stageflow 0.42.0 → 0.46.0

package/dist/config/githubTriggerAction.js

@@ -0,0 +1,29 @@
+export const GITHUB_TRIGGER_ACTIONS = [
+    "opened",
+    "synchronize",
+    "updated",
+    "merged",
+    "closed",
+];
+const ACTION_SET = new Set(GITHUB_TRIGGER_ACTIONS);
+export function isGithubTriggerAction(value) {
+    return typeof value === "string" && ACTION_SET.has(value);
+}
+/**
+ * For `event.source` values starting with `github.`, `match.action` must be set
+ * to one of the five PR poll actions. Returns an error message or undefined.
+ */
+export function githubMatchActionError(source, match) {
+    if (!source.startsWith("github."))
+        return undefined;
+    const action = match?.action;
+    if (action === undefined) {
+        return ("event.match.action is required for github.* sources " +
+            `(one of: ${GITHUB_TRIGGER_ACTIONS.join(", ")})`);
+    }
+    if (!isGithubTriggerAction(action)) {
+        return (`event.match.action must be one of: ${GITHUB_TRIGGER_ACTIONS.join(", ")} ` +
+            `(got ${JSON.stringify(action)})`);
+    }
+    return undefined;
+}

package/dist/config/hostConfig.js

@@ -28,6 +28,7 @@ export const KNOWN_STAGEFLOW_ENV_KEYS = new Set([
     "STAGEFLOW_READ_TOKEN_FILE",
     "STAGEFLOW_ALLOW_UNKNOWN_CONFIG",
     "STAGEFLOW_EVALS_KEEP_WORKDIR",
+    "STAGEFLOW_SHOW_INTERNAL_AGENTS",
     "STAGEFLOW_MAX_CONCURRENT_RUNS",
     "STAGEFLOW_MAX_CONCURRENT_RUNS_PER_PROJECT",
     "STAGEFLOW_MAX_QUEUED",
@@ -59,6 +60,7 @@ export const KNOWN_STAGEFLOW_ENV_KEYS = new Set([
     "STAGEFLOW_STAGE_EXECUTION",
     "STAGEFLOW_STAGE_CONTAINER_IMAGE",
     "STAGEFLOW_STAGE_CONTAINER_DOCKER_BIN",
+    "STAGEFLOW_STAGE_READONLY_DIR",
     "STAGEFLOW_STAGE_ENV_ALLOW",
     "STAGEFLOW_STAGE_ENV_PASSTHROUGH",
     "STAGEFLOW_GC_INTERVAL_MS",

package/dist/config/loadEval.d.ts

@@ -1,4 +1,4 @@
-import type { EvalConversation, EvalFile, ResolvedConversation, ResolvedGrader } from "../evals/types.js";
+import type { EvalConversation, JudgeSettings, EvalFile, ResolvedConversation, ResolvedGrader } from "../evals/types.js";
 import { type LoadOutcome } from "./loadOutcome.js";
 type UnhashedGrader = ResolvedGrader extends infer G ? (G extends unknown ? Omit<G, "hash"> : never) : never;
 export type LoadedEval = {
@@ -25,6 +25,8 @@ export type EvalPaths = {
 };
 /** Paths in an eval file resolve against the eval file's directory (P6). */
 export declare function resolveEvalPaths(file: EvalFile, evalAbsPath: string): EvalPaths;
+/** Grader settings over the eval defaults, key by key; undefined when neither sets anything. */
+export declare function mergeJudgeSettings(base: JudgeSettings | undefined, over: JudgeSettings | undefined): JudgeSettings | undefined;
 export declare function graderHash(grader: UnhashedGrader): string;
 export declare function graderHashShort(grader: Pick<ResolvedGrader, "hash">): string;
 export declare function parseEvalOutcome(yamlText: string, filePath: string, projectRoot: string): LoadOutcome<LoadedEval>;

