@boardwalk-labs/runner 0.1.3 → 0.1.5

package/dist/daemon/daemon.js

@@ -92,6 +92,10 @@ export function startDaemon(deps) {
     }
     const done = (async () => {
         log.info("daemon_started", { runnerId: deps.runnerId, workDir: deps.workDir });
+        // Reclaim run dirs a previous daemon left behind (crash / SIGKILL / force-quit): a completed
+        // run always cleans its own dir, so anything here is orphaned and may hold a workspace the
+        // crashed run wrote. Best-effort; a failure must not stop the daemon.
+        await rm(path.join(deps.workDir, "runs"), { recursive: true, force: true }).catch(() => undefined);
         while (!draining) {
             deps.onIdle?.();
             try {

package/dist/runtime/agent/model_rates.js

@@ -6,7 +6,7 @@
 // no upstream cost: a BYO-provider turn (the org pays its own key), or a managed turn whose cost the
 // broker couldn't read. It bounds runaway loops; it is NOT the bill. Actual billing is per-request
 // COST PASS-THROUGH (OpenRouter's reported cost × margin) via Stripe meters (domain/billing +
-// run_usage_service).
+// run_usage_service). the platform spec
 //
 // Deliberately NOT a per-model table with a silent fallback: a lookup that returns a Sonnet-class
 // default for any unknown id only created the ILLUSION of precision. The real per-request cost (above)

package/dist/runtime/agent/secret_redactor.js

@@ -1,5 +1,4 @@
-// SecretRedactor — scrubs known secret values from everything bound for an LLM (the platform spec,
-// the workflow runtime design, plan #9).
+// SecretRedactor — scrubs known secret values from everything bound for an LLM (the platform spec).
 //
 // The architectural guarantee is structural: secrets live ONLY in the workflow PROGRAM (the trusted
 // deterministic tool layer), which holds them via `secrets.get` / `ctx.secrets.resolve`. The

package/dist/runtime/broker_artifact_store.js

@@ -1,5 +1,5 @@
 // BrokerArtifactStore — the ArtifactStore the `artifacts` tool uses under the Runner Credential
-// Broker (the Runner Credential Broker model — Artifacts). It forwards every op to the Runner Control API:
+// Broker (the Runner Credential Broker model). It forwards every op to the Runner Control API:
 // the broker computes the S3 key, neutralizes the served content type, PUTs with its
 // own creds, and records the catalog row — so the untrusted runner holds no S3 credential and can't
 // bypass those server-side rules. A thin adapter over the run-bound RunnerControlClient.

package/dist/runtime/broker_event_publisher.js

@@ -1,5 +1,5 @@
 // BrokerEventPublisher — a `RedisPublisher` that ships the agent event-stream through the broker
-// instead of publishing to Redis directly (the Runner Credential Broker model — Telemetry).
+// instead of publishing to Redis directly (the Runner Credential Broker model).
 //
 // The run-event live channel is a per-event `redis.publish(run:<id>, frame)`. Under the broker the
 // runner holds no Redis credential, so this stand-in BUFFERS frames and POSTs them in batches to the

package/dist/runtime/cancel_watcher.js

@@ -1,4 +1,4 @@
-// CancelWatcher — stops a run when the user cancels it mid-flight (the platform spec + the Runner Credential Broker model).
+// CancelWatcher — stops a run when the user cancels it mid-flight (the platform spec).
 //
 // The user-cancel counterpart to CreditWatcher. One per run session. On a timer it asks — through the
 // broker (`GET /cancel`, since the runner holds no DB/Redis credential) — whether the run has been

package/dist/runtime/credit_watcher.js

@@ -1,5 +1,4 @@
-// CreditWatcher — stops a run when its org runs out of prepaid credit mid-flight (the platform spec +
-// the coding-agent design §6/§10).
+// CreditWatcher — stops a run when its org runs out of prepaid credit mid-flight (the platform spec).
 //
 // One per run session. On a timer it asks — through the broker (`GET /credit`, since the runner holds
 // no Stripe credential) — whether the org is still funded; the FIRST time it isn't, it fires

