.value.manifest.agent)
             : undefined,

package/dist/runtime/triggerPort.d.ts

@@ -1,12 +1,14 @@
 import type { TaskFile } from "../types/task.js";
 export type TriggerFireEvent = {
     triggerId: string;
+    project_root?: string;
     task?: TaskFile;
 };
 /**
- * Abstract seam for anything that decides "fire trigger X now" — a croner-backed
- * schedule loop, a GitHub/email poller, a webhook receiver. No adapter implements
- * this yet; it exists so those later adapters build against a locked contract.
+ * Long-running sources that decide "fire trigger X now". ScheduleSource,
+ * GithubPollSource, and EmailSource implement this. Webhook deliveries are
+ * request-driven: acceptWebhook shares TriggerFireEvent's optional task, and
+ * the HTTP route fires; a webhook is not a start/stop loop.
  */
 export interface TriggerSourcePort {
     start(onFire: (event: TriggerFireEvent) => Promise<void>): Promise<void>;

package/dist/runtime/triggerRunner.d.ts

@@ -13,5 +13,6 @@ import type { TaskFile } from "../types/task.js";
  */
 export declare function fireTrigger(triggerId: string, store: RunStore, runManager: RunManager, options?: {
     cwd?: string;
+    project_root?: string;
     task?: TaskFile;
 }): Promise<StartRunResult>;