lael-labs/executor

.oxlintrc.jsonc+1−0

@@ -40,6 +40,7 @@ · 39 unmodified lines
40		40
41	// Monorepo-specific rules.	41	// Monorepo-specific rules.
42	"executor-monorepo/no-cross-workspace-relative-imports": "error",	42	"executor-monorepo/no-cross-workspace-relative-imports": "error",
		43	"executor-monorepo/no-node-fs-with-effect-imports": "error",
43	"executor-monorepo/no-raw-effect-fail-errors": "error",	44	"executor-monorepo/no-raw-effect-fail-errors": "error",
44	"executor-monorepo/no-yield-effect-fail": "error",	45	"executor-monorepo/no-yield-effect-fail": "error",
45	"executor-monorepo/no-workspace-src-imports": "warn"	46	"executor-monorepo/no-workspace-src-imports": "warn"

apps/executor/src/cli/main.ts+99−79

@@ -1,9 +1,7 @@
1	import { existsSync, readFileSync } from "node:fs";
2	import { mkdir, open, readFile, rm } from "node:fs/promises";
3	import { spawn } from "node:child_process";	1	import { spawn } from "node:child_process";
4	import { dirname, resolve } from "node:path";	2	import { createRequire } from "node:module";
		3	import { dirname } from "node:path";
5	import { createInterface } from "node:readline/promises";	4	import { createInterface } from "node:readline/promises";
6	import { fileURLToPath } from "node:url";
7	import { FileSystem } from "@effect/platform";	5	import { FileSystem } from "@effect/platform";
8	import { Args, Command, Options } from "@effect/cli";	6	import { Args, Command, Options } from "@effect/cli";
9	import {	7	import {
@@ -120,17 +118,17 @@ const readCode = (input: { · 110 unmodified lines
120	code?: string;	118	code?: string;
121	file?: string;	119	file?: string;
122	stdin?: boolean;	120	stdin?: boolean;
123	}): Effect.Effect<string, Error, never> =>	121	}): Effect.Effect<string, Error, FileSystem.FileSystem> =>
124	Effect.gen(function* () {	122	Effect.gen(function* () {
125	if (input.code && input.code.trim().length > 0) {	123	if (input.code && input.code.trim().length > 0) {
126	return input.code;	124	return input.code;
127	}	125	}
128		126
129	if (input.file && input.file.trim().length > 0) {	127	if (input.file && input.file.trim().length > 0) {
130	const contents = yield* Effect.tryPromise({	128	const fs = yield* FileSystem.FileSystem;
131	try: () => readFile(input.file!, "utf8"),	129	const contents = yield* fs.readFileString(input.file!, "utf8").pipe(
132	catch: toError,	130	Effect.mapError(toError),
133	});	131	);
134	if (contents.trim().length > 0) {	132	if (contents.trim().length > 0) {
135	return contents;	133	return contents;
136	}	134	}
@@ -151,22 +149,17 @@ const getBootstrapClient = (baseUrl: string = DEFAULT_SERVER_BASE_URL) => · 14 unmodified lines
151	createControlPlaneClient({ baseUrl });	149	createControlPlaneClient({ baseUrl });
152		150
153	const decodeExecutionId = Schema.decodeUnknown(ExecutionIdSchema);	151	const decodeExecutionId = Schema.decodeUnknown(ExecutionIdSchema);
154	const cliSourceDir = dirname(fileURLToPath(import.meta.url));	152	const require = createRequire(import.meta.url);
155	const CLI_NAME = "executor";	153	const CLI_NAME = "executor";
156	const CLI_VERSION = (() => {	154	const CLI_VERSION = (() => {
157	const candidatePaths = [	155	const candidatePaths = [
158	resolve(cliSourceDir, "../package.json"),	156	"../package.json",
159	resolve(cliSourceDir, "../../package.json"),	157	"../../package.json",
160	];	158	];
161		159
162	for (const candidatePath of candidatePaths) {	160	for (const candidatePath of candidatePaths) {
163	if (!existsSync(candidatePath)) {
164	continue;
165	}
166
167	try {	161	try {
168	const contents = readFileSync(candidatePath, "utf8");	162	const metadata = require(candidatePath) as { version?: string };
169	const metadata = JSON.parse(contents) as { version?: string };
170	if (metadata.version && metadata.version.trim().length > 0) {	163	if (metadata.version && metadata.version.trim().length > 0) {
171	return metadata.version;	164	return metadata.version;
172	}	165	}
@@ -428,24 +421,30 @@ const getDefaultServerOptions = (port: number = DEFAULT_SERVER_PORT) => { · 255 unmodified lines
428	};	421	};
429		422
430	const startServerInBackground = (port: number) =>	423	const startServerInBackground = (port: number) =>
431	Effect.tryPromise({	424	Effect.scoped(
432	try: async () => {	425	Effect.gen(function* () {
		426	const fs = yield* FileSystem.FileSystem;
433	const command = resolveSelfCommand(["__local-server", "--port", String(port)]);	427	const command = resolveSelfCommand(["__local-server", "--port", String(port)]);
434	await mkdir(dirname(DEFAULT_SERVER_LOG_FILE), { recursive: true });	428	yield* fs.makeDirectory(dirname(DEFAULT_SERVER_LOG_FILE), {
435	const logHandle = await open(DEFAULT_SERVER_LOG_FILE, "a");	429	recursive: true,
436		430	}).pipe(Effect.mapError(toError));
437	try {	431	const logHandle = yield* fs.open(DEFAULT_SERVER_LOG_FILE, {
438	const child = spawn(command[0]!, command.slice(1), {	432	flag: "a",
439	detached: true,	433	}).pipe(Effect.mapError(toError));
440	stdio: ["ignore", logHandle.fd, logHandle.fd],	434
441	});	435	yield* Effect.try({
442	child.unref();	436	try: () => {
443	} finally {	437	const fd = Number(logHandle.fd);
444	await logHandle.close();	438	const child = spawn(command[0]!, command.slice(1), {
445	}	439	detached: true,
446	},	440	stdio: ["ignore", fd, fd],
447	catch: toError,	441	});
448	});	442	child.unref();
		443	},
		444	catch: toError,
		445	});
		446	}),
		447	);
449		448
450	type LocalServerPidRecord = {	449	type LocalServerPidRecord = {
451	pid?: number;	450	pid?: number;
@@ -456,13 +455,21 @@ type LocalServerPidRecord = { · 4 unmodified lines
456	logFile?: string;	455	logFile?: string;
457	};	456	};
458		457
459	const readPidRecord = (): Effect.Effect<LocalServerPidRecord \| null, never, never> =>	458	const readPidRecord = (): Effect.Effect<
460	Effect.tryPromise({	459	LocalServerPidRecord \| null,
461	try: async () => {	460	never,
462	const contents = await readFile(DEFAULT_SERVER_PID_FILE, "utf8");	461	FileSystem.FileSystem
463	return JSON.parse(contents) as LocalServerPidRecord;	462	> =>
464	},	463	Effect.gen(function* () {
465	catch: () => null,	464	const fs = yield* FileSystem.FileSystem;
		465	const contents = yield* fs.readFileString(DEFAULT_SERVER_PID_FILE, "utf8").pipe(
		466	Effect.catchAll(() => Effect.succeed<string \| null>(null)),
		467	);
		468	if (contents === null) {
		469	return null;
		470	}
		471
		472	return JSON.parse(contents) as LocalServerPidRecord;
466	}).pipe(Effect.catchAll(() => Effect.succeed(null)));	473	}).pipe(Effect.catchAll(() => Effect.succeed(null)));
467		474
468	const isPidRunning = (pid: number): boolean => {	475	const isPidRunning = (pid: number): boolean => {
@@ -547,7 +554,9 @@ const renderDenoSandboxDetail = (denoVersion: string \| null): string => · 78 unmodified lines
547	? `deno ${denoVersion}`	554	? `deno ${denoVersion}`
548	: "deno not found (run `executor sandbox` to install)";	555	: "deno not found (run `executor sandbox` to install)";
549		556
550	const getServerStatus = (baseUrl: string): Effect.Effect<LocalServerStatus, Error, never> =>	557	const getServerStatus = (
		558	baseUrl: string,
		559	): Effect.Effect<LocalServerStatus, Error, FileSystem.FileSystem> =>
551	Effect.gen(function* () {	560	Effect.gen(function* () {
552	const pidRecord = yield* readPidRecord();	561	const pidRecord = yield* readPidRecord();
553	const reachable = yield* isServerReachable(baseUrl);	562	const reachable = yield* isServerReachable(baseUrl);
@@ -647,20 +656,20 @@ const printText = (value: string) => · 93 unmodified lines
647		656
648	const stopServer = (baseUrl: string) =>	657	const stopServer = (baseUrl: string) =>
649	Effect.gen(function* () {	658	Effect.gen(function* () {
		659	const fs = yield* FileSystem.FileSystem;
		660	const removePidFile = fs.remove(DEFAULT_SERVER_PID_FILE, {
		661	force: true,
		662	}).pipe(Effect.ignore);
650	const pidRecord = yield* readPidRecord();	663	const pidRecord = yield* readPidRecord();
651	const pid = typeof pidRecord?.pid === "number" ? pidRecord.pid : null;	664	const pid = typeof pidRecord?.pid === "number" ? pidRecord.pid : null;
652		665
653	if (pid === null) {	666	if (pid === null) {
654	yield* Effect.tryPromise(() => rm(DEFAULT_SERVER_PID_FILE, { force: true })).pipe(	667	yield* removePidFile;
655	Effect.ignore,
656	);
657	return false;	668	return false;
658	}	669	}
659		670
660	if (!isPidRunning(pid)) {	671	if (!isPidRunning(pid)) {
661	yield* Effect.tryPromise(() => rm(DEFAULT_SERVER_PID_FILE, { force: true })).pipe(	672	yield* removePidFile;
662	Effect.ignore,
663	);
664	return false;	673	return false;
665	}	674	}
666		675
@@ -671,7 +680,7 @@ const stopServer = (baseUrl: string) => · 4 unmodified lines
671		680
672	yield* waitForReachability(baseUrl, false).pipe(	681	yield* waitForReachability(baseUrl, false).pipe(
673	Effect.catchAll(() =>	682	Effect.catchAll(() =>
674	Effect.tryPromise(() => rm(DEFAULT_SERVER_PID_FILE, { force: true })).pipe(	683	removePidFile.pipe(
675	Effect.ignore,	684	Effect.ignore,
676	Effect.zipRight(Effect.fail(executorAppEffectError("cli/main", `Timed out stopping local executor server pid ${pid}`))),	685	Effect.zipRight(Effect.fail(executorAppEffectError("cli/main", `Timed out stopping local executor server pid ${pid}`))),
677	),	686	),
@@ -1178,38 +1187,49 @@ const doctorCommand = Command.make( · 500 unmodified lines
1178	),	1187	),
1179	).pipe(Command.withDescription("Check local executor install and daemon health"));	1188	).pipe(Command.withDescription("Check local executor install and daemon health"));
1180		1189
1181	const getDenoVersion = (): Effect.Effect<string \| null, never, never> =>	1190	const getDenoVersion = (): Effect.Effect<string \| null, never, FileSystem.FileSystem> =>
1182	Effect.tryPromise({	1191	Effect.gen(function* () {
1183	try: () =>	1192	const fs = yield* FileSystem.FileSystem;
1184	new Promise<string \| null>((resolve) => {	1193	const configuredDenoExecutable = process.env.DENO_BIN?.trim();
1185	const denoExecutable = process.env.DENO_BIN?.trim()	1194	const bundledDenoExecutable = process.env.HOME?.trim()
1186	\|\| (process.env.HOME && existsSync(`${process.env.HOME}/.deno/bin/deno`)	1195	? `${process.env.HOME.trim()}/.deno/bin/deno`
1187	? `${process.env.HOME}/.deno/bin/deno`	1196	: null;
1188	: "deno");	1197	const bundledDenoExists = bundledDenoExecutable === null
1189		1198	? false
1190	const child = spawn(denoExecutable, ["--version"], {	1199	: yield* fs.exists(bundledDenoExecutable).pipe(
1191	stdio: ["ignore", "pipe", "ignore"],	1200	Effect.catchAll(() => Effect.succeed(false)),
1192	timeout: 5000,	1201	);
1193	});	1202	const denoExecutable = configuredDenoExecutable
		1203	\|\| (bundledDenoExists ? bundledDenoExecutable : null)
		1204	\|\| "deno";
		1205
		1206	return yield* Effect.tryPromise({
		1207	try: () =>
		1208	new Promise<string \| null>((resolveVersion) => {
		1209	const child = spawn(denoExecutable, ["--version"], {
		1210	stdio: ["ignore", "pipe", "ignore"],
		1211	timeout: 5000,
		1212	});
1194		1213
1195	let stdout = "";	1214	let stdout = "";
1196	child.stdout?.setEncoding("utf8");	1215	child.stdout?.setEncoding("utf8");
1197	child.stdout?.on("data", (chunk: string) => {	1216	child.stdout?.on("data", (chunk: string) => {
1198	stdout += chunk;	1217	stdout += chunk;
1199	});	1218	});
1200		1219
1201	child.once("error", () => resolve(null));	1220	child.once("error", () => resolveVersion(null));
1202	child.once("close", (code) => {	1221	child.once("close", (code) => {
1203	if (code !== 0) {	1222	if (code !== 0) {
1204	resolve(null);	1223	resolveVersion(null);
1205	return;	1224	return;
1206	}	1225	}
1207		1226
1208	const match = /deno\s+(\S+)/i.exec(stdout);	1227	const match = /deno\s+(\S+)/i.exec(stdout);
1209	resolve(match ? match[1] : null);	1228	resolveVersion(match ? match[1] : null);
1210	});	1229	});
1211	}),	1230	}),
1212	catch: () => null,	1231	catch: () => null,
		1232	}).pipe(Effect.catchAll(() => Effect.succeed(null)));
1213	}).pipe(Effect.catchAll(() => Effect.succeed(null)));	1233	}).pipe(Effect.catchAll(() => Effect.succeed(null)));
1214		1234
1215	const sandboxCommand = Command.make(	1235	const sandboxCommand = Command.make(

