stageflow 0.35.0 → 0.39.0

package/dist/runstore/overviewSummary.js

@@ -0,0 +1,134 @@
+export const OVERVIEW_RANGES = ["24h", "7d", "30d"];
+export function isOverviewRange(value) {
+    return OVERVIEW_RANGES.includes(value);
+}
+const HOUR_MS = 3_600_000;
+const RANGE_SHAPE = {
+    "24h": { windowMs: 24 * HOUR_MS, bucketMs: 3 * HOUR_MS },
+    "7d": { windowMs: 7 * 24 * HOUR_MS, bucketMs: 24 * HOUR_MS },
+    "30d": { windowMs: 30 * 24 * HOUR_MS, bucketMs: 3 * 24 * HOUR_MS },
+};
+export function overviewWindowMs(range) {
+    return RANGE_SHAPE[range].windowMs;
+}
+function emptyTotals() {
+    return {
+        runs: 0,
+        succeeded: 0,
+        failed: 0,
+        cancelled: 0,
+        in_flight: 0,
+        finished: 0,
+        success_rate: null,
+        cost_usd: 0,
+    };
+}
+function tally(rows) {
+    const totals = emptyTotals();
+    for (const row of rows) {
+        totals.runs += 1;
+        if (row.status === "succeeded")
+            totals.succeeded += 1;
+        else if (row.status === "failed")
+            totals.failed += 1;
+        else if (row.status === "cancelled")
+            totals.cancelled += 1;
+        else
+            totals.in_flight += 1;
+        totals.cost_usd += row.cost_usd ?? 0;
+    }
+    totals.finished = totals.succeeded + totals.failed;
+    totals.success_rate = totals.finished > 0 ? totals.succeeded / totals.finished : null;
+    totals.cost_usd = roundCost(totals.cost_usd);
+    return totals;
+}
+function roundCost(value) {
+    return Math.round(value * 10_000) / 10_000;
+}
+function median(values) {
+    if (values.length === 0)
+        return null;
+    const sorted = [...values].sort((a, b) => a - b);
+    const mid = Math.floor(sorted.length / 2);
+    return sorted.length % 2 === 1 ? sorted[mid] : Math.round((sorted[mid - 1] + sorted[mid]) / 2);
+}
+function durationMs(row) {
+    if (row.status !== "succeeded" && row.status !== "failed")
+        return null;
+    if (!row.finished_at)
+        return null;
+    const ms = Date.parse(row.finished_at) - Date.parse(row.created_at);
+    return Number.isFinite(ms) && ms >= 0 ? ms : null;
+}
+/**
+ * Rows must cover `[now - 2 * window, now]` by `created_at`; the older half feeds `previous`.
+ * Buckets are rolling segments ending at `now`, so they need no time zone.
+ */
+export function buildOverview(rows, range, now = new Date()) {
+    const { windowMs, bucketMs } = RANGE_SHAPE[range];
+    const nowMs = now.getTime();
+    const sinceMs = nowMs - windowMs;
+    const previousSinceMs = sinceMs - windowMs;
+    const current = [];
+    const previous = [];
+    for (const row of rows) {
+        const created = Date.parse(row.created_at);
+        if (!Number.isFinite(created))
+            continue;
+        if (created >= sinceMs && created <= nowMs)
+            current.push(row);
+        else if (created >= previousSinceMs && created < sinceMs)
+            previous.push(row);
+    }
+    const bucketCount = windowMs / bucketMs;
+    const buckets = Array.from({ length: bucketCount }, (_, i) => ({
+        start: new Date(sinceMs + i * bucketMs).toISOString(),
+        succeeded: 0,
+        failed: 0,
+        cancelled: 0,
+    }));
+    for (const row of current) {
+        const index = Math.min(bucketCount - 1, Math.floor((Date.parse(row.created_at) - sinceMs) / bucketMs));
+        const bucket = buckets[index];
+        if (row.status === "succeeded")
+            bucket.succeeded += 1;
+        else if (row.status === "failed")
+            bucket.failed += 1;
+        else if (row.status === "cancelled")
+            bucket.cancelled += 1;
+    }
+    const byPipeline = new Map();
+    for (const row of current) {
+        const list = byPipeline.get(row.pipeline_id);
+        if (list)
+            list.push(row);
+        else
+            byPipeline.set(row.pipeline_id, [row]);
+    }
+    const pipelines = [...byPipeline.entries()]
+        .map(([pipeline_id, list]) => {
+        const totals = tally(list);
+        const durations = list.map(durationMs).filter((ms) => ms !== null);
+        return {
+            pipeline_id,
+            runs: totals.runs,
+            succeeded: totals.succeeded,
+            failed: totals.failed,
+            cancelled: totals.cancelled,
+            success_rate: totals.success_rate,
+            median_duration_ms: median(durations),
+            cost_usd: totals.cost_usd,
+            last_run_at: list.reduce((latest, row) => (row.created_at > latest ? row.created_at : latest), list[0].created_at),
+        };
+    })
+        .sort((a, b) => b.runs - a.runs || a.pipeline_id.localeCompare(b.pipeline_id));
+    return {
+        range,
+        generated_at: now.toISOString(),
+        since: new Date(sinceMs).toISOString(),
+        totals: tally(current),
+        previous: tally(previous),
+        buckets,
+        pipelines,
+    };
+}