package/dist/config/loadEval.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { AGENT_ID_PATTERN, isReservedAgentId } from "../agents/agentId.js";
 import { canonicalJson, hash6, sha256Hex } from "../evals/canonical.js";
+import { EVAL_LIMITS } from "../evals/constants.js";
 import { loadFailure, loadSuccess } from "./loadOutcome.js";
 import { yamlParsePosition } from "./yamlParsePosition.js";
 export const EVAL_DEFAULT_REPEATS = 3;
@@ -74,6 +75,7 @@ const TOP_KEYS = [
 ];
 const TARGET_KEYS = ["kind", "pipeline", "stage", "file"];
 const AGENT_TARGET_KEYS = ["kind", "agent"];
+const INTERNAL_AGENT_TARGET_KEYS = ["kind", "profile"];
 const CONVERSATION_KEYS = [
     "mode",
     "max_turns",
@@ -88,6 +90,7 @@ const TASK_KEYS = ["goal", "context", "constraints"];
 const DEFAULTS_KEYS = [
     "repeats",
     "judge",
+    "judge_settings",
     "pass_threshold",
     "max_cost_usd",
     "concurrency",
@@ -100,11 +103,11 @@ const GRADER_TYPE_KEYS = {
     schema: [],
     field: ["checks"],
     reference: ["mode", "path", "expected", "pass_at"],
-    rubric: ["rubric", "scale", "pass_at", "judge", "examples"],
+    rubric: ["rubric", "scale", "pass_at", "judge", "judge_settings", "examples"],
     code: ["code"],
     tool_calls: ["must_call", "must_not_call", "must_ask_first", "max_calls", "args"],
     conversation_check: ["max_turns", "max_agent_questions_per_turn", "final_reply"],
-    goal_reached: ["judge", "guidance"],
+    goal_reached: ["judge", "judge_settings", "guidance"],
 };
 const TOOL_ARG_KEYS = ["tool", "path", "op", "value"];
 const FINAL_REPLY_KEYS = ["op", "value"];
@@ -188,13 +191,15 @@ function parseTarget(c, raw) {
         return undefined;
     }
     if (raw.kind === undefined) {
-        c.add("eval.invalid_field", `target "kind" is required ("stage" or "agent")`);
+        c.add("eval.invalid_field", `target "kind" is required ("stage", "agent" or "internal_agent")`);
         return undefined;
     }
     if (raw.kind === "agent")
         return parseAgentTarget(c, raw);
+    if (raw.kind === "internal_agent")
+        return parseInternalAgentTarget(c, raw);
     if (raw.kind !== "stage") {
-        c.add("eval.target_kind_unsupported", `target kind ${JSON.stringify(raw.kind)} is not supported (only "stage" and "agent")`);
+        c.add("eval.target_kind_unsupported", `target kind ${JSON.stringify(raw.kind)} is not supported (only "stage", "agent" and "internal_agent")`);
         return undefined;
     }
     if (raw.agent !== undefined) {
@@ -251,6 +256,21 @@ function parseAgentTarget(c, raw) {
     }
     return { kind: "agent", agent };
 }
+function parseInternalAgentTarget(c, raw) {
+    for (const key of ["agent", "pipeline", "stage", "file"]) {
+        if (raw[key] !== undefined) {
+            c.add("eval.target_invalid", `target "${key}" is not valid with kind: internal_agent; use "profile"`);
+            return undefined;
+        }
+    }
+    c.unknownKeys(raw, INTERNAL_AGENT_TARGET_KEYS, "target");
+    const profile = raw.profile;
+    if (typeof profile !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(profile)) {
+        c.add("eval.target_invalid", `target "profile" must be an internal agent id such as stageflow-guide`);
+        return undefined;
+    }
+    return { kind: "internal_agent", profile };
+}
 function parseTask(c, raw) {
     if (raw === undefined)
         return undefined;
@@ -267,6 +287,51 @@ function parseTask(c, raw) {
     }
     return out;
 }
+const JUDGE_SETTINGS_KEYS = ["temperature", "reasoning", "votes"];
+/** A mapping of judge call settings, or undefined when absent or invalid (findings added). */
+function parseJudgeSettings(c, raw, label) {
+    if (raw === undefined)
+        return undefined;
+    if (!isPlainObject(raw)) {
+        c.add("eval.invalid_field", `${label} "judge_settings" must be a mapping`);
+        return undefined;
+    }
+    c.unknownKeys(raw, JUDGE_SETTINGS_KEYS, `${label} judge_settings`);
+    const out = {};
+    let ok = true;
+    if (raw.temperature !== undefined) {
+        if (typeof raw.temperature === "number" && raw.temperature >= 0 && raw.temperature <= 1) {
+            out.temperature = raw.temperature;
+        }
+        else {
+            c.add("eval.invalid_field", `${label} judge_settings "temperature" must be a number from 0 to 1`);
+            ok = false;
+        }
+    }
+    if (raw.reasoning !== undefined) {
+        if (typeof raw.reasoning === "boolean")
+            out.reasoning = raw.reasoning;
+        else {
+            c.add("eval.invalid_field", `${label} judge_settings "reasoning" must be true or false`);
+            ok = false;
+        }
+    }
+    if (raw.votes !== undefined) {
+        if (typeof raw.votes === "number" && Number.isInteger(raw.votes) && raw.votes >= 1 && raw.votes <= 5 && raw.votes % 2 === 1) {
+            out.votes = raw.votes;
+        }
+        else {
+            c.add("eval.invalid_field", `${label} judge_settings "votes" must be 1, 3 or 5`);
+            ok = false;
+        }
+    }
+    return ok ? out : undefined;
+}
+/** Grader settings over the eval defaults, key by key; undefined when neither sets anything. */
+export function mergeJudgeSettings(base, over) {
+    const merged = { ...(base ?? {}), ...(over ?? {}) };
+    return Object.keys(merged).length === 0 ? undefined : merged;
+}
 function parseDefaults(c, raw, kind) {
     if (raw === undefined)
         return undefined;
@@ -282,6 +347,9 @@ function parseDefaults(c, raw, kind) {
     const judge = optionalString(c, raw, "judge", "defaults", { min: 1 });
     if (judge !== undefined)
         out.judge = judge;
+    const judgeSettings = parseJudgeSettings(c, raw.judge_settings, "defaults");
+    if (judgeSettings !== undefined)
+        out.judge_settings = judgeSettings;
     const passThreshold = optionalNumber(c, raw, "pass_threshold", "defaults", "a number greater than 0 and at most 1", (n) => n > 0 && n <= 1);
