lael-labs/executor

apps/host-selfhost/src/apps-resolver.ts+34−44

   ToolAddress,
   isToolResult,
   type ConnectionRef,
-  type ExecuteError,
   type Owner,
   type PluginCtx,
 } from "@executor-js/sdk";
   };
 };
-const bindingError = (input: {
-  readonly integration: string;
-  readonly connection?: string;
-  readonly message: string;
-  readonly cause?: unknown;
-}): BindingError =>
-  new BindingError({
-    role: input.integration,
-    integration: input.integration,
-    requestedConnection: input.connection,
-    message: input.message,
-  });
-const executeErrorMessage = (cause: ExecuteError): string =>
-  typeof cause.message === "string" && cause.message.length > 0 ? cause.message : cause._tag;
 const toCandidate = (connection: {
   readonly address: unknown;
   readonly integration: unknown;
   listConnections: ({ integration }) =>
     input.ctx.connections.list({ integration: IntegrationSlug.make(integration) }).pipe(
       Effect.map((connections) => connections.map(toCandidate)),
-      Effect.mapError((cause) =>
+      Effect.mapError(
-        bindingError({
+        () =>
-          integration,
+          new BindingError({
-          message: `failed to list ${integration} connections`,
+            role: integration,
-          cause,
+            integration,
-        }),
+            message: `failed to list ${integration} connections`,
+          }),
       ),
     ),
       const ref = parseConnectionAddress(connection);
       if (!ref) return null;
       const row = yield* input.ctx.connections.get(ref).pipe(
-        Effect.mapError((cause) =>
+        Effect.mapError(
-          bindingError({
+          () =>
-            integration: String(ref.integration),
+            new BindingError({
-            connection,
+              role: String(ref.integration),
-            message: `failed to resolve connection ${connection}`,
+              integration: String(ref.integration),
-            cause,
+              requestedConnection: connection,
-          }),
+              message: `failed to resolve connection ${connection}`,
+            }),
         ),
       );
       return row ? toCandidate(row) : null;
     Effect.gen(function* () {
       const ref = parseConnectionAddress(connection);
       if (!ref) {
-        return yield* bindingError({
+        return yield* new BindingError({
+          role: integration,
           integration,
-          connection,
+          requestedConnection: connection,
           message: `invalid connection address ${connection}`,
         });
       }
       if (String(ref.integration) !== integration) {
-        return yield* bindingError({
+        return yield* new BindingError({
+          role: integration,
           integration,
-          connection,
+          requestedConnection: connection,
           message: `connection "${connection}" belongs to integration "${ref.integration}", not "${integration}"`,
         });
       }
       const address = ToolAddress.make(`${connection}.${tool}`);
       const payload = args[0] ?? {};
       const result = yield* input.ctx.execute(address, payload, invokeOptions).pipe(
-        Effect.mapError((cause) =>
+        Effect.mapError(
-          bindingError({
+          () =>
-            integration,
+            new BindingError({
-            connection,
+              role: integration,
-            message: executeErrorMessage(cause),
+              integration,
-            cause,
+              requestedConnection: connection,
-          }),
+              message: `failed to execute ${address}`,
+            }),
         ),
       );
       if (isToolResult(result)) {
         if (result.ok) return result.data;
-        return yield* bindingError({
+        const { message } = result.error;
+        return yield* new BindingError({
+          role: integration,
           integration,
-          connection,
+          requestedConnection: connection,
-          message: result.error.message,
+          message,
         });
       }
       return result;

apps/host-selfhost/src/apps-route.ts+18−16

 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
-import { Data, Effect, Layer } from "effect";
+import { Data, Effect, Layer, Predicate } from "effect";
 import {
   IdentityProvider,
   readonly message: string;
 }> {}
+const isAppsSyncRouteError = (failure: unknown): failure is AppsSyncRouteError =>
+  Predicate.isTagged("AppsSyncRouteError")(failure);
 const parseJson = (request: Request): Effect.Effect<unknown, AppsSyncRouteError> =>
   Effect.tryPromise({
     try: () => request.json() as Promise<unknown>,
 ): Effect.Effect<HttpServerResponse.HttpServerResponse, never, unknown> =>
   Effect.gen(function* () {
     const httpRequest = yield* HttpServerRequest.HttpServerRequest;
-    const request = yield* HttpServerRequest.toWeb(httpRequest).pipe(Effect.orDie);
+    const request = yield* HttpServerRequest.toWeb(httpRequest).pipe(
+      Effect.catch(() => Effect.succeed(null)),
+    );
+    if (request === null) {
+      return HttpServerResponse.text("Internal Server Error", { status: 500 });
+    }
     return yield* run(request).pipe(
       Effect.map((body) => HttpServerResponse.jsonUnsafe(body)),
-      Effect.catch((error: unknown) => {
+      Effect.catch((failure: unknown) => {
-        const tag =
+        if (Predicate.isTagged("Unauthorized")(failure)) {
-          error && typeof error === "object" && "_tag" in error ? String(error._tag) : null;
-        if (tag === "Unauthorized") {
           return Effect.succeed(HttpServerResponse.text("Unauthorized", { status: 401 }));
         }
-        if (tag === "NoOrganization") {
+        if (Predicate.isTagged("NoOrganization")(failure)) {
           return Effect.succeed(HttpServerResponse.text("Forbidden", { status: 403 }));
         }
-        if (tag === "Unavailable") {
+        if (Predicate.isTagged("Unavailable")(failure)) {
           return Effect.succeed(HttpServerResponse.text("Unavailable", { status: 503 }));
         }
-        if (tag === "AppsSyncRouteError") {
+        if (isAppsSyncRouteError(failure)) {
-          const routeError = error as AppsSyncRouteError;
+          const message = failure.message;
-          return Effect.succeed(
+          const status = failure.status;
-            HttpServerResponse.jsonUnsafe(
+          return Effect.succeed(HttpServerResponse.jsonUnsafe({ error: message }, { status }));
-              { error: routeError.message },
-              { status: routeError.status },
-            ),
-          );
         }
         return Effect.succeed(HttpServerResponse.text("Internal Server Error", { status: 500 }));
       }),

apps/host-selfhost/src/apps-wire.node.test.ts+58−30

 import { join } from "node:path";
 import { afterAll, beforeAll, expect, test } from "@effect/vitest";
+import { Effect, Schema } from "effect";
 import { createEmulator, type Emulator } from "@executor-js/emulate";
 const dataDir = mkdtempSync(join(tmpdir(), "eh-apps-wire-"));
   "x-test-org": TEST_ORG,
 };
+const decodeJsonText = Schema.decodeUnknownEffect(Schema.UnknownFromJsonString);
+const parseJsonText = async <T>(text: string): Promise<T> => {
+  if (text.length === 0) return null as T;
+  const value = await Effect.runPromise(decodeJsonText(text));
+  return value as T;
+};
 const findFreePort = (): Promise<number> =>
-  new Promise((resolve, reject) => {
+  Effect.runPromise(
-    const probe = createNetServer();
+    Effect.callback<number, string>((resume) => {
-    probe.once("error", reject);
+      const probe = createNetServer();
-    probe.listen(0, "127.0.0.1", () => {
+      probe.once("error", () => resume(Effect.fail("failed to find a free port")));
-      const address = probe.address();
+      probe.listen(0, "127.0.0.1", () => {
-      const port = typeof address === "object" && address ? address.port : 0;
+        const address = probe.address();
-      probe.close((error) => (error ? reject(error) : resolve(port)));
+        const port = typeof address === "object" && address ? address.port : 0;
-    });
+        probe.close((error) =>
-  });
+          error
+            ? resume(Effect.fail("failed to close free-port probe"))
+            : resume(Effect.succeed(port)),
+        );
+      });
+    }),
+  );
 const readRequestBody = async (request: IncomingMessage): Promise<Buffer | undefined> => {
   if (request.method === "GET" || request.method === "HEAD") return undefined;
 ): Promise<TestHttpServer> => {
   let port = 0;
   const server = createServer((request, response) => {
-    void (async () => {
+    void Effect.runPromise(
-      try {
+      Effect.tryPromise({
-        await sendWebResponse(await handler(await webRequestFromNode(request, port)), response);
+        try: async () => {
-      } catch (error) {
+          await sendWebResponse(await handler(await webRequestFromNode(request, port)), response);
-        response.statusCode = 500;
+        },
-        response.end(error instanceof Error ? error.message : String(error));
+        catch: () => "request failed",
-      }
+      }).pipe(
-    })();
+        Effect.catch(() =>
-  });
+          Effect.sync(() => {
-  await new Promise<void>((resolve, reject) => {
+            response.statusCode = 500;
-    server.once("error", reject);
+            response.end("request failed");
-    server.listen(0, "127.0.0.1", () => {
+          }),
-      const address = server.address();
+        ),
-      port = typeof address === "object" && address ? address.port : 0;
+      ),
-      resolve();
+    );
-    });
   });
+  await Effect.runPromise(
+    Effect.callback<void, string>((resume) => {
+      server.once("error", () => resume(Effect.fail("failed to start test server")));
+      server.listen(0, "127.0.0.1", () => {
+        const address = server.address();
+        port = typeof address === "object" && address ? address.port : 0;
+        resume(Effect.void);
+      });
+    }),
+  );
   return {
     baseUrl: `http://127.0.0.1:${port}`,
     close: () =>
-      new Promise((resolve, reject) => {
+      Effect.runPromise(
-        server.close((error) => (error ? reject(error) : resolve()));
+        Effect.callback<void, string>((resume) => {
-      }),
+          server.close((error) =>
+            error ? resume(Effect.fail("failed to close test server")) : resume(Effect.void),
+          );
+        }),
+      ),
   };
 };
   const response = await fetch(`${server.baseUrl}${path}`, init);
   const text = await response.text();
   expect(response.status).toBe(expectedStatus);
-  return (text.length > 0 ? JSON.parse(text) : null) as T;
+  return parseJsonText<T>(text);
 };
 const postJson = <T>(path: string, body: unknown, expectedStatus = 200): Promise<T> =>
   const response = await fetch(`${emulator.url}${path}`, { ...init, headers });
   const text = await response.text();
   expect(response.ok).toBe(true);
-  return (text.length > 0 ? JSON.parse(text) : null) as T;
+  return parseJsonText<T>(text);
 };
 const createIssue = (