package/dist/runtime/direct_inference.d.ts

@@ -23,7 +23,13 @@ export interface DirectInferenceDeps {
 }
 /** One model turn, straight to the org's endpoint. Returns the ChatTurn + canonical model ref;
  *  BYO carries no platform cost (costMicros stays 0 — BYO is never metered). */
-export declare function streamDirectTurn(deps: DirectInferenceDeps, entry: ByoInferenceProvider, req: DirectTurnRequest, onDelta: ((text: string) => void) | undefined): Promise<{
+export declare function streamDirectTurn(deps: DirectInferenceDeps, entry: ByoInferenceProvider, req: DirectTurnRequest, onDelta: ((text: string) => void) | undefined, 
+/** Register the resolved key with the CURRENT leaf's engine redactor, before the model call.
+ *  The key resolves mid-leaf (after the leaf's redactor snapshot is seeded), so without this a
+ *  provider that echoes the Authorization header in an error body would leak it into that
+ *  leaf's error run event. The run-level redactor already has it via resolveSecret; this closes
+ *  the per-leaf gap. */
+registerSecret?: (value: string) => void): Promise<{
     turn: ChatTurn;
     modelRef: string;
 }>;

package/dist/runtime/direct_inference.js

@@ -53,8 +53,16 @@ export function directProviderFor(registry, provider) {
 }
 /** One model turn, straight to the org's endpoint. Returns the ChatTurn + canonical model ref;
  *  BYO carries no platform cost (costMicros stays 0 — BYO is never metered). */
-export async function streamDirectTurn(deps, entry, req, onDelta) {
+export async function streamDirectTurn(deps, entry, req, onDelta, 
+/** Register the resolved key with the CURRENT leaf's engine redactor, before the model call.
+ *  The key resolves mid-leaf (after the leaf's redactor snapshot is seeded), so without this a
+ *  provider that echoes the Authorization header in an error body would leak it into that
+ *  leaf's error run event. The run-level redactor already has it via resolveSecret; this closes
+ *  the per-leaf gap. */
+registerSecret) {
     const apiKey = entry.auth_secret_name === null ? null : await deps.resolveSecret(entry.auth_secret_name);
+    if (apiKey !== null)
+        registerSecret?.(apiKey);
     if (entry.base_url === null) {
         throw new Error(`BYO provider '${entry.name}' has no base_url`);
     }

package/dist/runtime/index.js

@@ -1,4 +1,4 @@
-// Worker composition root (the workflow runtime design + the Runner Credential Broker model). The Boardwalk-hosted
+// Worker composition root (the workflow runtime design). The Boardwalk-hosted
 // worker container runs `node dist/fargate/worker/index.js`; the dispatcher launches it per run with
 // RUN_ID + the per-run control-plane handle. This file assembles real implementations behind every
 // seam `runProgramWorker(runId, deps)` injects, then runs the one workflow program to terminal.
@@ -139,7 +139,7 @@ export function assembleWorkerDeps(runtime) {
         const nextMeterIdentifier = tokenMeterIdentifiers(run.id, meteringSessionId);
         // Per-run secret boundary: every value resolved (program `secrets.get` OR a tool's
         // ctx.secrets.resolve) is recorded into one shared redactor; the leaf seeds a fresh engine
-        // Redactor from it so the loop scrubs those values out of all model-bound content (see the platform spec).
+        // Redactor from it so the loop scrubs those values out of all model-bound content. the platform spec
         const redactor = new SecretRedactor();
         // Record the run's own API key so a prompt-injected agent can't echo it back to the model.
         if (runApiKey !== undefined && runApiKey !== "")

package/dist/runtime/inference_transport.js

@@ -1,5 +1,5 @@
 // The broker inference transport the engine-backed leaf streams a model turn through
-// (the Runner Credential Broker model — "Inference (class 2)").
+// (the Runner Credential Broker model)").
 //
 // Under the Runner Credential Broker the runner invokes NO model directly: it holds neither the
 // managed-inference key nor any BYO provider key. So the `agent()` leaf's `LeafIo.streamModel`

