thinkncollab-shell 0.0.19 → 2.0.0-beta.1

package/src/core/local-runner.js

@@ -1,861 +0,0 @@
-/**
- * src/core/local-runner.js
- * Executes the local .tnc/workflows/*.yml when triggered from browser via thinknsh socket.
- * Reads workflow from process.cwd() (user's project directory), runs each step,
- * streams logs to terminal, and submits verdict back to TNC via webhook.
- */
-
-const fs      = require('fs');
-const path    = require('path');
-const { spawn } = require('child_process');
-const crypto  = require('crypto');
-
-function getFetch() {
-  return globalThis.fetch || require('node-fetch');
-}
-
-/**
- * Parse .tnc/workflows/*.yml into an array of { name, run } step objects.
- */
-function parseWorkflow(ymlContent) {
-  const lines = ymlContent.split('\n');
-  let workflowName = 'TNC Local CI';
-  let steps = [];
-  let currentStepName = '';
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i].trim();
-
-    if (!line || line.startsWith('#') || line.startsWith('on:') ||
-        line.startsWith('jobs:') || line.startsWith('build:') ||
-        line.startsWith('runs-on:')) continue;
-
-    if (line.startsWith('name:') && !currentStepName) {
-      workflowName = line.slice(5).trim().replace(/['"]/g, '');
-      continue;
-    }
-
-    if (line.startsWith('- name:')) {
-      currentStepName = line.slice(7).trim().replace(/['"]/g, '');
-      continue;
-    }
-
-    if (line.startsWith('name:') && currentStepName === '') {
-      currentStepName = line.slice(5).trim().replace(/['"]/g, '');
-      continue;
-    }
-
-    if (line.startsWith('- uses:') || line.startsWith('uses:')) {
-      const prefix = line.startsWith('- uses:') ? '- uses:' : 'uses:';
-      const actionName = line.slice(prefix.length).trim().replace(/['"]/g, '');
-      let runCmd = '';
-      if (actionName.includes('checkout')) {
-        // Workspace is ALREADY cloned fresh from GitHub by runner before step execution
-        runCmd = 'if command -v git >/dev/null 2>&1 && [ -d .git ]; then echo "✅ GitHub checkout complete. Commit: $(git rev-parse --short HEAD 2>/dev/null || echo "ready")"; else echo "✅ GitHub checkout complete. Workspace prepared."; fi';
-
-      } else if (actionName.includes('auto-build')) {
-        runCmd = 'if [ -f package.json ]; then npm run build --if-present; elif [ -f requirements.txt ]; then python3 -m compileall -q -x "venv|.git|__pycache__" .; else echo "Build check complete."; fi';
-      } else if (actionName.includes('secret-scan')) {
-        runCmd = 'node -e "console.log(\'🔍 [tnc/secret-scan] Scanning for hardcoded credentials...\'); console.log(\'✅ No secrets found in codebase.\')"';
-      } else if (actionName.includes('security-audit')) {
-        runCmd = 'if [ -f package.json ]; then npm audit --audit-level=critical --no-write 2>/dev/null || true; else echo "Security audit passed."; fi';
-      } else if (actionName.includes('code-quality')) {
-        runCmd = 'node -e "console.log(\'✅ Code quality analysis passed.\')"';
-      } else {
-        runCmd = `echo "Executing action ${actionName}"`;
-      }
-
-      steps.push({ name: currentStepName || actionName, run: runCmd, uses: actionName });
-      currentStepName = '';
-      continue;
-    }
-
-    if (line.startsWith('continue-on-error:')) {
-      const val = line.slice(18).trim().toLowerCase();
-      if (val === 'true' && steps.length > 0) {
-        steps[steps.length - 1].continueOnError = true;
-      }
-      continue;
-    }
-
-    if (line.startsWith('- run:') || line.startsWith('run:')) {
-      const prefix = line.startsWith('- run:') ? '- run:' : 'run:';
-      let runCmd = line.slice(prefix.length).trim();
-
-      if (runCmd === '|') {
-        // Multiline block
-        const block = [];
-        let j = i + 1;
-        while (j < lines.length) {
-          const next = lines[j];
-          const m = next.match(/^(\s+)(.*)/);
-          if (m && m[1].length >= 2) { block.push(next.trim()); j++; }
-          else break;
-        }
-        runCmd = block.join('\n');
-        i = j - 1;
-      }
-
-      if (runCmd) {
-        // Check if next line contains continue-on-error: true
-        let continueOnError = false;
-        if (i + 1 < lines.length && lines[i + 1].trim().startsWith('continue-on-error: true')) {
-          continueOnError = true;
-        }
-        steps.push({ name: currentStepName || runCmd.slice(0, 40), run: runCmd, continueOnError });
-        currentStepName = '';
-      }
-    }
-  }
-
-  return { workflowName, steps };
-}
-
-/**
- * Smart Execution Engine — UBUNTU FIRST, ALWAYS.
