@cat-factory/executor-harness 1.35.0 → 1.37.2

package/dist/git.js

@@ -51,14 +51,18 @@ const GIT_TIMEOUT_MS = Math.max(GIT_TIMEOUT_FLOOR_MS, loadRunnerLimits().inactiv
 // Emptying the helper list (`credential.helper=` with no value RESETS the multi-valued config,
 // dropping the system/global/local helpers) removes GCM from the chain, so git falls back to
 // the harness's own askpass helper — which returns the per-job PAT we already hold (see
-// `authEnv`). `credential.interactive=false` is belt-and-suspenders for any backend that still
-// runs. The token is never in argv; only this non-secret config is.
-const NON_INTERACTIVE_CREDENTIAL_ARGS = [
-    '-c',
-    'credential.helper=',
-    '-c',
-    'credential.interactive=false',
-];
+// `authEnv`). The token is never in argv; only this non-secret config is.
+//
+// DO NOT re-add `-c credential.interactive=false` here. It reads like harmless belt-and-braces
+// but modern git (≥ 2.47, incl. the executor image + host git) HONORS `credential.interactive`
+// and treats invoking GIT_ASKPASS as "interactive" — so with it set git SKIPS the askpass
+// entirely and dies with "fatal: unable to get password from user", failing EVERY authenticated
+// clone/push on both the native and container paths (it clones a public base repo fine — that
+// needs no auth — then fails only at push, which is what makes it look intermittent). The GCM
+// popup it was meant to belt-and-braces against is already fully handled by the emptied helper
+// list above plus `GIT_TERMINAL_PROMPT=0` / `GCM_INTERACTIVE=never` in the env (see authEnv /
+// nonInteractiveGitEnv). Exported so a unit test can pin that this arg never creeps back in.
+export const NON_INTERACTIVE_CREDENTIAL_ARGS = ['-c', 'credential.helper='];
 /**
  * Env applied to git commands that DON'T carry {@link authEnv} (local ops like config/checkout/
  * rev-parse). Keeps them from ever going interactive too — `GIT_TERMINAL_PROMPT=0` blocks the

package/dist/inline.js

@@ -0,0 +1,58 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runSubscriptionHarness } from './agent-runner.js';
+// The `inline` job handler: one-shot LLM completion through a subscription harness CLI
+// (Claude Code / Codex) with NO checkout. It is the container analogue of the local
+// host-CLI inline runner (runtimes/local `harnessInline.ts`) — it exists so the inline
+// LLM steps (requirements reviewer, brainstorm, task-estimator, inline document kinds) can
+// run on a subscription model even when the host has no `claude`/`codex` binary (and in
+// mothership mode without touching the host), at warm-pool latency. It reuses
+// `runSubscriptionHarness`'s credential-env setup verbatim (the single site that turns a
+// leased subscription token into `CLAUDE_CODE_OAUTH_TOKEN` / `ANTHROPIC_*` / a Codex
+// `auth.json`), so the container and coding paths can never disagree on how a credential
+// is injected.
+/**
+ * Map the harness CLI's terminal stop reason (lifted onto the last call metric) to the
+ * inline `finishReason` the reviewer keys off. Only Claude Code reports it (`max_tokens` on
+ * a `--output-format stream-json` result); Codex's thinner stream exposes none, so it reads
+ * as `stop` — the same one-shot limitation the host-CLI runner has.
+ */
+function deriveFinishReason(calls) {
+    const last = calls?.[calls.length - 1];
+    const reason = last?.finishReason?.toLowerCase() ?? '';
+    return reason === 'max_tokens' || reason === 'length' ? 'length' : 'stop';
+}
+/**
+ * Run one inline completion in a throwaway temp cwd and return the reply text + lifted
+ * usage/telemetry. The CLI clones/pushes nothing — the empty cwd only gives it a working
+ * directory. The job's watchdog (inactivity + max-duration, see {@link JobRegistry}) bounds
+ * it through `opts.signal`; `opts.onActivity` keeps the inactivity timer alive while the CLI
+ * streams. The temp cwd is always removed.
+ */
+export async function handleInline(job, opts) {
+    opts.onPhase?.('agent');
+    const cwd = await mkdtemp(join(tmpdir(), 'cf-inline-'));
+    try {
+        const outcome = await runSubscriptionHarness(job.harness, {
+            cwd,
+            model: job.model,
+            systemPrompt: job.systemPrompt,
+            userPrompt: job.userPrompt,
+            ...(job.subscriptionToken ? { subscriptionToken: job.subscriptionToken } : {}),
+            ...(job.subscriptionBaseUrl ? { subscriptionBaseUrl: job.subscriptionBaseUrl } : {}),
+            ...(job.ambientAuth ? { ambientAuth: true } : {}),
+            ...(opts.signal ? { signal: opts.signal } : {}),
+            ...(opts.onActivity ? { onActivity: opts.onActivity } : {}),
+        });
+        return {
+            text: outcome.summary,
+            finishReason: deriveFinishReason(outcome.callMetrics),
+            ...(outcome.usage ? { usage: outcome.usage } : {}),
+            ...(outcome.callMetrics ? { callMetrics: outcome.callMetrics } : {}),
+        };
+    }
+    finally {
+        await rm(cwd, { recursive: true, force: true }).catch(() => { });
+    }
+}