package/dist/runtime/leaf_executor.js

@@ -105,7 +105,7 @@ export class EngineLeafExecutor {
             // through providerIo.onDelta and return the terminal turn. An aborted run rejects in-flight.
             streamModel: async (req, providerIo) => {
                 throwIfAborted(signal);
-                return this.streamModel(req, providerIo, signal, (costMicros) => {
+                return this.streamModel(req, providerIo, signal, redactor, (costMicros) => {
                     pendingCostMicros = (pendingCostMicros ?? 0) + costMicros;
                 });
             },
@@ -193,7 +193,7 @@ export class EngineLeafExecutor {
     /** POST one model turn to the broker's `/inference` and adapt its NDJSON stream into the engine's
      *  ModelTurnResult: each `delta` frame drives providerIo.onDelta; the terminal `result` frame is
      *  the turn. An `error` frame throws (the broker already classified it). An abort mid-stream throws. */
-    async streamModel(req, providerIo, signal, onCost) {
+    async streamModel(req, providerIo, signal, redactor, onCost) {
         // Runner-direct BYO (D7): the org's own endpoint + key, called with the same engine adapters
         // the broker uses. No platform cost (BYO is never metered) — onCost stays untouched.
         // A direct turn needs an explicit model (an omitted model means the managed auto lane,
@@ -209,7 +209,10 @@ export class EngineLeafExecutor {
                 messages: req.messages,
                 tools: req.tools,
                 ...(req.reasoning !== undefined ? { reasoning: req.reasoning } : {}),
-            }, providerIo.onDelta);
+            }, providerIo.onDelta, 
+            // Register the org's key with THIS leaf's redactor before the model call, so an error
+            // body echoing it is scrubbed from the leaf's run events (not just the terminal error).
+            (value) => redactor.add("byo-key", value));
             throwIfAborted(signal);
             return { turn: out.turn, modelRef: out.modelRef };
         }

package/dist/runtime/lease_renewer.js

@@ -1,5 +1,5 @@
 // LeaseRenewer — keeps a long run's lease fresh so the recovery sweep doesn't reclaim a STILL-ALIVE
-// worker (the Runner Credential Broker model; the platform spec).
+// worker (the Runner Credential Broker model).
 //
 // A run is claimed with a fixed lease (DEFAULT_LEASE_MS, 5 min). The worker never used to renew it,
 // so any run longer than the lease (an Opus agentic loop is routinely 7+ min) had its lease expire

package/dist/runtime/program_runner.d.ts

@@ -1,5 +1,15 @@
 import type { WorkflowHost } from "@boardwalk-labs/workflow/runtime";
 import { type SuspendSignal } from "./suspension.js";
+/**
+ * Link THIS runtime's `@boardwalk-labs/workflow` into the exec dir's `node_modules` so the
+ * program's bare import resolves anywhere (a self-hosted daemon workspace has no ancestor
+ * `node_modules`; hosted images do, making the link a harmless no-op there). A symlink — not a
+ * copy — is load-bearing: Node resolves it to the REAL path, so the program gets the same
+ * module instance the host adapter was installed on (the singleton contract). `junction` covers
+ * Windows without elevation; a failed link is only logged, since a resolvable ancestor may
+ * still exist.
+ */
+export declare function ensureSdkLink(execDir: string): Promise<void>;
 export interface RunProgramArgs {
     /** Run id — used for the temp dir path + correlation. */
     runId: string;
@@ -38,7 +48,7 @@ export interface ProgramRunnerDeps {
      * Scrubs known secret values out of a string (the run's `SecretRedactor.redactText`). Applied to a
      * top-level throw's message before it is logged AND before it is returned to the worker — a program
      * that resolves a secret and then throws it in an error message must NOT land that secret raw in the
-     * logs or the finalized run output (the platform spec,). Defaults to identity (tests/local).
+     * logs or the finalized run output (the platform spec). Defaults to identity (tests/local).
      */
     redactText?: (text: string) => string;
     /**