apps/executor/src/distribution/harness.ts+35−28

 import { spawn } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { createServer } from "node:net";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { buildDistributionPackage } from "./artifact";
 import { executorAppEffectError } from "../effect-errors";
+const toError = (cause: unknown): Error =>
+  cause instanceof Error ? cause : new Error(String(cause));
 type CommandResult = {
   readonly stdout: string;
   readonly stderr: string;
 export const LocalDistributionHarnessLive = Layer.scoped(
   DistributionHarness,
   Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
     const tempRoot = yield* Effect.acquireRelease(
-      Effect.tryPromise({
+      fs.makeTempDirectory({
-        try: () => mkdtemp(join(tmpdir(), "executor-distribution-")),
+        directory: tmpdir(),
-        catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+        prefix: "executor-distribution-",
-      }),
+      }).pipe(Effect.mapError(toError)),
-      (path) => Effect.tryPromise({
+      (path) =>
-        try: () => rm(path, { recursive: true, force: true }),
+        fs.remove(path, { recursive: true, force: true }).pipe(
-        catch: (cause) =>
+          Effect.mapError(toError),
-          cause instanceof Error ? cause : new Error(String(cause ?? "temp dir cleanup failed")),
+          Effect.orDie,
-      }).pipe(Effect.orDie),
+        ),
     );
     const packageDir = join(tempRoot, "package");
     const installedWorkspaceRoot = tempRoot;
     const baseUrl = `http://127.0.0.1:${yield* allocatePort()}`;
-    yield* Effect.tryPromise({
+    yield* Effect.all([
-      try: async () => {
+      fs.makeDirectory(prefixDir, { recursive: true }),
-        await mkdir(prefixDir, { recursive: true });
+      fs.makeDirectory(homeDir, { recursive: true }),
-        await mkdir(homeDir, { recursive: true });
+      fs.makeDirectory(executorHome, { recursive: true }),
-        await mkdir(executorHome, { recursive: true });
+    ]).pipe(Effect.mapError(toError));
-      },
-      catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
-    });
     const artifact = yield* buildPackage(packageDir);
     const tarballPath = yield* packPackage(packageDir, tempRoot);
       });
     const writeProjectConfig = (contents: string) =>
-      Effect.tryPromise({
+      Effect.forEach(
-        try: async () => {
+        [stagedWorkspaceRoot, installedWorkspaceRoot],
-          for (const workspaceRoot of [stagedWorkspaceRoot, installedWorkspaceRoot]) {
+        (workspaceRoot) =>
+          Effect.gen(function* () {
             const configDir = join(workspaceRoot, ".executor");
-            await mkdir(configDir, { recursive: true });
+            yield* fs.makeDirectory(configDir, { recursive: true }).pipe(
-            await writeFile(join(configDir, "executor.jsonc"), contents, "utf8");
+              Effect.mapError(toError),
-          }
+            );
-        },
+            yield* fs.writeFileString(
-        catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+              join(configDir, "executor.jsonc"),
-      });
+              contents,
+            ).pipe(Effect.mapError(toError));
+          }),
+        { discard: true },
+      );
     return DistributionHarness.of({
       packageDir,
       runInstalled,
       fetchText,
     });
-  }),
+  }).pipe(Effect.provide(NodeFileSystem.layer)),
 );

bun.lock+2−1

     },
     "apps/executor": {
       "name": "executor",
-      "version": "1.2.2",
+      "version": "1.2.3",
       "bin": {
         "executor": "bin/executor",
       },
       "dependencies": {
         "@effect/opentelemetry": "^0.61.0",
         "@effect/platform": "catalog:",
+        "@effect/platform-node": "catalog:",
         "@executor/control-plane": "workspace:*",
         "@executor/executor-mcp": "workspace:*",
         "@opentelemetry/api": "^1.9.0",

packages/clients/react/src/index.test.tsx+9−6

 import { createServer } from "node:http";
-import { HttpApiBuilder, HttpServer } from "@effect/platform";
+import { FileSystem, HttpApiBuilder, HttpServer } from "@effect/platform";
-import { NodeHttpServer } from "@effect/platform-node";
+import { NodeFileSystem, NodeHttpServer } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   createControlPlaneApiLayer,
   Scope.close(scope, Exit.void).pipe(Effect.orDie);
 const startControlPlaneServer = async (): Promise<ApiServer> => {
+  const workspaceRoot = await Effect.runPromise(
+    FileSystem.FileSystem.pipe(
+      Effect.flatMap((fs) => fs.makeTempDirectory({ prefix: "executor-react-test-" })),
+      Effect.provide(NodeFileSystem.layer),
+    ),
+  );
   const runtime = await Effect.runPromise(
     createControlPlaneRuntime({
-      workspaceRoot: mkdtempSync(join(tmpdir(), "executor-react-test-")),
+      workspaceRoot,
     }),
   );
   const scope = await Effect.runPromise(Scope.make());
     60_000,
   );
 });
-import { mkdtempSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";

packages/kernel/runtime-deno-subprocess/src/index.ts+5−2

 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import type {
   const home = process.env.HOME?.trim();
   if (home) {
     const installedPath = `${home}/.deno/bin/deno`;
-    if (existsSync(installedPath)) {
+    const installedResult = spawnSync(installedPath, ["--version"], {
+      stdio: "ignore",
+      timeout: 5000,
+    });
+    if (installedResult.error === undefined && installedResult.status === 0) {
       return installedPath;
     }
   }

packages/platform/control-plane/src/runtime/catalog/source/type-declarations.test.ts+60−26

-import { mkdtempSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
   updatedAt: 0,
 });
+const makeTempDirectory = (prefix: string) =>
+  FileSystem.FileSystem.pipe(
+    Effect.flatMap((fs) =>
+      fs.makeTempDirectory({
+        directory: tmpdir(),
+        prefix,
+      })
+    ),
+    Effect.provide(NodeFileSystem.layer),
+  );
+const readTextFile = (path: string) =>
+  FileSystem.FileSystem.pipe(
+    Effect.flatMap((fs) => fs.readFileString(path, "utf8")),
+    Effect.provide(NodeFileSystem.layer),
+  );
+const fileExists = (path: string) =>
+  FileSystem.FileSystem.pipe(
+    Effect.flatMap((fs) => fs.exists(path)),
+    Effect.provide(NodeFileSystem.layer),
+  );
 describe("source-type-declarations", () => {
   it("writes per-source and aggregate declaration files", async () => {
-    const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-types-"));
+    const workspaceRoot = await Effect.runPromise(
+      makeTempDirectory("executor-types-"),
+    );
     const context = {
       cwd: workspaceRoot,
       workspaceRoot,
       ],
     }));
-    const sourceDeclaration = readFileSync(
+    const sourceDeclaration = await Effect.runPromise(
-      join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
+      readTextFile(
-      "utf8",
+        join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
+      ),
     );
-    const aggregateDeclaration = readFileSync(
+    const aggregateDeclaration = await Effect.runPromise(
-      join(workspaceRoot, ".executor", "types", "index.d.ts"),
+      readTextFile(join(workspaceRoot, ".executor", "types", "index.d.ts")),
-      "utf8",
     );
     expect(sourceDeclaration).toContain("export interface SourceTools_src_linear");
   });
   it("removes stale source declarations when the source disappears", async () => {
-    const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-types-stale-"));
+    const workspaceRoot = await Effect.runPromise(
+      makeTempDirectory("executor-types-stale-"),
+    );
     const context = {
       cwd: workspaceRoot,
       workspaceRoot,
       entries: [],
     }));
-    const aggregateDeclaration = readFileSync(
+    const aggregateDeclaration = await Effect.runPromise(
-      join(workspaceRoot, ".executor", "types", "index.d.ts"),
+      readTextFile(join(workspaceRoot, ".executor", "types", "index.d.ts")),
-      "utf8",
     );
     expect(aggregateDeclaration).toContain("export type ExecutorSourceTools = {};");
-    expect(() =>
+    expect(
-      readFileSync(
+      await Effect.runPromise(
-        join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
+        fileExists(
-        "utf8",
+          join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
-      )
+        ),
-    ).toThrow();
+      ),
+    ).toBe(false);
   });
   it("falls back to unknown for unsupported declaration-only shape nodes", async () => {
-    const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-types-unsupported-"));
+    const workspaceRoot = await Effect.runPromise(
+      makeTempDirectory("executor-types-unsupported-"),
+    );
     const context = {
       cwd: workspaceRoot,
       workspaceRoot,
       entries: [{ source: makeSource({ id: "src_linear" }), snapshot }],
     }));
-    const sourceDeclaration = readFileSync(
+    const sourceDeclaration = await Effect.runPromise(
-      join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
+      readTextFile(
-      "utf8",
+        join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
+      ),
     );
     expect(sourceDeclaration).toContain("unsupportedNot?: unknown;");
   });
   it("renders object unions as discriminated unions with shared fields", async () => {
-    const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-types-union-"));
+    const workspaceRoot = await Effect.runPromise(
+      makeTempDirectory("executor-types-union-"),
+    );
     const context = {
       cwd: workspaceRoot,
       workspaceRoot,
       entries: [{ source: makeSource({ id: "src_linear" }), snapshot }],
     }));
-    const sourceDeclaration = readFileSync(
+    const sourceDeclaration = await Effect.runPromise(
-      join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
+      readTextFile(
-      "utf8",
+        join(workspaceRoot, ".executor", "types", "sources", "src_linear.d.ts"),
+      ),
     );
     expect(sourceDeclaration).toContain("teams: (args?: LinearTeamsCall) => Promise<{");

packages/platform/control-plane/src/runtime/control-plane-runtime.test.ts+2−3

 import { createServer } from "node:http";
-import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { FileSystem } from "@effect/platform";
       );
       const configPath = join(workspaceRoot, ".executor", "executor.jsonc");
-      const createdConfig = JSON.parse(readFileSync(configPath, "utf8")) as {
+      const createdConfig = JSON.parse(yield* fs.readFileString(configPath, "utf8")) as {
         sources?: Record<string, { kind: string; connection: { endpoint: string } }>;
       };
       expect(createdConfig.sources?.github?.kind).toBe("openapi");
       );
       expect(removed.removed).toBe(true);
-      const removedConfig = JSON.parse(readFileSync(configPath, "utf8")) as {
+      const removedConfig = JSON.parse(yield* fs.readFileString(configPath, "utf8")) as {
         sources?: Record<string, unknown>;
       };
       expect(removedConfig.sources?.github).toBeUndefined();

packages/platform/control-plane/src/runtime/execution/http.test.ts+9−3

-import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 };
 const makeRuntime = Effect.acquireRelease(
-  Effect.sync(() => {
+  Effect.gen(function* () {
-    const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-execution-http-"));
+    const fs = yield* FileSystem.FileSystem;
+    const workspaceRoot = yield* fs.makeTempDirectory({
+      directory: tmpdir(),
+      prefix: "executor-execution-http-",
+    });
     return {
       workspaceRoot,
       homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
     };
   }).pipe(
+    Effect.provide(NodeFileSystem.layer),
     Effect.flatMap(({ workspaceRoot, homeConfigPath, homeStateDirectory }) =>
       createControlPlaneRuntime({
         localDataDir: ":memory:",

packages/platform/control-plane/src/runtime/execution/mcp-resume.test.ts+8−3

 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import { assertTrue } from "@effect/vitest/utils";
 import * as Effect from "effect/Effect";
   it.scoped("keeps live form elicitation resumable without replaying the run", () =>
     Effect.gen(function* () {
       const mcpServer = yield* makeFormElicitationServer;
-      const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-execution-mcp-resume-"));
+      const fs = yield* FileSystem.FileSystem;
+      const workspaceRoot = yield* fs.makeTempDirectory({
+        directory: tmpdir(),
+        prefix: "executor-execution-mcp-resume-",
+      });
       const runtime = yield* Effect.acquireRelease(
         createControlPlaneRuntime({
           localDataDir: ":memory:",
       expect(resumed.pendingInteraction).toBeNull();
       expect(resumed.execution.resultJson).toContain("approved:from-control-plane");
-    }),
+    }).pipe(Effect.provide(NodeFileSystem.layer)),
     60_000,
   );
 });

packages/platform/control-plane/src/runtime/execution/runtime-config.test.ts+25−17

