CL-6458: seed the template library on first read, not at boot behind an operator bench

apps/hub/src/index.ts

@@ -257,6 +257,7 @@
   createArtifactRoutes,
   createTemplateLibraryDbStore,
   createTemplateLibraryRoutes,
+  createTemplateLibrarySeeder,
   createUnavailableArtifactRoutes,
   createUnavailableTemplateLibraryRoutes,
   createUnavailableWorkflowArtifactRoutes,
@@ -333,7 +334,6 @@
 } from "./config";
 import type { SidecarProvisioner } from "@intx/hub-sessions";
 import { scheduleEnvProviderCredentialPlant } from "./env-credential-plant";
-import { scheduleTemplateLibrarySeed } from "./template-library-seed";
 import { createHubRoutineLauncher } from "./routine-launcher";
 import { withTurnPartWriteDefaults } from "./turn-part-content-default";
 import { createHubRunSummaryResolver } from "./routine-run-summary";
@@ -403,7 +403,7 @@
 // in ahead of that would be dead surface that also risks logging a
 // verification secret with nowhere honest to send it.
 function dbConfigFromUrl(databaseUrl: string) {
   const url = new URL(databaseUrl);
   return {
     host: url.hostname,
     port: url.port === "" ? 5432 : Number(url.port),
@@ -3307,15 +3307,23 @@
 
     // The bench library's template shelf (CL-6344): what the
     // new-workbench picker instantiates from — seeded rows, never a
-    // hardcoded import.
+    // hardcoded import. Reading the shelf is what seeds it (CL-6458), so
+    // a bench created at any point after boot carries the shipped
+    // manifests the first time its picker opens.
     app.route(
       `${TENANT_PREFIX}/library/templates`,
       createTemplateLibraryRoutes({
         store: createTemplateLibraryDbStore(artifactsHandle.db),
+        seeder: createTemplateLibrarySeeder({
+          db: artifactsHandle.db,
+          entries: workbenchTemplateLibraryEntries(),
+          log: (line) => log.info`${line}`,
+        }),
         requireGrant: createRequireGrant({
           grantStore: chatGrantStore,
           conditionRegistry: chatConditionRegistry,
         }),
+        log: (line) => log.error`${line}`,
       }),
     );
 
@@ -3456,23 +3464,6 @@
     fetch: (request) => Promise.resolve(guardedApp.fetch(request)),
   });
 
-  // Bench-library template seed (CL-6344): the hub, as system, plants
-  // the shipped workbench template manifests and their tool tarballs
-  // into the operator bench's library at boot — idempotently, so a
-  // second boot leaves exactly one entry per template. Skipped in
-  // degraded (no-artifacts) mode: with no library to seed into there is
-  // nothing honest to do. See ./template-library-seed.ts.
-  const templateLibrarySeed =
-    artifactsHandle !== undefined
-      ? scheduleTemplateLibrarySeed({
-          baseUrl: config.baseUrl,
-          admin: config.envCredentialPlantAdmin,
-          fetch: (request) => Promise.resolve(guardedApp.fetch(request)),
-          artifactsDb: artifactsHandle.db,
-          entries: workbenchTemplateLibraryEntries(),
-        })
-      : { stop: (): void => {} };
-
   return {
     app: guardedApp,
     db,
@@ -3482,7 +3473,6 @@
         clearTimeout(sidecarAllocationReconciliationTimer);
       }
       envCredentialPlant.stop();
-      templateLibrarySeed.stop();
       chatOrchestrator.dispose();
       taskOrchestrator.dispose();
       taskLifecycle.stop();

apps/web/src/instant-agent-create.ts

@@ -106,19 +106,21 @@ export async function createWorkbenchFromTemplate(
   if (setupTemplate === undefined) {
     throw new Error("No default setup agent found for this workbench.");
   }
-  // The manifest comes from the bench library the hub seeded at boot
-  // (CL-6344), never from a hardcoded catalog import. `blank` is the one
-  // id with no manifest by design; any other id resolving to nothing
-  // means this bench's boot seed hasn't run — fail loud rather than
-  // mint a workbench missing its agents.
+  // The manifest comes from the bench library (CL-6344), never from a
+  // hardcoded catalog import; reading it is what seeds the shelf
+  // (CL-6458). `blank` is the one id with no manifest by design; any
+  // other id resolving to nothing means this build ships no such
+  // template — fail loud rather than mint a workbench missing its
+  // agents. The picker only offers ids the library listed, so this is
+  // the race-loser's message, not the everyday path.
   const manifest =
     templateId === "blank"
       ? undefined
       : ((await fetchWorkbenchTemplateManifest(tenantId, templateId)) ??
         undefined);
   if (templateId !== "blank" && manifest === undefined) {
     throw new Error(
-      `The "${templateId}" template isn't in this bench's library yet — its boot seed hasn't run.`,
+      `This bench can't set up a ${templateId} workbench yet — it isn't in the library.`,
     );
   }
   const requiresGithub =