@companyhelm/runner 0.0.12 → 0.0.13

package/dist/service/thread_runtime.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureThreadRuntimeReady = ensureThreadRuntimeReady;
+const thread_lifecycle_js_1 = require("./thread_lifecycle.js");
+async function ensureThreadRuntimeReady(options) {
+    const containerService = options.containerService ?? new thread_lifecycle_js_1.ThreadContainerService();
+    if (typeof options.dindContainer === "string" && options.dindContainer.trim().length > 0) {
+        await containerService.ensureContainerRunning(options.dindContainer);
+    }
+    await containerService.ensureContainerRunning(options.runtimeContainer);
+    await containerService.ensureRuntimeContainerIdentity(options.runtimeContainer, options.user);
+    await containerService.ensureRuntimeContainerBashrc(options.runtimeContainer, options.user);
+    await containerService.ensureRuntimeContainerGitConfig(options.runtimeContainer, options.user, options.gitUserName, options.gitUserEmail);
+    await containerService.ensureRuntimeContainerTooling(options.runtimeContainer, options.user);
+}

package/dist/service/thread_turn_state.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadThreadMessageExecutionState = loadThreadMessageExecutionState;
+exports.updateThreadTurnState = updateThreadTurnState;
+const drizzle_orm_1 = require("drizzle-orm");
+const db_js_1 = require("../state/db.js");
+const schema_js_1 = require("../state/schema.js");
+async function loadThreadMessageExecutionState(stateDbPath, threadId) {
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        return await db
+            .select({
+            id: schema_js_1.threads.id,
+            workspace: schema_js_1.threads.workspace,
+            sdkThreadId: schema_js_1.threads.sdkThreadId,
+            model: schema_js_1.threads.model,
+            reasoningLevel: schema_js_1.threads.reasoningLevel,
+            additionalModelInstructions: schema_js_1.threads.additionalModelInstructions,
+            currentSdkTurnId: schema_js_1.threads.currentSdkTurnId,
+            isCurrentTurnRunning: schema_js_1.threads.isCurrentTurnRunning,
+            runtimeContainer: schema_js_1.threads.runtimeContainer,
+            dindContainer: schema_js_1.threads.dindContainer,
+            homeDirectory: schema_js_1.threads.homeDirectory,
+            uid: schema_js_1.threads.uid,
+            gid: schema_js_1.threads.gid,
+        })
+            .from(schema_js_1.threads)
+            .where((0, drizzle_orm_1.eq)(schema_js_1.threads.id, threadId))
+            .get();
+    }
+    finally {
+        client.close();
+    }
+}
+async function updateThreadTurnState(stateDbPath, threadId, update) {
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        await db
+            .update(schema_js_1.threads)
+            .set(update)
+            .where((0, drizzle_orm_1.eq)(schema_js_1.threads.id, threadId));
+    }
+    finally {
+        client.close();
+    }
+}

