@aictiq/cli 0.2.0 → 0.4.1

package/dist/index.js

@@ -1201,8 +1201,9 @@ async function resolveAgentId(ctx, agent) {
 
 // src/commands/runner.ts
 import { Command as Command7 } from "commander";
+import { randomUUID as randomUUID2 } from "crypto";
 import { existsSync as existsSync3 } from "fs";
-import { arch, platform } from "os";
+import { arch, homedir as homedir4, platform } from "os";
 import { resolve as resolve2 } from "path";
 
 // src/runner/client.ts
@@ -1245,6 +1246,10 @@ var RunnerClient = class {
   async claim(harnesses2, slots, signal2) {
     return await this.send("/runner/runs/claim", { harnesses: harnesses2, slots }, signal2) ?? null;
   }
+  /** Hands a claimed run back before it starts; the instance queues it again and revokes its token. */
+  async release(runId) {
+    await this.send(`/runner/runs/${runId}/release`);
+  }
   async started(runId) {
     await this.send(`/runner/runs/${runId}/started`);
   }
@@ -1338,6 +1343,7 @@ var RunnerClient = class {
 };
 
 // src/runner/config.ts
+import { createHash, randomUUID } from "crypto";
 import { chmodSync as chmodSync3, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname2, join as join3 } from "path";
@@ -1597,12 +1603,30 @@ async function provisionLocal(run, checkout, options, env) {
       return false;
     }
   );
+  if (run.workOnDefaultBranch && !hasOrigin) {
+    throw new RunFailure(
+      "no-remote",
+      `${repo}, ${origin} ${run.projectKey}, has no origin remote to push ${run.branchName} to. Direct delivery needs one; add it with \`git remote add origin <url>\` or use branch-and-pull-request delivery.`
+    );
+  }
   let base = run.defaultBranch;
   if (hasOrigin) {
     options.event(`Fetching origin in ${repo}`);
     await call(["fetch", "origin"]);
     base = `origin/${run.defaultBranch}`;
   }
+  if (run.workOnDefaultBranch) {
+    await call(["clone", "--no-hardlinks", "--", repo, checkout]);
+    const isolated = (args) => gitStep(args, { cwd: checkout, env, signal: options.signal });
+    const remote = (await git(["remote", "get-url", "origin"], { cwd: repo, env })).trim();
+    const remoteUrl = isAbsolute(remote) || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(remote) || /^[^/]+:/.test(remote) ? remote : resolve(repo, remote);
+    await isolated(["remote", "set-url", "origin", remoteUrl]);
+    await isolated(["fetch", "origin"]);
+    await isolated(["checkout", "-B", run.branchName, `origin/${run.branchName}`]);
+    await isolated(["branch", "--set-upstream-to", `origin/${run.branchName}`, run.branchName]);
+    options.event(`Created isolated clone ${checkout} on default branch ${run.branchName}`);
+    return null;
+  }
   const branchExists = await git(
     ["rev-parse", "--verify", "--quiet", `refs/heads/${run.branchName}`],
     {
@@ -1667,8 +1691,10 @@ async function provisionGithub(run, runDir, checkout, options, env) {
   );
   options.event(`Cloned ${full} (depth 50)`);
   const call = (args) => gitStep(args, { cwd: checkout, env, signal: options.signal }, token);
-  await call(["checkout", "-b", run.branchName]);
-  options.event(`Created branch ${run.branchName} from ${run.defaultBranch}`);
+  if (!run.workOnDefaultBranch) {
+    await call(["checkout", "-b", run.branchName]);
+    options.event(`Created branch ${run.branchName} from ${run.defaultBranch}`);
+  }
   await call(["config", "--local", "--replace-all", "credential.helper", ""]);
   await call(["config", "--local", "--add", "credential.helper", CREDENTIAL_HELPER]);
   return { [TOKEN_ENV]: token };
@@ -1750,22 +1776,23 @@ function readRunnerConfig(path = runnerConfigPath()) {
     return null;
   }
   if (typeof parsed !== "object" || parsed === null) return null;
-  const { url, token, name, workspaces, repoRoots, attachments } = parsed;
-  if (typeof url !== "string" || typeof token !== "string") return null;
-  const mapped = {};
-  if (typeof workspaces === "object" && workspaces !== null) {
-    for (const [key, value] of Object.entries(workspaces)) {
-      if (typeof value === "string") mapped[key] = value;
-    }
+  const raw = parsed;
+  let profiles;
+  if (Array.isArray(raw.profiles)) {
+    profiles = raw.profiles.flatMap((entry) => {
+      const profile = readProfile(entry);
+      return profile ? [profile] : [];
+    });
+  } else {
+    const legacy = readProfile(raw);
+    if (!legacy) return null;
+    profiles = [legacy];
   }
-  const roots = Array.isArray(repoRoots) ? repoRoots.filter((root) => typeof root === "string" && root.trim() !== "") : [];
-  const rawLimits = typeof attachments === "object" && attachments !== null ? attachments : {};
+  const rawLimits = typeof raw.attachments === "object" && raw.attachments !== null ? raw.attachments : {};
   return {
-    url,
-    token,
-    ...typeof name === "string" ? { name } : {},
-    workspaces: mapped,
-    repoRoots: roots,
+    machineId: typeof raw.machineId === "string" && UuidPattern.test(raw.machineId) ? raw.machineId : randomUUID(),
+    ...typeof raw.name === "string" ? { name: raw.name } : {},
+    profiles,
     attachments: {
       maxCount: validLimit(rawLimits.maxCount, DefaultAttachmentMaxCount),
       maxBytes: validLimit(rawLimits.maxBytes, DefaultAttachmentMaxBytes)
@@ -1774,10 +1801,56 @@ function readRunnerConfig(path = runnerConfigPath()) {
 }
 function writeRunnerConfig(config, path = runnerConfigPath()) {
   mkdirSync3(dirname2(path), { recursive: true, mode: 448 });
-  writeFileSync3(path, `${JSON.stringify(config, null, 2)}
+  const document = {
+    machineId: config.machineId,
+    ...config.name ? { name: config.name } : {},
+    attachments: config.attachments,
+    profiles: config.profiles.map((profile) => ({
+      ...profile.organization ? { organization: profile.organization } : {},
+      url: profile.url,
+      token: profile.token,
+      workspaces: profile.workspaces,
+      repoRoots: profile.repoRoots