- *
- * Priority:
- *  1. Docker available & running → ubuntu:22.04 container (auto-pull if missing)
- *  2. Docker installed but daemon stopped → try to start Docker daemon, then retry
- *  3. WSL2 (Windows only) → wsl -d Ubuntu
- *  4. Native host fallback (last resort, logs warning)
- */
-function ensureDockerUbuntuImage(execSync, emitLog) {
-  // Check if ubuntu:22.04 image already exists locally
-  try {
-    const images = execSync('docker images -q ubuntu:22.04', { encoding: 'utf8', stdio: 'pipe' }).trim();
-    if (images) return true; // already have it
-  } catch (e) {}
-
-  // Pull ubuntu:22.04 from Docker Hub
-  const pullMsg = '📥 [Ubuntu Engine] Downloading ubuntu:22.04 OS image (~30 MB compressed)...';
-  console.log(`\n${pullMsg}`);
-  if (emitLog) emitLog('system', pullMsg);
-
-  try {
-    execSync('docker pull ubuntu:22.04', { stdio: 'inherit' });
-    const okMsg = '✅ [Ubuntu Engine] ubuntu:22.04 OS image download complete.';
-    console.log(`\n${okMsg}\n`);
-    if (emitLog) emitLog('system', okMsg);
-    return true;
-  } catch (e) {
-    console.error('❌ Failed to pull ubuntu:22.04:', e.message);
-    return false;
-  }
-}
-
-function tryStartDockerDaemon(execSync) {
-  const platform = process.platform;
-  console.log('🔄 [TNC Runner] Docker daemon not running. Attempting to start...');
-  try {
-    if (platform === 'darwin') {
-      // macOS: Open Docker Desktop app
-      execSync('open -a Docker', { stdio: 'ignore' });
-      // Wait up to 20s for daemon to be ready
-      for (let i = 0; i < 20; i++) {
-        try {
-          execSync('docker info', { stdio: 'ignore' });
-          console.log('✅ Docker daemon started successfully.');
-          return true;
-        } catch (_) {
-          execSync('sleep 1', { stdio: 'ignore' });
-        }
-      }
-    } else if (platform === 'linux') {
-      execSync('sudo systemctl start docker', { stdio: 'ignore' });
-      execSync('sleep 2', { stdio: 'ignore' });
-      execSync('docker info', { stdio: 'ignore' });
-      console.log('✅ Docker daemon started successfully.');
-      return true;
-    } else if (platform === 'win32') {
-      execSync('start "" "C:\\Program Files\\Docker\\Docker\\Docker Desktop.exe"', { stdio: 'ignore' });
-      for (let i = 0; i < 20; i++) {
-        try {
-          execSync('docker info', { stdio: 'ignore' });
-          console.log('✅ Docker daemon started successfully.');
-          return true;
-        } catch (_) {
-          execSync('timeout 1', { stdio: 'ignore' });
-        }
-      }
-    }
-  } catch (e) {}
-  return false;
-}
-
-function resolveExecutionEngine(cmd, cwd) {
-  const { execSync } = require('child_process');
-
-  // Ensure /opt/homebrew/bin is in PATH for Mac environments
-  if (process.platform === 'darwin' && !process.env.PATH?.includes('/opt/homebrew/bin')) {
-    process.env.PATH = `/opt/homebrew/bin:${process.env.PATH || ''}`;
-  }
-
-  // ── Command Normalization (runs regardless of engine) ────────────────────
-  let normalizedCmd = cmd
-    .replace(/\bpython\b/g, 'python3')
-    .replace(/\bpip install\b/g, 'pip install')
-    .replace(/\bpip3 install\b/g, 'pip install')
-    // npm ci / npm install peer dependency fallback
-    .replace(/\bnpm ci\b/g, 'npm install --legacy-peer-deps')
-    .replace(/\bnpm install\b(?!\s+--legacy-peer-deps)/g, 'npm install --legacy-peer-deps');
-
-  // Guard npm commands if npm or package.json does not exist in workspace container
-  if (normalizedCmd.trim().startsWith('npm ') || normalizedCmd.includes(' npm ')) {
-    normalizedCmd = `if command -v npm >/dev/null 2>&1 && [ -f package.json ]; then ${normalizedCmd}; else echo "ℹ️  npm or package.json not present — skipping npm step"; fi`;
-  }
-
-  // Guard node -e commands if node binary is not installed in minimal container
-  if (normalizedCmd.includes('node -e')) {
-    normalizedCmd = `if command -v node >/dev/null 2>&1; then ${normalizedCmd}; else echo "✅ Step check completed."; fi`;
-  }
-
-  // Skip engine overhead for empty/probe calls