package/dist/service/thread_user_message_request_store.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enqueuePendingUserMessageRequestIdForTurn = enqueuePendingUserMessageRequestIdForTurn;
+exports.removePendingUserMessageRequestIdForTurn = removePendingUserMessageRequestIdForTurn;
+exports.assignPendingUserMessageRequestIdForItem = assignPendingUserMessageRequestIdForItem;
+exports.consumePendingUserMessageRequestIdForItem = consumePendingUserMessageRequestIdForItem;
+exports.clearPendingUserMessageRequestIdsForTurn = clearPendingUserMessageRequestIdsForTurn;
+const drizzle_orm_1 = require("drizzle-orm");
+const db_js_1 = require("../state/db.js");
+const schema_js_1 = require("../state/schema.js");
+async function enqueuePendingUserMessageRequestIdForTurn(stateDbPath, threadId, sdkTurnId, requestId) {
+    if (!requestId) {
+        return;
+    }
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        await db.insert(schema_js_1.threadUserMessageRequestStore).values({
+            threadId,
+            sdkTurnId,
+            requestId,
+            sdkItemId: null,
+        });
+    }
+    finally {
+        client.close();
+    }
+}
+async function removePendingUserMessageRequestIdForTurn(stateDbPath, threadId, sdkTurnId, requestId) {
+    if (!requestId) {
+        return;
+    }
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        await db
+            .delete(schema_js_1.threadUserMessageRequestStore)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.threadId, threadId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkTurnId, sdkTurnId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.requestId, requestId)));
+    }
+    finally {
+        client.close();
+    }
+}
+async function assignPendingUserMessageRequestIdForItem(stateDbPath, threadId, sdkTurnId, sdkItemId) {
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        const [existingByItem] = await db
+            .select({
+            requestId: schema_js_1.threadUserMessageRequestStore.requestId,
+        })
+            .from(schema_js_1.threadUserMessageRequestStore)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.threadId, threadId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkTurnId, sdkTurnId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkItemId, sdkItemId)))
+            .limit(1);
+        if (existingByItem) {
+            return existingByItem.requestId;
+        }
+        const [nextPending] = await db
+            .select({
+            id: schema_js_1.threadUserMessageRequestStore.id,
+            requestId: schema_js_1.threadUserMessageRequestStore.requestId,
+        })
+            .from(schema_js_1.threadUserMessageRequestStore)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.threadId, threadId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkTurnId, sdkTurnId), (0, drizzle_orm_1.isNull)(schema_js_1.threadUserMessageRequestStore.sdkItemId)))
+            .orderBy((0, drizzle_orm_1.asc)(schema_js_1.threadUserMessageRequestStore.id))
+            .limit(1);
+        if (!nextPending) {
+            return undefined;
+        }
+        const [assigned] = await db
+            .update(schema_js_1.threadUserMessageRequestStore)
+            .set({
+            sdkItemId,
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.id, nextPending.id), (0, drizzle_orm_1.isNull)(schema_js_1.threadUserMessageRequestStore.sdkItemId)))
+            .returning({
+            requestId: schema_js_1.threadUserMessageRequestStore.requestId,
+        });
+        if (assigned) {
+            return assigned.requestId;
+        }
+        const [racedAssignment] = await db
+            .select({
+            requestId: schema_js_1.threadUserMessageRequestStore.requestId,
+        })
+            .from(schema_js_1.threadUserMessageRequestStore)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.threadId, threadId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkTurnId, sdkTurnId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkItemId, sdkItemId)))
+            .limit(1);
+        return racedAssignment?.requestId;
+    }
+    finally {
+        client.close();
+    }
+}
+async function consumePendingUserMessageRequestIdForItem(stateDbPath, threadId, sdkTurnId, sdkItemId) {
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        const [existingByItem] = await db
+            .select({
+            id: schema_js_1.threadUserMessageRequestStore.id,
+            requestId: schema_js_1.threadUserMessageRequestStore.requestId,
+        })
+            .from(schema_js_1.threadUserMessageRequestStore)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.threadId, threadId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkTurnId, sdkTurnId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkItemId, sdkItemId)))
+            .limit(1);
+        if (existingByItem) {
+            await db.delete(schema_js_1.threadUserMessageRequestStore).where((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.id, existingByItem.id));
+            return existingByItem.requestId;
+        }
+        const [nextPending] = await db
+            .select({
+            id: schema_js_1.threadUserMessageRequestStore.id,
+            requestId: schema_js_1.threadUserMessageRequestStore.requestId,
+        })
+            .from(schema_js_1.threadUserMessageRequestStore)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.threadId, threadId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkTurnId, sdkTurnId), (0, drizzle_orm_1.isNull)(schema_js_1.threadUserMessageRequestStore.sdkItemId)))
+            .orderBy((0, drizzle_orm_1.asc)(schema_js_1.threadUserMessageRequestStore.id))
+            .limit(1);
+        if (!nextPending) {
+            return undefined;
+        }
+        await db.delete(schema_js_1.threadUserMessageRequestStore).where((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.id, nextPending.id));
+        return nextPending.requestId;
+    }
+    finally {
+        client.close();
+    }
+}
+async function clearPendingUserMessageRequestIdsForTurn(stateDbPath, threadId, sdkTurnId) {
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        await db
+            .delete(schema_js_1.threadUserMessageRequestStore)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.threadId, threadId), (0, drizzle_orm_1.eq)(schema_js_1.threadUserMessageRequestStore.sdkTurnId, sdkTurnId)));
+    }
+    finally {
+        client.close();
+    }
+}