+    }))
+  };
+  writeFileSync3(path, `${JSON.stringify(document, null, 2)}
 `, { mode: 384 });
   chmodSync3(path, 384);
 }
+function profileLabel(profile) {
+  if (profile.organization) return profile.organization;
+  try {
+    return new URL(profile.url).host;
+  } catch {
+    return profile.url;
+  }
+}
+function profileKey(profile) {
+  return createHash("sha256").update(profile.token).digest("hex").slice(0, 16);
+}
+function sameInstance(left, right) {
+  return left.replace(/\/+$/, "").toLowerCase() === right.replace(/\/+$/, "").toLowerCase();
+}
+var UuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function readProfile(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const { url, token, organization, workspaces, repoRoots } = value;
+  if (typeof url !== "string" || typeof token !== "string") return null;
+  const mapped = {};
+  if (typeof workspaces === "object" && workspaces !== null) {
+    for (const [key, path] of Object.entries(workspaces)) {
+      if (typeof path === "string") mapped[key] = path;
+    }
+  }
+  const roots = Array.isArray(repoRoots) ? repoRoots.filter((root) => typeof root === "string" && root.trim() !== "") : [];
+  return {
+    url,
+    token,
+    ...typeof organization === "string" && organization !== "" ? { organization } : {},
+    workspaces: mapped,
+    repoRoots: roots
+  };
+}
 function validLimit(value, fallback) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : fallback;
 }
@@ -2119,7 +2192,7 @@ async function executeRun(run, options) {
       mcpServer: options.workspace.mcpServer
     });
     const env = {
-      ...process.env,
+      ...inheritedEnv(process.env),
       ...invocation.env,
       ...workspace.env,
       // The agent reaches the instance as itself, never as the runner: `aictiq mcp` and the
@@ -2149,7 +2222,9 @@ async function executeRun(run, options) {
       ...invocation.stdin === void 0 ? {} : { stdin: invocation.stdin },
       onLine: (stream, raw) => {
         const line = stripVTControlCharacters(raw);
-        for (const match of line.matchAll(PullRequestUrl)) pullRequestUrl = match[0];
+        if (!run.workOnDefaultBranch) {
+          for (const match of line.matchAll(PullRequestUrl)) pullRequestUrl = match[0];
+        }
         if (stream === "stderr") {
           log.push("stderr", line);
           remember(line);
@@ -2173,7 +2248,7 @@ async function executeRun(run, options) {
     const usage = { costUsd, inputTokens, outputTokens, exitCode };
     if (stopReason) return stopped(exitCode, lastLines, usage);
     const verdict = adapter.outcome(exitCode, lastLines, lastResult);
-    if (verdict.outcome === "succeeded" && !pullRequestUrl) {
+    if (verdict.outcome === "succeeded" && !run.workOnDefaultBranch && !pullRequestUrl) {
       pullRequestUrl = await (options.findPullRequest ?? findPullRequest)(
         workspace.checkout,
         run.branchName,
@@ -2278,6 +2353,9 @@ function truncate(value, max) {
   if (!value) return null;
   return value.length <= max ? value : `${value.slice(0, max - 1)}\u2026`;
 }
+function inheritedEnv(env) {
+  return Object.fromEntries(Object.entries(env).filter(([key]) => !key.toUpperCase().startsWith("AICTIQ_")));
+}
 function message2(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -2613,6 +2691,171 @@ async function probeHarnesses(env) {
   return found.filter((info) => info !== null);
 }
 
+// src/runner/service.ts
+import { posix } from "path";
+var RevokedExitCode = 5;
+function servicePlatform(platform2 = process.platform) {
+  if (platform2 === "darwin") return "macos";
+  if (platform2 === "win32") return "windows";
+  return "linux";
+}
+function serviceDefinition(platform2, options) {
+  switch (platform2) {
+    case "macos":
+      return launchdAgent(options);
+    case "windows":
+      return scheduledTaskInstaller(options);
+    default:
+      return systemdUnit(options);
+  }
+}
+function systemdUnit({ node, entry, parallel, path }) {
+  return `# Save as ~/.config/systemd/user/aictiq-runner.service, then:
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now aictiq-runner
+#   loginctl enable-linger "$USER"   # keep it running after you log out
+#
+# The runner executes agents as this user, with this user's harness sign-ins and git
+# credentials: one runner is one trust domain. SIGTERM lets runs in flight finish;
+# TimeoutStopSec bounds how long systemd waits before it cancels them.
+[Unit]
+Description=Aictiq runner
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${node} ${entry} runner start --parallel ${parallel}
+Restart=on-failure
+RestartSec=10
+# Exit ${RevokedExitCode} means the secret was revoked; restarting cannot fix that.
+RestartPreventExitStatus=${RevokedExitCode}
+KillMode=mixed
+TimeoutStopSec=15min
+Environment=PATH=${path}
+
+[Install]
+WantedBy=default.target
+`;
+}
+var LaunchdLabel = "com.aictiq.runner";
+var LaunchdWrapper = `"$1" "$2" runner start --parallel "$3" &
+child=$!
+trap 'kill -TERM "$child" 2>/dev/null' TERM INT
+wait "$child"
+status=$?
+while kill -0 "$child" 2>/dev/null; do wait "$child"; status=$?; done
+if [ "$status" -eq ${RevokedExitCode} ]; then exit 0; fi
+exit "$status"`;
+function launchdAgent({ node, entry, parallel, path, home }) {
+  const log = posix.join(home, "Library", "Logs", "aictiq-runner.log");
+  const plistPath = `~/Library/LaunchAgents/${LaunchdLabel}.plist`;
+  const string = (value) => `<string>${xml(value)}</string>`;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Save as ${plistPath}, then:
+    launchctl bootstrap gui/$(id -u) ${plistPath}
+  Check it:   launchctl print gui/$(id -u)/${LaunchdLabel}
+  Log:        tail -f ${xmlComment(log)}
+  Remove it:  launchctl bootout gui/$(id -u)/${LaunchdLabel}
+
+  The runner executes agents as this user, with this user's harness sign-ins and git
+  credentials: one runner is one trust domain. It runs while this user is logged in.