-  if (!normalizedCmd.trim()) {
-    return { shell: '/bin/sh', args: ['-c', 'true'], engineName: 'Probe' };
-  }
-
-  const isWin = process.platform === 'win32';
-
-  // ── TIER 0: Native Developer Host Engine ──────────────────────────────
-  const hasNode = (() => { try { execSync('node --version', { stdio: 'ignore' }); return true; } catch { return false; } })();
-  if (hasNode) {
-    const hostCmd = normalizedCmd
-      .replace(/python3 -m pip install(?! --break)/g, 'python3 -m pip install --break-system-packages')
-      .replace(/pip install(?! --break)/g, 'python3 -m pip install --break-system-packages');
-
-    return {
-      shell: isWin ? 'cmd.exe' : (fs.existsSync('/bin/bash') ? '/bin/bash' : '/bin/sh'),
-      args: isWin ? ['/s', '/c', hostCmd] : ['-c', hostCmd],
-      engineName: 'Native Developer Host'
-    };
-  }
-
-  // ── TIER 1: Docker ────────────────────────────────────────────────────────
-  let dockerAvailable = false;
-  let dockerRunning = false;
-
-  try {
-    execSync('docker --version', { stdio: 'ignore' });
-    dockerAvailable = true;
-  } catch (e) {}
-
-  if (dockerAvailable) {
-    try {
-      execSync('docker info', { stdio: 'ignore' });
-      dockerRunning = true;
-    } catch (e) {
-      // Daemon stopped — try to start it
-      dockerRunning = tryStartDockerDaemon(execSync);
-    }
-  }
-
-  if (dockerAvailable && dockerRunning) {
-    // Ensure ubuntu:22.04 image exists locally (auto-pull if not)
-    const imageReady = ensureDockerUbuntuImage(execSync);
-    if (imageReady) {
-      const formattedCwd = isWin ? cwd.replace(/\\/g, '/') : cwd;
-      // Escape the command for bash -c inside Docker
-      const escaped = normalizedCmd.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-      const dockerCmd = [
-        'docker run --rm',
-        '--memory=2g',
-        '--cpus=2',
-        '--pids-limit=256',
-        '--security-opt=no-new-privileges:true',
-        '--network=host',
-        `-v "${formattedCwd}:/workspace"`,
-        '-w /workspace',
-        'ubuntu:22.04',
-        `bash -c "${escaped}"`
-      ].join(' ');
-      return {
-        shell: isWin ? 'cmd.exe' : '/bin/bash',
-        args: isWin ? ['/s', '/c', dockerCmd] : ['-c', dockerCmd],
-        engineName: 'Ubuntu 22.04 (Hardened Docker Container)'
-      };
-    }
-  }
-
-  // ── TIER 2: WSL2 (Windows only — Native Ubuntu on Windows) ───────────────
-  if (isWin) {
-    let hasWsl = false;
-    try {
-      execSync('wsl --list', { stdio: 'ignore' });
-      hasWsl = true;
-    } catch (e) {}
-    if (hasWsl) {
-      // Translate Windows path (C:\Users\...) to WSL path (/mnt/c/Users/...)
-      const wslCwd = cwd
-        .replace(/^([A-Za-z]):/, (_, drive) => `/mnt/${drive.toLowerCase()}`)
-        .replace(/\\/g, '/');
-
-      const escaped = normalizedCmd.replace(/"/g, '\\"');
-      const wslCmd = `wsl -d Ubuntu bash -c "cd \\"${wslCwd}\\" && ${escaped}"`;
-
-      return {
-        shell: 'cmd.exe',
-        args: ['/s', '/c', wslCmd],
-        engineName: 'Ubuntu Linux (WSL2 Engine)'
-      };
-    }
-  }
-
-  // ── TIER 3: Lima Ubuntu VM (Mac without Docker) ──────────────────────────
-  // Lima = Lightweight Ubuntu VM for macOS (by Canonical, open-source)
-  if (process.platform === 'darwin') {
-    let limactlBin = null;
-    const fs = require('fs');
-    if (fs.existsSync('/opt/homebrew/bin/limactl')) {
-      limactlBin = '/opt/homebrew/bin/limactl';
-    } else {
-      try {
-        execSync('limactl --version', { stdio: 'ignore' });
-        limactlBin = 'limactl';
-      } catch (e) {}
-    }
-
-    if (limactlBin) {
-      try {
-        const list = execSync(`${limactlBin} list --json 2>/dev/null`, { encoding: 'utf8' });
-        const vms  = list.trim().split('\n').map(l => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
-        let ubuntuVm = vms.find(vm => vm.name === 'ubuntu' || vm.name.includes('ubuntu')) || vms[0];
-
-        if (ubuntuVm) {
-          // Auto-start Ubuntu VM if it is currently Stopped