package/dist/job.js

@@ -455,6 +455,35 @@ function parseFrontendInfraSpec(o) {
         ...(wiremockPort !== undefined ? { wiremockPort } : {}),
     };
 }
+/**
+ * Validate + narrow an untrusted body into an {@link InlineJob}. The harness MUST be a
+ * subscription harness (`claude-code` / `codex`) — the inline path never runs Pi (that goes
+ * through the LLM proxy inline, not a container CLI). Reuses {@link parseHarnessAuth}, so a
+ * non-ambient job requires `subscriptionToken`.
+ */
+export function parseInlineJob(input) {
+    if (typeof input !== 'object' || input === null) {
+        throw new Error('Invalid job: body must be an object');
+    }
+    const o = input;
+    // Validate the harness FIRST (before parseHarnessAuth, whose `pi` branch demands a proxy
+    // base URL): the inline path only ever runs a subscription CLI, so a Pi/absent harness is a
+    // clear inline-specific rejection rather than a confusing "proxyBaseUrl required".
+    if (o.harness !== 'claude-code' && o.harness !== 'codex') {
+        throw new Error("Invalid inline job: 'harness' must be 'claude-code' or 'codex'");
+    }
+    const auth = parseHarnessAuth(o);
+    const maxOutputTokens = posInt(o.maxOutputTokens);
+    return {
+        jobId: str(o.jobId, 'jobId'),
+        model: str(o.model, 'model'),
+        // The system prompt is optional (an empty role is valid); the user prompt is required.
+        systemPrompt: typeof o.systemPrompt === 'string' ? o.systemPrompt : '',
+        userPrompt: str(o.userPrompt, 'userPrompt'),
+        ...auth,
+        ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),
+    };
+}
 /** Validate + narrow an untrusted body into an {@link AgentJob}, throwing on bad input. */
 export function parseAgentJob(input) {
     if (typeof input !== 'object' || input === null) {