package/dist/runtime/program_runner.js

@@ -20,16 +20,55 @@
 // Durability: the body runs once, in-process. `sleep`/`workflows.call` hold in-process via the host
 // (no checkpoint, no exit). A crash mid-run restarts the run from the top (handled by the
 // worker/scheduler-sweep, not here). Output capture is deferred (v0 returns null).
-import { mkdir, writeFile, rm } from "node:fs/promises";
-import { join } from "node:path";
+import { mkdir, writeFile, rm, symlink, lstat } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
 import { installHost, installInput, installConfig, takeDeclaredOutput, resetRuntime, } from "@boardwalk-labs/workflow/runtime";
-import { createLogger } from "./support/index.js";
+import { AppError, ErrorCode, createLogger } from "./support/index.js";
 import { SuspendError } from "./suspension.js";
 const log = createLogger("ProgramRunner");
 /** Subdirectory (under the work root) that holds transient extracted program trees. */
 const RUN_DIR = ".bw-runs";
+/**
+ * Link THIS runtime's `@boardwalk-labs/workflow` into the exec dir's `node_modules` so the
+ * program's bare import resolves anywhere (a self-hosted daemon workspace has no ancestor
+ * `node_modules`; hosted images do, making the link a harmless no-op there). A symlink — not a
+ * copy — is load-bearing: Node resolves it to the REAL path, so the program gets the same
+ * module instance the host adapter was installed on (the singleton contract). `junction` covers
+ * Windows without elevation; a failed link is only logged, since a resolvable ancestor may
+ * still exist.
+ */
+export async function ensureSdkLink(execDir) {
+    // A program tarball that ships its own `node_modules/@boardwalk-labs/workflow` would shadow the
+    // runtime's copy — the host adapter is installed on OUR instance, so the program's hooks would
+    // silently throw "no host installed". Fail loudly instead of link-then-EEXIST-swallow. Only a
+    // REAL entry is a vendored copy; a symlink is our own link (idempotent re-invocation), left be.
+    const linkPath = join(execDir, "node_modules", "@boardwalk-labs", "workflow");
+    const existing = await lstat(linkPath).catch(() => null);
+    if (existing !== null) {
+        if (existing.isSymbolicLink())
+            return;
+        throw new AppError(ErrorCode.VALIDATION_FAILED, "Program bundles its own @boardwalk-labs/workflow; the runtime provides it (do not vendor it).");
+    }
+    try {
+        // Resolve via the MAIN entry (the SDK's export map exposes no "./package.json") and cut the
+        // path back to the package root.
+        const entry = createRequire(import.meta.url).resolve("@boardwalk-labs/workflow");
+        const marker = join("node_modules", "@boardwalk-labs", "workflow");
+        const idx = entry.lastIndexOf(marker);
+        const sdkDir = idx === -1 ? dirname(dirname(entry)) : entry.slice(0, idx + marker.length);
+        const scopeDir = join(execDir, "node_modules", "@boardwalk-labs");
+        await mkdir(scopeDir, { recursive: true });
+        await symlink(sdkDir, join(scopeDir, "workflow"), process.platform === "win32" ? "junction" : "dir");
+    }
+    catch (err) {
+        if (err.code !== "EEXIST") {
+            log.warn("sdk_link_failed", { error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+}
 /** Scratch filename for the in-flight artifact tarball inside a run's dir. */
 const ARTIFACT_FILE = "__program.tgz";
 /**
@@ -54,6 +93,9 @@ export async function runWorkflowProgram(args, deps) {
         await rm(tgzPath, { force: true });
         // The bundled tree is now on disk — let the worker point the agent() leaf at `<dir>/skills/*.md`.
         deps.onExtracted?.(dir);
+        // Make the bare `@boardwalk-labs/workflow` import resolve from ANY work root — hosted images
+        // provide it via an ancestor node_modules, but a self-hosted daemon's workspace has none.
+        await ensureSdkLink(dir);
         const entryPath = join(dir, ...args.entry.split("/"));
         // Run the program body. A SUSPEND is surfaced two ways and both land here as a `suspended`
         // result: (a) out of band via `suspendSignal` — racing the body, immune to a program's own

package/dist/runtime/recording_secret_resolver.js

@@ -1,4 +1,4 @@
-// RecordingSecretResolver — the redaction feeder (the platform spec, plan #9).
+// RecordingSecretResolver — the redaction feeder (the platform spec).
 //
 // Decorates any SecretResolver so EVERY value a run resolves — whether the workflow program asked
 // via `secrets.get(name)` or a tool asked via `ctx.secrets.resolve(ref)` — is recorded into the

package/dist/runtime/run_abort.js

@@ -1,5 +1,4 @@
-// run_abort — the provider-agnostic cooperative-cancellation substrate for a run (the Runner Credential Broker model
-// §15 credit watching; the foundation user-initiated cancel will reuse).
+// run_abort — the provider-agnostic cooperative-cancellation substrate for a run (the Runner Credential Broker model).
 //
 // The cancellation primitive is a Web-standard `AbortSignal` — NOT a Strands/model concept. The worker
 // owns one `AbortController` per run session; a watcher (credit, later user-cancel) calls