-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 const writeProjectConfig = (
   workspaceRoot: string,
   config: Record<string, unknown>,
-) => {
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
   const configDirectory = join(workspaceRoot, ".executor");
-  mkdirSync(configDirectory, { recursive: true });
+    yield* fs.makeDirectory(configDirectory, { recursive: true });
-  writeFileSync(
+    yield* fs.writeFileString(
-    join(configDirectory, "executor.jsonc"),
+      join(configDirectory, "executor.jsonc"),
-    `${JSON.stringify(config, null, 2)}\n`,
+      `${JSON.stringify(config, null, 2)}\n`,
-    "utf8",
+    );
-  );
+  });
-};
 const makeRuntime = (config: Record<string, unknown>) => {
-  const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-runtime-config-"));
-  writeProjectConfig(workspaceRoot, config);
   return Effect.acquireRelease(
-    createControlPlaneRuntime({
+    Effect.gen(function* () {
-      workspaceRoot,
+      const fs = yield* FileSystem.FileSystem;
-      homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),
+      const workspaceRoot = yield* fs.makeTempDirectory({
-      homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
+        directory: tmpdir(),
-    }),
+        prefix: "executor-runtime-config-",
+      });
+      yield* writeProjectConfig(workspaceRoot, config);
+      return yield* createControlPlaneRuntime({
+        workspaceRoot,
+        homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),
+        homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
+      });
+    }).pipe(Effect.provide(NodeFileSystem.layer)),
     (runtime) => Effect.promise(() => runtime.close()).pipe(Effect.orDie),
   );
 };

packages/platform/control-plane/src/runtime/index.ts+11−2

+import { FileSystem } from "@effect/platform";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
 import * as ManagedRuntime from "effect/ManagedRuntime";
 import * as Scope from "effect/Scope";
 import { NodeFileSystem } from "@effect/platform-node";
+import { clearAllMcpConnectionPools } from "@executor/source-mcp";
 import { type ControlPlaneApiRuntimeContext } from "#api";
 import type { LocalInstallation } from "#schema";
     const installationStore = LocalInstallationStore;
     const workspaceConfigStore = LocalWorkspaceConfigStore;
+    const fileSystem = yield* FileSystem.FileSystem;
     const localInstallation = yield* installationStore.getOrProvision({
       context: localWorkspaceContext,
       ),
     );
-    const persistence = createLocalControlPlanePersistence(localWorkspaceContext);
+    const persistence = createLocalControlPlanePersistence(
+      localWorkspaceContext,
+      fileSystem,
+    );
     const rows = persistence.rows;
     const loadedLocalConfig = yield* workspaceConfigStore.load(
       localInstallation,
       managedRuntime,
       runtimeLayer: concreteRuntimeLayer as RuntimeControlPlaneLayer,
-      close: () => managedRuntime.dispose().catch(() => {}),
+      close: async () => {
+        await clearAllMcpConnectionPools().catch(() => undefined);
+        await managedRuntime.dispose().catch(() => undefined);
+      },
     };
   }).pipe(Effect.provide(NodeFileSystem.layer));

packages/platform/control-plane/src/runtime/local/config.test.ts+21−19

-import { mkdtempSync } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { FileSystem } from "@effect/platform";
 import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 } from "./config";
 const makeWorkspaceRoot = () =>
-  mkdtempSync(join(tmpdir(), "executor-local-config-"));
+  FileSystem.FileSystem.pipe(
+    Effect.flatMap((fs) =>
+      fs.makeTempDirectory({
+        directory: tmpdir(),
+        prefix: "executor-local-config-",
+      })
+    ),
+  );
 describe("local-config", () => {
   it.effect("parses jsonc project config with comments and trailing commas", () =>
     Effect.gen(function* () {
-      const workspaceRoot = makeWorkspaceRoot();
+      const fs = yield* FileSystem.FileSystem;
+      const workspaceRoot = yield* makeWorkspaceRoot();
       const configDirectory = join(workspaceRoot, ".executor");
-      yield* Effect.promise(() => mkdir(configDirectory, { recursive: true }));
+      yield* fs.makeDirectory(configDirectory, { recursive: true });
-      yield* Effect.promise(() =>
+      yield* fs.writeFileString(
-        writeFile(
+        join(configDirectory, "executor.jsonc"),
-          join(configDirectory, "executor.jsonc"),
+        `{
-          `{
   "runtime": "ses",
   // local workspace config
   "sources": {
   },
 }
 `,
-          "utf8",
-        ),
       );
       const context = yield* resolveLocalWorkspaceContext({ workspaceRoot });
   it.effect("reports jsonc syntax errors with line and column details", () =>
     Effect.gen(function* () {
-      const workspaceRoot = makeWorkspaceRoot();
+      const fs = yield* FileSystem.FileSystem;
+      const workspaceRoot = yield* makeWorkspaceRoot();
       const configDirectory = join(workspaceRoot, ".executor");
-      yield* Effect.promise(() => mkdir(configDirectory, { recursive: true }));
+      yield* fs.makeDirectory(configDirectory, { recursive: true });
-      yield* Effect.promise(() =>
+      yield* fs.writeFileString(
-        writeFile(
+        join(configDirectory, "executor.jsonc"),
-          join(configDirectory, "executor.jsonc"),
+        `{
-          `{
   "sources": {
     "github": {
       "kind": "openapi"
   }
 }
 `,
-          "utf8",
-        ),
       );
       const context = yield* resolveLocalWorkspaceContext({ workspaceRoot });

packages/platform/control-plane/src/runtime/local/control-plane-store.test.ts+31−20

-import { existsSync, mkdtempSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
   writeLocalControlPlaneState,
 } from "./control-plane-store";
-const makeContext = (): ResolvedLocalWorkspaceContext => {
+const makeContext = (): Effect.Effect<
-  const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-control-plane-store-"));
+  ResolvedLocalWorkspaceContext,
+  never,
+  FileSystem.FileSystem
+> =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const workspaceRoot = yield* fs.makeTempDirectory({
+      directory: tmpdir(),
+      prefix: "executor-control-plane-store-",
+    }).pipe(Effect.orDie);
-  return {
+    return {
-    cwd: workspaceRoot,
+      cwd: workspaceRoot,
-    workspaceRoot,
+      workspaceRoot,
-    workspaceName: "executor-control-plane-store",
+      workspaceName: "executor-control-plane-store",
-    configDirectory: join(workspaceRoot, ".executor"),
+      configDirectory: join(workspaceRoot, ".executor"),
-    projectConfigPath: join(workspaceRoot, ".executor", "executor.jsonc"),
+      projectConfigPath: join(workspaceRoot, ".executor", "executor.jsonc"),
-    homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),
+      homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),
-    homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
+      homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
-    artifactsDirectory: join(workspaceRoot, ".executor", "artifacts"),
+      artifactsDirectory: join(workspaceRoot, ".executor", "artifacts"),
-    stateDirectory: join(workspaceRoot, ".executor", "state"),
+      stateDirectory: join(workspaceRoot, ".executor", "state"),
-  };
+    };
-};
+  });
 describe("local-control-plane-store", () => {
   it.effect("stores secret-bearing control-plane state outside the workspace", () =>
     Effect.gen(function* () {
-      const context = makeContext();
+      const fs = yield* FileSystem.FileSystem;
+      const context = yield* makeContext();
       const expectedPath = localControlPlaneStatePath(context);
       const workspacePath = join(context.stateDirectory, "control-plane-state.json");
       });
       expect(expectedPath.startsWith(context.homeStateDirectory)).toBe(true);
-      expect(existsSync(expectedPath)).toBe(true);
+      expect(yield* fs.exists(expectedPath)).toBe(true);
-      expect(existsSync(workspacePath)).toBe(false);
+      expect(yield* fs.exists(workspacePath)).toBe(false);
       const loaded = yield* loadLocalControlPlaneState(context);
       expect(loaded.version).toBe(1);
       expect(loaded.secretMaterials).toEqual([]);
       if (process.platform !== "win32") {
-        expect(statSync(expectedPath).mode & 0o777).toBe(0o600);
+        expect((yield* fs.stat(expectedPath)).mode & 0o777).toBe(0o600);
       }
-    }),
+    }).pipe(Effect.provide(NodeFileSystem.layer)),
   );
 });