+  A stop lets runs in flight finish for up to 15 minutes before launchd kills them.
+-->
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  ${string(LaunchdLabel)}
+  <key>ProgramArguments</key>
+  <array>
+    ${string("/bin/sh")}
+    ${string("-c")}
+    ${string(LaunchdWrapper)}
+    ${string("aictiq-runner")}
+    ${string(node)}
+    ${string(entry)}
+    ${string(parallel)}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    ${string(path)}
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>ExitTimeOut</key>
+  <integer>900</integer>
+  <key>ProcessType</key>
+  ${string("Background")}
+  <key>StandardOutPath</key>
+  ${string(log)}
+  <key>StandardErrorPath</key>
+  ${string(log)}
+</dict>
+</plist>
+`;
+}
+var ScheduledTaskName = "Aictiq runner";
+function scheduledTaskInstaller({ node, entry, parallel, path }) {
+  const loop = `# Written by \`aictiq runner install-service\`; the "${ScheduledTaskName}" task runs it at logon.
+$ErrorActionPreference = 'Continue'
+$env:PATH = ${ps(path)}
+$log = Join-Path $env:LOCALAPPDATA 'aictiq\\runner.log'
+while ($true) {
+  # "$_" turns stderr's error records back into the plain lines the runner wrote.
+  & ${ps(node)} ${ps(entry)} runner start --parallel ${ps(parallel)} 2>&1 |
+    ForEach-Object { "$_" } | Add-Content -Path $log -Encoding utf8
+  if ($LASTEXITCODE -eq ${RevokedExitCode}) {
+    Add-Content -Path $log -Encoding utf8 -Value 'The runner secret was revoked; not restarting.'
+    break
+  }
+  Start-Sleep -Seconds 10
+}
+`;
+  return `# Aictiq runner as a Windows scheduled task. Save as install-runner.ps1, then run:
+#   powershell -NoProfile -ExecutionPolicy Bypass -File install-runner.ps1
+# Check it:   Get-ScheduledTask -TaskName '${ScheduledTaskName}' | Get-ScheduledTaskInfo
+# Log:        Get-Content -Wait "$env:LOCALAPPDATA\\aictiq\\runner.log"
+# Remove it:  Unregister-ScheduledTask -TaskName '${ScheduledTaskName}' -Confirm:$false
+#
+# The task starts at logon and runs while this user is logged in, as this user, with this
+# user's harness sign-ins and git credentials: one runner is one trust domain. Stopping the
+# task ends the runner at once; runs in flight are cancelled, not finished.
+$ErrorActionPreference = 'Stop'
+$dir = Join-Path $env:LOCALAPPDATA 'aictiq'
+New-Item -ItemType Directory -Force -Path $dir | Out-Null
+$script = Join-Path $dir 'runner-service.ps1'
+Set-Content -Path $script -Encoding utf8 -Value @'
+${loop}'@
+
+$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \`"$script\`""
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User "$env:USERDOMAIN\\$env:USERNAME"
+$principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\\$env:USERNAME" -LogonType Interactive -RunLevel Limited
+$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew
+Register-ScheduledTask -TaskName '${ScheduledTaskName}' -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null
+Start-ScheduledTask -TaskName '${ScheduledTaskName}'
+Write-Host "Installed and started '${ScheduledTaskName}'. Log: $(Join-Path $dir 'runner.log')"
+`;
+}
+function xml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function xmlComment(value) {
+  return value.replace(/--/g, "- -");
+}
+function ps(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
 // src/runner/loop.ts
 var KnownHarnesses = ["claude", "codex", "opencode"];
 var RunnerRevokedError = class extends Error {
@@ -2650,6 +2893,7 @@ var RunnerLoop = class {
     let capabilities = await this.options.probe();
     const hello = await this.retrying(() => client.hello(capabilities));
     if (!hello) return;
+    this.options.onHello?.(hello);
     local(
       `Runner "${hello.name}" connected to ${client.baseUrl} (${hello.organizationSlug}); harnesses: ${capabilities.harnesses.map((h) => h.name).join(", ") || "none detected"}`
     );
@@ -2664,9 +2908,15 @@ var RunnerLoop = class {
         }
       })();
     }, hello.heartbeatIntervalSeconds * 1e3);
+    const { floor } = this.options;
+    const floorKey = this.options.floorKey ?? client.baseUrl;
     try {
       let attempt = 0;
       while (!this.stopping) {
+        if (floor) {
+          await floor.turn(floorKey, this.claimAbort.signal);
+          if (this.stopping) break;
+        }
         const free = this.options.parallel - this.active.size;
         if (free <= 0) {
           await this.waitForSlot();
@@ -2693,6 +2943,8 @@ var RunnerLoop = class {
           continue;
         }
         if (!claimed) continue;
+        if (floor && !floor.enter(floorKey) && !await this.handBack(claimed, floor, floorKey))
+          continue;
         local(`Claimed ${claimed.itemKey} (run ${claimed.runId}, ${claimed.harness})`);
         const execution = this.options.execute(claimed, hello, this.shutdown.signal).then(() => void 0).catch((error) => {
           if (error instanceof RunnerHttpError && error.revoked) this.revoke(error);
@@ -2701,6 +2953,7 @@ var RunnerLoop = class {
               `Run ${claimed.runId} ended with an error: ${error instanceof Error ? error.message : String(error)}`
             );
         }).finally(() => {
+          floor?.leave(floorKey);
           this.active.delete(execution);
           this.wake?.();
         });
@@ -2713,6 +2966,32 @@ var RunnerLoop = class {
     }
     if (this.revoked) throw this.revoked;
   }
+  /**
+   * A run claimed while another organization took the floor. It goes back to the queue;
+   * true only when it could not be given back and has now waited for the floor instead,
+   * so the caller executes it.