package/dist/runstore/port.d.ts

@@ -7,6 +7,7 @@ import type { FeedbackLoopConfig, InlinePipelineDefinition, ResolvedPipelineDag
 import type { CompletionCheck } from "../types/completion.js";
 import type { StageGateKind } from "../types/stage.js";
 import type { StageUsage } from "../types/usage.js";
+import type { OverviewRunRow } from "./overviewSummary.js";
 export type { ConfigOriginRecord };
 export type RunStatus = "created" | "queued" | "running" | "succeeded" | "failed" | "cancelled";
 export type RunPipelineDagSnapshot = ResolvedPipelineDag & {
@@ -463,6 +464,8 @@ export interface RunStore {
     }): Promise<void>;
     listStageEvents(runId: string, stageId: string, attempt?: number): Promise<StageLogEvent[]>;
     listRuns(filter?: ListRunsFilter): Promise<RunSummary[]>;
+    /** One light row per run created at or after `since` (ISO), newest first, with summed stage cost. No stages are loaded. */
+    listRunOverviewRows(since: string): Promise<OverviewRunRow[]>;
     /** Idempotent upsert; returns the realpath/resolve-normalized absolute key. */
     ensureProject(absPath: string): Promise<string>;
     /** Absolute roots from the durable projects registry. */

package/dist/runstore/sqlite/SqliteRunStore.d.ts

@@ -2,6 +2,7 @@ import Database from "better-sqlite3";
 import type { StageEnvelope } from "../../types/envelope.js";
 import type { StageLogLine } from "../../agent/activity.js";
 import { type CreateFeedbackLoopInput, type CreateFeedbackReplayInput, type CreateFeedbackReplayStagePassInput, type CreateForkGenerationInput, type CreateRunInput, type CreatedRun, type FeedbackLoopPatch, type FeedbackLoopRecord, type FeedbackLoopState, type FeedbackReplayPatch, type FeedbackReplayRecord, type FeedbackReplayStagePassPatch, type FeedbackReplayStagePassRecord, type ForkGenerationPatch, type ForkGenerationRecord, type ListRunsFilter, type RunDetail, type RunMeta, type RunPipelineDagSnapshot, type RunStatus, type RunStore, type RunSummary, type StageExecution, type StageExecutionPatch, type StageLogEvent, type TriggerRecord, type UpsertTriggerInput, type VerificationCheckResult, type VerificationCheckResultPatch, type ConfigOriginRecord } from "../port.js";
+import type { OverviewRunRow } from "../overviewSummary.js";
 import { type RunSubmissionRecord } from "../submission.js";
 type SqliteRunStoreOpenerMode = "assert" | "migrate";
 export declare class SqliteRunStore implements RunStore {
@@ -76,6 +77,7 @@ export declare class SqliteRunStore implements RunStore {
     private updateStageStatusDenorm;
     listStageEvents(runId: string, stageId: string, attempt?: number): Promise<StageLogEvent[]>;
     listRuns(filter?: ListRunsFilter): Promise<RunSummary[]>;
+    listRunOverviewRows(since: string): Promise<OverviewRunRow[]>;
     ensureProject(absPath: string): Promise<string>;
     listRegisteredProjects(): Promise<string[]>;
     upsertTrigger(input: UpsertTriggerInput): Promise<TriggerRecord>;

