stageflow 0.36.0 → 0.40.0

package/dist/runtime/stageWorker.js

@@ -11,6 +11,7 @@ import { bindPiAgentDirEnv, overlayStageBindingEnv, rootsForStageWorker, stageBi
 import { buildStageEnvironment } from "./stageEnvironment.js";
 import { ensureStageCacheDirs } from "./stageCacheEnv.js";
 import { PACKAGE_VERSION } from "../package-meta.js";
+import { openStageSandbox } from "./stageSandbox.js";
 import { runStage, isRunStageWaiting, } from "./stageRunner.js";
 import { openStageAttempt } from "./stageAttemptBootstrap.js";
 import { attemptContext } from "./stageAttemptContext.js";
@@ -60,97 +61,137 @@ export async function runStageWorker(input) {
         .filter((e) => e[1] !== undefined));
     const mode = input.mode ?? "run";
     const attempt = input.attempt ?? 1;
-    loadNamedSecretsFromAttemptDir(attemptWorkspaceDir(workspaceDir, input.stageId, attempt));
+    const attemptDir = attemptWorkspaceDir(workspaceDir, input.stageId, attempt);
+    loadNamedSecretsFromAttemptDir(attemptDir);
     const attemptCtx = input.attempt !== undefined ? attemptContext(input.attempt) : undefined;
     const eventOptions = { attempt };
-    const roots = withResolvedAuthPath(rootsForStageWorker(workspaceDir, input.stageId, stage.model, checkoutRoot, attemptCtx), input.rootDir);
+    let roots = withResolvedAuthPath(rootsForStageWorker(workspaceDir, input.stageId, stage.model, checkoutRoot, attemptCtx), input.rootDir);
     const unbindAgentDir = bindPiAgentDirEnv(roots.agentDir);
+    const sandbox = await openStageSandbox({
+        env: process.env,
+        roots,
+        runId: input.runId,
+        stageId: input.stageId,
+        attempt,
+        attemptDir,
+        ...(checkoutRoot !== undefined ? { checkoutRoot } : {}),
+    });
+    roots = sandbox.roots;
+    const beforeVerify = sandbox.beforeVerify;
+    let outcome;
+    let thrown;
     try {
-        if (mode === "resume") {
-            const opened = await openStageAttempt({
-                agent,
-                store,
-                runId: input.runId,
-                stage,
-                stageId: input.stageId,
-                task,
-                dag,
-                checkoutRoot,
-                workspaceDir,
-                factoryCwd: input.rootDir,
-                attemptCtx,
-                operatorCatalog: input.operatorCatalog,
-                roots,
-                resumeToken: input.sessionFilePath,
-                sessionMode: "waiting_resume",
-                stageEnv,
-                onActivity: (event) => {
-                    void store.appendStageEvent(input.runId, input.stageId, event, eventOptions);
-                },
-            });
-            if (!opened.ok) {
-                return { ok: false, reason: opened.reason };
+        outcome = await (async () => {
+            if (sandbox.failure !== undefined) {
+                return { ok: false, reason: sandbox.failure };
             }
-            opened.handle.deliverAnswer(input.resumeAnswer);
-            const outcome = await runStage({
-                agent,
-                store,
-                runId: input.runId,
-                stage,
-                stageId: input.stageId,
-                task,
-                dag,
-                checkoutRoot,
-                workspaceDir,
-                skipStarted: true,
-                existingHandle: opened.handle,
-                workerMode: true,
-                roots,
-                attemptCtx,
-                factoryCwd: input.rootDir,
-                operatorCatalog: input.operatorCatalog,
-                skipGates: input.skipGates,
-                stageEnv,
-            });
-            return outcome;
-        }
-        if (mode === "feedback_resume" || mode === "new_session") {
-            const feedbackLoopContext = await loadActiveFeedbackLoopContext(store, input.runId, input.stageId);