apps/host-selfhost/src/custom-tools-console.web.test.ts+8−9

-import { describe, expect, it, vi } from "@effect/vitest";
+import { describe, expect, it } from "@effect/vitest";
 import appsClientPlugin, {
   CUSTOM_TOOLS_LABEL,
   CUSTOM_TOOLS_PLUGIN_KEY,
+  type CustomToolsFetch,
   appsIntegrationPlugin,
   formatSyncErrors,
   listCustomToolSources,
   });
   it("surfaces successful sync and source detail data", async () => {
-    const fetchImpl = vi.fn(async (input: RequestInfo | URL) => {
+    const fetchImpl: CustomToolsFetch = async (input) => {
       const url = String(input);
       if (url.endsWith("/sync")) {
         return jsonResponse({
           },
         ],
       });
-    }) as unknown as typeof fetch;
+    };
     const syncResult = await syncCustomToolSource(
       {
   });
   it("renders failed sync errors readably", async () => {
-    const fetchImpl = vi.fn(async () =>
+    const fetchImpl: CustomToolsFetch = async () =>
       jsonResponse({
         status: "failed",
         tools: [],
             diagnostics: [{ path: "tools/x.ts", message: "vendor: nope" }],
           },
         ],
-      }),
+      });
-    ) as unknown as typeof fetch;
     const result = await syncCustomToolSource(
       {
   });
   it("shows the up-to-date sync state", async () => {
-    const fetchImpl = vi.fn(async () =>
+    const fetchImpl: CustomToolsFetch = async () =>
       jsonResponse({
         status: "up-to-date",
         upstreamSha: "abc123",
         tools: ["repo-summary"],
         skipped: [],
-      }),
+      });
-    ) as unknown as typeof fetch;
     const result = await syncCustomToolSource(
       {

packages/plugins/apps/CHANGELOG.md+1−0

@@ -0,0 +1 @@
		1	# @executor-js/plugin-apps

packages/plugins/apps/src/backing/git-artifact-store.cas.test.ts+1−1

@@ -2,7 +2,7 @@ import { mkdtempSync } from "node:fs"; · 1 unmodified line
2	import { tmpdir } from "node:os";	2	import { tmpdir } from "node:os";
3	import { join } from "node:path";	3	import { join } from "node:path";
4		4
5	import { describe, expect, it } from "vitest";	5	import { describe, expect, it } from "@effect/vitest";
6	import { Effect } from "effect";	6	import { Effect } from "effect";
7		7
8	import { makeGitArtifactStore } from "./git-artifact-store";	8	import { makeGitArtifactStore } from "./git-artifact-store";

packages/plugins/apps/src/backing/git-artifact-store.ts+12−8

 // scope repo). git treats the empty string as "the ref must not already exist".
 const EMPTY_OID = "";
+const stderrText = (stderr: string | Buffer): string =>
+  Buffer.isBuffer(stderr) ? stderr.toString("utf8").trim() : String(stderr).trim();
+const gitFailureMessage = (command: string, stderr: string | Buffer): string => {
+  const detail = stderrText(stderr);
+  return detail ? `git ${command} failed: ${detail}` : `git ${command} failed`;
+};
 const run = (
   cwd: string,
   args: readonly string[],
           resume(
             Effect.fail(
               new ArtifactStoreError({
-                message: `git ${args[0]} failed: ${(stderr as Buffer)?.toString() || error.message}`,
+                message: gitFailureMessage(args[0] ?? "command", stderr),
                 cause: error,
               }),
             ),
                   resume(
                     Effect.fail(
                       new ArtifactStoreError({
-                        message: `git ${args[0]} failed: ${(stderr as Buffer)?.toString() || error.message}`,
+                        message: gitFailureMessage(args[0] ?? "command", stderr),
                         cause: error,
                       }),
                     ),
                 resume(
                   Effect.fail(
                     new ArtifactStoreError({
-                      message: `git commit-tree failed: ${(stderr as Buffer)?.toString() || error.message}`,
+                      message: gitFailureMessage("commit-tree", stderr),
                       cause: error,
                     }),
                   ),
   const init = async (key: string): Promise<ScopeArtifactStore> => {
     const repoDir = join(options.root, `${key}.git`);
     await mkdir(repoDir, { recursive: true });
-    await new Promise<void>((resolve, reject) => {
+    await Effect.runPromise(run(repoDir, ["init", "--bare", "--quiet"]));
-      execFile("git", ["init", "--bare", "--quiet"], { cwd: repoDir }, (error) =>
-        error ? reject(error) : resolve(),
-      );
-    });
     return makeScopeStore(repoDir);
   };

packages/plugins/apps/src/backing/libsql-scope-db.ts+1−1

@@ -86,7 +86,7 @@ const makeHandle = (address: ScopeAddress, client: Client): ScopeDbHandle => { · 85 unmodified lines
86	await bump(targets);	86	await bump(targets);
87	}	87	}
88	}	88	}
89	return result.rows as unknown as readonly Row[];	89	return result.rows.map((row) => row as Row);
90	},	90	},
91	catch: (cause) =>	91	catch: (cause) =>
92	new ScopeDbError({ message: `scope-db statement failed for scope ${label}`, cause }),	92	new ScopeDbError({ message: `scope-db statement failed for scope ${label}`, cause }),

packages/plugins/apps/src/backing/quickjs-tool-sandbox.test.ts+7−8

-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "@effect/vitest";
-import { Effect } from "effect";
+import { Effect, Exit } from "effect";
 import { bundleEntry } from "../pipeline/bundle";
 import { makeQuickjsToolSandbox } from "./quickjs-tool-sandbox";
       ),
     );
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
-    if (exit._tag !== "Failure") throw new Error("expected validation failure");
+    expect(JSON.stringify(exit)).toContain("InputValidationError");
-    expect(JSON.stringify(exit.cause)).toContain("InputValidationError");
+    expect(JSON.stringify(exit)).toContain("q");
-    expect(JSON.stringify(exit.cause)).toContain("q");
   });
   it("invokes raw JSON Schema tools without sandbox Standard Schema validation", async () => {
     const files = new Map([["tools/rng.ts", nondeterministic]]);
     const { code } = await run(bundleEntry({ files, entry: "tools/rng.ts" }));
     const exit = await Effect.runPromiseExit(sandbox.collect(code));
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
   });
   it("denies network (fetch throws in the sandbox)", async () => {
     const exit = await Effect.runPromiseExit(
       sandbox.invoke(code, { artifact: "net", kind: "tool", input: {}, roots: {} }, bridge),
     );
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
   });
   it("returns typed InputValidationError from promise rejection", async () => {

packages/plugins/apps/src/backing/quickjs-tool-sandbox.ts+41−37

-import { Effect } from "effect";
+import { Effect, Option, Predicate, Schema } from "effect";
 import type { SandboxToolInvoker } from "@executor-js/codemode-core";
 import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs";
 })(module, exports, require);
 `;
+const decodeJsonMarker = Schema.decodeUnknownOption(Schema.UnknownFromJsonString);
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
 const parseMarker = (message: string): unknown => {
-  const parse = (text: string): unknown => {
+  const parse = (text: string): unknown => Option.getOrNull(decodeJsonMarker(text));
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  };
   const direct = parse(message);
   if (direct) return direct;
   const firstBrace = message.indexOf("{");
 };
 const isMarker = (value: unknown, tag: string): value is Record<string, unknown> => {
-  if (value === null || typeof value !== "object") return false;
+  if (!isRecord(value)) return false;
-  return (value as { readonly _tag?: unknown })._tag === tag;
+  return Predicate.isTagged(tag)(value);
 };
 const markerMessage = (marker: Record<string, unknown>, fallback: string): string =>
   typeof marker.message === "string" ? marker.message : fallback;
 const markerIssues = (marker: Record<string, unknown>): readonly ValidationIssue[] =>
-  Array.isArray(marker.issues) ? (marker.issues as readonly ValidationIssue[]) : [];
+  Array.isArray(marker.issues) ? marker.issues.filter(isValidationIssue) : [];
+const isValidationIssue = (value: unknown): value is ValidationIssue =>
+  isRecord(value) &&
+  typeof value.message === "string" &&
+  (value.path === undefined || Array.isArray(value.path));
 // Collect driver: describe the artifact's integrations + input/output schema.
 // Deterministic JSON only — no handler execution.
 // A no-op invoker for collect: no handle calls should happen; if they do
 // (misbehaving describe path), fail loudly.
 const collectInvoker: SandboxToolInvoker = {
-  invoke: () => Effect.fail(new Error("collect must not make handle calls")) as never,
+  invoke: () =>
+    Effect.fail(
+      new ToolSandboxError({ kind: "collect", message: "collect must not make handle calls" }),
+    ),
 };
 export interface QuickjsToolSandboxOptions {
         const a = stableStringify(first);
         const b = stableStringify(second);
         if (a !== b) {
-          return yield* Effect.fail(
+          return yield* new ToolSandboxError({
-            new ToolSandboxError({
+            kind: "nondeterministic",
-              kind: "nondeterministic",
+            message:
-              message:
+              "descriptor collection is non-deterministic (an artifact read Math.random/Date.now or otherwise diverged between runs)",
-                "descriptor collection is non-deterministic (an artifact read Math.random/Date.now or otherwise diverged between runs)",
+          });
-            }),
-          );
         }
         const descriptor = first as { artifact?: string };
         const result: CollectResult = {
             // through an unexpected channel.
             if (input.path !== "__handle__") {
               return Effect.fail(
-                new Error(`unexpected sandbox bridge path: ${input.path}`),
+                new ToolSandboxError({
-              ) as never;
+                  kind: "invoke",
+                  message: `unexpected sandbox bridge path: ${input.path}`,
+                }),
+              );
             }
             const call = input.args as {
               root: string;
               args: readonly unknown[];
             };
             if (!call || typeof call.root !== "string" || !Array.isArray(call.path)) {
-              return Effect.fail(new Error("malformed sandbox bridge call")) as never;
+              return Effect.fail(
+                new ToolSandboxError({ kind: "invoke", message: "malformed sandbox bridge call" }),
+              );
             }
             return bridge.call({ root: call.root, path: call.path, args: call.args }) as never;
           },
         if (result.error) {
           const marker = parseMarker(result.error);
           if (isMarker(marker, "InputValidationError")) {
-            return yield* Effect.fail(
+            return yield* new InputValidationError({
-              new InputValidationError({
+              message: markerMessage(marker, "input validation failed"),
-                message: markerMessage(marker, "input validation failed"),
+              issues: markerIssues(marker),
-                issues: markerIssues(marker),
+            });
-              }),
-            );
           }
           if (isMarker(marker, "OutputValidationError")) {
-            return yield* Effect.fail(
+            return yield* new OutputValidationError({
-              new OutputValidationError({
+              message: markerMessage(marker, "output validation failed"),
-                message: markerMessage(marker, "output validation failed"),
+              issues: markerIssues(marker),
-                issues: markerIssues(marker),
+            });
-              }),
-            );
           }
-          return yield* Effect.fail(
+          return yield* new ToolSandboxError({ kind: "invoke", message: result.error });
-            new ToolSandboxError({ kind: "invoke", message: result.error }),
-          );
         }
         return { output: result.result, logs: result.logs ?? [] } satisfies InvokeResult;
       }),