     if (passThreshold !== undefined)
         out.pass_threshold = passThreshold;
@@ -465,8 +533,8 @@ function parseChecks(c, raw, where) {
     return ok ? checks : undefined;
 }
 function parseExamples(c, raw, scale, where) {
-    if (!Array.isArray(raw) || raw.length > 6) {
-        c.add("eval.grader_invalid", `${where} "examples" must be an array of at most 6 items`);
+    if (!Array.isArray(raw) || raw.length > EVAL_LIMITS.rubricExamplesMax) {
+        c.add("eval.grader_invalid", `${where} "examples" must be an array of at most ${EVAL_LIMITS.rubricExamplesMax} items`);
         return undefined;
     }
     const out = [];
@@ -592,7 +660,7 @@ function parseFinalReply(c, raw, where) {
     });
     return ok ? out : undefined;
 }
-function parseGrader(c, raw, index, defaultJudge, kind) {
+function parseGrader(c, raw, index, defaultJudge, kind, defaultJudgeSettings) {
     if (!isPlainObject(raw)) {
         c.add("eval.grader_invalid", `graders[${index}] must be a mapping`);
         return undefined;
@@ -669,7 +737,7 @@ function parseGrader(c, raw, index, defaultJudge, kind) {
                 c.add("eval.grader_invalid", `${label} "mode" must be "each_mentioned" or "equals"`);
                 ok = false;
             }
-            let pathValue = kind === "agent" ? "final_reply" : "payload";
+            let pathValue = kind === "agent" || kind === "internal_agent" ? "final_reply" : "payload";
             if (raw.path !== undefined) {
                 if (typeof raw.path === "string" && FIELD_PATH_PATTERN.test(raw.path))
                     pathValue = raw.path;
@@ -751,6 +819,10 @@ function parseGrader(c, raw, index, defaultJudge, kind) {
                 if (examples === undefined)
                     ok = false;
             }
+            const ownSettings = parseJudgeSettings(c, raw.judge_settings, label);
+            if (raw.judge_settings !== undefined && ownSettings === undefined)
+                ok = false;
+            const judgeSettings = mergeJudgeSettings(defaultJudgeSettings, ownSettings);
             if (ok) {
                 result = {
                     config: {
@@ -760,6 +832,7 @@ function parseGrader(c, raw, index, defaultJudge, kind) {
                         ...(raw.scale !== undefined ? { scale } : {}),
                         ...(passAt !== undefined ? { pass_at: passAt } : {}),
                         ...(judge !== undefined ? { judge } : {}),
+                        ...(ownSettings !== undefined ? { judge_settings: ownSettings } : {}),
                         ...(examples !== undefined ? { examples } : {}),
                     },
                     resolved: {
@@ -769,6 +842,7 @@ function parseGrader(c, raw, index, defaultJudge, kind) {
                         scale,
                         passAt: scale === "1_to_5" ? (passAt ?? 4) : 1,
                         judge: judge ?? defaultJudge ?? "",
+                        ...(judgeSettings !== undefined ? { judgeSettings } : {}),
                         examples: examples ?? [],
                     },
                 };
@@ -864,18 +938,24 @@ function parseGrader(c, raw, index, defaultJudge, kind) {
                     ok = false;
                 }
             }
+            const goalSettings = parseJudgeSettings(c, raw.judge_settings, label);
+            if (raw.judge_settings !== undefined && goalSettings === undefined)
+                ok = false;
+            const goalMerged = mergeJudgeSettings(defaultJudgeSettings, goalSettings);
             if (ok) {
                 result = {
                     config: {
                         ...common,
                         type: "goal_reached",
                         ...(judge !== undefined ? { judge } : {}),
+                        ...(goalSettings !== undefined ? { judge_settings: goalSettings } : {}),
                         ...(guidance !== undefined ? { guidance } : {}),
                     },
                     resolved: {
                         ...resolvedCommon,
                         type: "goal_reached",
                         judge: judge ?? defaultJudge ?? "",
+                        ...(goalMerged !== undefined ? { judgeSettings: goalMerged } : {}),
                         ...(guidance !== undefined ? { guidance } : {}),
                     },
                 };
@@ -914,6 +994,7 @@ function graderHashObject(grader) {
                 scale: grader.scale,
                 ...(grader.scale === "1_to_5" ? { pass_at: grader.passAt } : {}),
                 judge: grader.judge,
+                ...(grader.judgeSettings !== undefined ? { judge_settings: grader.judgeSettings } : {}),
                 examples: grader.examples,
             };
         case "code":
@@ -935,7 +1016,12 @@ function graderHashObject(grader) {
                 final_reply: grader.finalReply,
             };
         case "goal_reached":
-            return { ...base, judge: grader.judge, guidance: grader.guidance };
+            return {
+                ...base,
+                judge: grader.judge,
+                ...(grader.judgeSettings !== undefined ? { judge_settings: grader.judgeSettings } : {}),
+                guidance: grader.guidance,
+            };
     }
 }
 export function graderHash(grader) {
@@ -1029,7 +1115,7 @@ export function parseEvalOutcome(yamlText, filePath, projectRoot) {
     else {
         const seen = new Set();
         raw.graders.forEach((rawGrader, index) => {
-            const parsed = parseGrader(c, rawGrader, index, defaults?.judge, target?.kind);
+            const parsed = parseGrader(c, rawGrader, index, defaults?.judge, target?.kind, defaults?.judge_settings);
             if (isPlainObject(rawGrader) && typeof rawGrader.id === "string") {
                 if (seen.has(rawGrader.id)) {
                     c.add("eval.grader_duplicate_id", `Duplicate grader id "${rawGrader.id}"`);