package/dist/server.js

@@ -1,7 +1,8 @@
 import { timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
-import { parseAgentJob } from './job.js';
+import { parseAgentJob, parseInlineJob } from './job.js';
 import { handleAgent } from './agent.js';
+import { handleInline } from './inline.js';
 import { redactSecrets } from './git.js';
 import { JobRegistry, loadRunnerLimits } from './runner.js';
 import { log } from './logger.js';
@@ -67,6 +68,13 @@ const KINDS = {
         repo: `${job.repo.owner}/${job.repo.name}`,
         branch: job.branch,
     })),
+    // The one-shot, no-checkout inline completion (requirements reviewer / brainstorm /
+    // task-estimator / inline document kinds) on a leased subscription credential — the
+    // container analogue of the local host-CLI inline runner. See inline.ts.
+    inline: defineKind(parseInlineJob, handleInline, (job) => ({
+        harness: job.harness,
+        model: job.model,
+    })),
 };
 async function readBody(req) {
     const chunks = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/executor-harness",
-  "version": "1.35.0",
+  "version": "1.37.2",
   "description": "Container payload: a thin TypeScript wrapper that runs the Pi coding agent against a cloned repo and opens a PR. Runs in the Cloudflare Container (and, in local native mode, as a host process); carries no secrets.",
   "repository": {
     "type": "git",
@@ -26,8 +26,8 @@
     "hono": "^4.12.27",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
-    "@cat-factory/spend": "0.10.104",
-    "@cat-factory/server": "0.88.0"
+    "@cat-factory/server": "0.101.0",
+    "@cat-factory/spend": "0.11.15"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/git.ts

@@ -61,14 +61,18 @@ const GIT_TIMEOUT_MS = Math.max(
 // Emptying the helper list (`credential.helper=` with no value RESETS the multi-valued config,
 // dropping the system/global/local helpers) removes GCM from the chain, so git falls back to
 // the harness's own askpass helper — which returns the per-job PAT we already hold (see
-// `authEnv`). `credential.interactive=false` is belt-and-suspenders for any backend that still
-// runs. The token is never in argv; only this non-secret config is.
-const NON_INTERACTIVE_CREDENTIAL_ARGS = [
-  '-c',
-  'credential.helper=',
-  '-c',
-  'credential.interactive=false',
-]
+// `authEnv`). The token is never in argv; only this non-secret config is.
+//
+// DO NOT re-add `-c credential.interactive=false` here. It reads like harmless belt-and-braces
+// but modern git (≥ 2.47, incl. the executor image + host git) HONORS `credential.interactive`
+// and treats invoking GIT_ASKPASS as "interactive" — so with it set git SKIPS the askpass
+// entirely and dies with "fatal: unable to get password from user", failing EVERY authenticated
+// clone/push on both the native and container paths (it clones a public base repo fine — that
+// needs no auth — then fails only at push, which is what makes it look intermittent). The GCM
+// popup it was meant to belt-and-braces against is already fully handled by the emptied helper
+// list above plus `GIT_TERMINAL_PROMPT=0` / `GCM_INTERACTIVE=never` in the env (see authEnv /
+// nonInteractiveGitEnv). Exported so a unit test can pin that this arg never creeps back in.
+export const NON_INTERACTIVE_CREDENTIAL_ARGS = ['-c', 'credential.helper=']
 
 /**
  * Env applied to git commands that DON'T carry {@link authEnv} (local ops like config/checkout/