package/dist/runtime/runner_control_client.d.ts

@@ -168,7 +168,7 @@ export declare class RunnerControlClient {
         output: unknown;
     } | null>;
     /**
-     * Proxy one model turn through the broker (the Runner Credential Broker model — Inference). POSTs the
+     * Proxy one model turn through the broker (the Runner Credential Broker model). POSTs the
      * neutral conversation; the broker resolves the REAL model server-side (the runner holds no model
      * creds), invokes the matching engine adapter, and relays the model's stream back as NDJSON
      * `InferenceFrame`s (delta / result / error). Yields each frame; the engine-backed leaf surfaces

package/dist/runtime/runner_control_client.js

@@ -381,7 +381,7 @@ export class RunnerControlClient {
         return (await res.json());
     }
     /**
-     * Proxy one model turn through the broker (the Runner Credential Broker model — Inference). POSTs the
+     * Proxy one model turn through the broker (the Runner Credential Broker model). POSTs the
      * neutral conversation; the broker resolves the REAL model server-side (the runner holds no model
      * creds), invokes the matching engine adapter, and relays the model's stream back as NDJSON
      * `InferenceFrame`s (delta / result / error). Yields each frame; the engine-backed leaf surfaces

package/dist/runtime/runtime_flusher.js

@@ -1,5 +1,5 @@
 // RuntimeFlusher — meters a run's held-task runtime as periodic DELTAS, instead of one charge at
-// terminal (the platform spec; the Runner Credential Broker model). The heartbeat counterpart to the credit / cancel
+// terminal (the platform spec). The heartbeat counterpart to the credit / cancel
 // / lease watchers.
 //
 // Why: runtime used to be booked once, at terminal (`now - sessionStart`). That left two holes — a run

package/dist/runtime/support/index.js

@@ -4,7 +4,8 @@
 // (AppError taxonomy) and minimally where it doesn't (the logger: structured JSON to
 // stdout, same call surface as the platform's Powertools child logger).
 import { randomUUID } from "node:crypto";
-// ---- errors (ported from the Boardwalk platform's error taxonomy) ----
+// ---- errors (ported from boardwalk-backend src/common/errors.ts; keep in sync until the
+// backend consumes this package and the copy there is deleted) ----
 export var ErrorCode;
 (function (ErrorCode) {
     ErrorCode["VALIDATION_FAILED"] = "VALIDATION_FAILED";

package/dist/runtime/tools/artifacts.js

@@ -1,4 +1,4 @@
-// artifacts — persist + reference run outputs (the platform spec + §13.6). Available to any agent
+// artifacts — persist + reference run outputs (the platform spec). Available to any agent
 // (no sandbox required). Three operations:
 //   * write(name, content_type, body)   → store a file under the run's prefix; returns id + a signed URL.
 //   * list()                            → artifacts produced in THIS run.

package/dist/runtime/wire/artifact_storage.js

@@ -1,5 +1,5 @@
 // Artifact storage policy — the server-side rules for turning an agent's artifact-write request into
-// a stored S3 object (the platform spec,). These used to live in the `artifacts` TOOL,
+// a stored S3 object (the platform spec). These used to live in the `artifacts` TOOL,
 // which runs on the UNTRUSTED runner; under the Runner Credential Broker (the Runner Credential Broker model) the
 // broker owns them so a malicious runner can't bypass content-type neutralization or escape its
 // run's key prefix. Pure functions — unit-tested exhaustively.

package/dist/runtime/wire/inference_proxy.js

@@ -1,4 +1,4 @@
-// Inference proxy protocol (the Runner Credential Broker model — "Inference (class 2)").
+// Inference proxy protocol (the Runner Credential Broker model)").
 //
 // The runner never invokes a model directly: under the Runner Credential Broker it holds no
 // managed-inference creds and no BYO provider key. Instead the `agent()` leaf's model turn (the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/runner",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Boardwalk self-hosted runner: execute cloud-scheduled runs on your own machines. Currently: the canonical runner contract types.",
   "license": "Apache-2.0",
   "repository": {