+   */
+  async handBack(run, floor, key) {
+    const { client, local } = this.options;
+    try {
+      await client.release(run.runId);
+      local(
+        `Gave ${run.itemKey} back to the queue: another organization has runs executing on this machine`
+      );
+      return false;
+    } catch (error) {
+      if (error instanceof RunnerHttpError && error.revoked) {
+        this.revoke(error);
+        return false;
+      }
+      if (error instanceof RunnerHttpError && error.problem?.type) return false;
+      local(
+        `Could not give ${run.itemKey} back (${error instanceof Error ? error.message : String(error)}); it starts when the other organization's runs finish`
+      );
+      while (!floor.enter(key)) await floor.turn(key);
+      return true;
+    }
+  }
   revoke(error) {
     this.revoked ??= new RunnerRevokedError(
       error.problem?.type?.endsWith("token-revoked") ? "This runner was disabled, deleted or rotated. Register it again with `aictiq runner register`." : `The instance refused the runner secret (${error.message}). Register it again with \`aictiq runner register\`.`
@@ -2757,12 +3036,208 @@ var RunnerLoop = class {
   }
 };
 
+// src/runner/floor.ts
+var Floor = class {
+  constructor(handoffMs = 2e3) {
+    this.handoffMs = handoffMs;
+  }
+  handoffMs;
+  holder = null;
+  count = 0;
+  last = null;
+  freedAt = 0;
+  waiting = /* @__PURE__ */ new Map();
+  changed = deferred();
+  /** The organization with runs executing, or null when the floor is free. */
+  get current() {
+    return this.holder;
+  }
+  /**
+   * Resolves when `key` may claim: the floor is free, or its own runs hold it. Also resolves
+   * when `signal` aborts; the caller checks why.
+   */
+  async turn(key, signal2) {
+    this.waiting.set(key, (this.waiting.get(key) ?? 0) + 1);
+    try {
+      while (!signal2?.aborted) {
+        const yieldFor = this.yieldFor(key);
+        if (this.count > 0 ? this.holder === key : yieldFor === 0) return;
+        const waits = [this.changed.promise];
+        let timer;
+        if (yieldFor > 0)
+          waits.push(new Promise((resolve3) => timer = setTimeout(resolve3, yieldFor)));
+        let onAbort;
+        if (signal2) {
+          waits.push(
+            new Promise((resolve3) => {
+              onAbort = () => resolve3();
+              signal2.addEventListener("abort", onAbort, { once: true });
+            })
+          );
+        }
+        await Promise.race(waits);
+        clearTimeout(timer);
+        if (onAbort) signal2?.removeEventListener("abort", onAbort);
+      }
+    } finally {
+      const left = (this.waiting.get(key) ?? 1) - 1;
+      if (left === 0) this.waiting.delete(key);
+      else this.waiting.set(key, left);
+    }
+  }
+  /** Takes the floor for one run of `key`; false when another organization's runs hold it. */
+  enter(key) {
+    if (this.count > 0 && this.holder !== key) return false;
+    this.holder = key;
+    this.count++;
+    this.notify();
+    return true;
+  }
+  leave(key) {
+    if (this.holder !== key || this.count === 0) return;
+    this.count--;
+    if (this.count === 0) {
+      this.holder = null;
+      this.last = key;
+      this.freedAt = Date.now();
+    }
+    this.notify();
+  }
+  /** How long `key` stands back from a free floor so a waiting organization goes first. */
+  yieldFor(key) {
+    if (this.count > 0 || key !== this.last) return 0;
+    const othersWaiting = [...this.waiting.keys()].some((other) => other !== key);
+    if (!othersWaiting) return 0;
+    return Math.max(0, this.freedAt + this.handoffMs - Date.now());
+  }
+  notify() {
+    const previous = this.changed;
+    this.changed = deferred();
+    previous.resolve();
+  }
+};
+function deferred() {
+  let resolve3;
+  const promise = new Promise((done) => resolve3 = done);
+  return { promise, resolve: resolve3 };
+}
+
+// src/runner/supervisor.ts
+var RunnerSupervisor = class {
+  options;
+  floor;
+  running = /* @__PURE__ */ new Map();
+  /** Secrets that failed: revoked ones for good, others until the time given. */
+  failed = /* @__PURE__ */ new Map();
+  stopping = false;
+  settle;
+  constructor(options) {
+    this.options = options;
+    this.floor = options.floor ?? new Floor();
+  }
+  get inFlight() {
+    let total = 0;
+    for (const { loop } of this.running.values()) total += loop.inFlight;
+    return total;
+  }
+  stop() {
+    this.stopping = true;
+    for (const { loop } of this.running.values()) loop.stop();
+    this.settle?.();
+  }
+  abort() {
+    this.stopping = true;
+    for (const { loop } of this.running.values()) loop.abort();
+    this.settle?.();
+  }
+  async run() {
+    const reload = setInterval(() => this.sync(), this.options.reloadMs ?? 5e3);
+    try {
+      this.sync();
+      while (!this.stopping) {
+        const revoked = this.allRevoked();
+        if (revoked) throw revoked;
+        await new Promise((resolve3) => this.settle = resolve3);
+      }
+      await Promise.all([...this.running.values()].map(({ done }) => done));
+    } finally {
+      clearInterval(reload);
+      this.settle = void 0;
+    }
+  }
+  /** Every configured profile is revoked and nothing runs: the error to exit with, else null. */
+  allRevoked() {
+    if (this.running.size > 0) return null;
+    const profiles = this.options.readConfig()?.profiles ?? [];
+    if (profiles.length === 0) return null;
+    let last = null;
+    for (const profile of profiles) {
+      const failure = this.failed.get(profile.token);
+      if (!failure?.revoked) return null;
+      last = failure.revoked;
+    }
+    return profiles.length === 1 || !last ? last : new RunnerRevokedError(
+      "Every organization this runner served disabled, deleted or rotated its runner. Register it again with `aictiq runner register`."