packages/plugins/apps/src/backing/scope-collision.test.ts+1−1

@@ -2,7 +2,7 @@ import { mkdtempSync, readdirSync } from "node:fs"; · 1 unmodified line
2	import { tmpdir } from "node:os";	2	import { tmpdir } from "node:os";
3	import { join } from "node:path";	3	import { join } from "node:path";
4		4
5	import { describe, expect, it } from "vitest";	5	import { describe, expect, it } from "@effect/vitest";
6	import { Effect } from "effect";	6	import { Effect } from "effect";
7		7
8	import { makeLibsqlScopeDb } from "./libsql-scope-db";	8	import { makeLibsqlScopeDb } from "./libsql-scope-db";

packages/plugins/apps/src/backing/sqlite-apps-store.ts+35−10

 import { dirname, resolve } from "node:path";
 import { createClient, type Client } from "@libsql/client";
-import { Effect } from "effect";
+import { Effect, Schema } from "effect";
-import type { StorageFailure } from "@executor-js/sdk";
+import { StorageError, type StorageFailure } from "@executor-js/sdk";
 import type { AppDescriptor } from "../pipeline/descriptor";
 import type { AppsStore } from "../plugin/store";
 `;
 const storageFail = (message: string, cause: unknown): StorageFailure =>
-  ({ _tag: "StorageError", message, cause }) as unknown as StorageFailure;
+  new StorageError({ message, cause });
+const decodeDescriptorJson = Schema.decodeUnknownEffect(Schema.UnknownFromJsonString);
+const decodeDescriptor = (
+  value: unknown,
+  message: string,
+): Effect.Effect<AppDescriptor, StorageFailure> =>
+  decodeDescriptorJson(String(value)).pipe(
+    Effect.map((descriptor) => descriptor as AppDescriptor),
+    Effect.mapError((cause) => storageFail(message, cause)),
+  );
 export interface SqliteAppsStoreOptions {
   readonly path: string;
             args: [tenant, scope],
           });
           const row = res.rows[0];
-          return row ? (JSON.parse(String(row.descriptor)) as AppDescriptor) : null;
+          return row?.descriptor ?? null;
         },
         catch: (cause) => storageFail("getDescriptor failed", cause),
-      }),
+      }).pipe(
+        Effect.flatMap((descriptor) =>
+          descriptor === null
+            ? Effect.succeed(null)
+            : decodeDescriptor(descriptor, "getDescriptor failed"),
+        ),
+      ),
     listDescriptors: (tenant) =>
       Effect.tryPromise({
         try: async () => {
             sql: "SELECT descriptor, published_at FROM descriptors WHERE tenant = ? ORDER BY published_at DESC",
             args: [tenant],
           });
-          return res.rows.map((row) => ({
+          return res.rows;
-            descriptor: JSON.parse(String(row.descriptor)) as AppDescriptor,
-            publishedAt: Number(row.published_at),
-          }));
         },
         catch: (cause) => storageFail("listDescriptors failed", cause),
-      }),
+      }).pipe(
+        Effect.flatMap((rows) =>
+          Effect.forEach(rows, (row) =>
+            decodeDescriptor(row.descriptor, "listDescriptors failed").pipe(
+              Effect.map((descriptor) => ({
+                descriptor,
+                publishedAt: Number(row.published_at),
+              })),
+            ),
+          ),
+        ),
+      ),
     putScopeForConnection: (tenant, connectionName, scope) =>
       Effect.tryPromise({
         try: async () => {

packages/plugins/apps/src/pipeline/bundle.ts+37−10

 import { build, version as esbuildVersion } from "esbuild";
-import { Effect } from "effect";
+import { Effect, Option, Schema } from "effect";
 import { ToolSandboxError } from "../seams/tool-sandbox";
 import type { ToolchainRef } from "./descriptor";
   readonly code: string;
 }
+const EsbuildDiagnostic = Schema.Struct({
+  text: Schema.String,
+});
+const EsbuildFailure = Schema.Struct({
+  errors: Schema.Array(EsbuildDiagnostic),
+});
+const decodeEsbuildFailure = Schema.decodeUnknownOption(EsbuildFailure);
+const bundleFailureMessage = (entry: string, cause: unknown): string => {
+  const decoded = Option.getOrNull(decodeEsbuildFailure(cause));
+  const detail = decoded?.errors
+    .map((error) => error.text)
+    .filter((text) => text.length > 0)
+    .join("; ");
+  return detail ? `bundle failed for ${entry}: ${detail}` : `bundle failed for ${entry}`;
+};
 const resolveRelative = (base: string, rel: string): string => {
   const parts = (base ? base.split("/") : []).concat(rel.split("/"));
   const out: string[] = [];
 /** Bundle one entry from the file set to a single CJS string. */
 export const bundleEntry = (input: BundleInput): Effect.Effect<BundleOutput, ToolSandboxError> =>
   Effect.tryPromise({
-    try: async () => {
+    try: () =>
-      const result = await build({
+      build({
         entryPoints: [VIRTUAL_ENTRY],
         bundle: true,
         write: false,
         logLevel: "silent",
         external: [...PLATFORM_MODULES],
         plugins: [fileSetPlugin(input.files, input.entry) as never],
-      });
+      }),
-      const out = result.outputFiles?.[0]?.text;
-      if (out === undefined) throw new Error("esbuild produced no output");
-      return { code: out };
-    },
     catch: (cause) =>
       new ToolSandboxError({
         kind: "bundle",
-        message: `bundle failed for ${input.entry}: ${cause instanceof Error ? cause.message : String(cause)}`,
+        message: bundleFailureMessage(input.entry, cause),
         cause,
       }),
-  });
+  }).pipe(
+    Effect.flatMap((result) => {
+      const out = result.outputFiles?.[0]?.text;
+      return out === undefined
+        ? Effect.fail(
+            new ToolSandboxError({
+              kind: "bundle",
+              message: `bundle failed for ${input.entry}: esbuild produced no output`,
+            }),
+          )
+        : Effect.succeed({ code: out });
+    }),
+  );

packages/plugins/apps/src/pipeline/descriptor.ts+1−1

@@ -108,7 +108,7 @@ export const stableStringify = (value: unknown): string => { · 107 unmodified lines
108	const seen = new WeakSet<object>();	108	const seen = new WeakSet<object>();
109	const walk = (v: unknown): unknown => {	109	const walk = (v: unknown): unknown => {
110	if (v === null \|\| typeof v !== "object") return v;	110	if (v === null \|\| typeof v !== "object") return v;
111	if (seen.has(v)) throw new Error("cyclic value cannot be serialized deterministically");	111	if (seen.has(v)) return "[Circular]";
112	seen.add(v);	112	seen.add(v);
113	if (Array.isArray(v)) return v.map(walk);	113	if (Array.isArray(v)) return v.map(walk);
114	const out: Record<string, unknown> = {};	114	const out: Record<string, unknown> = {};

packages/plugins/apps/src/pipeline/publish.test.ts+9−11

 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "@effect/vitest";
-import { Effect } from "effect";
+import { Effect, Exit } from "effect";
 import { makeGitArtifactStore } from "../backing/git-artifact-store";
 import { makeQuickjsToolSandbox } from "../backing/quickjs-tool-sandbox";
     const exit = await Effect.runPromiseExit(publish(deps, { scope: "s", files }));
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
     expect(JSON.stringify(exit)).toContain("collides");
     expect(JSON.stringify(exit)).toContain("crm");
   });
     const exit = await Effect.runPromiseExit(publish(deps, { scope: "s", files }));
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
     expect(JSON.stringify(exit)).toContain("vendor-without-json-schema");
     expect(JSON.stringify(exit)).toContain("vendor");
     expect(JSON.stringify(exit)).toContain("input");
       ],
     ]);
     const exit = await Effect.runPromiseExit(publish(deps, { scope: "s", files }));
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
-    if (exit._tag === "Failure") {
+    expect(JSON.stringify(exit)).toContain("bundle");
-      expect(JSON.stringify(exit.cause)).toContain("bundle");
-    }
   });
   it("rejects an oversized publish set (too many files) and persists nothing", async () => {
       files.set(`tools/t${i}.ts`, "// noop");
     }
     const exit = await Effect.runPromiseExit(publish(deps, { scope: "s", files }));
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
     expect(JSON.stringify(exit)).toContain("exceeding the limit");
     const latest = await run(
       Effect.flatMap(deps.artifactStore.forScope(scopeAddress("org", "s")), (s) => s.latest()),
     const big = "x".repeat(PUBLISH_LIMITS.maxFileBytes + 1);
     const files = new Map([["tools/big.ts", big]]);
     const exit = await Effect.runPromiseExit(publish(deps, { scope: "s", files }));
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
     expect(JSON.stringify(exit)).toContain("per-file limit");
   });
     const count = Math.ceil(PUBLISH_LIMITS.maxTotalBytes / PUBLISH_LIMITS.maxFileBytes) + 1;
     for (let i = 0; i < count; i++) files.set(`tools/t${i}.ts`, half);
     const exit = await Effect.runPromiseExit(publish(deps, { scope: "s", files }));
-    expect(exit._tag).toBe("Failure");
+    expect(Exit.isFailure(exit)).toBe(true);
     expect(JSON.stringify(exit)).toContain("total limit");
   });
 });