packages/platform/control-plane/src/runtime/local/control-plane-store.ts+68−41

@@ -1,7 +1,7 @@
1	import { randomUUID } from "node:crypto";	1	import { randomUUID } from "node:crypto";
2	import { existsSync } from "node:fs";
3	import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
4	import { dirname, join } from "node:path";	2	import { dirname, join } from "node:path";
		3	import { FileSystem } from "@effect/platform";
		4	import { NodeFileSystem } from "@effect/platform-node";
5		5
6	import {	6	import {
7	AuthArtifactSchema,	7	AuthArtifactSchema,
@@ -60,7 +60,7 @@ export type LocalControlPlanePersistence = { · 52 unmodified lines
60	close: () => Promise<void>;	60	close: () => Promise<void>;
61	};	61	};
62		62
63	const decodeLocalControlPlaneState = Schema.decodeUnknownSync(	63	const decodeLocalControlPlaneState = Schema.decodeUnknown(
64	LocalControlPlaneStateSchema,	64	LocalControlPlaneStateSchema,
65	);	65	);
66		66
@@ -118,54 +118,74 @@ const localControlPlaneStatePath = ( · 51 unmodified lines
118	LOCAL_CONTROL_PLANE_STATE_BASENAME,	118	LOCAL_CONTROL_PLANE_STATE_BASENAME,
119	);	119	);
120		120
121	const readStateFromDisk = async (	121	const bindFileSystem = <A, E>(
		122	fileSystem: FileSystem.FileSystem,
		123	effect: Effect.Effect<A, E, FileSystem.FileSystem>,
		124	): Effect.Effect<A, E, never> =>
		125	effect.pipe(Effect.provideService(FileSystem.FileSystem, fileSystem));
		126
		127	const bindNodeFileSystem = <A, E>(
		128	effect: Effect.Effect<A, E, FileSystem.FileSystem>,
		129	): Effect.Effect<A, E, never> =>
		130	effect.pipe(Effect.provide(NodeFileSystem.layer));
		131
		132	const readStateFromDisk = (
122	context: ResolvedLocalWorkspaceContext,	133	context: ResolvedLocalWorkspaceContext,
123	): Promise<LocalControlPlaneState> => {	134	): Effect.Effect<LocalControlPlaneState, LocalFileSystemError, FileSystem.FileSystem> =>
124	const path = localControlPlaneStatePath(context);	135	Effect.gen(function* () {
125	if (!existsSync(path)) {	136	const fs = yield* FileSystem.FileSystem;
126	return defaultLocalControlPlaneState();	137	const path = localControlPlaneStatePath(context);
127	}	138	const exists = yield* fs.exists(path).pipe(
		139	Effect.mapError(mapFileSystemError(path, "check control plane state path")),
		140	);
		141	if (!exists) {
		142	return defaultLocalControlPlaneState();
		143	}
128		144
129	const content = await readFile(path, "utf8");	145	const content = yield* fs.readFileString(path, "utf8").pipe(
130	return decodeLocalControlPlaneState(JSON.parse(content) as unknown);	146	Effect.mapError(mapFileSystemError(path, "read control plane state")),
131	};	147	);
		148	const parsed = yield* Effect.try({
		149	try: () => JSON.parse(content) as unknown,
		150	catch: mapFileSystemError(path, "parse control plane state"),
		151	});
		152	return yield* decodeLocalControlPlaneState(parsed).pipe(
		153	Effect.mapError(mapFileSystemError(path, "decode control plane state")),
		154	);
		155	});
132		156
133	const writeStateToDisk = async (	157	const writeStateToDisk = (
134	context: ResolvedLocalWorkspaceContext,	158	context: ResolvedLocalWorkspaceContext,
135	state: LocalControlPlaneState,	159	state: LocalControlPlaneState,
136	): Promise<void> => {	160	): Effect.Effect<void, LocalFileSystemError, FileSystem.FileSystem> =>
137	const path = localControlPlaneStatePath(context);	161	Effect.gen(function* () {
138	await mkdir(dirname(path), { recursive: true });	162	const fs = yield* FileSystem.FileSystem;
139	const tempPath = `${path}.${randomUUID()}.tmp`;	163	const path = localControlPlaneStatePath(context);
140	await writeFile(tempPath, `${JSON.stringify(state, null, 2)}\n`, {	164	const tempPath = `${path}.${randomUUID()}.tmp`;
141	encoding: "utf8",	165
142	mode: 0o600,	166	yield* fs.makeDirectory(dirname(path), { recursive: true }).pipe(
		167	Effect.mapError(mapFileSystemError(dirname(path), "create control plane state directory")),
		168	);
		169	yield* fs.writeFileString(tempPath, `${JSON.stringify(state, null, 2)}\n`, {
		170	mode: 0o600,
		171	}).pipe(
		172	Effect.mapError(mapFileSystemError(tempPath, "write control plane state")),
		173	);
		174	yield* fs.rename(tempPath, path).pipe(
		175	Effect.mapError(mapFileSystemError(path, "replace control plane state")),
		176	);
143	});	177	});
144	await rename(tempPath, path);
145	};
146		178
147	export const loadLocalControlPlaneState = (	179	export const loadLocalControlPlaneState = (
148	context: ResolvedLocalWorkspaceContext,	180	context: ResolvedLocalWorkspaceContext,
149	): Effect.Effect<LocalControlPlaneState, LocalFileSystemError> =>	181	): Effect.Effect<LocalControlPlaneState, LocalFileSystemError> =>
150	Effect.tryPromise({	182	bindNodeFileSystem(readStateFromDisk(context));
151	try: () => readStateFromDisk(context),
152	catch: mapFileSystemError(
153	localControlPlaneStatePath(context),
154	"read control plane state",
155	),
156	});
157		183
158	export const writeLocalControlPlaneState = (input: {	184	export const writeLocalControlPlaneState = (input: {
159	context: ResolvedLocalWorkspaceContext;	185	context: ResolvedLocalWorkspaceContext;
160	state: LocalControlPlaneState;	186	state: LocalControlPlaneState;
161	}): Effect.Effect<void, LocalFileSystemError> =>	187	}): Effect.Effect<void, LocalFileSystemError> =>
162	Effect.tryPromise({	188	bindNodeFileSystem(writeStateToDisk(input.context, input.state));
163	try: () => writeStateToDisk(input.context, input.state),
164	catch: mapFileSystemError(
165	localControlPlaneStatePath(input.context),
166	"write control plane state",
167	),
168	});
169		189
170	const mergeById = <T extends { id: string }>(	190	const mergeById = <T extends { id: string }>(
171	current: readonly T[],	191	current: readonly T[],
@@ -338,16 +358,21 @@ type StateMutationResult<A> = { · 166 unmodified lines
338	value: A;	358	value: A;
339	};	359	};
340		360
341	const createStateManager = (context: ResolvedLocalWorkspaceContext) => {	361	const createStateManager = (
		362	context: ResolvedLocalWorkspaceContext,
		363	fileSystem: FileSystem.FileSystem,
		364	) => {
342	let cache: LocalControlPlaneState \| null = null;	365	let cache: LocalControlPlaneState \| null = null;
343	let mutationQueue: Promise<void> = Promise.resolve();	366	let mutationQueue: Promise<void> = Promise.resolve();
		367	const run = <A, E>(effect: Effect.Effect<A, E, FileSystem.FileSystem>) =>
		368	Effect.runPromise(bindFileSystem(fileSystem, effect));
344		369
345	const ensureLoaded = async (): Promise<LocalControlPlaneState> => {	370	const ensureLoaded = async (): Promise<LocalControlPlaneState> => {
346	if (cache !== null) {	371	if (cache !== null) {
347	return cache;	372	return cache;
348	}	373	}
349		374
350	cache = await readStateFromDisk(context);	375	cache = await run(readStateFromDisk(context));
351	return cache;	376	return cache;
352	};	377	};
353		378
@@ -381,7 +406,7 @@ const createStateManager = (context: ResolvedLocalWorkspaceContext) => { · 27 unmodified lines
381	const result = await operation(current);	406	const result = await operation(current);
382	cache = result.state;	407	cache = result.state;
383	value = result.value;	408	value = result.value;
384	await writeStateToDisk(context, cache);	409	await run(writeStateToDisk(context, cache));
385	} catch (cause) {	410	} catch (cause) {
386	failure = cause;	411	failure = cause;
387	}	412	}
@@ -409,8 +434,9 @@ const createStateManager = (context: ResolvedLocalWorkspaceContext) => { · 21 unmodified lines
409		434
410	export const createLocalControlPlaneStore = (	435	export const createLocalControlPlaneStore = (
411	context: ResolvedLocalWorkspaceContext,	436	context: ResolvedLocalWorkspaceContext,
		437	fileSystem: FileSystem.FileSystem,
412	) => {	438	) => {
413	const stateManager = createStateManager(context);	439	const stateManager = createStateManager(context, fileSystem);
414		440
415	return {	441	return {
416	authArtifacts: {	442	authArtifacts: {
@@ -1189,8 +1215,9 @@ export type LocalControlPlaneStore = ReturnType<typeof createLocalControlPlaneSt · 772 unmodified lines
1189		1215
1190	export const createLocalControlPlanePersistence = (	1216	export const createLocalControlPlanePersistence = (
1191	context: ResolvedLocalWorkspaceContext,	1217	context: ResolvedLocalWorkspaceContext,
		1218	fileSystem: FileSystem.FileSystem,
1192	): LocalControlPlanePersistence => ({	1219	): LocalControlPlanePersistence => ({
1193	rows: createLocalControlPlaneStore(context),	1220	rows: createLocalControlPlaneStore(context, fileSystem),
1194	close: async () => {},	1221	close: async () => {},
1195	});	1222	});
1196		1223

packages/platform/control-plane/src/runtime/local/installation.test.ts+32−19

-import { existsSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { FileSystem } from "@effect/platform";
 import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import { getOrProvisionLocalInstallation } from "./installation";
 import { resolveLocalWorkspaceContext } from "./config";
-const TEST_WORKSPACE_ROOT = mkdtempSync(join(tmpdir(), "executor-local-installation-"));
-const TEST_HOME_CONFIG_PATH = join(TEST_WORKSPACE_ROOT, ".executor-home.jsonc");
-const TEST_HOME_STATE_DIRECTORY = join(TEST_WORKSPACE_ROOT, ".executor-home-state");
 const makeRuntime = Effect.acquireRelease(
-  createControlPlaneRuntime({
+  Effect.gen(function* () {
-    localDataDir: ":memory:",
+    const fs = yield* FileSystem.FileSystem;
-    workspaceRoot: TEST_WORKSPACE_ROOT,
+    const workspaceRoot = yield* fs.makeTempDirectory({
-    homeConfigPath: TEST_HOME_CONFIG_PATH,
+      directory: tmpdir(),
-    homeStateDirectory: TEST_HOME_STATE_DIRECTORY,
+      prefix: "executor-local-installation-",
-  }),
+    });
-  (runtime) => Effect.promise(() => runtime.close()).pipe(Effect.orDie),
+    const homeConfigPath = join(workspaceRoot, ".executor-home.jsonc");
+    const homeStateDirectory = join(workspaceRoot, ".executor-home-state");
+    const runtime = yield* createControlPlaneRuntime({
+      localDataDir: ":memory:",
+      workspaceRoot,
+      homeConfigPath,
+      homeStateDirectory,
+    });
+    return {
+      runtime,
+      workspaceRoot,
+      homeConfigPath,
+      homeStateDirectory,
+    };
+  }).pipe(Effect.provide(NodeFileSystem.layer)),
+  ({ runtime }) => Effect.promise(() => runtime.close()).pipe(Effect.orDie),
 );
 describe("local-installation", () => {
   it.scoped("derives a stable local identity on first boot", () =>
     Effect.gen(function* () {
-      const runtime = yield* makeRuntime;
+      const { runtime, workspaceRoot } = yield* makeRuntime;
       const installation = runtime.localInstallation;
+      const fs = yield* FileSystem.FileSystem;
       expect(installation.accountId).toBe("acc_local_default");
       expect(installation.workspaceId.startsWith("ws_local_")).toBe(true);
-      expect(existsSync(join(TEST_WORKSPACE_ROOT, ".executor", "executor.jsonc"))).toBe(false);
+      expect(yield* fs.exists(join(workspaceRoot, ".executor", "executor.jsonc"))).toBe(false);
-    }),
+    }).pipe(Effect.provide(NodeFileSystem.layer)),
     60_000,
   );
   it.scoped("is idempotent when loading the default local installation", () =>
     Effect.gen(function* () {
-      const runtime = yield* makeRuntime;
+      const { runtime, workspaceRoot, homeConfigPath, homeStateDirectory } = yield* makeRuntime;
       const context = yield* resolveLocalWorkspaceContext({
-        workspaceRoot: TEST_WORKSPACE_ROOT,
+        workspaceRoot,
-        homeConfigPath: TEST_HOME_CONFIG_PATH,
+        homeConfigPath,
-        homeStateDirectory: TEST_HOME_STATE_DIRECTORY,
+        homeStateDirectory,
       });
       const first = runtime.localInstallation;

packages/platform/control-plane/src/runtime/local/secret-material-providers.ts+167−124