package/dist/runstore/sqlite/SqliteRunStore.js

@@ -870,6 +870,24 @@ export class SqliteRunStore {
         }
         return summaries;
     }
+    async listRunOverviewRows(since) {
+        await this.ready();
+        const rows = this.db
+            .prepare(`SELECT r.run_id, r.pipeline_id, r.status, r.created_at, r.finished_at,
+                (SELECT SUM(e.cost_usd) FROM stage_executions e WHERE e.run_id = r.run_id) AS cost_usd
+         FROM runs r
+         WHERE r.created_at >= ?
+         ORDER BY r.created_at DESC`)
+            .all(since);
+        return rows.map((row) => ({
+            run_id: row.run_id,
+            pipeline_id: row.pipeline_id,
+            status: row.status,
+            created_at: row.created_at,
+            ...(row.finished_at != null ? { finished_at: row.finished_at } : {}),
+            ...(row.cost_usd != null ? { cost_usd: row.cost_usd } : {}),
+        }));
+    }
     async ensureProject(absPath) {
         await this.ready();
         const resolved = path.resolve(absPath);

package/dist/runstore/sqlite/migrations/013-agents.d.ts

@@ -0,0 +1,12 @@
+import type Database from "better-sqlite3";
+/**
+ * Project agents: revisions, sessions, transcript, approvals, turns, spans.
+ * Read and written only by `AgentStore` (src/agents/store.ts); kept out of the
+ * run/stage-shaped RunStore port. `project_key` scopes rows to one project root.
+ */
+export declare const MIGRATION_013: {
+    version: number;
+    name: string;
+    minStageflowVersion: string;
+    up(db: Database.Database): void;
+};