-            if (mode === "feedback_resume" && feedbackLoopContext === undefined) {
-                return {
-                    ok: false,
-                    reason: "feedback_resume requires an active feedback-loop context",
-                };
+            if (mode === "resume") {
+                const opened = await openStageAttempt({
+                    agent,
+                    store,
+                    runId: input.runId,
+                    stage,
+                    stageId: input.stageId,
+                    task,
+                    dag,
+                    checkoutRoot,
+                    workspaceDir,
+                    factoryCwd: input.rootDir,
+                    attemptCtx,
+                    operatorCatalog: input.operatorCatalog,
+                    roots,
+                    resumeToken: input.sessionFilePath,
+                    sessionMode: "waiting_resume",
+                    stageEnv,
+                    onActivity: (event) => {
+                        void store.appendStageEvent(input.runId, input.stageId, event, eventOptions);
+                    },
+                });
+                if (!opened.ok) {
+                    return { ok: false, reason: opened.reason };
+                }
+                opened.handle.deliverAnswer(input.resumeAnswer);
+                const outcome = await runStage({
+                    agent,
+                    store,
+                    runId: input.runId,
+                    stage,
+                    stageId: input.stageId,
+                    task,
+                    dag,
+                    checkoutRoot,
+                    workspaceDir,
+                    skipStarted: true,
+                    existingHandle: opened.handle,
+                    workerMode: true,
+                    roots,
+                    attemptCtx,
+                    factoryCwd: input.rootDir,
+                    operatorCatalog: input.operatorCatalog,
+                    skipGates: input.skipGates,
+                    stageEnv,
+                    beforeVerify,
+                });
+                return outcome;
             }
-            const priorAttempt = feedbackLoopContext?.prior_stage_attempt;
-            const resumeToken = input.sessionFilePath ??
-                (mode === "feedback_resume" && priorAttempt !== undefined
-                    ? attemptContext(priorAttempt).sessionPath(workspaceDir, input.stageId)
-                    : undefined);
-            const opened = await openStageAttempt({
-                agent,
-                store,
-                runId: input.runId,
-                stage,
-                stageId: input.stageId,
-                task,
-                dag,
-                checkoutRoot,
-                workspaceDir,
-                factoryCwd: input.rootDir,
-                attemptCtx,
-                operatorCatalog: input.operatorCatalog,
-                roots,
-                ...(resumeToken !== undefined ? { resumeToken } : {}),
-                sessionMode: mode,
-                ...(feedbackLoopContext !== undefined ? { feedbackLoopContext } : {}),
-                stageEnv,
-                onActivity: (event) => {
-                    void store.appendStageEvent(input.runId, input.stageId, event, eventOptions);
-                },
-            });
-            if (!opened.ok) {
-                return { ok: false, reason: opened.reason };
+            if (mode === "feedback_resume" || mode === "new_session") {
+                const feedbackLoopContext = await loadActiveFeedbackLoopContext(store, input.runId, input.stageId);
+                if (mode === "feedback_resume" && feedbackLoopContext === undefined) {
+                    return {
+                        ok: false,