@@ -1,8 +1,8 @@
1	import { randomUUID } from "node:crypto";	1	import { randomUUID } from "node:crypto";
2	import { spawn } from "node:child_process";	2	import { spawn } from "node:child_process";
3	import { promises as fs } from "node:fs";
4	import { lstatSync, realpathSync } from "node:fs";
5	import { isAbsolute } from "node:path";	3	import { isAbsolute } from "node:path";
		4	import { FileSystem } from "@effect/platform";
		5	import { NodeFileSystem } from "@effect/platform-node";
6		6
7	import {	7	import {
8	type LocalConfigSecretProvider,	8	type LocalConfigSecretProvider,
@@ -29,6 +29,9 @@ export const PARAMS_SECRET_PROVIDER_ID = "params"; · 20 unmodified lines
29	export const KEYCHAIN_SECRET_PROVIDER_ID = "keychain";	29	export const KEYCHAIN_SECRET_PROVIDER_ID = "keychain";
30	export const LOCAL_SECRET_PROVIDER_ID = "local";	30	export const LOCAL_SECRET_PROVIDER_ID = "local";
31		31
		32	const toError = (cause: unknown): Error =>
		33	cause instanceof Error ? cause : new Error(String(cause));
		34
32	export type SecretStoreProviderId =	35	export type SecretStoreProviderId =
33	\| typeof KEYCHAIN_SECRET_PROVIDER_ID	36	\| typeof KEYCHAIN_SECRET_PROVIDER_ID
34	\| typeof LOCAL_SECRET_PROVIDER_ID;	37	\| typeof LOCAL_SECRET_PROVIDER_ID;
@@ -856,151 +859,191 @@ const createSecretMaterialProviderRuntime = (input: { · 821 unmodified lines
856	workspaceRoot: input.workspaceRoot ?? null,	859	workspaceRoot: input.workspaceRoot ?? null,
857	});	860	});
858		861
859	const isRegularFilePath = (path: string, allowSymlink: boolean): boolean => {	862	const isRegularFilePath = (
860	const stat = lstatSync(path);	863	path: string,
861	if (stat.isSymbolicLink()) {	864	allowSymlink: boolean,
862	if (!allowSymlink) {	865	): Effect.Effect<boolean, Error, FileSystem.FileSystem> =>
863	return false;	866	Effect.gen(function* () {
		867	const fs = yield* FileSystem.FileSystem;
		868	const stat = yield* fs.stat(path).pipe(Effect.mapError(toError));
		869	if (stat.type === "SymbolicLink") {
		870	if (!allowSymlink) {
		871	return false;
		872	}
		873
		874	const resolvedPath = yield* fs.realPath(path).pipe(Effect.mapError(toError));
		875	const targetStat = yield* fs.stat(resolvedPath).pipe(Effect.mapError(toError));
		876	return targetStat.type === "File";
864	}	877	}
865	const targetStat = lstatSync(realpathSync(path));
866	return targetStat.isFile();
867	}
868	return stat.isFile();
869	};
870		878
871	const ensureTrustedDir = (path: string, trustedDirs: readonly string[] \| undefined): boolean => {	879	return stat.type === "File";
872	if (!trustedDirs \|\| trustedDirs.length === 0) {	880	});
873	return true;	881
874	}	882	const ensureTrustedDir = (
		883	path: string,
		884	trustedDirs: readonly string[] \| undefined,
		885	): Effect.Effect<boolean, Error, FileSystem.FileSystem> =>
		886	Effect.gen(function* () {
		887	if (!trustedDirs \|\| trustedDirs.length === 0) {
		888	return true;
		889	}
		890
		891	const fs = yield* FileSystem.FileSystem;
		892	const real = yield* fs.realPath(path).pipe(Effect.mapError(toError));
		893
		894	for (const dir of trustedDirs) {
		895	const trusted = yield* fs.realPath(dir).pipe(Effect.mapError(toError));
		896	if (real === trusted \|\| real.startsWith(`${trusted}/`)) {
		897	return true;
		898	}
		899	}
875		900
876	const real = realpathSync(path);	901	return false;
877	return trustedDirs.some((dir) => {
878	const trusted = realpathSync(dir);
879	return real === trusted \|\| real.startsWith(`${trusted}/`);
880	});	902	});
881	};
882		903
883	const readFileSecretValue = (input: {	904	const readFileSecretValue = (input: {
884	provider: Extract<LocalConfigSecretProvider, { source: "file" }>;	905	provider: Extract<LocalConfigSecretProvider, { source: "file" }>;
885	ref: SecretRef;	906	ref: SecretRef;
886	workspaceRoot: string;	907	workspaceRoot: string;
887	}): Effect.Effect<string, Error, never> =>	908	}): Effect.Effect<string, Error, FileSystem.FileSystem> =>
888	Effect.tryPromise({	909	Effect.gen(function* () {
889	try: async () => {	910	const fs = yield* FileSystem.FileSystem;
890	const resolvedPath = resolveConfigRelativePath({	911	const resolvedPath = resolveConfigRelativePath({
891	path: input.provider.path,	912	path: input.provider.path,
892	workspaceRoot: input.workspaceRoot,	913	workspaceRoot: input.workspaceRoot,
893	});	914	});
894	const raw = await fs.readFile(resolvedPath, "utf8");	915	const raw = yield* fs.readFileString(resolvedPath, "utf8").pipe(
895	const mode = input.provider.mode ?? "singleValue";	916	Effect.mapError(toError),
896	if (mode === "singleValue") {	917	);
897	return raw.trim();	918	const mode = input.provider.mode ?? "singleValue";
898	}	919	if (mode === "singleValue") {
		920	return raw.trim();
		921	}
899		922
900	const parsed = JSON.parse(raw) as unknown;	923	return yield* Effect.try({
901	if (input.ref.handle.startsWith("/")) {	924	try: () => {
902	const segments = input.ref.handle	925	const parsed = JSON.parse(raw) as unknown;
903	.split("/")	926	if (input.ref.handle.startsWith("/")) {
904	.slice(1)	927	const segments = input.ref.handle
905	.map((segment) => segment.replaceAll("~1", "/").replaceAll("~0", "~"));	928	.split("/")
906	let current: unknown = parsed;	929	.slice(1)
907	for (const segment of segments) {	930	.map((segment) => segment.replaceAll("~1", "/").replaceAll("~0", "~"));
908	if (typeof current !== "object" \|\| current === null \|\| !(segment in current)) {	931	let current: unknown = parsed;
909	throw new Error(`Secret path not found in ${resolvedPath}: ${input.ref.handle}`);	932	for (const segment of segments) {
		933	if (typeof current !== "object" \|\| current === null \|\| !(segment in current)) {
		934	throw new Error(`Secret path not found in ${resolvedPath}: ${input.ref.handle}`);
		935	}
		936	current = (current as Record<string, unknown>)[segment];
910	}	937	}
911	current = (current as Record<string, unknown>)[segment];	938	if (typeof current !== "string" \|\| current.trim().length === 0) {
912	}	939	throw new Error(`Secret path did not resolve to a string: ${input.ref.handle}`);
913	if (typeof current !== "string" \|\| current.trim().length === 0) {	940	}
914	throw new Error(`Secret path did not resolve to a string: ${input.ref.handle}`);	941	return current;
915	}	942	}
916	return current;
917	}
918		943
919	if (typeof parsed !== "object" \|\| parsed === null) {	944	if (typeof parsed !== "object" \|\| parsed === null) {
920	throw new Error(`JSON secret provider must resolve to an object: ${resolvedPath}`);	945	throw new Error(`JSON secret provider must resolve to an object: ${resolvedPath}`);
921	}	946	}
922	const value = (parsed as Record<string, unknown>)[input.ref.handle];	947	const value = (parsed as Record<string, unknown>)[input.ref.handle];
923	if (typeof value !== "string" \|\| value.trim().length === 0) {	948	if (typeof value !== "string" \|\| value.trim().length === 0) {
924	throw new Error(`Secret key not found in ${resolvedPath}: ${input.ref.handle}`);	949	throw new Error(`Secret key not found in ${resolvedPath}: ${input.ref.handle}`);
925	}	950	}
926	return value;	951	return value;
927	},	952	},
928	catch: (cause) =>	953	catch: toError,
929	cause instanceof Error ? cause : new Error(String(cause)),	954	});
930	});	955	});
931		956
932	const resolveConfiguredSecretProvider = (input: {	957	const resolveConfiguredSecretProvider = (input: {
933	ref: SecretRef;	958	ref: SecretRef;
934	runtime: SecretMaterialProviderRuntime;	959	runtime: SecretMaterialProviderRuntime;
935	}): Effect.Effect<string, Error, never> => {	960	}): Effect.Effect<string, Error, FileSystem.FileSystem> =>
936	const providerAlias = fromConfigSecretProviderId(input.ref.providerId);	961	Effect.gen(function* () {
937	if (providerAlias === null) {	962	const providerAlias = fromConfigSecretProviderId(input.ref.providerId);
938	return Effect.fail(runtimeEffectError("local/secret-material-providers", `Unsupported secret provider: ${input.ref.providerId}`));	963	if (providerAlias === null) {
939	}	964	return yield* runtimeEffectError(
		965	"local/secret-material-providers",
		966	`Unsupported secret provider: ${input.ref.providerId}`,
		967	);
		968	}
940		969
941	const provider = input.runtime.localConfig?.secrets?.providers?.[providerAlias];	970	const provider = input.runtime.localConfig?.secrets?.providers?.[providerAlias];
942	if (!provider) {	971	if (!provider) {
943	return Effect.fail(	972	return yield* runtimeEffectError(
944	runtimeEffectError("local/secret-material-providers", `Config secret provider "${providerAlias}" is not configured`),	973	"local/secret-material-providers",
945	);	974	`Config secret provider "${providerAlias}" is not configured`,
946	}	975	);
947	if (input.runtime.workspaceRoot === null) {	976	}
948	return Effect.fail(	977	if (input.runtime.workspaceRoot === null) {
949	runtimeEffectError("local/secret-material-providers", `Config secret provider "${providerAlias}" requires a workspace root`),	978	return yield* runtimeEffectError(
950	);	979	"local/secret-material-providers",
951	}	980	`Config secret provider "${providerAlias}" requires a workspace root`,
		981	);
		982	}
952		983
953	if (provider.source === "env") {	984	if (provider.source === "env") {
954	const value = ensureNonEmptyString(input.runtime.env[input.ref.handle]);	985	const value = ensureNonEmptyString(input.runtime.env[input.ref.handle]);
955	return value === null	986	if (value === null) {
956	? Effect.fail(runtimeEffectError("local/secret-material-providers", `Environment variable ${input.ref.handle} is not set`))	987	return yield* runtimeEffectError(
957	: Effect.succeed(value);	988	"local/secret-material-providers",
958	}	989	`Environment variable ${input.ref.handle} is not set`,
		990	);
		991	}
		992	return value;
		993	}
959		994
960	if (provider.source === "file") {	995	if (provider.source === "file") {
961	return readFileSecretValue({	996	return yield* readFileSecretValue({
962	provider,	997	provider,
963	ref: input.ref,	998	ref: input.ref,
964	workspaceRoot: input.runtime.workspaceRoot,	999	workspaceRoot: input.runtime.workspaceRoot,
965	});	1000	});
966	}	1001	}
967		1002
968	const command = provider.command.trim();	1003	const command = provider.command.trim();
969	if (!isAbsolute(command)) {	1004	if (!isAbsolute(command)) {
970	return Effect.fail(	1005	return yield* runtimeEffectError(
971	runtimeEffectError("local/secret-material-providers", `Exec secret provider command must be absolute: ${command}`),	1006	"local/secret-material-providers",
972	);	1007	`Exec secret provider command must be absolute: ${command}`,
973	}	1008	);
974	if (!isRegularFilePath(command, provider.allowSymlinkCommand ?? false)) {	1009	}
975	return Effect.fail(	1010	const isRegularCommand = yield* isRegularFilePath(
976	runtimeEffectError("local/secret-material-providers", `Exec secret provider command is not an allowed regular file: ${command}`),	1011	command,
977	);	1012	provider.allowSymlinkCommand ?? false,
978	}
979	if (!ensureTrustedDir(command, provider.trustedDirs)) {
980	return Effect.fail(
981	runtimeEffectError("local/secret-material-providers", `Exec secret provider command is outside trustedDirs: ${command}`),
982	);	1013	);
983	}	1014	if (!isRegularCommand) {
		1015	return yield* runtimeEffectError(
		1016	"local/secret-material-providers",
		1017	`Exec secret provider command is not an allowed regular file: ${command}`,
		1018	);
		1019	}
		1020	const isTrustedCommand = yield* ensureTrustedDir(command, provider.trustedDirs);
		1021	if (!isTrustedCommand) {
		1022	return yield* runtimeEffectError(
		1023	"local/secret-material-providers",
		1024	`Exec secret provider command is outside trustedDirs: ${command}`,
		1025	);
		1026	}
984		1027
985	return runCommand({	1028	return yield* runCommand({
986	command,	1029	command,
987	args: [...(provider.args ?? []), input.ref.handle],	1030	args: [...(provider.args ?? []), input.ref.handle],
988	env: {	1031	env: {
989	...input.runtime.env,	1032	...input.runtime.env,
990	...provider.env,	1033	...provider.env,
991	},	1034	},
992	operation: `config-secret.get:${providerAlias}`,	1035	operation: `config-secret.get:${providerAlias}`,
993	}).pipe(	1036	}).pipe(
994	Effect.flatMap((result) =>	1037	Effect.flatMap((result) =>
995	ensureCommandSuccess({	1038	ensureCommandSuccess({
996	result,	1039	result,
997	operation: `config-secret.get:${providerAlias}`,	1040	operation: `config-secret.get:${providerAlias}`,
998	message: "Failed resolving configured exec secret",	1041	message: "Failed resolving configured exec secret",
999	}),	1042	}),
1000	),	1043	),
1001	Effect.map((result) => result.stdout.trimEnd()),	1044	Effect.map((result) => result.stdout.trimEnd()),
1002	);	1045	);
1003	};	1046	});
1004		1047
1005	export const createDefaultSecretMaterialResolver = (input: {	1048	export const createDefaultSecretMaterialResolver = (input: {
1006	rows: ControlPlaneStoreShape;	1049	rows: ControlPlaneStoreShape;
@@ -1037,7 +1080,7 @@ export const createDefaultSecretMaterialResolver = (input: { · 30 unmodified lines
1037	context: context ?? {},	1080	context: context ?? {},
1038	runtime,	1081	runtime,
1039	});	1082	});
1040	});	1083	}).pipe(Effect.provide(NodeFileSystem.layer));
1041	};	1084	};
1042		1085
1043	export const createDefaultSecretMaterialStorer = (input: {	1086	export const createDefaultSecretMaterialStorer = (input: {