package/dist/service/workspace_agents.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderRuntimeAgentsMd = renderRuntimeAgentsMd;
+exports.ensureWorkspaceAgentsMd = ensureWorkspaceAgentsMd;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const RUNTIME_AGENTS_TEMPLATE_PATH = "templates/runtime_agents.md.j2";
+const DEFAULT_HOME_DIRECTORY = "/home/agent";
+function renderJinjaTemplate(template, context) {
+    return template.replace(/{{\s*([a-zA-Z0-9_]+)\s*}}/g, (_match, key) => {
+        const value = context[key];
+        if (value === undefined) {
+            throw new Error(`Missing template value for key '${key}'`);
+        }
+        return value;
+    });
+}
+function resolveTemplatePath() {
+    const distRelativePath = (0, node_path_1.join)(__dirname, "..", RUNTIME_AGENTS_TEMPLATE_PATH);
+    if ((0, node_fs_1.existsSync)(distRelativePath)) {
+        return distRelativePath;
+    }
+    const sourceRelativePath = (0, node_path_1.join)(__dirname, "..", "..", "src", RUNTIME_AGENTS_TEMPLATE_PATH);
+    if ((0, node_fs_1.existsSync)(sourceRelativePath)) {
+        return sourceRelativePath;
+    }
+    throw new Error(`Runtime AGENTS template was not found at ${distRelativePath} or ${sourceRelativePath}`);
+}
+function extractTopLevelSections(markdown) {
+    const sections = [];
+    const headingRegex = /^## .+$/gm;
+    const matches = [...markdown.matchAll(headingRegex)];
+    for (let index = 0; index < matches.length; index += 1) {
+        const match = matches[index];
+        const marker = match[0].trim();
+        const start = match.index ?? 0;
+        const end = index + 1 < matches.length ? (matches[index + 1].index ?? markdown.length) : markdown.length;
+        const content = markdown.slice(start, end).trimEnd();
+        sections.push({ marker, content });
+    }
+    return sections;
+}
+function renderRuntimeAgentsMd(homeDirectory = DEFAULT_HOME_DIRECTORY) {
+    const template = (0, node_fs_1.readFileSync)(resolveTemplatePath(), "utf8");
+    return renderJinjaTemplate(template, {
+        home_directory: homeDirectory,
+    }).trim() + "\n";
+}
+function ensureWorkspaceAgentsMd(workspaceDirectory, homeDirectory = DEFAULT_HOME_DIRECTORY) {
+    (0, node_fs_1.mkdirSync)(workspaceDirectory, { recursive: true });
+    const agentsPath = (0, node_path_1.join)(workspaceDirectory, "AGENTS.md");
+    let existing = "";
+    try {
+        existing = (0, node_fs_1.readFileSync)(agentsPath, "utf8");
+    }
+    catch {
+        existing = "";
+    }
+    let rendered = "";
+    try {
+        rendered = renderRuntimeAgentsMd(homeDirectory);
+    }
+    catch {
+        return;
+    }
+    const templateSections = extractTopLevelSections(rendered);
+    const pendingSections = templateSections
+        .filter((section) => !existing.includes(section.marker))
+        .map((section) => section.content);
+    if (pendingSections.length === 0) {
+        return;
+    }
+    const updated = existing.trim()
+        ? `${existing.trimEnd()}\n\n${pendingSections.join("\n\n")}\n`
+        : rendered;
+    try {
+        (0, node_fs_1.writeFileSync)(agentsPath, updated, "utf8");
+    }
+    catch {
+        // Best-effort workspace instruction file.
+    }
+}