-          if (ubuntuVm.status !== 'Running') {
-            console.log(`\n🐧 [TNC Engine] Booting Ubuntu VM (${ubuntuVm.name})...`);
-            try {
-              execSync(`${limactlBin} start ${ubuntuVm.name} --tty=false`, { stdio: 'ignore' });
-              console.log(`✅ Ubuntu VM (${ubuntuVm.name}) booted successfully.\n`);
-            } catch (err) {}
-          }
-
-          const formattedCwd = cwd.replace(/\\/g, '/');
-          const escaped = normalizedCmd.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-          // Ephemeral container execution: nerdctl run --rm creates container, runs step, then DELETES container
-          const nerdCmd = `${limactlBin} shell ${ubuntuVm.name} nerdctl run --rm -v "${formattedCwd}:/workspace" -w /workspace ubuntu:22.04 bash -c "${escaped}"`;
-
-          return {
-            shell: '/bin/bash',
-            args: ['-c', nerdCmd],
-            engineName: 'Ubuntu 22.04 (Ephemeral Isolated Container)'
-          };
-        }
-      } catch (e) {}
-    }
-  }
-
-  // ── TIER 4: WSL2 (Windows only) ──────────────────────────────────────────
-  if (isWin) {
-    let hasWsl2 = false;
-    try {
-      const { execSync } = require('child_process');
-      execSync('wsl --list --running', { stdio: 'ignore' });
-      hasWsl2 = true;
-    } catch (e) {}
-    if (hasWsl2) {
-      const escaped = normalizedCmd.replace(/"/g, '\\"');
-      return {
-        shell: 'cmd.exe',
-        args: ['/s', '/c', `wsl -d Ubuntu bash -c "${escaped}"`],
-        engineName: 'Ubuntu (WSL2)'
-      };
-    }
-  }
-
-  // ── TIER 5: Native Host Fallback (last resort) ────────────────────────────
-  const platform = process.platform;
-  const installHint = platform === 'darwin'
-    ? '  📦 Mac:     brew install --cask docker  (OR)  brew install lima && limactl start template://ubuntu'
-    : platform === 'win32'
-    ? '  📦 Windows: wsl --install -d Ubuntu  (then restart)'
-    : '  📦 Linux:   sudo apt-get install docker.io && sudo systemctl start docker';
-
-  console.warn('\n⚠️  [TNC Runner] WARNING: Running on HOST machine — Ubuntu container not available.');
-  console.warn('   To run in isolated Ubuntu environment, install one of:');
-  console.warn(installHint);
-  console.warn('');
-
-  // On Mac/Linux native: add --break-system-packages to all pip installs
-  const hostCmd = normalizedCmd
-    .replace(/python3 -m pip install(?! --break)/g, 'python3 -m pip install --break-system-packages')
-    .replace(/pip install(?! --break)/g, 'python3 -m pip install --break-system-packages');
-
-  return {
-    shell: isWin ? 'cmd.exe' : '/bin/sh',
-    args: isWin ? ['/s', '/c', hostCmd] : ['-c', hostCmd],
-    engineName: 'Native Host (Fallback)'
-  };
-}
-
-/**
- * Run a single shell command, stream output to terminal, resolve with exitCode.
- */
-function runStep(cmd, cwd, onData) {
-  return new Promise((resolve) => {
-    const engine = resolveExecutionEngine(cmd, cwd);
-    const proc   = spawn(engine.shell, engine.args, {
-      cwd,
-      env: { ...process.env, PUPPETEER_SKIP_DOWNLOAD: 'true' }
-    });
-
-    proc.stdout.on('data', d => onData(d.toString()));
-    proc.stderr.on('data', d => onData(d.toString()));
-    proc.on('close', code => resolve(code ?? 0));
-  });
-}
-
-/**
- * Submit result back to TNC via webhook.
- */
-async function submitResult(apiUrl, taskId, webhookSecret, result) {
-  const fetch = getFetch();
-  const body  = JSON.stringify(result);
-  const sig   = 'sha256=' + crypto.createHmac('sha256', webhookSecret).update(body).digest('hex');
-  const res   = await fetch(`${apiUrl}/webhooks/tasks/${taskId}/judge`, {
-    method:  'POST',
-    headers: { 'Content-Type': 'application/json', 'x-tnc-signature': sig },
-    body,
-  });
-  if (!res.ok) {
-    const e = await res.json().catch(() => ({}));
-    throw new Error(e.error || `Webhook ${res.status}`);
-  }
-  return res.json();
-}
-
-/**
- * Main entry — triggered when server emits task:run-local to CLI socket.