packages/platform/control-plane/src/runtime/local/source-artifacts.test.ts+32−21

@@ -1,6 +1,6 @@
1	import { existsSync, mkdtempSync, readFileSync } from "node:fs";
2	import { tmpdir } from "node:os";	1	import { tmpdir } from "node:os";
3	import { join } from "node:path";	2	import { join } from "node:path";
		3	import { FileSystem } from "@effect/platform";
4	import { NodeFileSystem } from "@effect/platform-node";	4	import { NodeFileSystem } from "@effect/platform-node";
5	import { describe, expect, it } from "@effect/vitest";	5	import { describe, expect, it } from "@effect/vitest";
6	import * as Effect from "effect/Effect";	6	import * as Effect from "effect/Effect";
@@ -17,20 +17,30 @@ import { createCatalogImportMetadata } from "@executor/source-core"; · 10 unmodified lines
17	import { createGraphqlCatalogFragment } from "@executor/source-graphql";	17	import { createGraphqlCatalogFragment } from "@executor/source-graphql";
18	import { createOpenApiCatalogFragment } from "@executor/source-openapi";	18	import { createOpenApiCatalogFragment } from "@executor/source-openapi";
19		19
20	const makeContext = (): ResolvedLocalWorkspaceContext => {	20	const makeContext = (): Effect.Effect<
21	const workspaceRoot = mkdtempSync(join(tmpdir(), "executor-artifacts-"));	21	ResolvedLocalWorkspaceContext,
22	return {	22	never,
23	cwd: workspaceRoot,	23	FileSystem.FileSystem
24	workspaceRoot,	24	> =>
25	workspaceName: "executor-artifacts",	25	Effect.gen(function* () {
26	configDirectory: join(workspaceRoot, ".executor"),	26	const fs = yield* FileSystem.FileSystem;
27	projectConfigPath: join(workspaceRoot, ".executor", "executor.jsonc"),	27	const workspaceRoot = yield* fs.makeTempDirectory({
28	homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),	28	directory: tmpdir(),
29	homeStateDirectory: join(workspaceRoot, ".executor-home-state"),	29	prefix: "executor-artifacts-",
30	artifactsDirectory: join(workspaceRoot, ".executor", "artifacts"),	30	}).pipe(Effect.orDie);
31	stateDirectory: join(workspaceRoot, ".executor", "state"),	31
32	};	32	return {
33	};	33	cwd: workspaceRoot,
		34	workspaceRoot,
		35	workspaceName: "executor-artifacts",
		36	configDirectory: join(workspaceRoot, ".executor"),
		37	projectConfigPath: join(workspaceRoot, ".executor", "executor.jsonc"),
		38	homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),
		39	homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
		40	artifactsDirectory: join(workspaceRoot, ".executor", "artifacts"),
		41	stateDirectory: join(workspaceRoot, ".executor", "state"),
		42	};
		43	});
34		44
35	const makeSource = (): Source => ({	45	const makeSource = (): Source => ({
36	id: SourceIdSchema.make("src_test"),	46	id: SourceIdSchema.make("src_test"),
@@ -148,7 +158,8 @@ const makeGraphqlArtifact = () => { · 111 unmodified lines
148	describe("local-source-artifacts", () => {	158	describe("local-source-artifacts", () => {
149	it.effect("writes canonical uncompressed artifacts and reads them back", () =>	159	it.effect("writes canonical uncompressed artifacts and reads them back", () =>
150	Effect.gen(function* () {	160	Effect.gen(function* () {
151	const context = makeContext();	161	const fs = yield* FileSystem.FileSystem;
		162	const context = yield* makeContext();
152	const artifact = makeArtifact();	163	const artifact = makeArtifact();
153	const path = join(context.artifactsDirectory, "sources", "src_test.json");	164	const path = join(context.artifactsDirectory, "sources", "src_test.json");
154	const rawDocumentPath = join(	165	const rawDocumentPath = join(
@@ -165,11 +176,11 @@ describe("local-source-artifacts", () => { · 10 unmodified lines
165	artifact,	176	artifact,
166	});	177	});
167		178
168	expect(existsSync(path)).toBe(true);	179	expect(yield* fs.exists(path)).toBe(true);
169	expect(readFileSync(path, "utf8").startsWith("{")).toBe(true);	180	expect((yield* fs.readFileString(path, "utf8")).startsWith("{")).toBe(true);
170	expect(existsSync(rawDocumentPath)).toBe(true);	181	expect(yield* fs.exists(rawDocumentPath)).toBe(true);
171		182
172	const persistedArtifact = JSON.parse(readFileSync(path, "utf8"));	183	const persistedArtifact = JSON.parse(yield* fs.readFileString(path, "utf8"));
173	const persistedDocument = Object.values(	184	const persistedDocument = Object.values(
174	persistedArtifact.snapshot.catalog.documents,	185	persistedArtifact.snapshot.catalog.documents,
175	)[0] as {	186	)[0] as {
@@ -220,7 +231,7 @@ describe("local-source-artifacts", () => { · 44 unmodified lines
220	"preserves GraphQL execution metadata across a write/read round-trip",	231	"preserves GraphQL execution metadata across a write/read round-trip",
221	() =>	232	() =>
222	Effect.gen(function* () {	233	Effect.gen(function* () {
223	const context = makeContext();	234	const context = yield* makeContext();
224	const artifact = makeGraphqlArtifact();	235	const artifact = makeGraphqlArtifact();
225		236
226	yield* writeLocalSourceArtifact({	237	yield* writeLocalSourceArtifact({

packages/platform/control-plane/src/runtime/local/tools.ts+7−7

 import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
-import { dirname, extname, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { pathToFileURL } from "node:url";
 import { FileSystem } from "@effect/platform";
 import {
   createToolCatalogFromTools,
   });
 const resolveExecutorNodeModulesDirectory = (): string | null => {
-  let current = dirname(fileURLToPath(import.meta.url));
+  const require = createRequire(import.meta.url);
+  let current = dirname(require.resolve("typescript"));
   while (true) {
-    const candidate = join(current, "node_modules");
+    if (basename(current) === "node_modules") {
-    if (existsSync(candidate)) {
+      return current;
-      return candidate;
     }
     const parent = dirname(current);

packages/platform/control-plane/src/runtime/sources/source-adapter-fixture-matrix.test.ts+19−9

-import { readFileSync } from "node:fs";
 import { createServer } from "node:http";
+import { fileURLToPath } from "node:url";
 import {
+  FileSystem,
   HttpApi,
   HttpApiEndpoint,
   HttpApiGroup,
   HttpApiSchema,
   OpenApi,
 } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import {
   buildOpenApiToolPresentation,
   compileOpenApiToolDefinitions,
 const FIXTURE_WORKSPACE_ID = WorkspaceIdSchema.make("ws_source_fixture_matrix");
-const readFixture = (name: string): string =>
+const readFixture = (name: string) =>
-  readFileSync(new URL(`../fixtures/${name}`, import.meta.url), "utf8");
+  FileSystem.FileSystem.pipe(
+    Effect.flatMap((fs) =>
+      fs.readFileString(
+        fileURLToPath(new URL(`../fixtures/${name}`, import.meta.url)),
+        "utf8",
+      )
+    ),
+    Effect.provide(NodeFileSystem.layer),
+  );
 const makeSource = (input: {
   id: string;
     "imports the raw recorded Vercel OpenAPI spec into IR and discover projections",
     () =>
       Effect.gen(function* () {
-        const specText = readFixture("vercel-openapi.json");
+        const specText = yield* readFixture("vercel-openapi.json");
         const source = makeSource({
           id: "src_vercel_fixture",
           name: "Vercel",
     "imports the raw recorded Neon OpenAPI spec into IR with resolved request body schemas",
     () =>
       Effect.gen(function* () {
-        const specText = readFixture("neon-openapi.json");
+        const specText = yield* readFixture("neon-openapi.json");
         const source = makeSource({
           id: "src_neon_fixture",
           name: "Neon API",
     "imports the raw recorded Google Sheets discovery document into IR and discover projections",
     () =>
       Effect.gen(function* () {
-        const documentText = readFixture("google-sheets-discovery.json");
+        const documentText = yield* readFixture("google-sheets-discovery.json");
         const source = makeSource({
           id: "src_google_sheets_fixture",
           name: "Google Sheets",
     "projects every raw recorded Google Sheets discovery method into schemas and capabilities",
     () =>
       Effect.gen(function* () {
-        const documentText = readFixture("google-sheets-discovery.json");
+        const documentText = yield* readFixture("google-sheets-discovery.json");
         const source = makeSource({
           id: "src_google_sheets_coverage",
           name: "Google Sheets",
     "imports the raw recorded Linear GraphQL introspection dump into IR and resolves nested input refs",
     () =>
       Effect.gen(function* () {
-        const documentText = readFixture("linear-introspection.json");
+        const documentText = yield* readFixture("linear-introspection.json");
         const source = makeSource({
           id: "src_linear_fixture",
           name: "Linear GraphQL",
     "projects every raw recorded Linear GraphQL tool into schemas and capabilities",
     () =>
       Effect.gen(function* () {
-        const documentText = readFixture("linear-introspection.json");
+        const documentText = yield* readFixture("linear-introspection.json");
         const source = makeSource({
           id: "src_linear_coverage",
           name: "Linear GraphQL",

packages/platform/control-plane/src/runtime/sources/source-auth-service.ts+156−15