package/dist/config/pipelineNeeds.d.ts

@@ -1,6 +1,8 @@
 import type { NeedTerminalState, PipelineNeedEdge, PipelineNeedItem, PipelineNeeds, PipelineRoute, PipelineRouteForwardEntry, ResolvedPipelineStageNode } from "../types/pipeline.js";
 export declare const NEED_TERMINAL_STATES: readonly NeedTerminalState[];
 export declare function isNeedTerminalState(value: unknown): value is NeedTerminalState;
+/** Map known aliases; return undefined if not a terminal state or known alias. */
+export declare function canonicalizeNeedTerminalState(value: unknown): NeedTerminalState | undefined;
 export declare function parsePipelineNeeds(raw: unknown, stageId: string): {
     ok: true;
     value: PipelineNeeds;

package/dist/config/pipelineNeeds.js

@@ -5,9 +5,21 @@ export const NEED_TERMINAL_STATES = [
     "skipped",
 ];
 const NEED_TERMINAL_STATE_SET = new Set(NEED_TERMINAL_STATES);
+const NEED_TERMINAL_ALIASES = {
+    success: "succeeded",
+    failure: "failed",
+};
 export function isNeedTerminalState(value) {
     return typeof value === "string" && NEED_TERMINAL_STATE_SET.has(value);
 }
+/** Map known aliases; return undefined if not a terminal state or known alias. */
+export function canonicalizeNeedTerminalState(value) {
+    if (typeof value !== "string")
+        return undefined;
+    if (isNeedTerminalState(value))
+        return value;
+    return NEED_TERMINAL_ALIASES[value];
+}
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -21,14 +33,15 @@ function parseNeedOn(raw, stageId, parentId) {
     const seen = new Set();
     const on = [];
     for (const item of raw) {
-        if (typeof item !== "string" || !NEED_TERMINAL_STATE_SET.has(item) || seen.has(item)) {
+        const canonical = canonicalizeNeedTerminalState(item);
+        if (canonical === undefined || seen.has(canonical)) {
             return {
                 ok: false,
                 message: `stage "${stageId}": needs "${parentId}": on must be a non-empty unique subset of succeeded, failed, skipped`,
             };
         }
-        seen.add(item);
-        on.push(item);
+        seen.add(canonical);
+        on.push(canonical);
     }
     return { ok: true, value: on };
 }

package/dist/config/pipelineRoute.js

@@ -1,4 +1,4 @@
-import { isNeedTerminalState } from "./pipelineNeeds.js";
+import { canonicalizeNeedTerminalState } from "./pipelineNeeds.js";
 import { parseRouteIf } from "./routeIf.js";
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -81,14 +81,15 @@ function parseRouteOn(raw, stageId, targetId) {
     const seen = new Set();
     const on = [];
     for (const item of items) {
-        if (typeof item !== "string" || !isNeedTerminalState(item) || seen.has(item)) {
+        const canonical = canonicalizeNeedTerminalState(item);
+        if (canonical === undefined || seen.has(canonical)) {
             return {
                 ok: false,
                 message: `stage "${stageId}": route "${targetId}": on must be a non-empty unique subset of succeeded, failed, skipped`,
             };
         }
-        seen.add(item);
-        on.push(item);
+        seen.add(canonical);
+        on.push(canonical);
     }
     return { ok: true, value: on };
 }