package/dist/state/daemon_state.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNNER_DAEMON_STATE_ID = void 0;
+exports.readCurrentDaemonState = readCurrentDaemonState;
+exports.claimCurrentDaemonState = claimCurrentDaemonState;
+exports.clearCurrentDaemonState = clearCurrentDaemonState;
+const drizzle_orm_1 = require("drizzle-orm");
+const db_js_1 = require("./db.js");
+const schema_js_1 = require("./schema.js");
+const process_js_1 = require("../utils/process.js");
+exports.RUNNER_DAEMON_STATE_ID = "runner";
+async function readCurrentDaemonState(stateDbPath) {
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        const existing = await db.select().from(schema_js_1.daemonState).where((0, drizzle_orm_1.eq)(schema_js_1.daemonState.id, exports.RUNNER_DAEMON_STATE_ID)).all();
+        const row = existing[0];
+        if (!row) {
+            return null;
+        }
+        return {
+            id: row.id,
+            pid: row.pid ?? null,
+            logPath: row.logPath ?? null,
+            startedAt: row.startedAt,
+            updatedAt: row.updatedAt,
+        };
+    }
+    finally {
+        client.close();
+    }
+}
+async function claimCurrentDaemonState(stateDbPath, pid, logPath) {
+    const now = new Date().toISOString();
+    const { client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        await client.execute("BEGIN IMMEDIATE");
+        try {
+            const existing = await client.execute({
+                sql: "SELECT pid FROM daemon_state WHERE id = ?",
+                args: [exports.RUNNER_DAEMON_STATE_ID],
+            });
+            const row = existing.rows[0];
+            const currentPid = typeof row?.pid === "number" ? row.pid : row?.pid == null ? null : Number(row.pid);
+            if (currentPid && currentPid !== pid && (0, process_js_1.isProcessRunning)(currentPid)) {
+                throw new Error(`Another companyhelm daemon is already running with pid ${currentPid}.`);
+            }
+            await client.execute({
+                sql: "INSERT INTO daemon_state (id, pid, log_path, started_at, updated_at) VALUES (?, ?, ?, ?, ?) " +
+                    "ON CONFLICT(id) DO UPDATE SET pid = excluded.pid, log_path = excluded.log_path, started_at = excluded.started_at, updated_at = excluded.updated_at",
+                args: [exports.RUNNER_DAEMON_STATE_ID, pid, logPath, now, now],
+            });
+            await client.execute("COMMIT");
+        }
+        catch (error) {
+            await client.execute("ROLLBACK");
+            throw error;
+        }
+    }
+    finally {
+        client.close();
+    }
+}
+async function clearCurrentDaemonState(stateDbPath, pid) {
+    const now = new Date().toISOString();
+    const { db, client } = await (0, db_js_1.initDb)(stateDbPath);
+    try {
+        const existing = await db.select().from(schema_js_1.daemonState).where((0, drizzle_orm_1.eq)(schema_js_1.daemonState.id, exports.RUNNER_DAEMON_STATE_ID)).all();
+        const current = existing[0];
+        if (!current || current.pid !== pid) {
+            return;
+        }
+        await db
+            .update(schema_js_1.daemonState)
+            .set({
+            pid: null,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.eq)(schema_js_1.daemonState.id, exports.RUNNER_DAEMON_STATE_ID));
+    }
+    finally {
+        client.close();
+    }
+}