@@ -1,6 +1,7 @@
1	import {	1	import {
2	createSdkMcpConnector,	2	createSdkMcpConnector,
3	discoverMcpToolsFromConnector,	3	discoverMcpToolsFromConnector,
		4	isMcpStdioTransport,
4	type McpDiscoveryElicitationContext,	5	type McpDiscoveryElicitationContext,
5	} from "@executor/source-mcp";	6	} from "@executor/source-mcp";
6	import {	7	import {
@@ -125,6 +126,73 @@ const defaultNamespaceFromName = (name: string): string => { · 118 unmodified lines
125	return normalized.length > 0 ? normalized : "source";	126	return normalized.length > 0 ? normalized : "source";
126	};	127	};
127		128
		129	const defaultSourceNameFromCommand = (command: string): string => {
		130	const segments = command
		131	.split(/[\\/]+/)
		132	.map((segment) => segment.trim())
		133	.filter((segment) => segment.length > 0);
		134
		135	return segments[segments.length - 1] ?? command;
		136	};
		137
		138	const normalizeStringArray = (
		139	value: ReadonlyArray<string> \| null \| undefined,
		140	): string[] \| null => {
		141	if (!value \|\| value.length === 0) {
		142	return null;
		143	}
		144
		145	const normalized = value
		146	.map((entry) => entry.trim())
		147	.filter((entry) => entry.length > 0);
		148
		149	return normalized.length > 0 ? normalized : null;
		150	};
		151
		152	const slugifySourceLabel = (value: string): string => {
		153	const normalized = value
		154	.trim()
		155	.toLowerCase()
		156	.replace(/[^a-z0-9]+/g, "-")
		157	.replace(/^-+\|-+$/g, "");
		158
		159	return normalized.length > 0 ? normalized : "mcp";
		160	};
		161
		162	const createSyntheticMcpStdioEndpoint = (input: {
		163	endpoint?: string \| null;
		164	name?: string \| null;
		165	command?: string \| null;
		166	}): string => {
		167	const label =
		168	trimOrNull(input.name)
		169	?? trimOrNull(input.endpoint)
		170	?? trimOrNull(input.command)
		171	?? "mcp";
		172
		173	return `stdio://local/${slugifySourceLabel(label)}`;
		174	};
		175
		176	const normalizeMcpEndpoint = (input: {
		177	endpoint?: string \| null;
		178	transport?: SourceTransport \| null;
		179	command?: string \| null;
		180	name?: string \| null;
		181	}): string => {
		182	if (isMcpStdioTransport({ transport: input.transport ?? undefined, command: input.command ?? undefined })) {
		183	return normalizeEndpoint(
		184	trimOrNull(input.endpoint) ?? createSyntheticMcpStdioEndpoint(input),
		185	);
		186	}
		187
		188	const endpoint = trimOrNull(input.endpoint);
		189	if (endpoint === null) {
		190	throw new Error("Endpoint is required.");
		191	}
		192
		193	return normalizeEndpoint(endpoint);
		194	};
		195
128	const resolveSourceCredentialOauthCompleteUrl = (input: {	196	const resolveSourceCredentialOauthCompleteUrl = (input: {
129	baseUrl: string;	197	baseUrl: string;
130	workspaceId: WorkspaceId;	198	workspaceId: WorkspaceId;
@@ -152,10 +220,10 @@ const resolveWorkspaceProviderOauthCompleteUrl = (input: { · 21 unmodified lines
152	input.baseUrl,	220	input.baseUrl,
153	).toString();	221	).toString();
154		222
155	const normalizeEndpoint = (endpoint: string): string => {	223	function normalizeEndpoint(endpoint: string): string {
156	const url = new URL(endpoint.trim());	224	const url = new URL(endpoint.trim());
157	return url.toString();	225	return url.toString();
158	};	226	}
159		227
160	const defaultGoogleDiscoveryUrl = (service: string, version: string): string =>	228	const defaultGoogleDiscoveryUrl = (service: string, version: string): string =>
161	`https://www.googleapis.com/discovery/v1/apis/${encodeURIComponent(service)}/${encodeURIComponent(version)}/rest`;	229	`https://www.googleapis.com/discovery/v1/apis/${encodeURIComponent(service)}/${encodeURIComponent(version)}/rest`;
@@ -226,6 +294,10 @@ const probeMcpSourceWithoutAuth = ( · 64 unmodified lines
226	transport: bindingState.transport ?? undefined,	294	transport: bindingState.transport ?? undefined,
227	queryParams: bindingState.queryParams ?? undefined,	295	queryParams: bindingState.queryParams ?? undefined,
228	headers: bindingState.headers ?? undefined,	296	headers: bindingState.headers ?? undefined,
		297	command: bindingState.command ?? undefined,
		298	args: bindingState.args ?? undefined,
		299	env: bindingState.env ?? undefined,
		300	cwd: bindingState.cwd ?? undefined,
229	}),	301	}),
230	catch: (cause) =>	302	catch: (cause) =>
231	cause instanceof Error ? cause : new Error(String(cause)),	303	cause instanceof Error ? cause : new Error(String(cause)),
@@ -497,9 +569,16 @@ export type ExecutorAddSourceInput = · 265 unmodified lines
497	actorAccountId?: AccountId \| null;	569	actorAccountId?: AccountId \| null;
498	executionId: SourceAuthSession["executionId"];	570	executionId: SourceAuthSession["executionId"];
499	interactionId: SourceAuthSession["interactionId"];	571	interactionId: SourceAuthSession["interactionId"];
500	endpoint: string;	572	endpoint?: string \| null;
501	name?: string \| null;	573	name?: string \| null;
502	namespace?: string \| null;	574	namespace?: string \| null;
		575	transport?: SourceTransport \| null;
		576	queryParams?: StringMap \| null;
		577	headers?: StringMap \| null;
		578	command?: string \| null;
		579	args?: ReadonlyArray<string> \| null;
		580	env?: StringMap \| null;
		581	cwd?: string \| null;
503	}	582	}
504	\| {	583	\| {
505	kind: "openapi";	584	kind: "openapi";
@@ -566,13 +645,17 @@ export type ConnectMcpSourceInput = { · 60 unmodified lines
566	workspaceId: WorkspaceId;	645	workspaceId: WorkspaceId;
567	actorAccountId?: AccountId \| null;	646	actorAccountId?: AccountId \| null;
568	sourceId?: Source["id"] \| null;	647	sourceId?: Source["id"] \| null;
569	endpoint: string;	648	endpoint?: string \| null;
570	name?: string \| null;	649	name?: string \| null;
571	namespace?: string \| null;	650	namespace?: string \| null;
572	enabled?: boolean;	651	enabled?: boolean;
573	transport?: SourceTransport;	652	transport?: SourceTransport \| null;
574	queryParams?: StringMap \| null;	653	queryParams?: StringMap \| null;
575	headers?: StringMap \| null;	654	headers?: StringMap \| null;
		655	command?: string \| null;
		656	args?: ReadonlyArray<string> \| null;
		657	env?: StringMap \| null;
		658	cwd?: string \| null;
576	baseUrl?: string \| null;	659	baseUrl?: string \| null;
577	};	660	};
578		661
@@ -1549,18 +1632,21 @@ const connectMcpSourceInternal = (input: { · 970 unmodified lines
1549	sourceId?: Source["id"] \| null;	1632	sourceId?: Source["id"] \| null;
1550	executionId?: SourceAuthSession["executionId"];	1633	executionId?: SourceAuthSession["executionId"];
1551	interactionId?: SourceAuthSession["interactionId"];	1634	interactionId?: SourceAuthSession["interactionId"];
1552	endpoint: string;	1635	endpoint?: string \| null;
1553	name?: string \| null;	1636	name?: string \| null;
1554	namespace?: string \| null;	1637	namespace?: string \| null;
1555	enabled?: boolean;	1638	enabled?: boolean;
1556	transport?: SourceTransport;	1639	transport?: SourceTransport \| null;
1557	queryParams?: StringMap \| null;	1640	queryParams?: StringMap \| null;
1558	headers?: StringMap \| null;	1641	headers?: StringMap \| null;
		1642	command?: string \| null;
		1643	args?: ReadonlyArray<string> \| null;
		1644	env?: StringMap \| null;
		1645	cwd?: string \| null;
1559	mcpDiscoveryElicitation?: McpDiscoveryElicitationContext;	1646	mcpDiscoveryElicitation?: McpDiscoveryElicitationContext;
1560	resolveSecretMaterial: ResolveSecretMaterial;	1647	resolveSecretMaterial: ResolveSecretMaterial;
1561	}): Effect.Effect<McpSourceConnectResult, Error, WorkspaceStorageServices> =>	1648	}): Effect.Effect<McpSourceConnectResult, Error, WorkspaceStorageServices> =>
1562	Effect.gen(function* () {	1649	Effect.gen(function* () {
1563	const normalizedEndpoint = normalizeEndpoint(input.endpoint);
1564	const existing = yield* (	1650	const existing = yield* (
1565	input.sourceId	1651	input.sourceId
1566	? input.sourceStore.loadSourceById({	1652	? input.sourceStore.loadSourceById({
@@ -1587,21 +1673,57 @@ const connectMcpSourceInternal = (input: { · 20 unmodified lines
1587	)	1673	)
1588	);	1674	);
1589		1675
		1676	const existingBinding = existing
		1677	? yield* sourceBindingStateFromSource(existing)
		1678	: null;
		1679	const chosenCommand =
		1680	input.command !== undefined ? trimOrNull(input.command) : (existingBinding?.command ?? null);
		1681	const chosenTransport = input.transport !== undefined && input.transport !== null
		1682	? input.transport
		1683	: isMcpStdioTransport({
		1684	transport: existingBinding?.transport ?? undefined,
		1685	command: chosenCommand ?? undefined,
		1686	})
		1687	? "stdio"
		1688	: (existingBinding?.transport ?? "auto");
		1689	if (chosenTransport === "stdio" && chosenCommand === null) {
		1690	return yield* runtimeEffectError("sources/source-auth-service", "MCP stdio transport requires a command");
		1691	}
		1692	const normalizedEndpoint = normalizeMcpEndpoint({
		1693	endpoint: input.endpoint ?? existing?.endpoint ?? null,
		1694	transport: chosenTransport,
		1695	command: chosenCommand,
		1696	name: input.name ?? existing?.name ?? null,
		1697	});
1590	const chosenName =	1698	const chosenName =
1591	trimOrNull(input.name) ?? existing?.name ?? defaultSourceNameFromEndpoint(normalizedEndpoint);	1699	trimOrNull(input.name)
		1700	?? existing?.name
		1701	?? (chosenTransport === "stdio" && chosenCommand !== null
		1702	? defaultSourceNameFromCommand(chosenCommand)
		1703	: defaultSourceNameFromEndpoint(normalizedEndpoint));
1592	const chosenNamespace =	1704	const chosenNamespace =
1593	trimOrNull(input.namespace)	1705	trimOrNull(input.namespace)
1594	?? existing?.namespace	1706	?? existing?.namespace
1595	?? defaultNamespaceFromName(chosenName);	1707	?? defaultNamespaceFromName(chosenName);
1596	const chosenEnabled = input.enabled ?? existing?.enabled ?? true;	1708	const chosenEnabled = input.enabled ?? existing?.enabled ?? true;
1597	const existingBinding = existing
1598	? yield* sourceBindingStateFromSource(existing)
1599	: null;
1600	const chosenTransport = input.transport ?? existingBinding?.transport ?? "auto";
1601	const chosenQueryParams =	1709	const chosenQueryParams =
1602	input.queryParams !== undefined ? input.queryParams : (existingBinding?.queryParams ?? null);	1710	chosenTransport === "stdio"
		1711	? null
		1712	: input.queryParams !== undefined
		1713	? input.queryParams
		1714	: (existingBinding?.queryParams ?? null);
1603	const chosenHeaders =	1715	const chosenHeaders =
1604	input.headers !== undefined ? input.headers : (existingBinding?.headers ?? null);	1716	chosenTransport === "stdio"
		1717	? null
		1718	: input.headers !== undefined
		1719	? input.headers
		1720	: (existingBinding?.headers ?? null);
		1721	const chosenArgs =
		1722	input.args !== undefined ? normalizeStringArray(input.args) : (existingBinding?.args ?? null);
		1723	const chosenEnv =
		1724	input.env !== undefined ? input.env : (existingBinding?.env ?? null);
		1725	const chosenCwd =
		1726	input.cwd !== undefined ? trimOrNull(input.cwd) : (existingBinding?.cwd ?? null);
1605	const now = Date.now();	1727	const now = Date.now();
1606		1728
1607	const draftSource = existing	1729	const draftSource = existing
@@ -1617,6 +1739,10 @@ const connectMcpSourceInternal = (input: { · 9 unmodified lines
1617	transport: chosenTransport,	1739	transport: chosenTransport,
1618	queryParams: chosenQueryParams,	1740	queryParams: chosenQueryParams,
1619	headers: chosenHeaders,	1741	headers: chosenHeaders,
		1742	command: chosenCommand,
		1743	args: chosenArgs,
		1744	env: chosenEnv,
		1745	cwd: chosenCwd,
1620	},	1746	},
1621	importAuthPolicy: "reuse_runtime",	1747	importAuthPolicy: "reuse_runtime",
1622	importAuth: { kind: "none" },	1748	importAuth: { kind: "none" },
@@ -1639,6 +1765,10 @@ const connectMcpSourceInternal = (input: { · 16 unmodified lines
1639	transport: chosenTransport,	1765	transport: chosenTransport,
1640	queryParams: chosenQueryParams,	1766	queryParams: chosenQueryParams,
1641	headers: chosenHeaders,	1767	headers: chosenHeaders,
		1768	command: chosenCommand,
		1769	args: chosenArgs,
		1770	env: chosenEnv,
		1771	cwd: chosenCwd,
1642	},	1772	},
1643	importAuthPolicy: "reuse_runtime",	1773	importAuthPolicy: "reuse_runtime",
1644	importAuth: { kind: "none" },	1774	importAuth: { kind: "none" },
@@ -2681,6 +2811,13 @@ const createRuntimeSourceConnectionService = ( · 1036 unmodified lines
2681	endpoint: sourceInput.endpoint,	2811	endpoint: sourceInput.endpoint,
2682	name: sourceInput.name,	2812	name: sourceInput.name,
2683	namespace: sourceInput.namespace,	2813	namespace: sourceInput.namespace,
		2814	transport: sourceInput.transport,
		2815	queryParams: sourceInput.queryParams,
		2816	headers: sourceInput.headers,
		2817	command: sourceInput.command,
		2818	args: sourceInput.args,
		2819	env: sourceInput.env,
		2820	cwd: sourceInput.cwd,
2684	mcpDiscoveryElicitation: options?.mcpDiscoveryElicitation,	2821	mcpDiscoveryElicitation: options?.mcpDiscoveryElicitation,
2685	baseUrl: options?.baseUrl,	2822	baseUrl: options?.baseUrl,
2686	resolveSecretMaterial: input.resolveSecretMaterial,	2823	resolveSecretMaterial: input.resolveSecretMaterial,
@@ -2720,6 +2857,10 @@ const createRuntimeSourceConnectionService = ( · 33 unmodified lines
2720	transport: sourceInput.transport,	2857	transport: sourceInput.transport,
2721	queryParams: sourceInput.queryParams,	2858	queryParams: sourceInput.queryParams,
2722	headers: sourceInput.headers,	2859	headers: sourceInput.headers,
		2860	command: sourceInput.command,
		2861	args: sourceInput.args,
		2862	env: sourceInput.env,
		2863	cwd: sourceInput.cwd,
2723	baseUrl: sourceInput.baseUrl,	2864	baseUrl: sourceInput.baseUrl,
2724	resolveSecretMaterial: input.resolveSecretMaterial,	2865	resolveSecretMaterial: input.resolveSecretMaterial,
2725	}).pipe(	2866	}).pipe(

packages/platform/server/package.json+1−0

@@ -11,6 +11,7 @@ · 10 unmodified lines
11	"dependencies": {	11	"dependencies": {
12	"@effect/opentelemetry": "^0.61.0",	12	"@effect/opentelemetry": "^0.61.0",
13	"@effect/platform": "catalog:",	13	"@effect/platform": "catalog:",
		14	"@effect/platform-node": "catalog:",
14	"@executor/control-plane": "workspace:*",	15	"@executor/control-plane": "workspace:*",
15	"@executor/executor-mcp": "workspace:*",	16	"@executor/executor-mcp": "workspace:*",
16	"@opentelemetry/api": "^1.9.0",	17	"@opentelemetry/api": "^1.9.0",