package/dist/config/validateCatalog.d.ts

@@ -4,7 +4,7 @@ import type { LoadIssue } from "./loadOutcome.js";
 import type { AnyChannelProvider } from "../channels/types.js";
 export type ValidationSeverity = "error" | "warning";
 export type ValidationCategory = "pipeline" | "stage" | "catalog" | "task" | "trigger" | "eval" | "dataset";
-export type ValidationFindingCode = "pipeline.invalid_shape" | "pipeline.dag_error" | "pipeline.missing_stage" | "pipeline.load_error" | "pipeline.string_stage_ref" | "pipeline.stage_uses_inline_conflict" | "pipeline.stage_missing_body" | "pipeline.stage_id_mismatch" | "pipeline.stage_wrapper_skill_rejected" | "pipeline.invalid_completion" | "catalog.path_case_mismatch" | "pipeline.invalid_recovery" | "pipeline.include_cycle" | "pipeline.include_invalid" | "pipeline.include_duplicate_stage" | "pipeline.invalid_agent" | "pipeline.invalid_model" | "pipeline.invalid_verify" | "pipeline.io_incompatible" | "pipeline.model_applies" | "pipeline.route_if_invalid" | "pipeline.route_all_gated" | "pipeline.invalid_requires" | "pipeline.requires_conflict" | "pipeline.invalid_channels" | "pipeline.invalid_memories" | "pipeline.memory_unavailable" | "stage.invalid_shape" | "stage.invalid_model" | "stage.missing_model" | "stage.invalid_payload_schema" | "stage.invalid_clone_input_schema" | "stage.unresolved_schema_ref" | "stage.invalid_clone_actions" | "stage.invalid_gate_kinds" | "stage.invalid_pre_emit_checks" | "stage.invalid_timeout_ms" | "stage.invalid_skill" | "stage.invalid_mcp" | "stage.invalid_channels" | "stage.channel_unavailable" | "stage.invalid_browser" | "stage.invalid_secrets" | "stage.unknown_secret" | "stage.denied_secret" | "stage.invalid_requires" | "stage.invalid_agent" | "stage.invalid_io" | "stage.load_error" | "stage.id_filename_mismatch" | "task.invalid_shape" | "task.load_error" | "task.entry_input_unmet" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "trigger.invalid_shape" | "trigger.load_error" | "trigger.unknown_pipeline" | "trigger.unknown_task" | "catalog.duplicate_pipeline_id" | "catalog.manifest_missing" | "catalog.manifest_invalid" | "catalog.empty_catalog" | "catalog.manifest_load_error" | "catalog.invalid_mcp" | "catalog.mcp_command_missing" | "catalog.mixed_yaml_dialect" | "catalog.legacy_yaml" | "catalog.stageflow_home_absolute_path";
+export type ValidationFindingCode = "pipeline.invalid_shape" | "pipeline.dag_error" | "pipeline.missing_stage" | "pipeline.load_error" | "pipeline.string_stage_ref" | "pipeline.stage_uses_inline_conflict" | "pipeline.stage_missing_body" | "pipeline.stage_id_mismatch" | "pipeline.stage_wrapper_skill_rejected" | "pipeline.invalid_completion" | "catalog.path_case_mismatch" | "pipeline.invalid_recovery" | "pipeline.include_cycle" | "pipeline.include_invalid" | "pipeline.include_duplicate_stage" | "pipeline.invalid_agent" | "pipeline.invalid_model" | "pipeline.invalid_verify" | "pipeline.io_incompatible" | "pipeline.model_applies" | "pipeline.route_if_invalid" | "pipeline.route_all_gated" | "pipeline.invalid_requires" | "pipeline.requires_conflict" | "pipeline.invalid_channels" | "pipeline.invalid_memories" | "pipeline.memory_unavailable" | "stage.invalid_shape" | "stage.invalid_model" | "stage.missing_model" | "stage.invalid_payload_schema" | "stage.invalid_clone_input_schema" | "stage.unresolved_schema_ref" | "stage.invalid_clone_actions" | "stage.invalid_gate_kinds" | "stage.invalid_pre_emit_checks" | "stage.invalid_timeout_ms" | "stage.invalid_skill" | "stage.invalid_mcp" | "stage.invalid_channels" | "stage.channel_unavailable" | "stage.invalid_browser" | "stage.invalid_secrets" | "stage.unknown_secret" | "stage.denied_secret" | "stage.invalid_requires" | "stage.invalid_agent" | "stage.invalid_io" | "stage.load_error" | "stage.id_filename_mismatch" | "task.invalid_shape" | "task.load_error" | "task.entry_input_unmet" | "task.binding_conflict" | "task.repository_ref_required" | "task.ref_without_repository" | "task.repository_invalid" | "trigger.invalid_shape" | "trigger.load_error" | "trigger.unknown_pipeline" | "trigger.unknown_task" | "trigger.github_action_required" | "trigger.invalid_github_action" | "catalog.duplicate_pipeline_id" | "catalog.manifest_missing" | "catalog.manifest_invalid" | "catalog.empty_catalog" | "catalog.manifest_load_error" | "catalog.invalid_mcp" | "catalog.mcp_command_missing" | "catalog.mixed_yaml_dialect" | "catalog.legacy_yaml" | "catalog.stageflow_home_absolute_path";
 export type ValidationFinding = {
     severity: ValidationSeverity;
     code: ValidationFindingCode | string;