- * @param {Object} opts  { taskId, webhookSecret, apiUrl, repoUrl, repoBranch, workflowFile, chalk, shell, onLog }
- */
-async function runLocal({ taskId, webhookSecret, apiUrl, repoUrl, repoBranch, workflowFile, chalk, shell, onLog }) {
-  const localRoot = process.cwd();
-
-  console.log(chalk.cyan(`\n📡 TNC Build triggered for task: ${taskId}`));
-  console.log(chalk.dim(`   Local CWD: ${localRoot}`));
-
-  // ── Resolve GitHub remote URL ─────────────────────────────────────────────
-  let projectRoot = localRoot;
-  let cloneDir    = null;
-
-  try {
-    const { execSync } = require('child_process');
-    let remoteUrl = repoUrl || null;
-    let branch    = repoBranch || 'main';
-    let shortHash = 'latest';
-
-    if (!remoteUrl) {
-      try {
-        remoteUrl = execSync('git remote get-url origin', { cwd: localRoot, encoding: 'utf8', stdio: 'pipe' }).trim();
-        branch    = execSync('git rev-parse --abbrev-ref HEAD', { cwd: localRoot, encoding: 'utf8', stdio: 'pipe' }).trim();
-        shortHash = execSync('git rev-parse --short HEAD',     { cwd: localRoot, encoding: 'utf8', stdio: 'pipe' }).trim();
-      } catch (e) {
-        remoteUrl = null;
-      }
-    }
-
-    if (remoteUrl) {
-      const os = require('os');
-      cloneDir  = path.join(os.homedir(), '.tnc', 'sandboxes', `tnc-runner-${taskId}-${Date.now()}`);
-      fs.mkdirSync(cloneDir, { recursive: true });
-
-      console.log(chalk.cyan(`\n🐙 [TNC Checkout] Cloning from GitHub...`));
-      console.log(chalk.dim(`   Remote : ${remoteUrl}`));
-      console.log(chalk.dim(`   Branch : ${branch}  (${shortHash})`));
-      console.log(chalk.dim(`   Target : ${cloneDir}\n`));
-
-      execSync(
-        `git clone --depth=1 --branch "${branch}" "${remoteUrl}" "${cloneDir}"`,
-        { stdio: 'inherit' }
-      );
-
-      projectRoot = cloneDir;
-
-      // Copy local project folders into cloneDir to preserve local workspace fixes
-      const syncFolders = ['.tnc/workflows', 'scripts', 'routes', 'controllers', 'config', 'signaling', 'utils', 'Schema', 'tests'];
-      for (const folder of syncFolders) {
-        const localFolder = path.join(localRoot, folder);
-        const targetFolder = path.join(cloneDir, folder);
-        if (fs.existsSync(localFolder)) {
-          try {
-            fs.mkdirSync(path.dirname(targetFolder), { recursive: true });
-            fs.cpSync(localFolder, targetFolder, { recursive: true });
-          } catch (e) {}
-        }
-      }
-
-      console.log(chalk.green(`\n✅ GitHub checkout complete — running CI on fresh clone\n`));
-    }
-  } catch (e) {
-    console.log(chalk.yellow(`⚠️  GitHub clone note (${e.message?.split('\n')[0]}) — using local project directory`));
-    projectRoot = localRoot;
-  }
-
-  // 1. Find workflow file (evaluated in projectRoot, NOT localRoot)
-  const workflowsDir = path.join(projectRoot, '.tnc', 'workflows');
-
-  if (!fs.existsSync(workflowsDir)) {
-    console.log(chalk.red(`❌ No .tnc/workflows/ directory found in ${projectRoot}`));
-    console.log(chalk.yellow(`   Create one: mkdir -p .tnc/workflows && touch .tnc/workflows/tnc-ci.yml`));
-    return;
-  }
-
-  const files = fs.readdirSync(workflowsDir).filter(f => f.endsWith('.yml') || f.endsWith('.yaml'));
-  if (!files.length) {
-    console.log(chalk.red('❌ No .yml workflow files found in .tnc/workflows/'));
-    return;
-  }
-
-
-  // Use workflowFile from web trigger if provided, otherwise pick first yml found
-  const selectedWorkflowFile = workflowFile
-    ? files.find(f => f === workflowFile) || files[0]
-    : files[0];
-  const content      = fs.readFileSync(path.join(workflowsDir, selectedWorkflowFile), 'utf8');
-  const { workflowName, steps } = parseWorkflow(content);
-
-  if (!steps.length) {
-    console.log(chalk.red(`❌ No runnable steps found in ${selectedWorkflowFile}`));
-    return;
-  }
-
-
-  const activeEngine = resolveExecutionEngine('', projectRoot).engineName;
-  console.log(chalk.cyan(`\n🚀 [TNC Actions] Running: "${workflowName}" (${workflowFile})`));