package/src/inline.ts

@@ -0,0 +1,63 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runSubscriptionHarness, type SubscriptionHarness } from './agent-runner.js'
+import type { HarnessCallMetric } from './pi.js'
+import type { InlineJob, InlineResult } from './job.js'
+import type { RunOptions } from './runner.js'
+
+// The `inline` job handler: one-shot LLM completion through a subscription harness CLI
+// (Claude Code / Codex) with NO checkout. It is the container analogue of the local
+// host-CLI inline runner (runtimes/local `harnessInline.ts`) — it exists so the inline
+// LLM steps (requirements reviewer, brainstorm, task-estimator, inline document kinds) can
+// run on a subscription model even when the host has no `claude`/`codex` binary (and in
+// mothership mode without touching the host), at warm-pool latency. It reuses
+// `runSubscriptionHarness`'s credential-env setup verbatim (the single site that turns a
+// leased subscription token into `CLAUDE_CODE_OAUTH_TOKEN` / `ANTHROPIC_*` / a Codex
+// `auth.json`), so the container and coding paths can never disagree on how a credential
+// is injected.
+
+/**
+ * Map the harness CLI's terminal stop reason (lifted onto the last call metric) to the
+ * inline `finishReason` the reviewer keys off. Only Claude Code reports it (`max_tokens` on
+ * a `--output-format stream-json` result); Codex's thinner stream exposes none, so it reads
+ * as `stop` — the same one-shot limitation the host-CLI runner has.
+ */
+function deriveFinishReason(calls: HarnessCallMetric[] | undefined): 'stop' | 'length' {
+  const last = calls?.[calls.length - 1]
+  const reason = last?.finishReason?.toLowerCase() ?? ''
+  return reason === 'max_tokens' || reason === 'length' ? 'length' : 'stop'
+}
+
+/**
+ * Run one inline completion in a throwaway temp cwd and return the reply text + lifted
+ * usage/telemetry. The CLI clones/pushes nothing — the empty cwd only gives it a working
+ * directory. The job's watchdog (inactivity + max-duration, see {@link JobRegistry}) bounds
+ * it through `opts.signal`; `opts.onActivity` keeps the inactivity timer alive while the CLI
+ * streams. The temp cwd is always removed.
+ */
+export async function handleInline(job: InlineJob, opts: RunOptions): Promise<InlineResult> {
+  opts.onPhase?.('agent')
+  const cwd = await mkdtemp(join(tmpdir(), 'cf-inline-'))
+  try {
+    const outcome = await runSubscriptionHarness(job.harness as SubscriptionHarness, {
+      cwd,
+      model: job.model,
+      systemPrompt: job.systemPrompt,
+      userPrompt: job.userPrompt,
+      ...(job.subscriptionToken ? { subscriptionToken: job.subscriptionToken } : {}),
+      ...(job.subscriptionBaseUrl ? { subscriptionBaseUrl: job.subscriptionBaseUrl } : {}),
+      ...(job.ambientAuth ? { ambientAuth: true } : {}),
+      ...(opts.signal ? { signal: opts.signal } : {}),
+      ...(opts.onActivity ? { onActivity: opts.onActivity } : {}),
+    })
+    return {
+      text: outcome.summary,
+      finishReason: deriveFinishReason(outcome.callMetrics),
+      ...(outcome.usage ? { usage: outcome.usage } : {}),
+      ...(outcome.callMetrics ? { callMetrics: outcome.callMetrics } : {}),
+    }
+  } finally {
+    await rm(cwd, { recursive: true, force: true }).catch(() => {})
+  }
+}

package/src/job.ts

@@ -923,6 +923,73 @@ function parseFrontendInfraSpec(o: Record<string, unknown>): FrontendInfraSpec {
   }
 }
 