packages/plugins/apps/src/pipeline/publish.ts+64−55

@@ -1,4 +1,4 @@
1	import { Effect } from "effect";	1	import { Effect, Predicate, Schema } from "effect";
2		2
3	import type { ArtifactStore, FileSet, SnapshotId } from "../seams/artifact-store";	3	import type { ArtifactStore, FileSet, SnapshotId } from "../seams/artifact-store";
4	import { scopeAddress } from "../seams/scope-address";	4	import { scopeAddress } from "../seams/scope-address";
@@ -155,33 +155,39 @@ export interface PublishDeps { · 150 unmodified lines
155	readonly sandbox: ToolSandbox;	155	readonly sandbox: ToolSandbox;
156	}	156	}
157		157
		158	const isPublishError = Predicate.isTagged("PublishError") as (
		159	value: unknown,
		160	) => value is PublishError;
		161
		162	const decodeDescriptorJson = Schema.decodeUnknownEffect(Schema.UnknownFromJsonString);
		163
158	const assemble = (deps: PublishDeps, files: FileSet): Effect.Effect<AssembledApp, PublishError> =>	164	const assemble = (deps: PublishDeps, files: FileSet): Effect.Effect<AssembledApp, PublishError> =>
159	Effect.gen(function* () {	165	Effect.gen(function* () {
160	const discovered = discover(files);	166	const discovered = discover(files);
161	if (discovered instanceof PublishError) return yield* Effect.fail(discovered);	167	if (isPublishError(discovered)) return yield* discovered;
162		168
163	const tools: ToolDescriptor[] = [];	169	const tools: ToolDescriptor[] = [];
164		170
165	for (const artifact of discovered.artifacts) {	171	for (const artifact of discovered.artifacts) {
166	const bundle = yield* bundleEntry({ files, entry: artifact.entry }).pipe(	172	const bundle = yield* bundleEntry({ files, entry: artifact.entry }).pipe(
167	Effect.mapError(	173	Effect.mapError((bundleFailure) => {
168	(cause) =>	174	const message = bundleFailure.message;
169	new PublishError({	175	return new PublishError({
170	message: cause.message,	176	message,
171	stage: "bundle",	177	stage: "bundle",
172	diagnostics: [{ path: artifact.entry, message: cause.message }],	178	diagnostics: [{ path: artifact.entry, message }],
173	}),	179	});
174	),	180	}),
175	);	181	);
176	const collected = yield* deps.sandbox.collect(bundle.code, { artifact: artifact.name }).pipe(	182	const collected = yield* deps.sandbox.collect(bundle.code, { artifact: artifact.name }).pipe(
177	Effect.mapError(	183	Effect.mapError((collectFailure) => {
178	(cause) =>	184	const message = collectFailure.message;
179	new PublishError({	185	return new PublishError({
180	message: cause.message,	186	message,
181	stage: "collect",	187	stage: "collect",
182	diagnostics: [{ path: artifact.entry, message: cause.message }],	188	diagnostics: [{ path: artifact.entry, message }],
183	}),	189	});
184	),	190	}),
185	);	191	);
186	const raw = collected.artifacts.default?.descriptor as CollectedDescriptor \| undefined;	192	const raw = collected.artifacts.default?.descriptor as CollectedDescriptor \| undefined;
187	const keyed = collected.artifacts[artifact.name]?.descriptor as	193	const keyed = collected.artifacts[artifact.name]?.descriptor as
@@ -189,13 +195,11 @@ const assemble = (deps: PublishDeps, files: FileSet): Effect.Effect<AssembledApp · 1 unmodified line
189	\| undefined;	195	\| undefined;
190	const descriptor = keyed ?? raw;	196	const descriptor = keyed ?? raw;
191	if (!descriptor) {	197	if (!descriptor) {
192	return yield* Effect.fail(	198	return yield* new PublishError({
193	new PublishError({	199	message: `no descriptor collected from ${artifact.entry}`,
194	message: `no descriptor collected from ${artifact.entry}`,	200	stage: "collect",
195	stage: "collect",	201	diagnostics: [{ path: artifact.entry, message: "defineTool did not run" }],
196	diagnostics: [{ path: artifact.entry, message: "defineTool did not run" }],	202	});
197	}),
198	);
199	}	203	}
200	const integrations = toIntegrationDecls(descriptor.integrations);	204	const integrations = toIntegrationDecls(descriptor.integrations);
201	const collision = rejectRoleInputCollisions(	205	const collision = rejectRoleInputCollisions(
@@ -204,7 +208,7 @@ const assemble = (deps: PublishDeps, files: FileSet): Effect.Effect<AssembledApp · 2 unmodified lines
204	descriptor.inputJsonSchema,	208	descriptor.inputJsonSchema,
205	integrations,	209	integrations,
206	);	210	);
207	if (collision) return yield* Effect.fail(collision);	211	if (collision) return yield* collision;
208	const source = yield* sourceRef(artifact.entry, files.get(artifact.entry) ?? "");	212	const source = yield* sourceRef(artifact.entry, files.get(artifact.entry) ?? "");
209	tools.push({	213	tools.push({
210	name: artifact.name,	214	name: artifact.name,
@@ -247,19 +251,17 @@ export const publish = ( · 36 unmodified lines
247	Effect.gen(function* () {	251	Effect.gen(function* () {
248	const tenant = input.tenant ?? "org";	252	const tenant = input.tenant ?? "org";
249	const overLimit = enforcePublishLimits(input.files);	253	const overLimit = enforcePublishLimits(input.files);
250	if (overLimit) return yield* Effect.fail(overLimit);	254	if (overLimit) return yield* overLimit;
251		255
252	const assembled = yield* assemble(deps, input.files);	256	const assembled = yield* assemble(deps, input.files);
253	const body = descriptorBody(tenant, input.scope, assembled, input);	257	const body = descriptorBody(tenant, input.scope, assembled, input);
254		258
255	const scopeStore = yield* deps.artifactStore	259	const scopeStore = yield* deps.artifactStore.forScope(scopeAddress(tenant, input.scope)).pipe(
256	.forScope(scopeAddress(tenant, input.scope))	260	Effect.mapError((storeFailure) => {
257	.pipe(	261	const message = storeFailure.message;
258	Effect.mapError(	262	return new PublishError({ message, stage: "project", diagnostics: [] });
259	(cause) =>	263	}),
260	new PublishError({ message: cause.message, stage: "project", diagnostics: [] }),	264	);
261	),
262	);
263		265
264	const filesWithDescriptor = new Map(input.files);	266	const filesWithDescriptor = new Map(input.files);
265	filesWithDescriptor.set(DESCRIPTOR_SNAPSHOT_PATH, stableStringify(body));	267	filesWithDescriptor.set(DESCRIPTOR_SNAPSHOT_PATH, stableStringify(body));
@@ -267,10 +269,10 @@ export const publish = ( · 1 unmodified line
267	const meta = yield* scopeStore	269	const meta = yield* scopeStore
268	.commit(filesWithDescriptor, input.commitMessage ?? `publish ${new Date().toISOString()}`)	270	.commit(filesWithDescriptor, input.commitMessage ?? `publish ${new Date().toISOString()}`)
269	.pipe(	271	.pipe(
270	Effect.mapError(	272	Effect.mapError((storeFailure) => {
271	(cause) =>	273	const message = storeFailure.message;
272	new PublishError({ message: cause.message, stage: "project", diagnostics: [] }),	274	return new PublishError({ message, stage: "project", diagnostics: [] });
273	),	275	}),
274	);	276	);
275		277
276	const descriptor: AppDescriptor = { ...body, snapshotId: meta.id };	278	const descriptor: AppDescriptor = { ...body, snapshotId: meta.id };
@@ -285,21 +287,28 @@ export const loadDescriptorFromSnapshot = ( · 8 unmodified lines
285	snapshotId: SnapshotId,	287	snapshotId: SnapshotId,
286	): Effect.Effect<AppDescriptor \| null, PublishError> =>	288	): Effect.Effect<AppDescriptor \| null, PublishError> =>
287	Effect.gen(function* () {	289	Effect.gen(function* () {
288	const scopeStore = yield* store	290	const scopeStore = yield* store.forScope(scopeAddress(tenant, scope)).pipe(
289	.forScope(scopeAddress(tenant, scope))	291	Effect.mapError((storeFailure) => {
290	.pipe(	292	const message = storeFailure.message;
291	Effect.mapError(	293	return new PublishError({ message, stage: "project", diagnostics: [] });
292	(c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),	294	}),
293	),	295	);
294	);	296	const raw = yield* scopeStore.readFile(snapshotId, DESCRIPTOR_SNAPSHOT_PATH).pipe(
295	const raw = yield* scopeStore	297	Effect.mapError((storeFailure) => {
296	.readFile(snapshotId, DESCRIPTOR_SNAPSHOT_PATH)	298	const message = storeFailure.message;
297	.pipe(	299	return new PublishError({ message, stage: "project", diagnostics: [] });
298	Effect.mapError(	300	}),
299	(c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),	301	);
300	),
301	);
302	if (raw == null) return null;	302	if (raw == null) return null;
303	const body = JSON.parse(raw) as Omit<AppDescriptor, "snapshotId">;	303	const body = yield* decodeDescriptorJson(raw).pipe(
304	return { ...body, snapshotId };	304	Effect.mapError(
		305	(_cause) =>
		306	new PublishError({
		307	message: "descriptor snapshot is not valid JSON",
		308	stage: "project",
		309	diagnostics: [],
		310	}),
		311	),
		312	);
		313	return { ...(body as Omit<AppDescriptor, "snapshotId">), snapshotId };
305	});	314	});

packages/plugins/apps/src/plugin/apps-plugin.test.ts+1−1

@@ -2,7 +2,7 @@ import { mkdtempSync, readFileSync } from "node:fs"; · 1 unmodified line
2	import { tmpdir } from "node:os";	2	import { tmpdir } from "node:os";
3	import { join } from "node:path";	3	import { join } from "node:path";
4		4
5	import { describe, expect, it } from "vitest";	5	import { describe, expect, it } from "@effect/vitest";
6	import { Effect } from "effect";	6	import { Effect } from "effect";
7		7
8	import { appsPlugin, connectionNameForScope } from "./apps-plugin";	8	import { appsPlugin, connectionNameForScope } from "./apps-plugin";

packages/plugins/apps/src/plugin/apps-plugin.ts+21−25

 import { makeAppsStore } from "./store";
 import type { ClientResolver, ConnectionCandidate } from "./bindings";
 import type { IntegrationDecl, ToolDescriptor } from "../pipeline/descriptor";
+import { PublishError } from "../pipeline/discover";
 import { syncGitHubSource, type GitHubSyncResult } from "../source/github-source";
 export const APPS_INTEGRATION_SLUG = "apps";
 };
 export const appsPlugin = definePlugin((options?: AppsPluginOptions) => {
-  if (!options?.runtime) {
+  const runtime = options?.runtime as AppsRuntime;
-    throw new Error("appsPlugin requires a runtime");
+  const makeResolver = options?.makeResolver;
-  }
-  const runtime = options.runtime;
-  const makeResolver = options.makeResolver;
   const tenantFor = (ctx: Pick<PluginCtx, "owner"> | undefined): string => {
     const tenant = ctx?.owner?.tenant;
         const scope = yield* scopeFor(tenant, String(toolRow.connection));
         const descriptor = yield* runtime.getDescriptor(tenant, scope);
         if (!descriptor) {
-          return yield* Effect.fail(
+          return yield* new PublishError({
-            new Error(
+            message: `apps scope "${scope}" has no published app (connection "${toolRow.connection}")`,
-              `apps scope "${scope}" has no published app (connection "${toolRow.connection}")`,
+            stage: "project",
-            ),
+            diagnostics: [],
-          );
+          });
         }
         const toolDesc = descriptor.tools.find((t) => t.name === toolRow.name);
         if (!toolDesc) {
-          return yield* Effect.fail(
+          return yield* new PublishError({
-            new Error(`apps tool "${toolRow.name}" is not published in scope "${scope}"`),
+            message: `apps tool "${toolRow.name}" is not published in scope "${scope}"`,
-          );
+            stage: "project",
+            diagnostics: [],
+          });
         }
         const resolver = makeResolver
           ? makeResolver({ ctx, scope, tool: toolRow.name })
           : undefined;
-        return yield* runtime
+        return yield* runtime.invokeTool({
-          .invokeTool({ tenant, scope, tool: toolRow.name, args, resolver, invokeOptions })
+          tenant,
-          .pipe(
+          scope,
-            Effect.mapError(
+          tool: toolRow.name,
-              (cause) =>
+          args,
-                new Error(
+          resolver,
-                  "message" in cause && typeof cause.message === "string"
+          invokeOptions,
-                    ? cause.message
+        });
-                    : "apps tool invocation failed",
-                ),
-            ),
-          );
       }),
   };
 });