packages/platform/server/src/index.ts+63−37

-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import {
   createServer as createNodeServer,
   type IncomingMessage,
 import type { AddressInfo } from "node:net";
 import { dirname, extname, resolve } from "node:path";
 import { Readable } from "node:stream";
-import { HttpApiBuilder, HttpServer } from "@effect/platform";
+import { FileSystem, HttpApiBuilder, HttpServer } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import {
   createControlPlaneApiLayer,
   createControlPlaneRuntime,
   return target.startsWith(root) ? target : null;
 };
-const isRegularFile = async (path: string): Promise<boolean> => {
+const isRegularFile = async (
+  fileSystem: FileSystem.FileSystem,
+  path: string,
+): Promise<boolean> => {
   try {
-    return (await stat(path)).isFile();
+    const info = await Effect.runPromise(fileSystem.stat(path));
+    return info.type === "File";
   } catch {
     return false;
   }
   contentTypeByExtension[extname(path).toLowerCase()] ?? "application/octet-stream";
 const readResponseFile = async (
+  fileSystem: FileSystem.FileSystem,
   path: string,
   contentType?: string,
 ): Promise<Response> => {
-  const body = await readFile(path);
+  const body = await Effect.runPromise(fileSystem.readFile(path));
-  return new Response(body, {
+  return new Response(Buffer.from(body), {
     headers: {
       "content-type": contentType ?? contentTypeForPath(path),
     },
 const wantsHtml = (request: Request): boolean =>
   request.headers.get("accept")?.includes("text/html") ?? false;
-const serveUiAsset = async (request: Request, ui: StaticUiOptions): Promise<Response | null> => {
+const serveUiAsset = async (
+  fileSystem: FileSystem.FileSystem,
+  request: Request,
+  ui: StaticUiOptions,
+): Promise<Response | null> => {
   const url = new URL(request.url);
   if (ui.devServerUrl) {
   }
   const candidatePath = safeFilePath(ui.assetsDir, url.pathname);
-  if (candidatePath && await isRegularFile(candidatePath)) {
+  if (candidatePath && await isRegularFile(fileSystem, candidatePath)) {
-    return readResponseFile(candidatePath);
+    return readResponseFile(fileSystem, candidatePath);
   }
   const shouldServeIndex =
   }
   const indexPath = resolve(ui.assetsDir, "index.html");
-  if (!(await isRegularFile(indexPath))) {
+  if (!(await isRegularFile(fileSystem, indexPath))) {
     return null;
   }
-  return readResponseFile(indexPath, "text/html; charset=utf-8");
+  return readResponseFile(fileSystem, indexPath, "text/html; charset=utf-8");
 };
 const isApiRequest = (request: Request): boolean => {
   options: StartLocalExecutorServerOptions = {},
 ): Effect.Effect<LocalExecutorRequestHandler, Error, Scope.Scope> =>
   Effect.gen(function* () {
+    const fileSystem = yield* FileSystem.FileSystem;
     const requestedLocalDataDir = options.localDataDir ?? DEFAULT_LOCAL_DATA_DIR;
     if (requestedLocalDataDir !== ":memory:") {
-      yield* Effect.tryPromise({
+      yield* fileSystem.makeDirectory(dirname(requestedLocalDataDir), {
-        try: () => mkdir(dirname(requestedLocalDataDir), { recursive: true }),
+        recursive: true,
-        catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),
+      }).pipe(
-      });
+        Effect.mapError((cause) =>
+          cause instanceof Error ? cause : new Error(String(cause)),
+        ),
+      );
     }
     let baseUrlRef: string | undefined;
         baseUrlRef = baseUrl;
       },
     } satisfies LocalExecutorRequestHandler;
-  });
+  }).pipe(Effect.provide(NodeFileSystem.layer));
 export const createLocalExecutorServer = (
   options: StartLocalExecutorServerOptions = {},
 ): Effect.Effect<LocalExecutorServer, Error, Scope.Scope> =>
   Effect.gen(function* () {
+    const fileSystem = yield* FileSystem.FileSystem;
     const host = options.host ?? DEFAULT_SERVER_HOST;
     const port = options.port ?? DEFAULT_SERVER_PORT;
     const requestHandler = yield* createLocalExecutorRequestHandler(options);
                 const request = toWebRequest(nodeRequest);
                 const response = isApiRequest(request)
                   ? await requestHandler.handleApiRequest(request)
-                  : await serveUiAsset(request, options.ui ?? {}) ?? new Response("Not Found", { status: 404 });
+                  : await serveUiAsset(fileSystem, request, options.ui ?? {}) ?? new Response("Not Found", { status: 404 });
                 await writeNodeResponse(nodeResponse, response);
               })().catch((cause) => {
                 nodeResponse.statusCode = 500;
       port: resolvedAddress.port,
       baseUrl,
     } satisfies LocalExecutorServer;
-  });
+  }).pipe(Effect.provide(NodeFileSystem.layer));
 export const runLocalExecutorServer = (
   options: StartLocalExecutorServerOptions = {},
 ): Effect.Effect<void, Error, never> =>
   Effect.scoped(
     Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
       const server = yield* createLocalExecutorServer(options);
       const pidFile = options.pidFile ?? DEFAULT_SERVER_PID_FILE;
       yield* Effect.acquireRelease(
-        Effect.tryPromise({
+        Effect.gen(function* () {
-          try: async () => {
+          yield* fileSystem.makeDirectory(dirname(pidFile), {
-            await mkdir(dirname(pidFile), { recursive: true });
+            recursive: true,
-            await writeFile(pidFile, JSON.stringify({
+          }).pipe(
-              pid: process.pid,
+            Effect.mapError((cause) =>
-              port: server.port,
+              cause instanceof Error ? cause : new Error(String(cause)),
-              host: server.host,
+            ),
-              baseUrl: server.baseUrl,
+          );
-              startedAt: Date.now(),
+          yield* fileSystem.writeFileString(pidFile, JSON.stringify({
-              logFile: DEFAULT_SERVER_LOG_FILE,
+            pid: process.pid,
-            }, null, 2));
+            port: server.port,
-          },
+            host: server.host,
-          catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
+            baseUrl: server.baseUrl,
+            startedAt: Date.now(),
+            logFile: DEFAULT_SERVER_LOG_FILE,
+          }, null, 2)).pipe(
+            Effect.mapError((cause) =>
+              cause instanceof Error ? cause : new Error(String(cause)),
+            ),
+          );
         }),
-        () => Effect.tryPromise({
+        () =>
-          try: () => rm(pidFile, { force: true }),
+          fileSystem.remove(pidFile, { force: true }).pipe(
-          catch: (cause) =>
+            Effect.mapError((cause) =>
-            cause instanceof Error ? cause : new Error(String(cause ?? "pid file cleanup failed")),
+              cause instanceof Error
-        }).pipe(Effect.orDie),
+                ? cause
+                : new Error(String(cause ?? "pid file cleanup failed")),
+            ),
+            Effect.orDie,
+          ),
       );
       console.error(`executor server listening on ${server.baseUrl}`);
         });
       });
     }),
-  );
+  ).pipe(Effect.provide(NodeFileSystem.layer));

packages/sources/openapi/src/real-spec-coverage.test.ts+15−6

-import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
   OpenApiToolManifest,
 } from "./types";
-const readFixture = (name: string): string =>
+const readFixture = (name: string) =>
-  readFileSync(
+  FileSystem.FileSystem.pipe(
-    new URL(`../../../platform/control-plane/src/runtime/fixtures/${name}`, import.meta.url),
+    Effect.flatMap((fs) =>
-    "utf8",
+      fs.readFileString(
+        fileURLToPath(
+          new URL(`../../../platform/control-plane/src/runtime/fixtures/${name}`, import.meta.url),
+        ),
+        "utf8",
+      )
+    ),
+    Effect.provide(NodeFileSystem.layer),
   );
 const asObject = (value: unknown): Record<string, unknown> =>
       `projects every ${fixture.name} operation with request/response schemas that match the raw spec`,
       () =>
         Effect.gen(function* () {
-          const specText = readFixture(fixture.filename);
+          const specText = yield* readFixture(fixture.filename);
           const document = parseOpenApiDocument(specText);
           const manifest = yield* extractOpenApiManifest(
             fixture.name.toLowerCase(),

packages/sources/openapi/src/tool-presentation.test.ts+17−8

-import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { FileSystem } from "@effect/platform";
+import { NodeFileSystem } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import { extractOpenApiManifest } from "./extraction";
 import { buildOpenApiToolPresentation } from "./tool-presentation";
-const readFixture = (name: string): string =>
+const readFixture = (name: string) =>
-  readFileSync(
+  FileSystem.FileSystem.pipe(
-    new URL(`../../../platform/control-plane/src/runtime/fixtures/${name}`, import.meta.url),
+    Effect.flatMap((fs) =>
-    "utf8",
+      fs.readFileString(
+        fileURLToPath(
+          new URL(`../../../platform/control-plane/src/runtime/fixtures/${name}`, import.meta.url),
+        ),
+        "utf8",
+      )
+    ),
+    Effect.provide(NodeFileSystem.layer),
   );
 describe("buildOpenApiToolPresentation", () => {
     "resolves request and response schemas from ref hints for the real Neon OpenAPI spec",
     () =>
       Effect.gen(function* () {
-        const specText = readFixture("neon-openapi.json");
+        const specText = yield* readFixture("neon-openapi.json");
         const manifest = yield* extractOpenApiManifest("neon", specText);
         const definition = compileOpenApiToolDefinitions(manifest).find(
           (candidate) => candidate.toolId === "apiKey.createApiKey",
     "preserves response wrappers for response-only Neon operations",
     () =>
       Effect.gen(function* () {
-        const specText = readFixture("neon-openapi.json");
+        const specText = yield* readFixture("neon-openapi.json");
         const manifest = yield* extractOpenApiManifest("neon", specText);
         const definition = compileOpenApiToolDefinitions(manifest).find(
           (candidate) => candidate.toolId === "apiKey.listApiKeys",
     "extracts parameter schemas and descriptions for parameter-only Vercel operations",
     () =>
       Effect.gen(function* () {
-        const specText = readFixture("vercel-openapi.json");
+        const specText = yield* readFixture("vercel-openapi.json");
         const manifest = yield* extractOpenApiManifest("vercel", specText);
         const definition = compileOpenApiToolDefinitions(manifest).find(
           (candidate) => candidate.toolId === "accessGroups.listAccessGroupProjects",

tools/oxlint/README.md+1−0

@@ -11,6 +11,7 @@ Why it lives here: · 10 unmodified lines
11	Current rules:	11	Current rules:
12		12
13	- `executor-monorepo/no-cross-workspace-relative-imports`	13	- `executor-monorepo/no-cross-workspace-relative-imports`
		14	- `executor-monorepo/no-node-fs-with-effect-imports`
14	- `executor-monorepo/no-raw-effect-fail-errors`	15	- `executor-monorepo/no-raw-effect-fail-errors`
15	- `executor-monorepo/no-yield-effect-fail`	16	- `executor-monorepo/no-yield-effect-fail`
16	- `executor-monorepo/no-workspace-src-imports`	17	- `executor-monorepo/no-workspace-src-imports`

tools/oxlint/plugin.mjs+2−0

 import { definePlugin } from "@oxlint/plugins";
 import noCrossWorkspaceRelativeImports from "./rules/no-cross-workspace-relative-imports.mjs";
+import noNodeFsWithEffectImports from "./rules/no-node-fs-with-effect-imports.mjs";
 import noRawEffectFailErrors from "./rules/no-raw-effect-fail-errors.mjs";
 import noYieldEffectFail from "./rules/no-yield-effect-fail.mjs";
 import noWorkspaceSrcImports from "./rules/no-workspace-src-imports.mjs";
   },
   rules: {
     "no-cross-workspace-relative-imports": noCrossWorkspaceRelativeImports,
+    "no-node-fs-with-effect-imports": noNodeFsWithEffectImports,
     "no-raw-effect-fail-errors": noRawEffectFailErrors,
     "no-yield-effect-fail": noYieldEffectFail,
     "no-workspace-src-imports": noWorkspaceSrcImports,

tools/oxlint/rules/no-node-fs-with-effect-imports.mjs+70−0

@@ -0,0 +1,70 @@
	1	import { defineRule } from "@oxlint/plugins";
	2
	3	import {
	4	createModuleSourceVisitor,
	5	readStaticSpecifier,
	6	} from "../workspace-utils.mjs";
	7
	8	const isEffectSource = (specifier) =>
	9	specifier === "effect"
	10	\|\| specifier.startsWith("effect/")
	11	\|\| specifier.startsWith("@effect/");
	12
	13	const isNodeFsSource = (specifier) =>
	14	specifier === "node:fs" \|\| specifier === "node:fs/promises";
	15
	16	export default defineRule({
	17	meta: {
	18	type: "suggestion",
	19	docs: {
	20	description:
	21	"Disallow node:fs imports in modules that already depend on Effect.",
	22	recommended: true,
	23	},
	24	messages: {
	25	noNodeFsWithEffectImports:
	26	"This module already depends on Effect. Do not import {{moduleName}} here. Depend on `FileSystem.FileSystem` from `@effect/platform` instead, and provide `NodeFileSystem.layer` only at the Node boundary or in tests.",
	27	},
	28	},
	29	create(context) {
	30	let hasEffectImport = false;
	31	const nodeFsImports = [];
	32
	33	const visitSource = (sourceNode) => {
	34	const specifier = readStaticSpecifier(sourceNode);
	35	if (!specifier) {
	36	return;
	37	}
	38
	39	if (isEffectSource(specifier)) {
	40	hasEffectImport = true;
	41	}
	42
	43	if (isNodeFsSource(specifier)) {
	44	nodeFsImports.push({
	45	moduleName: specifier,
	46	node: sourceNode,
	47	});
	48	}
	49	};
	50
	51	return {
	52	...createModuleSourceVisitor(visitSource),
	53	"Program:exit"() {
	54	if (!hasEffectImport) {
	55	return;
	56	}
	57
	58	for (const entry of nodeFsImports) {
	59	context.report({
	60	node: entry.node,
	61	messageId: "noNodeFsWithEffectImports",
	62	data: {
	63	moduleName: entry.moduleName,
	64	},
	65	});
	66	}
	67	},
	68	};
	69	},
	70	});