-  console.log(chalk.green(`🟢 [Ubuntu Engine Active] Executing via ${activeEngine}`));
-  console.log(chalk.dim(`   ${steps.length} step(s)\n`));
-
-  // Stream initial workflow setup
-  if (onLog) {
-    onLog({
-      workflowName,
-      file: workflowFile,
-      steps: steps.map(st => ({ name: st.name })),
-      data: `\n🚀 [TNC Actions] Starting Local Workflow: "${workflowName}" (${workflowFile})\n🟢 Runner Engine: ${activeEngine}\n`
-    });
-  }
-
-  // 2. Execute each step
-  const stepResults = [];
-  let overallPassed = true;
-  let logsBuffer    = '';
-
-  for (let s = 0; s < steps.length; s++) {
-    const step = steps[s];
-    console.log(chalk.cyan(`⚙️  [Step ${s + 1}/${steps.length}] "${step.name}"`));
-    console.log(chalk.gray(`$ ${step.run}\n`));
-
-    const stepHeader = `\n⚙️ [Step ${s + 1}/${steps.length}] "${step.name}"\n$ ${step.run}\n`;
-    logsBuffer += stepHeader;
-
-    if (onLog) {
-      onLog({
-        stepIndex: s,
-        state: 'running',
-        data: stepHeader
-      });
-    }
-
-    const onData = chunk => {
-      process.stdout.write(chunk);
-      logsBuffer += chunk;
-      if (onLog) {
-        onLog({
-          stepIndex: s,
-          state: 'running',
-          data: chunk
-        });
-      }
-    };
-
-    const exitCode  = await runStep(step.run, projectRoot, onData);
-    const continueOnError = step.continueOnError || /continue-on-error:\s*true/i.test(content) || (step.run.includes('npm audit') && !step.run.includes('--audit-level=critical'));
-    const stepPassed = exitCode === 0 || continueOnError;
-
-    stepResults.push({ name: step.name, command: step.run, exitCode, passed: stepPassed });
-
-    if (exitCode === 0) {
-      console.log(chalk.green(`\n✅ "${step.name}" passed\n`));
-      const passMsg = `\n✅ Step "${step.name}" completed successfully.\n`;
-      logsBuffer += passMsg;
-      if (onLog) {
-        onLog({
-          stepIndex: s,
-          state: 'passed',
-          data: passMsg
-        });
-      }
-    } else if (continueOnError) {
-      console.log(chalk.yellow(`\n⚠️ "${step.name}" advisory check complete (exit ${exitCode}) — continuing pipeline.\n`));
-      const warnMsg = `\n⚠️ Step "${step.name}" completed with non-zero exit code ${exitCode} (non-blocking step).\n`;
-      logsBuffer += warnMsg;
-      if (onLog) {
-        onLog({
-          stepIndex: s,
-          state: 'passed',
-          data: warnMsg
-        });
-      }
-    } else {
-      overallPassed = false;
-      console.log(chalk.red(`\n❌ "${step.name}" failed (exit ${exitCode}). Aborting.\n`));
-      const failMsg = `\n❌ Step "${step.name}" failed with exit code: ${exitCode}. Aborting workflow.\n`;
-      logsBuffer += failMsg;
-      if (onLog) {
-        onLog({
-          stepIndex: s,
-          state: 'failed',
-          data: failMsg
-        });
-      }
-      break;
-    }
-  }
-
-  // 3. Print summary
-  const border = overallPassed ? chalk.green('─'.repeat(50)) : chalk.red('─'.repeat(50));
-  const badge  = overallPassed ? chalk.bgGreen.black(' PASS ') : chalk.bgRed.white(' FAIL ');
-  console.log(border);
-  console.log(`  ${badge}  ${workflowName}`);
-  console.log(border + '\n');
-
-  // 4. Submit verdict to TNC via webhook
-  const result = {
-    exitCode: overallPassed ? 0 : 1,
-    stdout:   logsBuffer,
-    stderr:   '',
-    output: {
-      workflow: workflowName,
-      status:   overallPassed ? 'passed' : 'failed',
-      stepsCount: steps.length,
-      stepsRun:   stepResults
-    },
-    json: {
-      workflow: workflowName,
-      status:   overallPassed ? 'passed' : 'failed',
-      stepsCount: steps.length,
-      stepsRun:   stepResults
-    }
-  };
-
-  try {
-    console.log(chalk.dim('  Syncing verdict with TNC...'));
-    await submitResult(apiUrl, taskId, webhookSecret, result);
-    console.log(chalk.green('  ✓ Verdict saved — task updated on TNC!\n'));
-  } catch (err) {
-    console.log(chalk.yellow(`  ⚠️  Sync failed: ${err.message}\n`));
-  }
-
-  // 5. Push notification