+    );
+  }
+  sync() {
+    if (this.stopping) return;
+    const config = this.options.readConfig();
+    const profiles = config?.profiles ?? [];
+    const wanted = new Map(profiles.map((profile) => [profile.token, profile]));
+    for (const [token, running] of this.running) {
+      if (wanted.has(token) || running.retired) continue;
+      running.retired = true;
+      this.options.local(
+        `[${profileLabel(running.profile)}] Removed from runner.json; stopping after its runs finish`
+      );
+      running.loop.stop();
+    }
+    for (const profile of wanted.values()) {
+      if (this.running.has(profile.token)) continue;
+      const failure = this.failed.get(profile.token);
+      if (failure && (failure.revoked || Date.now() < failure.retryAt)) continue;
+      this.failed.delete(profile.token);
+      this.start(profile);
+    }
+    this.settle?.();
+  }
+  start(profile) {
+    const label = () => profileLabel(profile);
+    const loop = this.options.createLoop(profile, this.floor, (hello) => {
+      if (profile.organization !== hello.organizationSlug) {
+        profile.organization = hello.organizationSlug;
+        this.options.learned?.(profile, hello);
+      }
+    });
+    const running = { profile, loop, done: Promise.resolve(), retired: false };
+    running.done = loop.run().catch((error) => {
+      if (error instanceof RunnerRevokedError) {
+        this.options.local(`[${label()}] ${error.message}`);
+        this.failed.set(profile.token, { revoked: error, retryAt: Number.POSITIVE_INFINITY });
+        return;
+      }
+      const retryMs = this.options.retryMs ?? 6e4;
+      this.options.local(
+        `[${label()}] Stopped: ${error instanceof Error ? error.message : String(error)}; trying again in ${Math.round(retryMs / 1e3)}s`
+      );
+      this.failed.set(profile.token, { revoked: null, retryAt: Date.now() + retryMs });
+    }).finally(() => {
+      this.running.delete(profile.token);
+      this.settle?.();
+    });
+    this.running.set(profile.token, running);
+  }
+};
+
 // src/commands/runner.ts
 function runnerCommand(globals) {
   const runner = new Command7("runner").description(
     "Run agent work dispatched from a Aictiq instance on this machine"
   );
-  runner.command("register").description("Store a runner secret (jrn_\u2026) from Factory \u2192 Runners and check it").option("--url <url>", "Base URL of the Aictiq instance").option("--token <token>", "Runner secret; read from stdin when omitted").option("--name <name>", "A local label for this runner (the instance keeps its own name)").action(async (options) => {
+  runner.command("register").description(
+    "Store a runner secret (jrn_\u2026) from Factory \u2192 Runners and check it. A secret from another organization adds it to this machine"
+  ).option("--url <url>", "Base URL of the Aictiq instance").option("--token <token>", "Runner secret; read from stdin when omitted").option("--name <name>", "A local label for this machine (each instance keeps its own name)").action(async (options) => {
     const global = globals();
     const rawUrl = options.url ?? global.url;
     if (!rawUrl) {
@@ -2779,92 +3254,150 @@ function runnerCommand(globals) {
       );
     }
     const url = rawUrl.replace(/\/+$/, "");
-    const capabilities = await probe(1);
+    const existing = readRunnerConfig();
+    const machineId = existing?.machineId ?? randomUUID2();
+    const capabilities = await probe(1, machineId);
     const hello = await new RunnerClient({ baseUrl: url, token }).hello(capabilities).catch((error) => {
       throw asCliError(error);
     });
-    const existing = readRunnerConfig();
-    const config = {
+    const profiles = existing?.profiles ?? [];
+    const index = await matchingProfile(profiles, url, token, hello.organizationSlug, capabilities);
+    const previous = index >= 0 ? profiles[index] : void 0;
+    const profile = {
       url,
       token,
-      ...options.name ? { name: options.name } : existing?.name ? { name: existing.name } : {},
-      // Re-registering (a rotated secret) keeps the repository map someone built up.
-      workspaces: existing?.workspaces ?? {},
-      repoRoots: existing?.repoRoots ?? [],
-      attachments: existing?.attachments ?? { maxCount: DefaultAttachmentMaxCount, maxBytes: DefaultAttachmentMaxBytes }
+      organization: hello.organizationSlug,
+      // Re-registering one organization (a rotated secret) keeps the repository map
+      // someone built up; a new organization starts with its own, empty one.
+      workspaces: previous?.workspaces ?? {},
+      repoRoots: previous?.repoRoots ?? []
     };
-    writeRunnerConfig(config);
+    const next = index >= 0 ? profiles.map((p, i) => i === index ? profile : p) : [...profiles, profile];
+    const name = options.name ?? existing?.name;
+    writeRunnerConfig({
+      machineId,
+      ...name ? { name } : {},
+      profiles: next,
+      attachments: existing?.attachments ?? { maxCount: DefaultAttachmentMaxCount, maxBytes: DefaultAttachmentMaxBytes }
+    });
     if (globals().json) {
-      printJson({ url, runner: hello, capabilities, configPath: runnerConfigPath() });
+      printJson({
+        url,
+        runner: hello,
+        capabilities,
+        configPath: runnerConfigPath(),
+        organizations: next.map(profileLabel)
+      });
       return;
     }
-    print(
-      `Registered runner "${hello.name}" with ${url} (${hello.organizationSlug}).
-Harnesses: ${capabilities.harnesses.map((h) => h.name).join(", ") || "none found on PATH"}
-Config written to ${runnerConfigPath()}. Start it with \`aictiq runner start\`.`
-    );
+    const organizations = next.map(profileLabel);
+    const lines = [
+      `Registered runner "${hello.name}" with ${url} (${hello.organizationSlug}).`,
+      `Harnesses: ${capabilities.harnesses.map((h) => h.name).join(", ") || "none found on PATH"}`,
+      `Config written to ${runnerConfigPath()}.`
+    ];
+    if (next.length > 1) {
+      lines.push(
+        "",
+        `This machine now runs for ${next.length} organizations: ${organizations.join(", ")}.`,
+        "Runs from different organizations never execute at the same time.",
+        `Repository roots and mappings are per organization: \`aictiq runner root <path> --org ${hello.organizationSlug}\`.`,
+        "A running `aictiq runner start` picks this up within a few seconds; otherwise start it."