packages/plugins/apps/src/plugin/bindings.strict.test.ts+3−3

@@ -1,5 +1,5 @@
1	import { describe, expect, it } from "vitest";	1	import { describe, expect, it } from "@effect/vitest";
2	import { Effect } from "effect";	2	import { Effect, Exit } from "effect";
3		3
4	import { buildBridge, resolveIntegrationBindings, type ClientResolver } from "./bindings";	4	import { buildBridge, resolveIntegrationBindings, type ClientResolver } from "./bindings";
5	import type { IntegrationDecl } from "../pipeline/descriptor";	5	import type { IntegrationDecl } from "../pipeline/descriptor";
@@ -43,7 +43,7 @@ const okResolver: ClientResolver = { · 37 unmodified lines
43	};	43	};
44		44
45	const fails = <A, E>(effect: Effect.Effect<A, E>): Promise<boolean> =>	45	const fails = <A, E>(effect: Effect.Effect<A, E>): Promise<boolean> =>
46	Effect.runPromiseExit(effect).then((exit) => exit._tag === "Failure");	46	Effect.runPromiseExit(effect).then((exit) => Exit.isFailure(exit));
47		47
48	describe("HandleBridge strict dispatch", () => {	48	describe("HandleBridge strict dispatch", () => {
49	const declared: Record<string, IntegrationDecl> = {	49	const declared: Record<string, IntegrationDecl> = {

packages/plugins/apps/src/plugin/bindings.ts+41−47

 const isRecord = (value: unknown): value is Record<string, unknown> =>
   value !== null && typeof value === "object" && !Array.isArray(value);
-const bindingError = (
-  role: string,
-  integration: string,
-  message: string,
-  requestedConnection?: string,
-): BindingError =>
-  new BindingError({
-    message,
-    role,
-    integration,
-    requestedConnection,
-  });
 const findDefaultConnection = (
   role: string,
   decl: IntegrationDecl,
     Effect.flatMap((connections) => {
       if (connections.length === 1) return Effect.succeed(connections[0]!.address);
       return Effect.fail(
-        bindingError(
+        new BindingError({
           role,
-          decl.integration,
+          integration: decl.integration,
-          connections.length === 0
+          message:
-            ? `missing required connection for role "${role}" (${decl.integration}); no connections are available`
+            connections.length === 0
-            : `missing required connection for role "${role}" (${decl.integration}); choose one of ${connections
+              ? `missing required connection for role "${role}" (${decl.integration}); no connections are available`
-                .map((c) => c.address)
+              : `missing required connection for role "${role}" (${decl.integration}); choose one of ${connections
-                .join(", ")}`,
+                  .map((c) => c.address)
-        ),
+                  .join(", ")}`,
+        }),
       );
     }),
   );
     Effect.flatMap((connection) => {
       if (!connection) {
         return Effect.fail(
-          bindingError(
+          new BindingError({
             role,
-            decl.integration,
+            integration: decl.integration,
-            `unknown connection "${requested}" for role "${role}" (${decl.integration})`,
+            message: `unknown connection "${requested}" for role "${role}" (${decl.integration})`,
-            requested,
+            requestedConnection: requested,
-          ),
+          }),
         );
       }
       if (connection.integration !== decl.integration) {
         return Effect.fail(
-          bindingError(
+          new BindingError({
             role,
-            decl.integration,
+            integration: decl.integration,
-            `connection "${requested}" belongs to integration "${connection.integration}", not "${decl.integration}" for role "${role}"`,
+            message: `connection "${requested}" belongs to integration "${connection.integration}", not "${decl.integration}" for role "${role}"`,
-            requested,
+            requestedConnection: requested,
-          ),
+          }),
         );
       }
       return Effect.succeed(connection.address);
         continue;
       }
       if (typeof raw !== "string" || raw.length === 0) {
-        return yield* Effect.fail(
+        return yield* new BindingError({
-          bindingError(
+          role,
-            role,
+          integration: decl.integration,
-            decl.integration,
+          message: `connection for role "${role}" (${decl.integration}) must be a non-empty string`,
-            `connection for role "${role}" (${decl.integration}) must be a non-empty string`,
+          ...(typeof raw === "string" ? { requestedConnection: raw } : {}),
-            typeof raw === "string" ? raw : undefined,
+        });
-          ),
-        );
       }
       bindings[role] = yield* resolveRequestedConnection(role, decl, raw, resolver);
     }
     if (root === "db") {
       if (path.length === 1 && path[0] === "sql") {
         const [strings, ...values] = args as [TemplateStringsArray, ...unknown[]];
-        return context.db
+        return context.db.sql(strings, ...values).pipe(
-          .sql(strings, ...values)
+          Effect.mapError(
-          .pipe(
+            (cause) =>
-            Effect.mapError(
+              new ToolSandboxError({
-              (cause) => new ToolSandboxError({ kind: "invoke", message: cause.message, cause }),
+                kind: "invoke",
-            ),
+                message: "scope database call failed",
-          );
+                cause,
+              }),
+          ),
+        );
       }
       return Effect.fail(invokeErr(`unsupported db call: ${path.join(".")}`));
     }
       })
       .pipe(
         Effect.mapError(
-          (cause) => new ToolSandboxError({ kind: "invoke", message: cause.message, cause }),
+          (cause) =>
+            new ToolSandboxError({
+              kind: "invoke",
+              message: "integration call failed",
+              cause,
+            }),
         ),
       );
   },

packages/plugins/apps/src/plugin/publish-concurrency.test.ts+6−7

 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "@effect/vitest";
 import { Effect } from "effect";
 import { makeSelfHostAppsRuntime } from "./self-host-runtime";
     // Every publish either succeeded or failed with a typed conflict; none
     // clobbered another silently.
     const succeeded = results.filter((r) => r.status === "fulfilled");
+    const rejectedReasons = results.flatMap((r) =>
+      r.status === "rejected" ? [JSON.stringify(r.reason)] : [],
+    );
     expect(succeeded.length).toBeGreaterThan(0);
-    for (const r of results) {
+    // A conflict is the only acceptable failure mode.
-      if (r.status === "rejected") {
+    expect(rejectedReasons.every((reason) => /conflict/i.test(reason))).toBe(true);
-        // A conflict is the only acceptable failure mode.
-        expect(String(r.reason)).toMatch(/conflict/i);
-      }
-    }
     // HEAD and the descriptor pointer AGREE: the store's current descriptor's
     // snapshotId equals the artifact store's latest committed snapshot.

packages/plugins/apps/src/plugin/runtime.test.ts+11−13

@@ -2,8 +2,8 @@ import { mkdtempSync } from "node:fs"; · 1 unmodified line
2	import { tmpdir } from "node:os";	2	import { tmpdir } from "node:os";
3	import { join } from "node:path";	3	import { join } from "node:path";
4		4
5	import { describe, expect, it } from "vitest";	5	import { describe, expect, it } from "@effect/vitest";
6	import { Effect } from "effect";	6	import { Effect, Exit } from "effect";
7		7
8	import { makeSelfHostAppsRuntime } from "./self-host-runtime";	8	import { makeSelfHostAppsRuntime } from "./self-host-runtime";
9	import { makeInMemoryAppsStore, makeTestResolver, dailyBriefFileSet } from "../testing";	9	import { makeInMemoryAppsStore, makeTestResolver, dailyBriefFileSet } from "../testing";
@@ -157,11 +157,10 @@ export default defineTool({ · 147 unmodified lines
157	host.runtime.invokeTool({ scope: "s", tool: "sync", args: {} }),	157	host.runtime.invokeTool({ scope: "s", tool: "sync", args: {} }),
158	);	158	);
159		159
160	expect(exit._tag).toBe("Failure");	160	expect(Exit.isFailure(exit)).toBe(true);
161	if (exit._tag !== "Failure") throw new Error("expected missing connection failure");	161	expect(JSON.stringify(exit)).toContain("BindingError");
162	expect(JSON.stringify(exit.cause)).toContain("BindingError");	162	expect(JSON.stringify(exit)).toContain("crm");
163	expect(JSON.stringify(exit.cause)).toContain("crm");	163	expect(JSON.stringify(exit)).toContain("dealcloud");
164	expect(JSON.stringify(exit.cause)).toContain("dealcloud");
165	await host.close();	164	await host.close();
166	});	165	});
167		166
@@ -204,12 +203,11 @@ export default defineTool({ · 36 unmodified lines
204	}),	203	}),
205	);	204	);
206		205
207	expect(exit._tag).toBe("Failure");	206	expect(Exit.isFailure(exit)).toBe(true);
208	if (exit._tag !== "Failure") throw new Error("expected wrong integration failure");	207	expect(JSON.stringify(exit)).toContain("BindingError");
209	expect(JSON.stringify(exit.cause)).toContain("BindingError");	208	expect(JSON.stringify(exit)).toContain("github");
210	expect(JSON.stringify(exit.cause)).toContain("github");	209	expect(JSON.stringify(exit)).toContain("dealcloud");
211	expect(JSON.stringify(exit.cause)).toContain("dealcloud");	210	expect(JSON.stringify(exit)).toContain("tools.github.user.main");
212	expect(JSON.stringify(exit.cause)).toContain("tools.github.user.main");
213	await host.close();	211	await host.close();
214	});	212	});
215		213