+// ---- Inline job (POST /jobs, kind=inline) --------------------------------
+//
+// A ONE-SHOT, no-checkout LLM completion run through a subscription harness CLI
+// (Claude Code / Codex) on a leased subscription credential — the container analogue of
+// the local host-CLI inline runner. It exists so a deployment that can't run the ambient
+// CLI on the host (no `claude`/`codex` binary, or mothership mode) can still serve the
+// inline LLM steps (requirements reviewer, brainstorm, task-estimator, inline document
+// kinds) on a subscription model, at warm-pool latency. It clones NOTHING and pushes
+// NOTHING: the CLI runs in a throwaway temp cwd and only the completion text + token usage
+// come back. Auth is the SAME `HarnessAuthFields` the coding path uses (subscriptionToken +
+// optional subscriptionBaseUrl, or ambientAuth), so the credential-env setup is shared.
+
+/** The one-shot inline completion job. `harness` must be a subscription harness. */
+export interface InlineJob extends HarnessAuthFields {
+  jobId: string
+  /** Real vendor model id, e.g. `claude-opus-4-8` / `gpt-5.5-codex`. */
+  model: string
+  /** Composed role + best-practice fragments (Claude: `--append-system-prompt`; Codex: prepended). */
+  systemPrompt: string
+  /** The concrete task/user prompt fed to the CLI over stdin. */
+  userPrompt: string
+  /** Advisory output cap, forwarded for parity; the one-shot CLIs don't all honour it. */
+  maxOutputTokens?: number
+}
+
+/** The inline completion result: the reply text plus lifted token usage / per-call telemetry. */
+export interface InlineResult {
+  text: string
+  /** `length` when the model hit its output cap (the reviewer rejects a truncated doc). */
+  finishReason?: 'stop' | 'length'
+  usage?: { inputTokens: number; outputTokens: number }
+  /** Per-model-call telemetry lifted from the CLI stream (recorded into `llm_call_metrics`). */
+  callMetrics?: HarnessCallMetric[]
+  /** A structured failure marks a job-level failure even on a clean HTTP exit (see JobResultBase). */
+  error?: string
+}
+
+/**
+ * Validate + narrow an untrusted body into an {@link InlineJob}. The harness MUST be a
+ * subscription harness (`claude-code` / `codex`) — the inline path never runs Pi (that goes
+ * through the LLM proxy inline, not a container CLI). Reuses {@link parseHarnessAuth}, so a
+ * non-ambient job requires `subscriptionToken`.
+ */
+export function parseInlineJob(input: unknown): InlineJob {
+  if (typeof input !== 'object' || input === null) {
+    throw new Error('Invalid job: body must be an object')
+  }
+  const o = input as Record<string, unknown>
+  // Validate the harness FIRST (before parseHarnessAuth, whose `pi` branch demands a proxy
+  // base URL): the inline path only ever runs a subscription CLI, so a Pi/absent harness is a
+  // clear inline-specific rejection rather than a confusing "proxyBaseUrl required".
+  if (o.harness !== 'claude-code' && o.harness !== 'codex') {
+    throw new Error("Invalid inline job: 'harness' must be 'claude-code' or 'codex'")
+  }
+  const auth = parseHarnessAuth(o)
+  const maxOutputTokens = posInt(o.maxOutputTokens)
+  return {
+    jobId: str(o.jobId, 'jobId'),
+    model: str(o.model, 'model'),
+    // The system prompt is optional (an empty role is valid); the user prompt is required.
+    systemPrompt: typeof o.systemPrompt === 'string' ? o.systemPrompt : '',
+    userPrompt: str(o.userPrompt, 'userPrompt'),
+    ...auth,
+    ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),
+  }
+}
+
 /** Validate + narrow an untrusted body into an {@link AgentJob}, throwing on bad input. */
 export function parseAgentJob(input: unknown): AgentJob {
   if (typeof input !== 'object' || input === null) {

package/src/server.ts

@@ -1,7 +1,8 @@
 import { timingSafeEqual } from 'node:crypto'
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
-import { parseAgentJob } from './job.js'
+import { parseAgentJob, parseInlineJob } from './job.js'
 import { handleAgent } from './agent.js'
+import { handleInline } from './inline.js'
 import { redactSecrets } from './git.js'
 import { JobRegistry, loadRunnerLimits, type JobResultBase, type RunOptions } from './runner.js'
 import { log } from './logger.js'
@@ -84,6 +85,13 @@ const KINDS: Record<string, KindEntry> = {
     repo: `${job.repo.owner}/${job.repo.name}`,
     branch: job.branch,
   })),
+  // The one-shot, no-checkout inline completion (requirements reviewer / brainstorm /
+  // task-estimator / inline document kinds) on a leased subscription credential — the
+  // container analogue of the local host-CLI inline runner. See inline.ts.
+  inline: defineKind(parseInlineJob, handleInline, (job) => ({
+    harness: job.harness,
+    model: job.model,
+  })),
 }
 
 async function readBody(req: IncomingMessage): Promise<string> {