+      );
+    } else {
+      lines.push("Start it with `aictiq runner start`.");
+    }
+    print(lines.join("\n"));
   });
   runner.command("map").description(
     "Map a project key to a local clone, for projects whose repository source is local"
-  ).argument("<projectKey>", "Project key, e.g. ACME").argument("[path]", "Path of the clone (default: the current directory); omit with --remove").option("--remove", "Remove the mapping").action((projectKey, path, options) => {
+  ).argument("<projectKey>", "Project key, e.g. ACME").argument("[path]", "Path of the clone (default: the current directory); omit with --remove").option("--remove", "Remove the mapping").option("--org <slug>", "The organization the mapping is for, when this machine runs for several").action((projectKey, path, options) => {
     const config = requireConfig();
+    const profile = selectProfile(config, options.org ?? globals().org);
     const key = projectKey.toUpperCase();
     if (options.remove) {
-      delete config.workspaces[key];
+      delete profile.workspaces[key];
     } else {
       const absolute = resolve2(path ?? ".");
       if (!existsSync3(absolute))
         throw new CliError(`${absolute} does not exist.`, ExitCode.Validation);
-      config.workspaces[key] = absolute;
+      profile.workspaces[key] = absolute;
     }
     writeRunnerConfig(config);
+    const where = config.profiles.length > 1 ? ` (${profileLabel(profile)})` : "";
     print(
-      options.remove ? `Removed the mapping for ${key}.` : `${key} \u2192 ${config.workspaces[key]}`
+      options.remove ? `Removed the mapping for ${key}${where}.` : `${key} \u2192 ${profile.workspaces[key]}${where}`
     );
   });
   runner.command("root").description(
     "Trust the web UI's path hint for local projects whose clone is under this directory"
-  ).argument("[path]", "Directory that holds your clones (default: the current directory)").option("--remove", "Stop trusting path hints under this directory").action((path, options) => {
+  ).argument("[path]", "Directory that holds your clones (default: the current directory)").option("--remove", "Stop trusting path hints under this directory").option("--org <slug>", "The organization whose path hints to trust, when this machine runs for several").action((path, options) => {
     const config = requireConfig();
+    const profile = selectProfile(config, options.org ?? globals().org);
     const absolute = resolve2(path ?? ".");
     if (options.remove) {
-      config.repoRoots = config.repoRoots.filter((root) => resolve2(root) !== absolute);
+      profile.repoRoots = profile.repoRoots.filter((root) => resolve2(root) !== absolute);
     } else {
       if (!existsSync3(absolute))
         throw new CliError(`${absolute} does not exist.`, ExitCode.Validation);
-      if (!config.repoRoots.some((root) => resolve2(root) === absolute))
-        config.repoRoots.push(absolute);
+      if (!profile.repoRoots.some((root) => resolve2(root) === absolute))
+        profile.repoRoots.push(absolute);
     }
     writeRunnerConfig(config);
+    const whose = config.profiles.length > 1 ? `${profileLabel(profile)}'s path hints` : "Path hints";
     print(
-      options.remove ? `Path hints under ${absolute} are no longer used.` : `Path hints under ${absolute} are used for projects without a mapping.`
+      options.remove ? `${whose} under ${absolute} are no longer used.` : `${whose} under ${absolute} are used for projects without a mapping.`
     );
   });
-  runner.command("status").description("Show the registration, detected harnesses and mapped repositories").action(async () => {
+  runner.command("remove").description("Stop running for one organization on this machine (the other organizations are kept)").argument("<org>", "Organization slug, as `aictiq runner status` lists it").action((org) => {
     const config = requireConfig();
-    const capabilities = await probe(1);
-    let registration;
-    let registrationText;
-    try {
-      const hello = await new RunnerClient({ baseUrl: config.url, token: config.token }).hello(
-        capabilities
-      );
-      registration = hello;
-      registrationText = `ok - "${hello.name}" in ${hello.organizationSlug}`;
-    } catch (error) {
-      registration = { error: error instanceof Error ? error.message : String(error) };
-      registrationText = `failing - ${error instanceof Error ? error.message : String(error)}`;
-      if (error instanceof RunnerHttpError && error.revoked) process.exitCode = ExitCode.Auth;
-    }
+    const profile = selectProfile(config, org);
+    config.profiles = config.profiles.filter((p) => p !== profile);
+    writeRunnerConfig(config);
+    print(
+      `Removed ${profileLabel(profile)} from this machine. A running \`aictiq runner start\` stops taking its runs within a few seconds.