-  if (shell && shell.pushNotification) {
-    shell.pushNotification({
-      type:   'verdict',
-      passed: overallPassed,
-      title:  workflowName,
-      reason: overallPassed ? 'TNC Local CI pipeline passed' : `Failed at: ${stepResults[stepResults.length - 1]?.name}`,
-      taskId,
-      at:     new Date().toISOString(),
-    });
-  }
-  // 6. Cleanup — delete temp GitHub clone dir (keep local dir intact)
-  if (cloneDir && fs.existsSync(cloneDir)) {
-    try {
-      fs.rmSync(cloneDir, { recursive: true, force: true });
-      console.log(chalk.dim(`  🗑️  Temp clone cleaned up: ${cloneDir}\n`));
-    } catch (e) {
-      console.log(chalk.yellow(`  ⚠️  Could not cleanup temp dir: ${e.message}\n`));
-    }
-  }
-}
-
-/**
- * Main entry for CI/CD triggered from dashboard via websocket (cicd:trigger / cicd:run-dispatch)
- */
-async function runCicdLocal({ runId, roomId, workflowFile, workflowYaml, localPath, chalk, api, socket }) {
-  const startTime = Date.now();
-  const localRoot = process.cwd();
-
-  const emitLog = (type, text) => {
-    const timestamp = new Date().toLocaleTimeString('en-IN', { timeZone: 'Asia/Kolkata', hour12: false });
-    if (socket && socket.connected) {
-      socket.emit('cicd:log', { runId, roomId, type, text, timestamp });
-    }
-  };
-
-  // ── Resolve GitHub remote URL & Clone Fresh ──────────────────────────────
-  let projectRoot = localRoot;
-  let cloneDir    = null;
-
-  try {
-    const { execSync } = require('child_process');
-    let remoteUrl = (localPath && localPath.startsWith('http')) ? localPath.trim() : null;
-    let branch    = 'main';
-
-    if (!remoteUrl) {
-      try {
-        remoteUrl = execSync('git remote get-url origin', { cwd: localRoot, encoding: 'utf8', stdio: 'pipe' }).trim();
-        branch    = execSync('git rev-parse --abbrev-ref HEAD', { cwd: localRoot, encoding: 'utf8', stdio: 'pipe' }).trim();
-      } catch (e) {
-        remoteUrl = null;
-      }
-    }
-
-    if (remoteUrl) {
-      const os = require('os');
-      cloneDir = path.join(os.homedir(), '.tnc', 'sandboxes', `tnc-cicd-${runId || Date.now()}-${Date.now()}`);
-      fs.mkdirSync(cloneDir, { recursive: true });
-
-      console.log(chalk.cyan(`\n🐙 [TNC Checkout] Cloning fresh from GitHub...`));
-      console.log(chalk.dim(`   Remote : ${remoteUrl}`));
-      console.log(chalk.dim(`   Branch : ${branch}`));
-      console.log(chalk.dim(`   Target : ${cloneDir}\n`));
-
-      emitLog('system', `🐙 [TNC Checkout] Cloning fresh project from GitHub (${remoteUrl})...`);
-
-      execSync(
-        `git clone --depth=1 --branch "${branch}" "${remoteUrl}" "${cloneDir}"`,
-        { stdio: 'pipe' }
-      );
-
-      projectRoot = cloneDir;
-      emitLog('system', `✅ Fresh GitHub clone ready.`);
-    }
-  } catch (e) {
-    emitLog('system', `⚠️ GitHub clone notice: using workspace (${e.message?.split('\n')[0]})`);
-    projectRoot = localRoot;
-  }
-
-  console.log(chalk.cyan(`\n📡 Cloud Dashboard triggered CI/CD workflow: ${workflowFile || 'universal-polyglot-ci.yml'}`));
-  console.log(chalk.dim(`   Project: ${projectRoot}`));
-
-  emitLog('system', `📥 [Ubuntu Engine] Initializing isolated Ubuntu Linux runtime environment...`);
-
-  const activeEngine = resolveExecutionEngine('', projectRoot).engineName;
-
-  emitLog('system', `🚀 [thinkncollab-shell] Triggered execution for workflow "${workflowFile || 'universal-polyglot-ci.yml'}"...`);
-  emitLog('system', `🟢 Runner Engine: ${activeEngine}`);
-  emitLog('system', `📁 Workspace: ${projectRoot}`);
-
-  let content = workflowYaml || '';
-  if (!content) {
-    let workflowPath = path.join(projectRoot, '.tnc', 'workflows', workflowFile || 'universal-polyglot-ci.yml');
-    if (!fs.existsSync(workflowPath)) {
-      const wfDir = path.join(projectRoot, '.tnc', 'workflows');
-      if (fs.existsSync(wfDir)) {
-        const files = fs.readdirSync(wfDir).filter(f => f.endsWith('.yml') || f.endsWith('.yaml'));
-        if (files.length) workflowPath = path.join(wfDir, files[0]);
-      }
-    }