package/dist/runstore/sqlite/migrations/013-agents.js

@@ -0,0 +1,156 @@
+import { PACKAGE_VERSION } from "../../../package-meta.js";
+/**
+ * Project agents: revisions, sessions, transcript, approvals, turns, spans.
+ * Read and written only by `AgentStore` (src/agents/store.ts); kept out of the
+ * run/stage-shaped RunStore port. `project_key` scopes rows to one project root.
+ */
+export const MIGRATION_013 = {
+    version: 13,
+    name: "013_agents",
+    minStageflowVersion: PACKAGE_VERSION,
+    up(db) {
+        db.exec(`
+CREATE TABLE agent_definitions (
+  project_key TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  current_revision INTEGER NOT NULL,
+  archived INTEGER NOT NULL DEFAULT 0,
+  file_hash TEXT,
+  issues_json TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_key, agent_id)
+);
+
+CREATE TABLE agent_revisions (
+  project_key TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  definition_json TEXT NOT NULL,
+  yaml_text TEXT NOT NULL,
+  source TEXT NOT NULL CHECK (source IN ('console', 'file', 'author', 'restore', 'api')),
+  author TEXT,
+  summary TEXT,
+  restored_from INTEGER,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_key, agent_id, revision)
+);
+
+CREATE TABLE agent_sessions (
+  session_id TEXT PRIMARY KEY NOT NULL,
+  project_key TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  backend TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('open', 'running', 'waiting', 'held', 'closed')),
+  source TEXT NOT NULL,
+  source_ref TEXT,
+  thread_key TEXT,
+  title TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX agent_sessions_agent_updated ON agent_sessions (project_key, agent_id, updated_at DESC);
+CREATE UNIQUE INDEX agent_sessions_thread ON agent_sessions (project_key, agent_id, thread_key)
+  WHERE thread_key IS NOT NULL;
+
+CREATE TABLE agent_messages (
+  message_id TEXT PRIMARY KEY NOT NULL,
+  session_id TEXT NOT NULL REFERENCES agent_sessions (session_id) ON DELETE CASCADE,
+  seq INTEGER NOT NULL,
+  turn_id TEXT,
+  role TEXT NOT NULL CHECK (role IN ('user', 'assistant')),
+  author TEXT,
+  text TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (session_id, seq)
+);
+
+CREATE TABLE agent_turns (
+  turn_id TEXT PRIMARY KEY NOT NULL,
+  session_id TEXT NOT NULL REFERENCES agent_sessions (session_id) ON DELETE CASCADE,
+  seq INTEGER NOT NULL,
+  revision INTEGER NOT NULL,
+  trace_id TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('running', 'waiting', 'succeeded', 'failed', 'cancelled')),
+  error_code TEXT,
+  input_tokens INTEGER,
+  output_tokens INTEGER,
+  cost_usd REAL,
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  UNIQUE (session_id, seq)
+);
+
+CREATE TABLE agent_spans (
+  span_id TEXT PRIMARY KEY NOT NULL,
+  turn_id TEXT NOT NULL REFERENCES agent_turns (turn_id) ON DELETE CASCADE,
+  parent_span_id TEXT,
+  name TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  status TEXT NOT NULL,
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  duration_ms INTEGER,
+  input_tokens INTEGER,
+  output_tokens INTEGER,
+  attributes_json TEXT NOT NULL DEFAULT '{}',
+  input_text TEXT,
+  output_text TEXT
+);
+CREATE INDEX agent_spans_turn ON agent_spans (turn_id, started_at);
+
+CREATE TABLE agent_eval_scores (
+  turn_id TEXT NOT NULL REFERENCES agent_turns (turn_id) ON DELETE CASCADE,
+  metric TEXT NOT NULL,
+  score REAL NOT NULL,
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (turn_id, metric)
+);
+
+CREATE TABLE agent_approvals (
+  approval_id TEXT PRIMARY KEY NOT NULL,
+  session_id TEXT NOT NULL REFERENCES agent_sessions (session_id) ON DELETE CASCADE,
+  turn_id TEXT,
+  tool TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  payload_hash TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'denied', 'expired')),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  decided_at TEXT,
+  actor_json TEXT
+);
+CREATE UNIQUE INDEX agent_approvals_one_pending ON agent_approvals (session_id) WHERE status = 'pending';
+
+CREATE TABLE agent_executed_payloads (
+  session_id TEXT NOT NULL REFERENCES agent_sessions (session_id) ON DELETE CASCADE,
+  payload_hash TEXT NOT NULL,
+  executed_at TEXT NOT NULL,
+  PRIMARY KEY (session_id, payload_hash)
+);
+
+CREATE TABLE agent_outbound_sends (
+  session_id TEXT NOT NULL REFERENCES agent_sessions (session_id) ON DELETE CASCADE,
+  operation_key TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('submitted', 'unknown')),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (session_id, operation_key)
+);
+
+CREATE TABLE agent_inbound_events (
+  project_key TEXT NOT NULL,
+  dedupe_key TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  PRIMARY KEY (project_key, dedupe_key)
+);
+
+CREATE TABLE agent_schedules (
+  project_key TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  next_run_at TEXT NOT NULL,
+  PRIMARY KEY (project_key, agent_id)
+);
+`);
+    },
+};