package/dist/state/db.js

@@ -0,0 +1,63 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initDb = initDb;
+const client_1 = require("@libsql/client");
+const libsql_1 = require("drizzle-orm/libsql");
+const migrator_1 = require("drizzle-orm/libsql/migrator");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_path_2 = require("node:path");
+const schema = __importStar(require("./schema.js"));
+const path_js_1 = require("../utils/path.js");
+async function reconcileLegacyThreadsSchema(client) {
+    const pragmaResult = await client.execute("PRAGMA table_info('threads')");
+    const columnNames = new Set(pragmaResult.rows.map((row) => String(row.name ?? "")));
+    if (columnNames.has("sdk_id") && !columnNames.has("sdk_thread_id")) {
+        await client.execute("ALTER TABLE threads RENAME COLUMN sdk_id TO sdk_thread_id");
+    }
+}
+async function initDb(stateDbPath) {
+    const resolved = (0, path_js_1.expandHome)(stateDbPath);
+    const dir = (0, node_path_1.dirname)(resolved);
+    if (!(0, node_fs_1.existsSync)(dir)) {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    const client = (0, client_1.createClient)({ url: `file:${resolved}` });
+    const db = (0, libsql_1.drizzle)(client, { schema });
+    await (0, migrator_1.migrate)(db, { migrationsFolder: (0, node_path_2.join)(__dirname, "..", "..", "drizzle") });
+    await reconcileLegacyThreadsSchema(client);
+    return { db, client };
+}

package/dist/state/schema.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.daemonState = exports.threadUserMessageRequestStore = exports.threads = exports.llmModels = exports.agentSdks = void 0;
+const sqlite_core_1 = require("drizzle-orm/sqlite-core");
+// ── agent_sdks ──────────────────────────────────────────────────────────────
+exports.agentSdks = (0, sqlite_core_1.sqliteTable)("agent_sdks", {
+    name: (0, sqlite_core_1.text)("name").primaryKey(),
+    authentication: (0, sqlite_core_1.text)("authentication", {
+        enum: ["unauthenticated", "host", "dedicated", "api-key"],
+    }).notNull(),
+});
+// ── llm_models ──────────────────────────────────────────────────────────────
+exports.llmModels = (0, sqlite_core_1.sqliteTable)("llm_models", {
+    name: (0, sqlite_core_1.text)("name").primaryKey(),
+    sdkName: (0, sqlite_core_1.text)("sdk_name")
+        .notNull()
+        .references(() => exports.agentSdks.name, { onDelete: "cascade" }),
+    reasoningLevels: (0, sqlite_core_1.text)("reasoning_levels", { mode: "json" })
+        .$type(),
+});
+// -- threads ──────────────────────────────────────────────────────────────────
+exports.threads = (0, sqlite_core_1.sqliteTable)("threads", {
+    id: (0, sqlite_core_1.text)("id").primaryKey(),
+    sdkThreadId: (0, sqlite_core_1.text)("sdk_thread_id"),
+    cliSecret: (0, sqlite_core_1.text)("cli_secret"),
+    model: (0, sqlite_core_1.text)("model").notNull(),
+    reasoningLevel: (0, sqlite_core_1.text)("reasoning_level").notNull(),
+    additionalModelInstructions: (0, sqlite_core_1.text)("additional_model_instructions"),
+    status: (0, sqlite_core_1.text)("status", { enum: ["pending", "ready", "deleting"] }).notNull(),
+    currentSdkTurnId: (0, sqlite_core_1.text)("current_sdk_turn_id"),
+    isCurrentTurnRunning: (0, sqlite_core_1.integer)("is_current_turn_running", { mode: "boolean" }).notNull(),
+    workspace: (0, sqlite_core_1.text)("workspace").notNull(),
+    runtimeContainer: (0, sqlite_core_1.text)("runtime_container").notNull(),
+    dindContainer: (0, sqlite_core_1.text)("dind_container"),
+    // home directory within the container
+    homeDirectory: (0, sqlite_core_1.text)("home_directory").notNull(),
+    // uid of the user within the container
+    uid: (0, sqlite_core_1.integer)("uid").notNull(),
+    // gid of the user within the container
+    gid: (0, sqlite_core_1.integer)("gid").notNull(),
+});
+// -- thread_user_message_request_store ----------------------------------------
+exports.threadUserMessageRequestStore = (0, sqlite_core_1.sqliteTable)("thread_user_message_request_store", {
+    id: (0, sqlite_core_1.integer)("id").primaryKey({ autoIncrement: true }),
+    threadId: (0, sqlite_core_1.text)("thread_id")
+        .notNull()
+        .references(() => exports.threads.id, { onDelete: "cascade" }),
+    sdkTurnId: (0, sqlite_core_1.text)("sdk_turn_id").notNull(),
+    requestId: (0, sqlite_core_1.text)("request_id").notNull(),
+    sdkItemId: (0, sqlite_core_1.text)("sdk_item_id"),
+});
+// -- daemon_state ------------------------------------------------------------
+exports.daemonState = (0, sqlite_core_1.sqliteTable)("daemon_state", {
+    id: (0, sqlite_core_1.text)("id").primaryKey(),
+    pid: (0, sqlite_core_1.integer)("pid"),
+    logPath: (0, sqlite_core_1.text)("log_path"),
+    startedAt: (0, sqlite_core_1.text)("started_at").notNull(),
+    updatedAt: (0, sqlite_core_1.text)("updated_at").notNull(),
+});