+                        reason: "feedback_resume requires an active feedback-loop context",
+                    };
+                }
+                const priorAttempt = feedbackLoopContext?.prior_stage_attempt;
+                const resumeToken = input.sessionFilePath ??
+                    (mode === "feedback_resume" && priorAttempt !== undefined
+                        ? attemptContext(priorAttempt).sessionPath(workspaceDir, input.stageId)
+                        : undefined);
+                const opened = await openStageAttempt({
+                    agent,
+                    store,
+                    runId: input.runId,
+                    stage,
+                    stageId: input.stageId,
+                    task,
+                    dag,
+                    checkoutRoot,
+                    workspaceDir,
+                    factoryCwd: input.rootDir,
+                    attemptCtx,
+                    operatorCatalog: input.operatorCatalog,
+                    roots,
+                    ...(resumeToken !== undefined ? { resumeToken } : {}),
+                    sessionMode: mode,
+                    ...(feedbackLoopContext !== undefined ? { feedbackLoopContext } : {}),
+                    stageEnv,
+                    onActivity: (event) => {
+                        void store.appendStageEvent(input.runId, input.stageId, event, eventOptions);
+                    },
+                });
+                if (!opened.ok) {
+                    return { ok: false, reason: opened.reason };
+                }
+                return runStage({
+                    agent,
+                    store,
+                    runId: input.runId,
+                    stage,
+                    stageId: input.stageId,
+                    task,
+                    dag,
+                    checkoutRoot,
+                    workspaceDir,
+                    existingHandle: opened.handle,
+                    workerMode: true,
+                    roots,
+                    attemptCtx,
+                    factoryCwd: input.rootDir,
+                    operatorCatalog: input.operatorCatalog,
+                    skipGates: input.skipGates,
+                    stageEnv,
+                    beforeVerify,
+                });
             }
             return runStage({
                 agent,
@@ -162,7 +203,6 @@ export async function runStageWorker(input) {
                 dag,
                 checkoutRoot,
                 workspaceDir,
-                existingHandle: opened.handle,
                 workerMode: true,
                 roots,
                 attemptCtx,
@@ -170,30 +210,23 @@ export async function runStageWorker(input) {
                 operatorCatalog: input.operatorCatalog,
                 skipGates: input.skipGates,
                 stageEnv,
+                beforeVerify,
             });
-        }
-        return runStage({
-            agent,
-            store,
-            runId: input.runId,
-            stage,
-            stageId: input.stageId,
-            task,
-            dag,
-            checkoutRoot,
-            workspaceDir,
-            workerMode: true,
-            roots,
-            attemptCtx,
-            factoryCwd: input.rootDir,
-            operatorCatalog: input.operatorCatalog,
-            skipGates: input.skipGates,
-            stageEnv,
-        });
+        })();
+    }
+    catch (err) {
+        thrown = err;
     }
     finally {
         unbindAgentDir();
+        await sandbox.close();
+    }
+    if (thrown !== undefined)
+        throw thrown;
+    if (outcome === undefined) {
+        throw new Error("stage worker finished without an outcome");
     }
+    return outcome;
 }
 export function sendWorkerResult(result) {
     if (typeof process.send !== "function") {