package/dist/config/validateCatalog.js

@@ -6,6 +6,7 @@ import { INLINE_PIPELINE_PATH, loadPipelineFromObjectOutcome, loadPipelineOutcom
 import { loadStageOutcome } from "./loadStage.js";
 import { loadTaskOutcome } from "./loadTask.js";
 import { loadTriggerOutcome } from "./loadTrigger.js";
+import { githubMatchActionError, isGithubTriggerAction } from "./githubTriggerAction.js";
 import { loadEvalCatalog } from "./evalCatalog.js";
 import { evalFindingsFromIssues } from "./validateEval.js";
 import { readYamlObject } from "./readYamlObject.js";
@@ -666,6 +667,17 @@ export function findingsForTriggerRefs(cwd, absPath, trigger, refs) {
     if (trigger.task !== undefined && !refs.taskIds.has(trigger.task)) {
         findings.push(findingTriggerError(cwd, absPath, `Trigger "${trigger.id}" references unknown task "${trigger.task}"`, "trigger.unknown_task"));
     }
+    const source = trigger.event?.source;
+    if (typeof source === "string" && source.startsWith("github.")) {
+        const action = trigger.event?.match?.action;
+        if (action === undefined) {
+            findings.push(findingTriggerError(cwd, absPath, `Trigger "${trigger.id}" requires event.match.action for github.* sources`, "trigger.github_action_required"));
+        }
+        else if (!isGithubTriggerAction(action)) {
+            findings.push(findingTriggerError(cwd, absPath, githubMatchActionError(source, trigger.event?.match) ??
+                `Trigger "${trigger.id}" has an invalid event.match.action`, "trigger.invalid_github_action"));
+        }
+    }
     return findings;
 }
 async function validateSingleTask(invocationCwd, taskArg) {

