Struct Controller 

pub struct Controller {
    pub config: HelConfig,
    pub state: HelState,
}

Fields

config: HelConfig

state: HelState

Implementations

impl Controller

pub fn resolve_aws_resource_options( &self, target_id: &str, executor: &impl CommandExecutor, ) -> Result<Vec<SessionResourceAllocation>>

pub fn reconnect_command(&self, session_id: &str) -> Result<CommandSpec>

pub fn resource_probe(&self, session_id: &str) -> Result<SessionResourceProbe>

pub fn deployment_capacity_targets(&self) -> Vec<DeploymentCapacityTarget>

pub fn test_target( &self, target_id: &str, executor: &impl CommandExecutor, ) -> Result<()>

impl Controller

pub async fn checkpoint_session( &mut self, session_id: &str, ) -> Result<CheckpointMetadata>

Materialize and locally verify a complete session checkpoint while the target remains live. A failed export or transfer leaves the previous archive and target untouched.

pub async fn checkpoint_session_controlled( &mut self, session_id: &str, executor: &(impl CommandExecutor + Sync), ) -> Result<CheckpointMetadata>

pub async fn create_recovery_checkpoint_managed_controlled( &self, session_id: &str, manager: &SessionManagerControl, executor: &(impl CommandExecutor + Sync), ) -> Result<CheckpointArtifact>

Create, verify, and durably install a recovery archive before allowing the relay to garbage-collect through its event frontier.

impl Controller

pub async fn close_session(&mut self, session_id: &str) -> Result<()>

Checkpoint, ask the harness to close, and only then tear down the exact provisioned target. Checkpoint failure is deliberately non-destructive.

pub async fn close_session_controlled( &mut self, session_id: &str, executor: &(impl CommandExecutor + Sync), ) -> Result<()>

pub async fn close_session_managed_controlled( &mut self, session_id: &str, executor: &(impl CommandExecutor + Sync), manager: &SessionManagerControl, ) -> Result<bool>

pub async fn recover_interrupted_close_managed( &mut self, session_id: &str, executor: &(impl CommandExecutor + Sync), manager: &SessionManagerControl, ) -> Result<bool>

Resume the durable closing state after a controller restart. If the relay had accepted Close, wait for it and destroy through the exact installed checkpoint gate. If it had not, take a fresh checkpoint; the previously installed archive may have become stale after EOF released its barrier.

pub fn cleanup_stopped_target( &mut self, session_id: &str, executor: &impl CommandExecutor, ) -> Result<()>

Finish storage cleanup for a stopped Podman target retained by the quiescence transition. The locator stays durable until every command succeeds, making daemon restart and explicit retry idempotent.

pub fn force_stop( &mut self, session_id: &str, executor: &impl CommandExecutor, ) -> Result<bool>

Tear down the current target without taking a fresh checkpoint, then leave the logical session resumable from its latest verified archive.

pub fn destroy_session_controlled( &mut self, session_id: &str, executor: &impl CommandExecutor, ) -> Result<()>

Permanently destroy an inactive session and every artifact Hel owns for it. External cleanup happens before the durable record is dropped so failures remain visible and retryable.

impl Controller

pub async fn provision_session_controlled( &mut self, session_id: &str, executor: &(impl CommandExecutor + Sync), ) -> Result<()>

pub async fn provision_session_controlled_with_commit( &mut self, session_id: &str, executor: &(impl CommandExecutor + Sync), grant_commit: impl FnOnce() -> Result<()>, ) -> Result<()>

pub async fn provision_session_with( &mut self, session_id: &str, executor: &(impl CommandExecutor + Sync), ) -> Result<()>

pub fn mark_worker_connected( &mut self, session_id: &str, native_session_id: Option<String>, ) -> Result<()>

impl Controller

pub fn scan_orphan_workers( &self, executor: &impl CommandExecutor, ) -> RecoveryScan

Find managed resources which are not represented by the controller’s current state. Labels/tags establish Hel ownership; the worker marker supplies profile and bundle metadata when it is available.

pub async fn adopt_orphan_worker( &mut self, session_id: &str, target_id: &str, profile_override: Option<&str>, bundle_override: Option<&str>, executor: &impl CommandExecutor, ) -> Result<()>

pub fn destroy_orphan_worker( &self, session_id: &str, target_id: &str, confirmation: &str, executor: &impl CommandExecutor, ) -> Result<()>

impl Controller

pub fn preflight_resume_repository_sources( &self, session_id: &str, target_id: &str, executor: &(impl CommandExecutor + Sync), ) -> Result<ResumeRepositorySourcePreflight>

Prove that each configured repository source still supplies the commit boundary its checkpoint bundle expects, before provisioning anything.

pub fn replace_resume_repository_origin( &mut self, session_id: &str, repository_id: &str, replacement: &str, executor: &(impl CommandExecutor + Sync), ) -> Result<ResumeRepositorySourcePreflight>

Validate a replacement first, then atomically save it and check the remaining sources so multi-repository bundles can report the next moved repository without ever provisioning a partial target.

impl Controller

pub async fn resume_session_with_options( &mut self, session_id: &str, profile_id: &str, target_id: &str, additional_mounts: Option<Vec<AdditionalMount>>, resource_allocation: Option<SessionResourceAllocation>, ) -> Result<MaterializedSession>

Resume a stopped logical session on any configured profile and target. Cross-harness resume restores Git and canonical history, starts a fresh native session, and supplies the prior transcript as its first context turn.