-    if (fs.existsSync(workflowPath)) {
-      content = fs.readFileSync(workflowPath, 'utf8');
-    }
-  }
-
-  if (!content) {
-    const errMsg = `❌ Workflow file not found locally or on server`;
-    console.log(chalk.red(errMsg));
-    emitLog('error', errMsg);
-    if (socket && socket.connected) {
-      socket.emit('cicd:status', { runId, roomId, status: 'failed', exitCode: 1, durationMs: Date.now() - startTime });
-    }
-    return;
-  }
-
-  const { workflowName, steps } = parseWorkflow(content);
-
-  if (!steps.length) {
-    const errMsg = `❌ No runnable steps found in ${workflowFile}`;
-    console.log(chalk.red(errMsg));
-    emitLog('error', errMsg);
-    if (socket && socket.connected) {
-      socket.emit('cicd:status', { runId, roomId, status: 'failed', exitCode: 1, durationMs: Date.now() - startTime });
-    }
-    return;
-  }
-
-  console.log(chalk.cyan(`\n🚀 [TNC Actions] Running: "${workflowName}" (${workflowFile})`));
-  console.log(chalk.dim(`   ${steps.length} step(s)\n`));
-
-  let overallPassed = true;
-  const logsArray = [];
-  logsArray.push(`🚀 [TNC Actions] Starting Local Workflow: "${workflowName}" (${workflowFile})`);
-
-  for (let s = 0; s < steps.length; s++) {
-    const step = steps[s];
-    console.log(chalk.cyan(`⚙️  [Step ${s + 1}/${steps.length}] "${step.name}"`));
-    console.log(chalk.gray(`$ ${step.run}\n`));
-
-    emitLog('system', `▶  [${s + 1}/${steps.length}]  ${step.name}`);
-    logsArray.push(`\n⚙️ [Step ${s + 1}/${steps.length}] "${step.name}"`);
-    logsArray.push(`$ ${step.run}`);
-
-    const onData = chunk => {
-      process.stdout.write(chunk);
-      const lines = chunk.toString().split('\n');
-      lines.forEach(l => {
-        if (l.trim()) {
-          logsArray.push(`[stdout] ${l}`);
-          emitLog('stdout', l);
-        }
-      });
-    };
-
-    const exitCode = await runStep(step.run, projectRoot, onData);
-    
-    if (exitCode === 0) {
-      console.log(chalk.green(`\n✅ "${step.name}" passed\n`));
-      emitLog('system', `   ✅ Passed`);
-      logsArray.push(`✅ [Step Passed] Step "${step.name}" completed successfully`);
-    } else {
-      overallPassed = false;
-      console.log(chalk.red(`\n❌ "${step.name}" failed (exit ${exitCode}). Aborting.\n`));
-      emitLog('stderr', `   ❌ Failed (exit ${exitCode})`);
-      logsArray.push(`❌ [Step Failed] Step "${step.name}" exited with status code: ${exitCode}`);
-      break;
-    }
-  }
-
-  const durationMs = Date.now() - startTime;
-  const border = overallPassed ? chalk.green('─'.repeat(50)) : chalk.red('─'.repeat(50));
-  const badge  = overallPassed ? chalk.bgGreen.black(' PASS ') : chalk.bgRed.white(' FAIL ');
-  console.log(border);
-  console.log(`  ${badge}  ${workflowName}`);
-  console.log(border + '\n');
-  
-  if (overallPassed) {
-    emitLog('system', `\n🎉 Workflow ran successfully! status code: 0`);
-    logsArray.push(`\n🎉 Workflow ran successfully! status code: 0`);
-  } else {
-    emitLog('error', `\n❌ Workflow failed!`);
-    logsArray.push(`\n❌ Workflow failed!`);
-  }
-
-  if (socket && socket.connected) {
-    socket.emit('cicd:status', { runId, roomId, status: overallPassed ? 'passed' : 'failed', exitCode: overallPassed ? 0 : 1, durationMs });
-  }
-
-  if (api) {
-    try {
-      console.log(chalk.dim('  Syncing CI/CD logs with dashboard...'));
-      await api._request('POST', `/tnccicd/api/save-run/${roomId}`, {
-        runId,
-        workflowFile,
-        status: overallPassed ? 'passed' : 'failed',
-        logs: logsArray.slice(-300)
-      }).catch(() => {});
-      console.log(chalk.green('  ✓ Logs synced successfully!\n'));
-    } catch (err) {}
-  }
-
-  // Cleanup temp clone directory if created
-  if (cloneDir && fs.existsSync(cloneDir)) {
-    try {
-      fs.rmSync(cloneDir, { recursive: true, force: true });
-      console.log(chalk.dim(`  🗑️  Isolated sandbox deleted: ${cloneDir}\n`));
-      emitLog('system', `🗑️  Isolated sandbox deleted & cleaned up.`);
-    } catch (e) {}
-  }
-}
-
-module.exports = { runLocal, runCicdLocal };