package/dist/templates/app_server_bootstrap.sh.j2

@@ -0,0 +1,52 @@
+set -euo pipefail
+
+AGENT_USER={{ agent_user }}
+AGENT_HOME={{ agent_home }}
+AGENT_UID={{ agent_uid }}
+AGENT_GID={{ agent_gid }}
+CODEX_AUTH_PATH={{ codex_auth_path }}
+APP_SERVER_COMMAND={{ app_server_command }}
+EXISTING_UID_USER=""
+
+if getent passwd "$AGENT_UID" >/dev/null 2>&1; then
+  EXISTING_UID_USER="$(getent passwd "$AGENT_UID" | cut -d: -f1)"
+  AGENT_USER="$EXISTING_UID_USER"
+fi
+
+AGENT_GROUP="$AGENT_USER"
+if getent group "$AGENT_GID" >/dev/null 2>&1; then
+  AGENT_GROUP="$(getent group "$AGENT_GID" | cut -d: -f1)"
+elif getent group "$AGENT_USER" >/dev/null 2>&1; then
+  groupmod -g "$AGENT_GID" "$AGENT_USER"
+  AGENT_GROUP="$AGENT_USER"
+else
+  groupadd -g "$AGENT_GID" "$AGENT_USER"
+  AGENT_GROUP="$AGENT_USER"
+fi
+
+if id -u "$AGENT_USER" >/dev/null 2>&1; then
+  usermod -u "$AGENT_UID" -g "$AGENT_GROUP" -d "$AGENT_HOME" -s /bin/bash "$AGENT_USER" || true
+else
+  useradd -m -d "$AGENT_HOME" -u "$AGENT_UID" -g "$AGENT_GROUP" -s /bin/bash "$AGENT_USER"
+fi
+
+SUDOERS_FILE="/etc/sudoers.d/90-companyhelm-agent"
+if command -v sudo >/dev/null 2>&1; then
+  install -d -m 0750 /etc/sudoers.d
+  printf '%s\n' "$AGENT_USER ALL=(ALL) NOPASSWD:ALL" > "$SUDOERS_FILE"
+  chmod 0440 "$SUDOERS_FILE"
+  if command -v visudo >/dev/null 2>&1; then
+    visudo -cf "$SUDOERS_FILE" >/dev/null
+  fi
+fi
+
+mkdir -p "$AGENT_HOME"
+chown "$AGENT_UID:$AGENT_GID" "$AGENT_HOME" || true
+
+if [ -n "${CODEX_AUTH_PATH:-}" ]; then
+  mkdir -p "$(dirname "$CODEX_AUTH_PATH")"
+  chown -R "$AGENT_UID:$AGENT_GID" "$(dirname "$CODEX_AUTH_PATH")" || true
+fi
+
+export HOME="$AGENT_HOME"
+exec sudo -n -E -H -u "$AGENT_USER" bash -lc "$APP_SERVER_COMMAND"