+Its secret still works until you disable or delete the runner in ${profileLabel(profile)}'s Factory \u2192 Runners.`
+    );
+  });
+  runner.command("status").description("Show each registration, detected harnesses and mapped repositories").action(async () => {
+    const config = requireConfig();
+    const capabilities = await probe(1, config.machineId);
+    const registrations = await Promise.all(
+      config.profiles.map(async (profile) => {
+        try {
+          const hello = await new RunnerClient({ baseUrl: profile.url, token: profile.token }).hello(capabilities);
+          return { profile, hello, text: `ok - "${hello.name}" in ${hello.organizationSlug}`, revoked: false };
+        } catch (error) {
+          const message3 = error instanceof Error ? error.message : String(error);
+          return {
+            profile,
+            error: message3,
+            text: `failing - ${message3}`,
+            revoked: error instanceof RunnerHttpError && error.revoked
+          };
+        }
+      })
+    );
+    if (registrations.some((r) => r.revoked)) process.exitCode = ExitCode.Auth;
     if (globals().json) {
-      printJson({ url: config.url, registration, capabilities, workspaces: config.workspaces, repoRoots: config.repoRoots, attachments: config.attachments });
+      printJson({
+        machineId: config.machineId,
+        capabilities,
+        attachments: config.attachments,
+        profiles: registrations.map((r) => ({
+          url: r.profile.url,
+          organization: r.hello?.organizationSlug ?? r.profile.organization ?? null,
+          registration: r.hello ?? { error: r.error },
+          workspaces: r.profile.workspaces,
+          repoRoots: r.profile.repoRoots
+        }))
+      });
       return;
     }
     print(
       renderFields([
-        ["Instance", config.url],
-        ["Registration", registrationText],
         ["Config", runnerConfigPath()],
+        ["Machine", config.machineId],
         ["Workspaces", defaultWorkspaceRoot()],
         ["Attachments", `${config.attachments.maxCount} files / ${formatBytes2(config.attachments.maxBytes)} per run`],
         ["CLI", `${version} (${capabilities.os}/${capabilities.arch})`]
@@ -2877,52 +3410,80 @@ Config written to ${runnerConfigPath()}. Start it with \`aictiq runner start\`.`
         { header: "VERSION", value: (h) => h.version ?? "" }
       ])
     );
-    print("");
-    const mapped = Object.entries(config.workspaces);
-    print(
-      mapped.length === 0 ? "No local repositories mapped (`aictiq runner map <KEY> <path>`)." : renderTable(mapped, [
-        { header: "PROJECT", value: ([key]) => key },
-        { header: "REPOSITORY", value: ([, path]) => path }
-      ])
-    );
-    print("");
-    print(
-      config.repoRoots.length === 0 ? "No repository roots; path hints from the web UI are not used (`aictiq runner root <path>`)." : renderTable(config.repoRoots, [{ header: "REPOSITORY ROOT", value: (root) => root }])
-    );
+    for (const { profile, hello, text } of registrations) {
+      const org = hello?.organizationSlug ?? profileLabel(profile);
+      print("");
+      print(
+        renderFields([
+          ["Organization", org],
+          ["Instance", profile.url],
+          ["Registration", text]
+        ])
+      );
+      const mapped = Object.entries(profile.workspaces);
+      print(
+        mapped.length === 0 ? `No local repositories mapped (\`aictiq runner map <KEY> <path> --org ${org}\`).` : renderTable(mapped, [
+          { header: "PROJECT", value: ([key]) => key },
+          { header: "REPOSITORY", value: ([, path]) => path }
+        ])
+      );
+      print(
+        profile.repoRoots.length === 0 ? `No repository roots; path hints from ${org} are not used (\`aictiq runner root <path> --org ${org}\`).` : renderTable(profile.repoRoots, [{ header: "REPOSITORY ROOT", value: (root) => root }])
+      );
+    }
   });
-  runner.command("start").description("Poll for runs and execute them until interrupted").option("--parallel <n>", "Runs executed at the same time", "1").option("--keep-workspaces", "Leave each run\u2019s checkout on disk after it finishes").option("--workspace-root <path>", "Where run checkouts are created").action(
+  runner.command("start").description("Poll every registered organization for runs and execute them until interrupted").option("--parallel <n>", "Runs of one organization executed at the same time", "1").option("--keep-workspaces", "Leave each run\u2019s checkout on disk after it finishes").option("--workspace-root <path>", "Where run checkouts are created").action(
     async (options) => {
       const config = requireConfig();
       const parallel = Number.parseInt(options.parallel, 10);
       if (!Number.isInteger(parallel) || parallel < 1 || parallel > 16) {
         throw new CliError("--parallel is between 1 and 16.", ExitCode.Validation);
       }
-      const client = new RunnerClient({ baseUrl: config.url, token: config.token });
-      const local = (message3) => process.stderr.write(`${(/* @__PURE__ */ new Date()).toISOString()} ${message3}
+      writeRunnerConfig(config);
+      const log = (message3) => process.stderr.write(`${(/* @__PURE__ */ new Date()).toISOString()} ${message3}
 `);
       const workspaceRoot = resolve2(options.workspaceRoot ?? defaultWorkspaceRoot());
-      const loop = new RunnerLoop({
-        client,
-        parallel,
-        probe: () => probe(parallel),
-        local,
-        execute: (run, hello, shutdown) => {
-          const current = readRunnerConfig() ?? config;
-          return executeRun(run, {
+      const supervisor = new RunnerSupervisor({
+        readConfig: () => readRunnerConfig(),
+        local: log,
+        learned: (profile) => {
+          const current = readRunnerConfig();
+          const stored = current?.profiles.find((p) => p.token === profile.token);
+          if (!current || !stored || stored.organization === profile.organization) return;
+          stored.organization = profile.organization;
+          writeRunnerConfig(current);
+        },
+        createLoop: (profile, floor, onHello) => {
+          const client = new RunnerClient({ baseUrl: profile.url, token: profile.token });
+          const local = (message3) => log(`[${profileLabel(profile)}] ${message3}`);
+          return new RunnerLoop({
             client,
-            hello,
-            adapters: harnesses,
-            runnerToken: config.token,
-            shutdown,
+            parallel,
+            probe: () => probe(parallel, config.machineId),
             local,
-            workspace: {
-              root: workspaceRoot,
-              repositories: current.workspaces,
-              repoRoots: current.repoRoots,
-              keep: options.keepWorkspaces === true,
-              mcpServer: mcpServerCommand(),
-              attachmentMaxCount: current.attachments.maxCount,