package/dist/config/validateEval.js

@@ -1,6 +1,8 @@
+import { internalAgentsVisible } from "../operatorAgent/internalAgents.js";
+import { PROFILE_GRANTS } from "../toolkit/profiles.js";
 import { realpath, stat } from "node:fs/promises";
 import path from "node:path";
-import { mapJudge } from "../evals/judgeProviders.js";
+import { isFloatingModelId, mapJudge } from "../evals/judgeProviders.js";
 import { classifyTool } from "../agents/toolRisk.js";
 import { checkDatasetAgainstAgent } from "./datasetAgentCheck.js";
 import { checkDatasetAgainstStage } from "./datasetStageCheck.js";
@@ -69,16 +71,20 @@ export async function validateEval(loaded, ctx) {
     }
     const targetKind = file.target.kind;
     for (const grader of loaded.graders) {
-        const wrongKind = targetKind === "agent"
+        const conversationTarget = targetKind === "agent" || targetKind === "internal_agent";
+        const wrongKind = conversationTarget
             ? grader.type === "schema"
             : CONVERSATION_GRADER_TYPES.includes(grader.type);
         if (wrongKind) {
-            add("error", "eval.grader_not_applicable", `Grader "${grader.id}" (${grader.type}) cannot grade ${targetKind === "agent" ? "an agent" : "a stage"} target`);
+            add("error", "eval.grader_not_applicable", `Grader "${grader.id}" (${grader.type}) cannot grade ${conversationTarget ? "an agent" : "a stage"} target`);
         }
     }
     if (file.target.kind === "agent") {
         return validateAgentEval(loaded, ctx, findings);
     }
+    if (file.target.kind === "internal_agent") {
+        return validateInternalAgentEval(loaded, findings);
+    }
     const target = await resolveEvalTarget(file, loaded.path, ctx.projectRoot);
     let resolved;
     if (!target.ok) {
@@ -100,6 +106,7 @@ export async function validateEval(loaded, ctx) {
     }
     const stageModel = file.defaults?.model ?? resolved?.modelResolved;
     const unknownChecked = new Set();
+    const unpinnedWarned = new Set();
     for (const grader of loaded.graders) {
         if (grader.type !== "rubric")
             continue;
@@ -116,6 +123,13 @@ export async function validateEval(loaded, ctx) {
         if (stageModel !== undefined && grader.judge === stageModel) {
             add("warning", "eval.judge_same_as_stage", `Rubric grader "${grader.id}" uses judge "${grader.judge}", the same model as the stage (self-preference bias)`);
         }
+        if (isFloatingModelId(grader.judge) && !unpinnedWarned.has(grader.judge)) {
+            unpinnedWarned.add(grader.judge);
+            add("warning", "eval.judge_unpinned", `Judge model "${grader.judge}" is a floating id; its behavior can change under stored runs. Pin a dated version`);
+        }
+        if ((grader.judgeSettings?.votes ?? 1) > 1 && grader.judgeSettings?.temperature === 0) {
+            add("warning", "eval.judge_votes_no_variation", `Grader "${grader.id}" asks for ${grader.judgeSettings?.votes} votes at temperature 0, so every vote is the same call and the cost is multiplied for nothing`);
+        }
     }
     const paths = resolveEvalPaths(file, loaded.path);
     const datasetProblem = ctx.datasetInline
@@ -199,6 +213,41 @@ function hasExpectedTools(c) {
     const record = expected;
     return record.tools !== undefined || record.forbidden_tools !== undefined;
 }
+function validateInternalAgentEval(loaded, findings) {
+    const add = (severity, code, message) => {
+        findings.push(evalFinding(loaded.relPath, severity, code, message));
+    };
+    const profile = loaded.file.target.kind === "internal_agent" ? loaded.file.target.profile : "";
+    if (!internalAgentsVisible()) {
+        add("error", "eval.internal_agent_hidden", "Internal agents are hidden. Set STAGEFLOW_SHOW_INTERNAL_AGENTS=1 on the Host to eval one.");
+    }
+    const grant = PROFILE_GRANTS[profile];
+    if (!grant) {
+        add("error", "eval.internal_agent_unknown", `No internal agent has id "${profile}"`);
+    }
+    const conversation = resolveConversation(loaded.file.conversation);
+    if (conversation.tools === "real") {
+        add("error", "eval.internal_agent_real_tools", "An internal agent eval cannot use real tools. They write the operator's project and do not pass the project-agent tool gate. Use read_only or mocked.");
+    }
+    if (grant) {
+        const names = new Set(grant.tools);
+        for (const grader of loaded.graders) {
+            if (grader.type !== "tool_calls")
+                continue;
+            const mentioned = [
+                ...(grader.mustCall ?? []),
+                ...(grader.mustNotCall ?? []),
+                ...(grader.mustAskFirst ?? []),
+                ...grader.args.map((arg) => arg.tool),
+            ];
+            const missing = [...new Set(mentioned)].filter((name) => !names.has(name));
+            if (missing.length > 0) {
+                add("warning", "eval.tool_not_granted", `Grader "${grader.id}" names tool(s) ${profile} does not have: ${missing.join(", ")}`);
+            }
+        }
+    }
+    return findings;
+}
 async function validateAgentEval(loaded, ctx, findings) {
     const add = (severity, code, message) => {
         findings.push(evalFinding(loaded.relPath, severity, code, message));
@@ -226,6 +275,7 @@ async function validateAgentEval(loaded, ctx, findings) {
     }
     const agentModel = file.defaults?.model ?? resolved?.modelResolved;
     const unknownChecked = new Set();
+    const unpinnedWarned = new Set();
     for (const grader of loaded.graders) {
         if (grader.type !== "rubric" && grader.type !== "goal_reached")
             continue;
@@ -242,6 +292,13 @@ async function validateAgentEval(loaded, ctx, findings) {
         if (agentModel !== undefined && grader.judge === agentModel) {
             add("warning", "eval.judge_same_as_stage", `Grader "${grader.id}" uses judge "${grader.judge}", the same model as the agent (self-preference bias)`);
         }
+        if (isFloatingModelId(grader.judge) && !unpinnedWarned.has(grader.judge)) {
+            unpinnedWarned.add(grader.judge);
+            add("warning", "eval.judge_unpinned", `Judge model "${grader.judge}" is a floating id; its behavior can change under stored runs. Pin a dated version`);
+        }
+        if ((grader.judgeSettings?.votes ?? 1) > 1 && grader.judgeSettings?.temperature === 0) {
+            add("warning", "eval.judge_votes_no_variation", `Grader "${grader.id}" asks for ${grader.judgeSettings?.votes} votes at temperature 0, so every vote is the same call and the cost is multiplied for nothing`);
+        }
     }
     if (resolved) {
         const grantWarn = (names, where) => {