packages/plugins/apps/src/plugin/runtime.ts+25−17

-import { Effect } from "effect";
+import { Effect, Predicate } from "effect";
 import type { InvokeOptions } from "@executor-js/sdk";
 import type { ArtifactStore } from "../seams/artifact-store";
     diagnostics: [],
   });
+const isInvokePassthroughError = (
+  cause: unknown,
+): cause is BindingError | InputValidationError | OutputValidationError =>
+  Predicate.isTagged("BindingError")(cause) ||
+  Predicate.isTagged("InputValidationError")(cause) ||
+  Predicate.isTagged("OutputValidationError")(cause);
 export const makeAppsRuntime = (deps: AppsRuntimeDeps): AppsRuntime => {
   const defaultTenant = deps.defaultTenant ?? "org";
   const bundleCache = new Map<string, string>();
   ): Promise<A> => {
     const key = `${tenant}:${scope}`;
     const prior = publishChains.get(key) ?? Promise.resolve();
-    const next = prior.catch(() => undefined).then(run);
+    const afterPrior = prior.then(
+      () => undefined,
+      () => undefined,
+    );
+    const next = afterPrior.then(run);
     publishChains.set(
       key,
-      next.catch(() => undefined),
+      next.then(
+        () => undefined,
+        () => undefined,
+      ),
     );
     return next;
   };
         )
         .pipe(
           Effect.mapError((c) => {
-            if (
+            if (isInvokePassthroughError(c)) {
-              c instanceof BindingError ||
-              c instanceof InputValidationError ||
-              c instanceof OutputValidationError
-            ) {
               return c;
             }
             return new PublishError({
               ),
             );
           },
-          catch: (cause) =>
+          catch: (_cause) =>
             new PublishError({
-              message: cause instanceof Error ? cause.message : String(cause),
+              message: "publish failed before pipeline completed",
               stage: "project",
               diagnostics: [],
             }),
         const descriptor = yield* requireDescriptor(tenant, input.scope);
         const toolDesc = descriptor.tools.find((t) => t.name === input.tool);
         if (!toolDesc) {
-          return yield* Effect.fail(
+          return yield* new PublishError({
-            new PublishError({
+            message: `tool "${input.tool}" is not published in scope "${input.scope}"`,
-              message: `tool "${input.tool}" is not published in scope "${input.scope}"`,
+            stage: "project",
-              stage: "project",
+            diagnostics: [],
-              diagnostics: [],
+          });
-            }),
-          );
         }
         return yield* invokeToolInternal(
           input.scope,

packages/plugins/apps/src/plugin/tenant-isolation.test.ts+1−1

@@ -2,7 +2,7 @@ import { mkdtempSync, readdirSync } from "node:fs"; · 1 unmodified line
2	import { tmpdir } from "node:os";	2	import { tmpdir } from "node:os";
3	import { join } from "node:path";	3	import { join } from "node:path";
4		4
5	import { describe, expect, it } from "vitest";	5	import { describe, expect, it } from "@effect/vitest";
6	import { Effect } from "effect";	6	import { Effect } from "effect";
7		7
8	import { makeSqliteAppsStore } from "../backing/sqlite-apps-store";	8	import { makeSqliteAppsStore } from "../backing/sqlite-apps-store";

packages/plugins/apps/src/react/AddCustomToolsSource.tsx+17−13

 import { useMemo, useState } from "react";
 import { useAtomValue } from "@effect/atom-react";
+import { Effect, Exit } from "effect";
 import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
 import { connectionsAllAtom } from "@executor-js/react/api/atoms";
   consoleIntegrationHref,
   formatSyncErrors,
   githubConnections,
-  syncCustomToolSource,
+  syncCustomToolSourceEffect,
   syncStatusLabel,
   validateGitHubRepo,
 } from "./custom-tools-client";
     if (validation || !selectedConnection) return;
     setSyncing(true);
-    try {
+    const exit = await Effect.runPromiseExit(
-      const result = await syncCustomToolSource({
+      syncCustomToolSourceEffect({
         repo,
         ref,
         connection: selectedConnection,
-      });
+      }),
-      if (result.status === "failed") {
+    );
-        setSyncError(formatSyncErrors(result).join("\n") || "Sync failed.");
+    if (Exit.isFailure(exit)) {
-        setSyncing(false);
+      setSyncError("Failed to sync custom tools.");
-        return;
-      }
-      toast.success(syncStatusLabel(result));
-      props.onComplete("apps");
-    } catch (error) {
-      setSyncError(error instanceof Error ? error.message : "Failed to sync custom tools.");
       setSyncing(false);
+      return;
     }
+    const result = exit.value;
+    if (result.status === "failed") {
+      setSyncError(formatSyncErrors(result).join("\n") || "Sync failed.");
+      setSyncing(false);
+      return;
+    }
+    toast.success(syncStatusLabel(result));
+    props.onComplete("apps");
   };
   return (

packages/plugins/apps/src/react/CustomToolsAccountsPanel.tsx+44−41

-import { useEffect, useMemo, useState, type ReactNode } from "react";
+import { useEffect, useState, type ReactNode } from "react";
+import { Effect, Exit } from "effect";
 import { Alert, AlertDescription, AlertTitle } from "@executor-js/react/components/alert";
 import { Badge } from "@executor-js/react/components/badge";
 import {
   consoleIntegrationHref,
   formatSyncErrors,
-  listCustomToolSources,
+  listCustomToolSourcesEffect,
-  syncCustomToolSource,
+  syncCustomToolSourceEffect,
   syncStatusLabel,
   toolDiff,
 } from "./custom-tools-client";
   const loadSources = async () => {
     setLoadState({ status: "loading" });
-    try {
+    const exit = await Effect.runPromiseExit(listCustomToolSourcesEffect());
-      const result = await listCustomToolSources();
+    if (Exit.isFailure(exit)) {
-      setLoadState({ status: "ready", sources: result.sources });
-      setSelectedScope((current) => current ?? result.sources[0]?.scope ?? null);
-    } catch (error) {
       setLoadState({
         status: "error",
-        message: error instanceof Error ? error.message : "Failed to load custom tool sources.",
+        message: "Failed to load custom tool sources.",
       });
+      return;
     }
+    const result = exit.value;
+    setLoadState({ status: "ready", sources: result.sources });
+    setSelectedScope((current) => current ?? result.sources[0]?.scope ?? null);
   };
   useEffect(() => {
     let active = true;
     void (async () => {
-      try {
+      const exit = await Effect.runPromiseExit(listCustomToolSourcesEffect());
-        const result = await listCustomToolSources();
+      if (Exit.isSuccess(exit)) {
         if (!active) return;
+        const result = exit.value;
         setLoadState({ status: "ready", sources: result.sources });
         setSelectedScope(result.sources[0]?.scope ?? null);
-      } catch (error) {
+      } else {
         if (!active) return;
         setLoadState({
           status: "error",
-          message: error instanceof Error ? error.message : "Failed to load custom tool sources.",
+          message: "Failed to load custom tool sources.",
         });
       }
     })();
   }, []);
   const sources = loadState.status === "ready" ? loadState.sources : [];
-  const selected = useMemo(
+  const selected = sources.find((source) => source.scope === selectedScope) ?? sources[0] ?? null;
-    () => sources.find((source) => source.scope === selectedScope) ?? sources[0] ?? null,
-    [sources, selectedScope],
-  );
   const syncSelected = async (source: GitHubCustomToolsSourceSummary) => {
     if (!source.connection) {
     setSyncingScope(source.scope);
     setNotice(null);
     const beforeTools = source.tools;
-    try {
+    const exit = await Effect.runPromiseExit(
-      const result = await syncCustomToolSource({
+      syncCustomToolSourceEffect({
         repo: source.repo,
         ref: source.ref,
         connection: source.connection,
-      });
+      }),
-      const diff =
+    );
-        result.status === "failed"
+    if (Exit.isFailure(exit)) {
-          ? { added: [], removed: [] }
-          : toolDiff(beforeTools, result.tools);
-      setNotice({
-        status: result.status,
-        message: syncStatusLabel(result),
-        added: diff.added,
-        removed: diff.removed,
-        errors: formatSyncErrors(result),
-      });
-      if (result.status !== "failed") {
-        await loadSources();
-        setSelectedScope(source.scope);
-      }
-    } catch (error) {
       setNotice({
         status: "failed",
         message: "Sync failed.",
         added: [],
         removed: [],
-        errors: [error instanceof Error ? error.message : "Failed to sync custom tools."],
+        errors: ["Failed to sync custom tools."],
       });
+      setSyncingScope(null);
+      return;
+    }
+    const result = exit.value;
+    const diff =
+      result.status === "failed" ? { added: [], removed: [] } : toolDiff(beforeTools, result.tools);
+    setNotice({
+      status: result.status,
+      message: syncStatusLabel(result),
+      added: diff.added,
+      removed: diff.removed,
+      errors: formatSyncErrors(result),
+    });
+    if (result.status !== "failed") {
+      await loadSources();
+      setSelectedScope(source.scope);
     }
     setSyncingScope(null);
   };
                   asChild
                   searchText={`${source.repo} ${source.ref}`}
                 >
-                  <button
+                  <Button
                     type="button"
+                    variant="ghost"
                     onClick={() => {
                       setSelectedScope(source.scope);
                       setNotice(null);
                     }}
                     className={
                       selected?.scope === source.scope
-                        ? "bg-muted/70 text-left"
+                        ? "h-auto w-full justify-start bg-muted/70 p-0 text-left"
-                        : "bg-transparent text-left"
+                        : "h-auto w-full justify-start bg-transparent p-0 text-left"
                     }
                   >
                     <CardStackEntryContent>
                     <CardStackEntryActions>
                       <Badge variant="secondary">{source.tools.length}</Badge>
                     </CardStackEntryActions>
-                  </button>
+                  </Button>
                 </CardStackEntry>
               ))}
             </CardStackContent>