package/dist/runstore/sqlite/migrations/014-agent-deliveries.d.ts

@@ -0,0 +1,11 @@
+import type Database from "better-sqlite3";
+/**
+ * Replies to people on a channel (AgentMail, iMessage): one row per turn that has to reach someone, with how
+ * the send went, so a failed reply can be retried or resent and a reply of unknown outcome is never duplicated.
+ */
+export declare const MIGRATION_014: {
+    version: number;
+    name: string;
+    minStageflowVersion: string;
+    up(db: Database.Database): void;
+};

package/dist/runstore/sqlite/migrations/014-agent-deliveries.js

@@ -0,0 +1,32 @@
+import { PACKAGE_VERSION } from "../../../package-meta.js";
+/**
+ * Replies to people on a channel (AgentMail, iMessage): one row per turn that has to reach someone, with how
+ * the send went, so a failed reply can be retried or resent and a reply of unknown outcome is never duplicated.
+ */
+export const MIGRATION_014 = {
+    version: 14,
+    name: "014_agent_deliveries",
+    minStageflowVersion: PACKAGE_VERSION,
+    up(db) {
+        db.exec(`
+CREATE TABLE agent_deliveries (
+  turn_id TEXT PRIMARY KEY REFERENCES agent_turns (turn_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES agent_sessions (session_id) ON DELETE CASCADE,
+  connection_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  reply_to TEXT NOT NULL,
+  text TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('pending', 'sending', 'delivered', 'failed', 'unknown')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  error_code TEXT,
+  error_message TEXT,
+  retryable INTEGER NOT NULL DEFAULT 0,
+  next_attempt_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX agent_deliveries_due ON agent_deliveries (state, next_attempt_at);
+CREATE INDEX agent_deliveries_session ON agent_deliveries (session_id);
+`);
+    },
+};

package/dist/runstore/sqlite/migrations/index.js

@@ -11,6 +11,8 @@ import { MIGRATION_009 } from "./009-trigger-next-run.js";
 import { MIGRATION_010 } from "./010-trigger-adapter-state.js";
 import { MIGRATION_011 } from "./011-email-dispatch-key.js";
 import { MIGRATION_012 } from "./012-trigger-fires.js";
+import { MIGRATION_013 } from "./013-agents.js";
+import { MIGRATION_014 } from "./014-agent-deliveries.js";
 const DEFAULT_MIGRATIONS = [
     MIGRATION_001,
     MIGRATION_002,
@@ -24,6 +26,8 @@ const DEFAULT_MIGRATIONS = [
     MIGRATION_010,
     MIGRATION_011,
     MIGRATION_012,
+    MIGRATION_013,
+    MIGRATION_014,
 ];
 export const CURRENT_SCHEMA_VERSION = DEFAULT_MIGRATIONS[DEFAULT_MIGRATIONS.length - 1].version;
 function throwStoreSchemaTooNew(db, version, maxKnown) {

package/dist/runtime/pipelineRunner.js

@@ -13,6 +13,7 @@ import { checkTaskEntryInput } from "./taskInput.js";
 import { pipelinePersistenceForStart } from "./startPayload.js";
 import { materializeRunSkills, } from "./runSkills.js";
 import { preflightFailureCode, runPipelinePreflight, } from "../preflight/pipelinePreflight.js";
+import { channelFailureSummary } from "../preflight/channelChecks.js";
 import { networkError } from "../errors/codes.js";
 import { newRunId } from "../runstore/paths.js";
 import { bindingFromFields, buildInitialRunManifest, collectDeclaredSecretValues, finaliseStoredRunManifest, } from "../runstore/runManifest.js";
@@ -24,7 +25,8 @@ export class PipelinePreflightError extends Error {
     code;
     preflight;
     constructor(code, preflight) {
-        super(`Pipeline preflight failed: ${code}`);
+        const detail = code === "channel_check_failed" ? channelFailureSummary(preflight.checks) : undefined;
+        super(`Pipeline preflight failed: ${code}${detail ? `: ${detail}` : ""}`);
         this.name = "PipelinePreflightError";
         this.code = code;
         this.preflight = preflight;