pub async fn resume_session_with_options_and_queue_disposition( &mut self, session_id: &str, profile_id: &str, target_id: &str, additional_mounts: Option<Vec<AdditionalMount>>, resource_allocation: Option<SessionResourceAllocation>, discard_queue: bool, ) -> Result<MaterializedSession>

pub async fn resume_session_controlled( &mut self, session_id: &str, profile_id: &str, target_id: &str, options: SessionResumeOptions, executor: &(impl CommandExecutor + Sync), ) -> Result<MaterializedSession>

pub async fn resume_session_controlled_with_repository_preflight( &mut self, session_id: &str, profile_id: &str, target_id: &str, options: SessionResumeOptions, repository_preflight: Option<ResumeRepositorySourceReceipt>, executor: &(impl CommandExecutor + Sync), ) -> Result<MaterializedSession>

impl Controller

pub fn stage_reviewer_profile( &self, session_id: &str, profile_id: &str, generation: u64, ) -> Result<ReviewerLaunchConfig>

Copy profile_id’s home into the session worker’s reviewer directory and describe how the worker should launch it.

generation distinguishes reviewer lifetimes: bumping it tells the worker to start a new conversation instead of reloading the last one.

pub fn stage_reviewer_profile_with_mcp( &self, session_id: &str, profile_id: &str, generation: u64, mcp_servers: &[ReviewMcpServer], dispatch_tool: bool, ) -> Result<ReviewerLaunchConfig>

Stage a reviewer that also gets mcp_servers, which is how a turn review attaches its analyzer tools.

dispatch_tool adds the review supervisor’s own tool, which is this worker’s binary in another mode. Only the controller knows where that binary and its socket sit on the target, so it is built here rather than by the caller.

pub fn stage_reviewer_profile_controlled( &self, session_id: &str, profile_id: &str, generation: u64, mcp_servers: &[ReviewMcpServer], executor: &impl CommandExecutor, ) -> Result<ReviewerLaunchConfig>

impl Controller

pub fn diagnose_worker(&self, session_id: &str) -> Option<String>

Probe the installed binary and collect the dead worker’s exit record and log tail after a session becomes unreachable. Best-effort; returns None when the target no longer exists or has no diagnostics.

pub fn diagnose_worker_controlled( &self, session_id: &str, executor: &impl CommandExecutor, ) -> Option<String>

pub fn worker_recovery_plan( &self, session_id: &str, ) -> Result<WorkerRecoveryPlan>

A non-destructive liveness probe plus commands that replace a confirmed dead session worker without touching its durable relay files. The session manager runs both off its async actor.

pub fn project_memory_sync_target( &self, session_id: &str, ) -> Result<ProjectMemorySyncTarget>

impl Controller

pub async fn upgrade_session_worker( &self, session_id: &str, executor: &(impl CommandExecutor + Sync), manager: &SessionManagerControl, reported_build: Option<&str>, ) -> Result<WorkerUpgradeOutcome>

Replace a session’s worker with the binary this controller would install, when the session is quiet and its worker is a different build.

reported_build is the digest the worker gave the observer that asked for this. It only saves work: a match returns before anything is leased. The decision that matters is taken again under the lease, against a snapshot read from the worker itself, because a session can start working between an observation and this call.

impl Controller

pub fn validate_project_directory( &self, target_id: &str, directory: &Path, executor: &impl CommandExecutor, ) -> Result<()>

Verify a bare project before leaving the project-directory dialog.

pub fn resolve_session_project_source( &self, session_id: &str, executor: &impl CommandExecutor, ) -> Result<ProjectSourceIdentity>

Resolves a session’s canonical project without doing process work on a UI loop. Raw checkouts use their Git origin, which joins sibling linked worktrees to configured bundles from the same repository.

impl Controller

pub fn load() -> Result<Self>

pub fn reload(&mut self) -> Result<()>

pub fn complete_mount_source( &self, target_id: &str, prefix: &str, executor: &impl CommandExecutor, ) -> Result<Vec<String>>

Complete a mount source at the same host that will run the container.

pub fn validate_mount_source( &self, target_id: &str, source: &Path, executor: &impl CommandExecutor, ) -> Result<Option<String>>

Verify a mount source on the host where Mjolnir will consume it, and report the filesystem reason it must be attached read-only, if there is one.

The probe runs in the same round trip as the existence check so the editor learns both answers without a second wait. A probe that cannot answer reports no reason: provisioning decides that authoritatively.

pub fn register_session_with_resources( &mut self, profile_id: &str, bundle_id: &str, target_id: &str, title: impl Into<String>, options: SessionLaunchOptions, ) -> Result<String>

pub fn rename_session( &mut self, session_id: &str, title: &str, ) -> Result<String>

pub fn rename_profile_id(&mut self, old_id: &str, new_id: &str) -> Result<()>

pub fn rename_target_id(&mut self, old_id: &str, new_id: &str) -> Result<()>

pub fn recover_config_id_rename() -> Result<bool>

Finish a profile/target id rename interrupted between the atomic config replacement and SQLite transaction. Each step is idempotent, so a second crash leaves the same intent available for the next startup.

pub fn update_session_container_settings( &mut self, session_id: &str, cpus: Option<String>, memory: Option<String>, additional_mounts: Vec<AdditionalMount>, mount_history: Vec<PathBuf>, ) -> Result<()>

Record the per-session container size overrides and attached directories. Nothing is applied to a running container: the values are read the next time the session’s container is created.