packages/plugins/apps/src/react/custom-tools-client.ts+84−48

@@ -1,4 +1,5 @@
1	import type { Connection } from "@executor-js/sdk/shared";	1	import type { Connection } from "@executor-js/sdk/shared";
		2	import { Data, Effect, Schema } from "effect";
2		3
3	import type { GitHubCustomToolsSourceSummary, GitHubSyncResult } from "../api";	4	import type { GitHubCustomToolsSourceSummary, GitHubSyncResult } from "../api";
4		5
@@ -15,12 +16,11 @@ export interface SyncGitHubSourceRequest { · 10 unmodified lines
15	readonly connection: string;	16	readonly connection: string;
16	}	17	}
17		18
18	export class CustomToolsClientError extends Error {	19	export type CustomToolsFetch = (input: RequestInfo \| URL, init?: RequestInit) => Promise<Response>;
19	constructor(message: string) {	20
20	super(message);	21	export class CustomToolsClientError extends Data.TaggedError("CustomToolsClientError")<{
21	this.name = "CustomToolsClientError";	22	readonly message: string;
22	}	23	}> {}
23	}
24		24
25	const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;	25	const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
26		26
@@ -34,47 +34,83 @@ export const validateGitHubRepo = (repo: string): string \| null => { · 7 unmodified lines
34	export const githubConnections = (connections: readonly Connection[]): readonly Connection[] =>	34	export const githubConnections = (connections: readonly Connection[]): readonly Connection[] =>
35	connections.filter((connection) => String(connection.integration) === "github");	35	connections.filter((connection) => String(connection.integration) === "github");
36		36
37	const parseJsonResponse = async <A>(response: Response, fallback: string): Promise<A> => {	37	const decodeJsonText = Schema.decodeUnknownEffect(Schema.UnknownFromJsonString);
38	const text = await response.text();
39	const body = text.length > 0 ? (JSON.parse(text) as unknown) : null;
40	if (!response.ok) {
41	const message =
42	body &&
43	typeof body === "object" &&
44	"error" in body &&
45	typeof (body as { error?: unknown }).error === "string"
46	? (body as { error: string }).error
47	: fallback;
48	throw new CustomToolsClientError(message);
49	}
50	return body as A;
51	};
52		38
53	export const listCustomToolSources = async (	39	const isRecord = (value: unknown): value is Record<string, unknown> =>
54	fetchImpl: typeof fetch = fetch,	40	value !== null && typeof value === "object" && !Array.isArray(value);
55	): Promise<GitHubSourcesListResponse> => {	41
56	const response = await fetchImpl("/api/apps/sources/github", {	42	const responseErrorMessage = (body: unknown, fallback: string): string =>
57	credentials: "same-origin",	43	isRecord(body) && typeof body.error === "string" ? body.error : fallback;
		44
		45	const parseJsonResponseEffect = <A>(
		46	response: Response,
		47	fallback: string,
		48	): Effect.Effect<A, CustomToolsClientError> =>
		49	Effect.gen(function* () {
		50	const text = yield* Effect.tryPromise({
		51	try: () => response.text(),
		52	catch: () => new CustomToolsClientError({ message: fallback }),
		53	});
		54	const body =
		55	text.length > 0
		56	? yield* decodeJsonText(text).pipe(
		57	Effect.mapError(() => new CustomToolsClientError({ message: fallback })),
		58	)
		59	: null;
		60	if (!response.ok) {
		61	return yield* new CustomToolsClientError({
		62	message: responseErrorMessage(body, fallback),
		63	});
		64	}
		65	return body as A;
58	});	66	});
59	return parseJsonResponse<GitHubSourcesListResponse>(response, "Failed to load custom tools.");
60	};
61		67
62	export const syncCustomToolSource = async (	68	export const listCustomToolSourcesEffect = (
		69	fetchImpl: CustomToolsFetch = fetch,
		70	): Effect.Effect<GitHubSourcesListResponse, CustomToolsClientError> =>
		71	Effect.tryPromise({
		72	try: () =>
		73	fetchImpl("/api/apps/sources/github", {
		74	credentials: "same-origin",
		75	}),
		76	catch: () => new CustomToolsClientError({ message: "Failed to load custom tools." }),
		77	}).pipe(
		78	Effect.flatMap((response) =>
		79	parseJsonResponseEffect<GitHubSourcesListResponse>(response, "Failed to load custom tools."),
		80	),
		81	);
		82
		83	export const listCustomToolSources = (
		84	fetchImpl: CustomToolsFetch = fetch,
		85	): Promise<GitHubSourcesListResponse> => Effect.runPromise(listCustomToolSourcesEffect(fetchImpl));
		86
		87	export const syncCustomToolSourceEffect = (
63	input: SyncGitHubSourceRequest,	88	input: SyncGitHubSourceRequest,
64	fetchImpl: typeof fetch = fetch,	89	fetchImpl: CustomToolsFetch = fetch,
65	): Promise<GitHubSyncResult> => {	90	): Effect.Effect<GitHubSyncResult, CustomToolsClientError> =>
66	const response = await fetchImpl("/api/apps/sources/github/sync", {	91	Effect.tryPromise({
67	method: "POST",	92	try: () =>
68	headers: { "content-type": "application/json" },	93	fetchImpl("/api/apps/sources/github/sync", {
69	credentials: "same-origin",	94	method: "POST",
70	body: JSON.stringify({	95	headers: { "content-type": "application/json" },
71	repo: input.repo.trim(),	96	credentials: "same-origin",
72	...(input.ref?.trim() ? { ref: input.ref.trim() } : {}),	97	body: JSON.stringify({
73	connection: input.connection,	98	repo: input.repo.trim(),
74	}),	99	...(input.ref?.trim() ? { ref: input.ref.trim() } : {}),
75	});	100	connection: input.connection,
76	return parseJsonResponse<GitHubSyncResult>(response, "Failed to sync custom tools.");	101	}),
77	};	102	}),
		103	catch: () => new CustomToolsClientError({ message: "Failed to sync custom tools." }),
		104	}).pipe(
		105	Effect.flatMap((response) =>
		106	parseJsonResponseEffect<GitHubSyncResult>(response, "Failed to sync custom tools."),
		107	),
		108	);
		109
		110	export const syncCustomToolSource = (
		111	input: SyncGitHubSourceRequest,
		112	fetchImpl: CustomToolsFetch = fetch,
		113	): Promise<GitHubSyncResult> => Effect.runPromise(syncCustomToolSourceEffect(input, fetchImpl));
78		114
79	export const syncStatusLabel = (result: GitHubSyncResult): string => {	115	export const syncStatusLabel = (result: GitHubSyncResult): string => {
80	if (result.status === "published") return `Published ${result.tools.length} tools.`;	116	if (result.status === "published") return `Published ${result.tools.length} tools.`;
@@ -84,11 +120,11 @@ export const syncStatusLabel = (result: GitHubSyncResult): string => { · 3 unmodified lines
84		120
85	export const formatSyncErrors = (result: GitHubSyncResult): readonly string[] => {	121	export const formatSyncErrors = (result: GitHubSyncResult): readonly string[] => {
86	if (result.status !== "failed") return [];	122	if (result.status !== "failed") return [];
87	return result.errors.map((error) => {	123	return result.errors.map((entry) => {
88	const details = error.diagnostics?.map((d) => `${d.path}: ${d.message}`).join("; ");	124	const message = entry.message;
89	return details	125	const stage = entry.stage;
90	? `${error.stage}: ${error.message} (${details})`	126	const details = entry.diagnostics?.map((d) => `${d.path}: ${d.message}`).join("; ");
91	: `${error.stage}: ${error.message}`;	127	return details ? `${stage}: ${message} (${details})` : `${stage}: ${message}`;
92	});	128	});
93	};	129	};
94		130

packages/plugins/apps/src/seams/artifact-store.conformance.ts+1−1

@@ -1,4 +1,4 @@
1	import { describe, expect, it } from "vitest";	1	import { describe, expect, it } from "@effect/vitest";
2	import { Effect } from "effect";	2	import { Effect } from "effect";
3		3
4	import type { ArtifactStore, FileSet } from "./artifact-store";	4	import type { ArtifactStore, FileSet } from "./artifact-store";

packages/plugins/apps/src/seams/scope-db.conformance.ts+1−1

@@ -1,4 +1,4 @@
1	import { describe, expect, it } from "vitest";	1	import { describe, expect, it } from "@effect/vitest";
2	import { Effect } from "effect";	2	import { Effect } from "effect";
3		3
4	import type { ScopeDb } from "./scope-db";	4	import type { ScopeDb } from "./scope-db";

packages/plugins/apps/src/seams/tool-sandbox.conformance.ts+5−5

@@ -1,5 +1,5 @@
1	import { describe, expect, it } from "vitest";	1	import { describe, expect, it } from "@effect/vitest";
2	import { Effect } from "effect";	2	import { Effect, Exit } from "effect";
3		3
4	import type { HandleBridge, ToolSandbox } from "./tool-sandbox";	4	import type { HandleBridge, ToolSandbox } from "./tool-sandbox";
5	import { bundleEntry } from "../pipeline/bundle";	5	import { bundleEntry } from "../pipeline/bundle";
@@ -34,7 +34,7 @@ import { z } from "zod"; · 28 unmodified lines
34	export default defineTool({ description: "x" + Math.random(), input: z.object({}), async handler(){ return {}; } });`;	34	export default defineTool({ description: "x" + Math.random(), input: z.object({}), async handler(){ return {}; } });`;
35	const rngBundle = await bundle("tools/rng.ts", rng);	35	const rngBundle = await bundle("tools/rng.ts", rng);
36	const exit = await Effect.runPromiseExit(sandbox.collect(rngBundle));	36	const exit = await Effect.runPromiseExit(sandbox.collect(rngBundle));
37	expect(exit._tag).toBe("Failure");	37	expect(Exit.isFailure(exit)).toBe(true);
38	});	38	});
39		39
40	it("denies network access", async () => {	40	it("denies network access", async () => {
@@ -47,7 +47,7 @@ export default defineTool({ description: "net", input: z.object({}), async handl · 6 unmodified lines
47	const exit = await Effect.runPromiseExit(	47	const exit = await Effect.runPromiseExit(
48	sandbox.invoke(b, { artifact: "net", kind: "tool", input: {}, roots: {} }, bridge),	48	sandbox.invoke(b, { artifact: "net", kind: "tool", input: {}, roots: {} }, bridge),
49	);	49	);
50	expect(exit._tag).toBe("Failure");	50	expect(Exit.isFailure(exit)).toBe(true);
51	});	51	});
52		52
53	it("kills a runaway handler on timeout", async () => {	53	it("kills a runaway handler on timeout", async () => {
@@ -60,7 +60,7 @@ export default defineTool({ description: "loop", input: z.object({}), async hand · 6 unmodified lines
60	const exit = await Effect.runPromiseExit(	60	const exit = await Effect.runPromiseExit(
61	sandbox.invoke(b, { artifact: "loop", kind: "tool", input: {}, roots: {} }, bridge),	61	sandbox.invoke(b, { artifact: "loop", kind: "tool", input: {}, roots: {} }, bridge),
62	);	62	);
63	expect(exit._tag).toBe("Failure");	63	expect(Exit.isFailure(exit)).toBe(true);
64	});	64	});
65		65
66	it("round-trips the handle bridge for a declared integration role", async () => {	66	it("round-trips the handle bridge for a declared integration role", async () => {

packages/plugins/apps/src/source/github-source.test.ts+3−3

@@ -2,8 +2,8 @@ import { mkdtempSync } from "node:fs"; · 1 unmodified line
2	import { tmpdir } from "node:os";	2	import { tmpdir } from "node:os";
3	import { join } from "node:path";	3	import { join } from "node:path";
4		4
5	import { describe, expect, it } from "vitest";	5	import { describe, expect, it } from "@effect/vitest";
6	import { Effect } from "effect";	6	import { Effect, Exit } from "effect";
7		7
8	import { makeSelfHostAppsRuntime } from "../plugin/self-host-runtime";	8	import { makeSelfHostAppsRuntime } from "../plugin/self-host-runtime";
9	import { makeInMemoryAppsStore, makeTestResolver } from "../testing";	9	import { makeInMemoryAppsStore, makeTestResolver } from "../testing";
@@ -208,7 +208,7 @@ describe("GitHub custom-tools source", () => { · 198 unmodified lines
208	const exit = await Effect.runPromiseExit(	208	const exit = await Effect.runPromiseExit(
209	fetchGitHubSource({ repo: "acme/tools", fetch: github.fetch }),	209	fetchGitHubSource({ repo: "acme/tools", fetch: github.fetch }),
210	);	210	);
211	expect(exit._tag).toBe("Failure");	211	expect(Exit.isFailure(exit)).toBe(true);
212	expect(JSON.stringify(exit)).toContain("exceeding the limit");	212	expect(JSON.stringify(exit)).toContain("exceeding the limit");
213	expect(github.blobCalls()).toBe(0);	213	expect(github.blobCalls()).toBe(0);
214	});	214	});