package/dist/runtime/workspaceBinding.d.ts

@@ -1,4 +1,5 @@
 import { type LoadOutcome } from "../config/loadOutcome.js";
+import type { CheckoutDescriptor } from "../types/task.js";
 export type WorkspaceBinding = {
     kind: "repository";
     repository: string;
@@ -12,7 +13,7 @@ export type WorkspaceBinding = {
 export type WorkspaceBindingInput = {
     repository?: string;
     ref?: string;
-    checkout?: string;
+    checkout?: CheckoutDescriptor;
 };
 export type ResolveWorkspaceBindingOptions = {
     checkoutOverride?: string;

package/dist/runtime/workspaceBinding.js

@@ -9,12 +9,25 @@ function nonEmptyTrimmed(value) {
 function isGithubOwnerRepo(repository) {
     return OWNER_REPO_RE.test(repository);
 }
+function resolveCheckoutBinding(checkout, checkoutOverride) {
+    const override = nonEmptyTrimmed(checkoutOverride);
+    if (override !== undefined)
+        return override;
+    if (checkout === undefined)
+        return undefined;
+    if (typeof checkout === "string")
+        return nonEmptyTrimmed(checkout);
+    if (typeof checkout === "object" && checkout !== null && !Array.isArray(checkout)) {
+        return checkout;
+    }
+    return undefined;
+}
 export function resolveWorkspaceBinding(task, options) {
     const repository = nonEmptyTrimmed(task.repository);
     const ref = nonEmptyTrimmed(task.ref);
-    const checkoutPath = nonEmptyTrimmed(options?.checkoutOverride ?? task.checkout);
+    const checkoutBinding = resolveCheckoutBinding(task.checkout, options?.checkoutOverride);
     const hasRepositoryField = repository !== undefined;
-    if (hasRepositoryField && checkoutPath !== undefined) {
+    if (hasRepositoryField && checkoutBinding !== undefined) {
         return loadFailure([
             {
                 code: "task.binding_conflict",
@@ -53,8 +66,11 @@ export function resolveWorkspaceBinding(task, options) {
         }
         return loadSuccess({ kind: "repository", repository, ref });
     }
-    if (checkoutPath !== undefined) {
-        return loadSuccess({ kind: "checkout", path: checkoutPath });
+    if (typeof checkoutBinding === "string") {
+        return loadSuccess({ kind: "checkout", path: checkoutBinding });
+    }
+    if (typeof checkoutBinding === "object") {
+        return loadSuccess({ kind: "checkout", path: "" });
     }
     return loadSuccess({ kind: "unbound" });
 }

package/dist/server/agentAuthorRoutes.d.ts

@@ -0,0 +1,5 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { OperatorAgentHost } from "../operatorAgent/index.js";
+type Json = (res: ServerResponse, status: number, body: unknown) => void;
+export declare function handleAgentAuthorRoutes(req: IncomingMessage, method: string, pathname: string, projectRoot: string, host: OperatorAgentHost, res: ServerResponse, json: Json): Promise<boolean>;
+export {};

package/dist/server/agentAuthorRoutes.js

@@ -0,0 +1,64 @@
+import { parseAgentAuthorDraft, runAgentAuthorTurn, undoAgentAuthorTurn } from "../agents/authorChat.js";
+async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        size += buffer.length;
+        if (size > 65536)
+            return { __tooLarge: true };
+        chunks.push(buffer);
+    }
+    if (chunks.length === 0)
+        return {};
+    try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+            ? parsed
+            : { __invalid: true };
+    }
+    catch {
+        return { __invalid: true };
+    }
+}
+export async function handleAgentAuthorRoutes(req, method, pathname, projectRoot, host, res, json) {
+    const chat = pathname === "/api/agent-author/chat";
+    const undo = pathname === "/api/agent-author/undo";
+    if (!chat && !undo)
+        return false;
+    if (method !== "POST") {
+        json(res, 405, { code: "agent.invalid" });
+        return true;
+    }
+    const body = await readBody(req);
+    if (body.__tooLarge || body.__invalid) {
+        json(res, 400, { code: "agent.invalid" });
+        return true;
+    }
+    try {
+        if (undo) {
+            const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
+            if (!sessionId) {
+                json(res, 400, { code: "agent.invalid" });
+                return true;
+            }
+            json(res, 200, { draft: undoAgentAuthorTurn(sessionId) });
+            return true;
+        }
+        const message = typeof body.message === "string" ? body.message : "";
+        const result = await runAgentAuthorTurn({
+            host,
+            projectRoot,
+            message,
+            ...(typeof body.sessionId === "string" ? { sessionId: body.sessionId } : {}),
+            draft: parseAgentAuthorDraft(body.draft),
+        });
+        json(res, 200, result);
+    }
+    catch (err) {
+        const code = err instanceof Error ? err.message : "agent.internal";
+        const status = code === "agent.session_not_found" ? 404 : code === "agent.conflict" ? 409 : 400;
+        json(res, status, { code: code.startsWith("agent.") ? code : "agent.internal" });
+    }
+    return true;
+}

package/dist/server/agentRoutes.d.ts

@@ -0,0 +1,5 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { AgentHostContext } from "../agents/hostContext.js";
+type Json = (res: ServerResponse, status: number, body: unknown) => void;
+export declare function handleAgentRoutes(req: IncomingMessage, method: string, pathname: string, host: AgentHostContext, projectRoot: string, res: ServerResponse, json: Json): Promise<boolean>;
+export {};