package/dist/runtime/repositoryMaterialize.d.ts

@@ -1,7 +1,7 @@
 import type { RunMeta, RunStore } from "../runstore/port.js";
 import type { TaskFile } from "../types/task.js";
 import type { WorkspaceBinding } from "./workspaceBinding.js";
-export type StartFailureCode = "busy_capacity" | "busy_checkout" | "busy_caller_quota" | "repository_auth_failed" | "repository_not_found" | "ref_not_found" | "repository_fetch_failed" | "worktree_create_failed" | "git_missing" | "insufficient_disk" | "disk_check_failed" | "pinned_sha_unavailable" | "invalid_run_branch" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "task.invalid_shape" | "task.load_error" | "trigger.task_override_not_allowed" | "trigger.task_required" | "start.token_rejected" | "inline_pipeline_too_large" | "skills_invalid_name" | "skills_invalid_path" | "skills_missing_skill_md" | "skills_payload_too_large" | "missing_tool" | "tool_version_mismatch" | "unknown_version" | "secret_unavailable" | "unresolved_var" | "shutting_down" | "autostart_disabled" | "ensure_project_not_allowed" | "claude_as_root";
+export type StartFailureCode = "busy_capacity" | "busy_checkout" | "busy_caller_quota" | "repository_auth_failed" | "repository_not_found" | "ref_not_found" | "repository_fetch_failed" | "worktree_create_failed" | "git_missing" | "insufficient_disk" | "disk_check_failed" | "pinned_sha_unavailable" | "invalid_run_branch" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "task.invalid_shape" | "task.load_error" | "trigger.task_override_not_allowed" | "trigger.task_required" | "start.token_rejected" | "inline_pipeline_too_large" | "skills_invalid_name" | "skills_invalid_path" | "skills_missing_skill_md" | "skills_payload_too_large" | "missing_tool" | "tool_version_mismatch" | "unknown_version" | "secret_unavailable" | "channel_check_failed" | "unresolved_var" | "shutting_down" | "autostart_disabled" | "ensure_project_not_allowed" | "claude_as_root";
 export type MaterializedBinding = {
     runId: string;
     checkoutRoot?: string;

package/dist/runtime/runManager.js

@@ -41,6 +41,7 @@ import { getContainerLimits } from "./containerLimits.js";
 import { stageflowCacheRoot } from "./stageCacheEnv.js";
 import { assertClaudeNotRoot, ClaudeRootError } from "../preflight/claudeRoot.js";
 import { preflightFailureCode, runPipelinePreflight, } from "../preflight/pipelinePreflight.js";
+import { channelFailureSummary } from "../preflight/channelChecks.js";
 import { asAgentBackendId } from "../agent/agentBackend.js";
 import { INVALID_SLOT_COUNT_MESSAGE, parseSlotCount, readMaxConcurrentFromGlobal, writeMaxConcurrentToGlobal, } from "./settingsFile.js";
 import { StageHitlController, waitKey, } from "./stageHitl.js";
@@ -2331,7 +2332,9 @@ export class RunManager {
                     "missing_tool";
                 return {
                     ok: false,
-                    reason: `Pipeline preflight failed: ${code}`,
+                    reason: `Pipeline preflight failed: ${code}${code === "channel_check_failed" && channelFailureSummary(preflight.checks)
+                        ? `: ${channelFailureSummary(preflight.checks)}`
+                        : ""}`,
                     status: 400,
                     code,
                 };