packages/plugins/apps/src/source/github-source.ts+81−74

@@ -1,4 +1,4 @@
1	import { Data, Effect, Result } from "effect";	1	import { Data, Effect, Predicate, Result, Schema } from "effect";
2		2
3	import { PublishError, type FileDiagnostic } from "../pipeline/discover";	3	import { PublishError, type FileDiagnostic } from "../pipeline/discover";
4	import { PUBLISH_LIMITS, enforcePublishLimits } from "../pipeline/publish";	4	import { PUBLISH_LIMITS, enforcePublishLimits } from "../pipeline/publish";
@@ -106,37 +106,42 @@ const requestJson = <A>( · 101 unmodified lines
106	input: GitHubSourceInput,	106	input: GitHubSourceInput,
107	path: string,	107	path: string,
108	): Effect.Effect<A, GitHubSourceError> =>	108	): Effect.Effect<A, GitHubSourceError> =>
109	Effect.tryPromise({	109	Effect.gen(function* () {
110	try: async () => {	110	const response = yield* Effect.tryPromise({
111	const fetchImpl = input.fetch ?? globalThis.fetch;	111	try: async () => {
112	const headers: Record<string, string> = {	112	const fetchImpl = input.fetch ?? globalThis.fetch;
113	accept: "application/vnd.github+json",	113	const headers: Record<string, string> = {
114	"user-agent": "executor-apps-github-source",	114	accept: "application/vnd.github+json",
115	};	115	"user-agent": "executor-apps-github-source",
116	if (input.token) headers.authorization = `Bearer ${input.token}`;	116	};
117	const response = await fetchImpl(	117	if (input.token) headers.authorization = `Bearer ${input.token}`;
118	`${trimBaseUrl(input.baseUrl ?? "https://api.github.com")}${path}`,	118	return fetchImpl(`${trimBaseUrl(input.baseUrl ?? "https://api.github.com")}${path}`, {
119	{
120	headers,	119	headers,
121	},
122	);
123	if (!response.ok) {
124	throw new GitHubSourceError({
125	message: `GitHub request failed: GET ${path} -> ${response.status}`,
126	status: response.status,
127	path,
128	});	120	});
129	}	121	},
130	return (await response.json()) as A;	122	catch: (cause) =>
131	},	123	new GitHubSourceError({
132	catch: (cause) =>	124	message: `GitHub request failed: GET ${path}`,
133	cause instanceof GitHubSourceError	125	path,
134	? cause	126	cause,
135	: new GitHubSourceError({	127	}),
136	message: `GitHub request failed: GET ${path}`,	128	});
137	path,	129	if (!response.ok) {
138	cause,	130	return yield* new GitHubSourceError({
139	}),	131	message: `GitHub request failed: GET ${path} -> ${response.status}`,
		132	status: response.status,
		133	path,
		134	});
		135	}
		136	return yield* Effect.tryPromise({
		137	try: () => response.json() as Promise<A>,
		138	catch: (cause) =>
		139	new GitHubSourceError({
		140	message: `GitHub response was not valid JSON: GET ${path}`,
		141	path,
		142	cause,
		143	}),
		144	});
140	});	145	});
141		146
142	interface RepoResponse {	147	interface RepoResponse {
@@ -254,42 +259,39 @@ const classifyTreeEntry = ( · 111 unmodified lines
254	};	259	};
255		260
256	const decodeBlob = (path: string, blob: BlobResponse): Effect.Effect<string, GitHubSourceError> =>	261	const decodeBlob = (path: string, blob: BlobResponse): Effect.Effect<string, GitHubSourceError> =>
257	Effect.try({	262	Effect.gen(function* () {
258	try: () => {	263	const encoding = asString(blob.encoding);
259	const encoding = asString(blob.encoding);	264	const content = asString(blob.content);
260	const content = asString(blob.content);	265	if (!content \|\| encoding !== "base64") {
261	if (!content \|\| encoding !== "base64") {	266	return yield* new GitHubSourceError({
262	throw new GitHubSourceError({	267	message: `GitHub blob ${path} did not return base64 content`,
263	message: `GitHub blob ${path} did not return base64 content`,	268	path,
264	path,	269	});
265	});	270	}
266	}	271	return Buffer.from(content.replace(/\s/g, ""), "base64").toString("utf8");
267	return Buffer.from(content.replace(/\s/g, ""), "base64").toString("utf8");
268	},
269	catch: (cause) =>
270	cause instanceof GitHubSourceError
271	? cause
272	: new GitHubSourceError({ message: `Failed to decode GitHub blob ${path}`, path, cause }),
273	});	272	});
274		273
		274	const decodeExecutorJson = Schema.decodeUnknownEffect(Schema.UnknownFromJsonString);
		275
275	const executorDescription = (	276	const executorDescription = (
276	files: FileSet,	277	files: FileSet,
277	): Effect.Effect<string \| undefined, GitHubSourceError> =>	278	): Effect.Effect<string \| undefined, GitHubSourceError> =>
278	Effect.try({	279	Effect.gen(function* () {
279	try: () => {	280	const raw = files.get("executor.json");
280	const raw = files.get("executor.json");	281	if (!raw) return undefined;
281	if (!raw) return undefined;	282	const parsed = yield* decodeExecutorJson(raw).pipe(
282	const parsed = JSON.parse(raw) as unknown;	283	Effect.mapError(
283	if (!isRecord(parsed)) return undefined;	284	(cause) =>
284	const description = parsed.description;	285	new GitHubSourceError({
285	return typeof description === "string" ? description : undefined;	286	message: "executor.json is not valid JSON",
286	},	287	path: "executor.json",
287	catch: (cause) =>	288	cause,
288	new GitHubSourceError({	289	}),
289	message: "executor.json is not valid JSON",	290	),
290	path: "executor.json",	291	);
291	cause,	292	if (!isRecord(parsed)) return undefined;
292	}),	293	const description = parsed.description;
		294	return typeof description === "string" ? description : undefined;
293	});	295	});
294		296
295	export const fetchGitHubSource = (	297	export const fetchGitHubSource = (
@@ -336,7 +338,7 @@ export const fetchGitHubSource = ( · 40 unmodified lines
336	else skipped.push(classified.skipped);	338	else skipped.push(classified.skipped);
337	}	339	}
338	const treeLimitError = checkTreeLimits(entries);	340	const treeLimitError = checkTreeLimits(entries);
339	if (treeLimitError) return yield* Effect.fail(treeLimitError);	341	if (treeLimitError) return yield* treeLimitError;
340		342
341	const files = new Map<string, string>();	343	const files = new Map<string, string>();
342	for (const entry of entries) {	344	for (const entry of entries) {
@@ -348,7 +350,7 @@ export const fetchGitHubSource = ( · 5 unmodified lines
348	files.set(path, yield* decodeBlob(path, blob));	350	files.set(path, yield* decodeBlob(path, blob));
349	}	351	}
350	const payloadLimitError = enforcePublishLimits(files);	352	const payloadLimitError = enforcePublishLimits(files);
351	if (payloadLimitError) return yield* Effect.fail(payloadLimitError);	353	if (payloadLimitError) return yield* payloadLimitError;
352		354
353	return {	355	return {
354	files,	356	files,
@@ -360,17 +362,22 @@ export const fetchGitHubSource = ( · 5 unmodified lines
360	};	362	};
361	});	363	});
362		364
363	const publishErrorToSyncError = (error: PublishError): SyncErrorData => ({	365	const publishErrorToSyncError = (publishFailure: PublishError): SyncErrorData => {
364	stage: error.stage,	366	const stage = publishFailure.stage;
365	message: error.message,	367	const message = publishFailure.message;
366	diagnostics: error.diagnostics,	368	const diagnostics = publishFailure.diagnostics;
367	});	369	return { stage, message, diagnostics };
		370	};
368		371
369	const sourceErrorToSyncError = (error: GitHubSourceError): SyncErrorData => ({	372	const sourceErrorToSyncError = (sourceFailure: GitHubSourceError): SyncErrorData => {
370	stage: "source",	373	const message = sourceFailure.message;
371	message: error.message,	374	const path = sourceFailure.path;
372	diagnostics: error.path ? [{ path: error.path, message: error.message }] : [],	375	return {
373	});	376	stage: "source",
		377	message,
		378	diagnostics: path ? [{ path, message }] : [],
		379	};
		380	};
374		381
375	const sourceRef = (snapshot: GitHubSourceSnapshot, connection?: string): AppSourceRef => ({	382	const sourceRef = (snapshot: GitHubSourceSnapshot, connection?: string): AppSourceRef => ({
376	kind: "github",	383	kind: "github",
@@ -391,7 +398,7 @@ export const syncGitHubSource = (input: SyncGitHubSourceInput): Effect.Effect<Gi · 14 unmodified lines
391	tools: [],	398	tools: [],
392	skipped: [],	399	skipped: [],
393	errors: [	400	errors: [
394	error instanceof PublishError	401	Predicate.isTagged("PublishError")(error)
395	? publishErrorToSyncError(error)	402	? publishErrorToSyncError(error)
396	: sourceErrorToSyncError(error),	403	: sourceErrorToSyncError(error),
397	],	404	],

packages/plugins/apps/src/testing/index.ts+8−7

 import type { AppDescriptor } from "../pipeline/descriptor";
 import type { AppsStore } from "../plugin/store";
-import type { BindingError, ClientResolver, ConnectionCandidate } from "../plugin/bindings";
+import { BindingError, type ClientResolver, type ConnectionCandidate } from "../plugin/bindings";
 import {
   ArtifactStoreError,
   asSnapshotId,
       calls.push({ integration, connection, method });
       const handler = handlers[integration]?.[method];
       if (!handler) {
-        return Effect.fail({
+        return Effect.fail(
-          _tag: "BindingError",
+          new BindingError({
-          message: `no test handler for ${integration}.${method}`,
+            message: `no test handler for ${integration}.${method}`,
-          role: integration,
+            role: integration,
-          integration,
+            integration,
-        } as unknown as BindingError);
+          }),
+        );
       }
       return Effect.sync(() => handler(args));
     },