-              attachmentMaxBytes: current.attachments.maxBytes
+            floor,
+            floorKey: profileKey(profile),
+            onHello,
+            execute: (run, hello, shutdown) => {
+              const current = readRunnerConfig();
+              const own = current?.profiles.find((p) => p.token === profile.token) ?? profile;
+              return executeRun(run, {
+                client,
+                hello,
+                adapters: harnesses,
+                runnerToken: profile.token,
+                shutdown,
+                local,
+                workspace: {
+                  root: workspaceRoot,
+                  repositories: own.workspaces,
+                  repoRoots: own.repoRoots,
+                  keep: options.keepWorkspaces === true,
+                  mcpServer: mcpServerCommand(),
+                  attachmentMaxCount: (current ?? config).attachments.maxCount,
+                  attachmentMaxBytes: (current ?? config).attachments.maxBytes
+                }
+              });
             }
           });
         }
@@ -2930,22 +3491,22 @@ Config written to ${runnerConfigPath()}. Start it with \`aictiq runner start\`.`
       let interrupts = 0;
       const onSignal = (signal2) => {
         interrupts++;
-        if (interrupts === 1 && loop.inFlight > 0) {
-          local(
-            `${signal2}: finishing ${loop.inFlight} run(s) in flight; send it again to cancel them`
+        if (interrupts === 1 && supervisor.inFlight > 0) {
+          log(
+            `${signal2}: finishing ${supervisor.inFlight} run(s) in flight; send it again to cancel them`
           );
-          loop.stop();
+          supervisor.stop();
         } else if (interrupts === 1) {
-          loop.stop();
+          supervisor.stop();
         } else {
-          local(`${signal2}: cancelling runs in flight`);
-          loop.abort();
+          log(`${signal2}: cancelling runs in flight`);
+          supervisor.abort();
         }
       };
       process.on("SIGINT", onSignal);
       process.on("SIGTERM", onSignal);
       try {
-        await loop.run();
+        await supervisor.run();
       } catch (error) {
         throw asCliError(error);
       } finally {
@@ -2954,50 +3515,72 @@ Config written to ${runnerConfigPath()}. Start it with \`aictiq runner start\`.`
       }
     }
   );
-  runner.command("install-service").description("Print a systemd user unit that keeps `aictiq runner start` running").option("--parallel <n>", "Runs executed at the same time", "1").action((options) => {
-    print(systemdUnit(process.execPath, cliEntry(), options.parallel));
+  runner.command("install-service").description(
+    "Print a service definition that keeps `aictiq runner start` running: a systemd user unit (Linux), a launchd agent (macOS) or a Task Scheduler installer (Windows)"
+  ).option("--parallel <n>", "Runs executed at the same time", "1").option("--platform <platform>", "linux, macos or windows (default: this machine)").action((options) => {
+    const platform2 = options.platform ?? servicePlatform();
+    if (!isServicePlatform(platform2)) {
+      throw new CliError(
+        `Unknown platform "${platform2}". Use linux, macos or windows.`,
+        ExitCode.Validation
+      );
+    }
+    print(
+      serviceDefinition(platform2, {
+        node: process.execPath,
+        entry: cliEntry(),
+        parallel: options.parallel,
+        path: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
+        home: homedir4()
+      })
+    );
   });
   return runner;
 }
-function systemdUnit(node, entry, parallel) {
-  return `# Save as ~/.config/systemd/user/aictiq-runner.service, then:
-#   systemctl --user daemon-reload
-#   systemctl --user enable --now aictiq-runner
-#   loginctl enable-linger "$USER"   # keep it running after you log out
-#
-# The runner executes agents as this user, with this user's harness sign-ins and git
-# credentials: one runner is one trust domain. SIGTERM lets runs in flight finish;
-# TimeoutStopSec bounds how long systemd waits before it cancels them.
-[Unit]
-Description=Aictiq runner
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStart=${node} ${entry} runner start --parallel ${parallel}
-Restart=on-failure
-RestartSec=10
-# Exit 5 means the secret was revoked; restarting cannot fix that.
-RestartPreventExitStatus=5
-KillMode=mixed
-TimeoutStopSec=15min
-Environment=PATH=${process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin"}
-
-[Install]
-WantedBy=default.target
-`;
-}
-async function probe(maxParallel) {
+async function probe(maxParallel, machineId) {
   return {
     v: 1,
     harnesses: await probeHarnesses(),
     os: platform(),
     arch: arch(),
     cliVersion: version,
-    maxParallel
+    maxParallel,
+    machineId
   };
 }
+async function matchingProfile(profiles, url, token, organization, capabilities) {
+  const exact = profiles.findIndex(
+    (p) => p.token === token || sameInstance(p.url, url) && p.organization === organization
+  );
+  if (exact >= 0) return exact;
+  for (const [index, profile] of profiles.entries()) {
+    if (profile.organization || !sameInstance(profile.url, url)) continue;
+    try {
+      const hello = await new RunnerClient({ baseUrl: profile.url, token: profile.token }).hello(capabilities);
+      profile.organization = hello.organizationSlug;
+      if (hello.organizationSlug === organization) return index;
+    } catch (error) {
+      if (error instanceof RunnerHttpError && error.revoked && profiles.length === 1) return index;
+    }
+  }
+  return -1;
+}
+function selectProfile(config, org) {
+  const serves = config.profiles.map(profileLabel).join(", ");
+  if (org) {
+    const wanted = org.toLowerCase();
+    const found = config.profiles.find((p) => profileLabel(p).toLowerCase() === wanted);
+    if (!found) {
+      throw new CliError(`This machine does not run for ${org}. It runs for: ${serves}.`, ExitCode.Validation);
+    }
+    return found;
+  }
+  if (config.profiles.length === 1) return config.profiles[0];
+  throw new CliError(
+    `This machine runs for several organizations (${serves}). Say which with --org <slug>.`,
+    ExitCode.Validation
+  );
+}
 function cliEntry() {
   return resolve2(process.argv[1] ?? "aictiq");
 }
@@ -3009,7 +3592,7 @@ function formatBytes2(value) {
 }
 function requireConfig() {
   const config = readRunnerConfig();
-  if (!config) {
+  if (!config || config.profiles.length === 0) {
     throw new CliError(
       `This machine is not registered as a runner (${runnerConfigPath()}). Run \`aictiq runner register --url <url> --token <jrn_\u2026>\`.`,
       ExitCode.Auth
@@ -3027,6 +3610,9 @@ function asCliError(error) {
   }
   return error;
 }
+function isServicePlatform(value) {
+  return value === "linux" || value === "macos" || value === "windows";
+}
 
 // src/commands/sprint.ts
 import { Command as Command8 } from "commander";