package/dist/runtime/stageAttemptBootstrap.js

@@ -1,4 +1,10 @@
 import { emailHostFor, stageEmail, workerStageEmail, validateStageEmailAccounts } from "../email/host.js";
+import { ChannelError } from "../channels/errors.js";
+import { channelHostFor, stageChannels, validateStageChannelConnections, workerStageChannels } from "../channels/host.js";
+import { bindStageMemory } from "../memory/access.js";
+import { memoryHostFor } from "../memory/host.js";
+import { workerMemoryForStage } from "../memory/worker.js";
+import { memoryPrompt } from "../tools/memoryTools.js";
 import { EmailError } from "../email/port.js";
 import { bindingKindForOrigin, catalogOrSeededOrigin, decideWorkspaceConfigTrust, } from "../config/configOrigin.js";
 import { loginCheckPromptBlock, readStageLoginCheck, } from "../browser/loginCheck.js";
@@ -96,12 +102,13 @@ async function resolveAttemptMcpServers(allowlist, factoryCwd, artifactsDir, opt
     };
     const stageIdOpt = options.stageId !== undefined ? { stageId: options.stageId } : {};
     const bindingKind = bindingKindForOrigin(options.bindingKind);
-    if (factoryCwd !== undefined && (await mcpCatalogExists(factoryCwd))) {
+    if (factoryCwd !== undefined && (await mcpCatalogExists(factoryCwd, { scope: { kind: "validate" } }))) {
         await mkdir(artifactsDir, { recursive: true });
         const resolved = await resolveStageMcpServers({
             projectRoot: factoryCwd,
             allowlist: names,
             env,
+            scope: { kind: "stage", secrets: options.declaredSecrets ?? [] },
             bindingKind,
             trustWorkspaceConfig: options.trustWorkspaceConfig,
             ...stageIdOpt,
@@ -185,6 +192,7 @@ async function openStageWithOperatorCatalog(agent, input, catalog, factoryCwd, a
             trustWorkspaceConfig: resolveOptions.trustWorkspaceConfig,
             stageEnv: resolveOptions.stageEnv,
             stageId: input.stageId,
+            declaredSecrets: (input.stage.secrets ?? []).map((d) => d.name),
         });
         resolvedMcpServers = mcp.servers;
         origins.push(...mcp.origins);
@@ -450,6 +458,21 @@ export async function openStageAttempt(input) {
             throw error;
         }
     }
+    if (process.env.SF_STAGE_WORKER !== "1" && input.stage.channels?.length) {
+        try {
+            validateStageChannelConnections(channelHostFor(input.factoryCwd ?? process.cwd()), input.stage);
+        }
+        catch (error) {
+            if (error instanceof ChannelError)
+                return { ok: false, reason: error.code };
+            throw error;
+        }
+    }
+    const stageMemory = input.stage.memories?.length
+        ? process.env.SF_STAGE_WORKER === "1"
+            ? await workerMemoryForStage(input.stage.memories)
+            : await bindStageMemory(memoryHostFor(), input.stage.memories)
+        : undefined;
     const opened = await openStageWithOperatorCatalog(input.agent, {
         roots,
         stage: input.stage,
@@ -465,6 +488,13 @@ export async function openStageAttempt(input) {
         resumeToken,
         email: input.stage.email?.length ? (process.env.SF_STAGE_WORKER === "1" ? workerStageEmail()
             : stageEmail(emailHostFor(input.factoryCwd ?? process.cwd()).mailbox, input.stage, input.runId, { workspaceDir: input.workspaceDir, attempt })) : undefined,
+        ...(input.stage.channels?.length ? {
+            channels: process.env.SF_STAGE_WORKER === "1" ? workerStageChannels()
+                : stageChannels(channelHostFor(input.factoryCwd ?? process.cwd()), input.stage, input.runId),
+        } : {}),
+        ...(stageMemory
+            ? { memory: stageMemory, memoryPrompt: await memoryPrompt(stageMemory) }
+            : {}),
         ...(input.sessionMode !== undefined ? { sessionMode: input.sessionMode } : {}),
         onActivity: (event) => {
             input.onActivity?.(input.stage.browser !== undefined