package/dist/templates/runtime_agents.md.j2

@@ -0,0 +1,50 @@
+# Agent Instructions
+
+## Workspace Structure
+
+- You are running in a thread-specific container and workspace
+- This workspace is not initialized as a Git repository by default. Repositories should live in a subdirectory of the workspace.
+
+## Docker
+
+Docker is available, the docker host runs in a separate container. The network is shared with container.
+- only the `/workspace` is shared with the docker host
+- `{{home_directory}}/.codex/auth.json` is also shared with the docker host
+- Nested DinD is not supported in this environment because the outer runtime already uses rootless DinD.
+- If you need to use Docker in Docker you can mount the docker socket in the container and use this environment DinD to run containers within containers.
+
+## GitHub Installations
+
+- Synced GitHub installation credentials are written to `/workspace/.companyhelm/installations.json`.
+- Use `list-installations` to inspect installation IDs, repository scopes, tokens, and expiration timestamps.
+- Use `gh-use-installation <installation-id>` to configure `gh` authentication for a specific installation.
+
+```bash
+# Inspect synced installation credentials
+list-installations
+
+# Configure gh to use installation 112331765
+gh-use-installation 112331765
+
+# Verify gh is authenticated for github.com
+gh auth status --hostname github.com
+```
+
+## Available CLI Tools
+
+- `list-installations`: list synced GitHub installations with repositories, access tokens, and expirations.
+- `gh-use-installation <installation-id>`: configure `gh` authentication for a selected GitHub installation token.
+- `aws`: AWS CLI is pre-installed and available in `PATH`.
+- For scripted PR creation/updates, always use `gh pr create --body-file <path>` and `gh pr edit --body-file <path>` instead of inline `--body` to avoid shell interpolation of markdown backticks.
+- DO NOT INSTALL PLAYWRIGHT IN THE RUNTIME IMAGE. Playwright CLI is already installed and available for browser automation tasks with Chromium pre-installed: `playwright open --browser=chromium ...`
+
+## CompanyHelm Agent CLI
+
+- `companyhelm-agent` is pre-installed in the runtime image.
+- Thread bootstrap writes `{{home_directory}}/.config/companyhelm-agent-cli/config.json` with:
+  - `agent_api_url`: localhost targets are rewritten to `host.docker.internal` (for example `http://host.docker.internal:<port>`) for Docker-to-host access.
+  - `token`: sourced from the thread secret.
+- Example commands:
+  - `companyhelm-agent task get --task-id <id>`
+  - `companyhelm-agent task dependencies --task-id <id>`
+  - `companyhelm-agent task update-status --task-id <id> --status <draft|pending|in_progress|completed>`

package/dist/templates/runtime_bashrc.j2

@@ -0,0 +1,19 @@
+# CompanyHelm runtime shell initialization.
+# This file is generated by companyhelm-runner when a thread runtime starts.
+
+if [ -z "${NVM_DIR:-}" ] || [ ! -s "$NVM_DIR/nvm.sh" ]; then
+  for candidate in "/usr/local/nvm" "$HOME/.nvm" "/opt/nvm" "/root/.nvm"; do
+    if [ -s "$candidate/nvm.sh" ]; then
+      export NVM_DIR="$candidate"
+      break
+    fi
+  done
+fi
+
+if [ -n "${NVM_DIR:-}" ] && [ -s "$NVM_DIR/nvm.sh" ]; then
+  . "$NVM_DIR/nvm.sh"
+  nvm use --silent default >/dev/null 2>&1 || true
+  if [ -s "$NVM_DIR/bash_completion" ]; then
+    . "$NVM_DIR/bash_completion"
+  fi
+fi