package/dist/config/writeEval.js

@@ -138,7 +138,7 @@ export function renderEvalYaml(definition) {
     return toText(doc);
 }
 function fillCreateDefaults(definition) {
-    if (definition.target?.kind === "agent") {
+    if (definition.target?.kind === "agent" || definition.target?.kind === "internal_agent") {
         const conversation = { ...definition.conversation };
         const d = EVAL_CONVERSATION_DEFAULTS;
         const explicit = {
@@ -315,7 +315,7 @@ export function previewEvalUpdate(currentText, definition) {
     if (isDeepStrictEqual(doc.toJS(), JSON.parse(JSON.stringify(target))))
         return currentText;
     const targetKind = isPlain(target.target) ? target.target.kind : undefined;
-    syncMap(doc, doc.contents, target, [], targetKind === "agent");
+    syncMap(doc, doc.contents, target, [], targetKind === "agent" || targetKind === "internal_agent");
     return toText(doc);
 }
 function relOf(projectRoot, abs) {

package/dist/envelope/assertEmittedArtifacts.d.ts

@@ -0,0 +1,12 @@
+export type ArtifactPresenceContext = {
+    runWorkspaceDir: string;
+    stageId: string;
+    attempt: number;
+};
+/**
+ * When `artifacts` is non-empty and attempt context is provided, each listed
+ * path must resolve to an existing regular file under the current attempt
+ * artifacts directory. Empty `artifacts` is a no-op. Distinct from emit-phase
+ * `artifact_declared` (list-only) and after-phase `type: artifact` verify.
+ */
+export declare function assertEmittedArtifactsOnDisk(artifacts: readonly string[], presence: ArtifactPresenceContext | undefined): Promise<void>;

package/dist/envelope/assertEmittedArtifacts.js

@@ -0,0 +1,43 @@
+import path from "node:path";
+import { acceptArtifactListedPath } from "../runtime/artifactPath.js";
+import { inspectArtifactUnderRoot } from "../runtime/artifactDiskInspect.js";
+import { attemptArtifactsDir } from "../runstore/workspaceLayout.js";
+import { EnvelopeError } from "../types/envelope.js";
+function artifactBasename(listedPath) {
+    return path.posix.basename(listedPath.replace(/\\/g, "/"));
+}
+function missingArtifactMessage(listedPath) {
+    return `artifact "${artifactBasename(listedPath)}" is missing from this attempt's artifacts directory; write it with write_stage_artifact before emit`;
+}
+function notFileArtifactMessage(listedPath, fileType) {
+    return `artifact "${artifactBasename(listedPath)}" is ${fileType}, not a regular file under this attempt's artifacts directory; write it with write_stage_artifact before emit`;
+}
+/**
+ * When `artifacts` is non-empty and attempt context is provided, each listed
+ * path must resolve to an existing regular file under the current attempt
+ * artifacts directory. Empty `artifacts` is a no-op. Distinct from emit-phase
+ * `artifact_declared` (list-only) and after-phase `type: artifact` verify.
+ */
+export async function assertEmittedArtifactsOnDisk(artifacts, presence) {
+    if (artifacts.length === 0 || presence === undefined) {
+        return;
+    }
+    const artifactsDir = attemptArtifactsDir(presence.runWorkspaceDir, presence.stageId, presence.attempt);
+    for (const listed of artifacts) {
+        const accepted = acceptArtifactListedPath(listed, {
+            kind: "current_attempt",
+            stageId: presence.stageId,
+            attempt: presence.attempt,
+        });
+        if (accepted === undefined) {
+            throw new EnvelopeError(missingArtifactMessage(listed));
+        }
+        const disk = await inspectArtifactUnderRoot(artifactsDir, accepted.relative);
+        if (disk.file_type === "missing") {
+            throw new EnvelopeError(missingArtifactMessage(listed));
+        }
+        if (disk.file_type !== "file") {
+            throw new EnvelopeError(notFileArtifactMessage(listed, disk.file_type));
+        }
+    }
+}

package/dist/envelope/preEmitChecks.d.ts

@@ -12,9 +12,12 @@
 import { type QaExchange } from "../hitl/qaTrail.js";
 import { type StageEnvelope } from "../types/envelope.js";
 import type { PreEmitCheck } from "../types/preEmitCheck.js";
+import type { ArtifactPresenceContext } from "./assertEmittedArtifacts.js";
 export type PreEmitCheckOptions = {
     checks?: PreEmitCheck[];
     readQaTrail?: () => QaExchange[] | Promise<QaExchange[]>;
+    /** Host attempt context for emit disk-truth of non-empty `envelope.artifacts`. */
+    artifactPresence?: ArtifactPresenceContext;
 };
 export declare function declaredArtifactIssue(artifacts: readonly string[], check: Extract<PreEmitCheck, {
     type: "artifact_declared";