package/dist/runtime/stageEnvironment.d.ts

@@ -2,6 +2,7 @@ export declare const STAGE_ENV_PASSTHROUGH = "STAGEFLOW_STAGE_ENV_PASSTHROUGH";
 export declare const STAGE_ENV_ALLOW = "STAGEFLOW_STAGE_ENV_ALLOW";
 /** Names copied from Host when present (exact-name allowlist; no prefix wildcards). */
 export declare const STAGE_ENV_ALLOWLIST: readonly string[];
+export declare const PROVIDER_AND_CLOUD_NAMES: readonly ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "OPENAI_API_KEY_FILE", "GOOGLE_API_KEY", "GEMINI_API_KEY", "GROQ_API_KEY", "MISTRAL_API_KEY", "DEEPSEEK_API_KEY", "TOGETHER_API_KEY", "FIREWORKS_API_KEY", "PERPLEXITY_API_KEY", "XAI_API_KEY", "COHERE_API_KEY", "OPENROUTER_API_KEY", "AZURE_OPENAI_API_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_SECURITY_TOKEN", "AWS_PROFILE", "AWS_DEFAULT_REGION", "AWS_REGION", "GOOGLE_APPLICATION_CREDENTIALS", "GCLOUD_PROJECT", "AZURE_CLIENT_SECRET", "AZURE_TENANT_ID", "AZURE_CLIENT_ID", "NPM_TOKEN", "NODE_AUTH_TOKEN", "SSH_AUTH_SOCK", "SSH_AGENT_PID", "GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN_FILE", "GH_TOKEN_FILE"];
 /** Never grantable — even via secrets `as: env`. */
 export declare const FOREVER_DENIED_SECRET_NAMES: ReadonlySet<string>;
 /** Blocked from ambient / ALLOW / PASSTHROUGH; `as: env` grants may still inject. */
@@ -29,6 +30,7 @@ export type BuildStageEnvironmentResult = {
     passthroughActive: boolean;
 };
 export declare function isForeverDeniedSecret(name: string): boolean;
+export declare function isProviderOrCloudName(name: string): boolean;
 export declare function isAmbientBlockedEnv(name: string): boolean;
 /**
  * Construct the stage child environment. Exact-name allowlist only — never a

package/dist/runtime/stageEnvironment.js

@@ -27,7 +27,7 @@ export const STAGE_ENV_ALLOWLIST = [
     "STAGEFLOW_HOME",
     "STAGEFLOW_CURSOR_EXTENSION",
 ];
-const PROVIDER_AND_CLOUD_NAMES = [
+export const PROVIDER_AND_CLOUD_NAMES = [
     "ANTHROPIC_API_KEY",
     "OPENAI_API_KEY",
     "OPENAI_API_KEY_FILE",
@@ -70,6 +70,8 @@ export const FOREVER_DENIED_SECRET_NAMES = new Set([
     "STAGEFLOW_CONTROL_TOKEN_FILE",
     "STAGEFLOW_READ_TOKEN",
     "STAGEFLOW_READ_TOKEN_FILE",
+    // Host-generated key for the MCP OAuth token store; never hand it to a stage or an MCP server.
+    "PI_MCP_ADAPTER_OAUTH_FILE_KEY",
 ]);
 /** Blocked from ambient / ALLOW / PASSTHROUGH; `as: env` grants may still inject. */
 export const AMBIENT_BLOCKED_ENV_NAMES = new Set([
@@ -94,6 +96,9 @@ export function isForeverDeniedSecret(name) {
         return true;
     return name.startsWith("STAGEFLOW_CONTROL_TOKEN_");
 }
+export function isProviderOrCloudName(name) {
+    return PROVIDER_AND_CLOUD_NAMES.includes(name);
+}
 export function isAmbientBlockedEnv(name) {
     return isForeverDeniedSecret(name) || AMBIENT_BLOCKED_ENV_NAMES.has(name);
 }