@companyhelm/runner 0.0.15 → 0.0.18

package/dist/commands/register-commands.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerCommands = registerCommands;
+const common_js_1 = require("./runner/common.js");
 const register_runner_commands_js_1 = require("./runner/register-runner-commands.js");
+const start_js_1 = require("./runner/start.js");
 const shell_js_1 = require("./shell.js");
 const register_sdk_commands_js_1 = require("./sdk/register-sdk-commands.js");
 const status_js_1 = require("./status.js");
 const register_thread_commands_js_1 = require("./thread/register-thread-commands.js");
 function registerCommands(program) {
+    (0, common_js_1.addRunnerStartOptions)(program
+        .command("companyhelm-runner")
+        .description("Alias for starting the local CompanyHelm runner.")).action(start_js_1.runRunnerStartCommand);
     (0, register_runner_commands_js_1.registerRunnerCommands)(program);
     (0, status_js_1.registerStatusCommand)(program);
     (0, register_thread_commands_js_1.registerThreadCommands)(program);

package/dist/commands/root.js

@@ -1661,15 +1661,17 @@ async function countSdkModels(cfg, sdkName) {
         client.close();
     }
 }
-async function refreshCodexModelsForRegistration(cfg, logger) {
+async function loadCodexSdkState(cfg) {
     const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
-    let codexSdk;
     try {
-        codexSdk = await db.select().from(schema_js_1.agentSdks).where((0, drizzle_orm_1.eq)(schema_js_1.agentSdks.name, "codex")).get() ?? undefined;
+        return await db.select().from(schema_js_1.agentSdks).where((0, drizzle_orm_1.eq)(schema_js_1.agentSdks.name, "codex")).get() ?? undefined;
     }
     finally {
         client.close();
     }
+}
+async function refreshCodexModelsForRegistration(cfg, logger) {
+    const codexSdk = await loadCodexSdkState(cfg);
     if (!codexSdk || codexSdk.status !== "configured" || codexSdk.authentication === "unauthenticated") {
         logger.info("Codex is not configured; registering runner with unconfigured Codex SDK state.");
         return null;
@@ -2004,18 +2006,18 @@ async function deleteThreadWithCleanup(cfg, request) {
     }
     return { kind: "deleted" };
 }
-async function handleDeleteThreadRequest(cfg, commandChannel, request, logger) {
+async function handleDeleteThreadRequest(cfg, commandChannel, request, requestId, logger) {
     const deleteResult = await deleteThreadWithCleanup(cfg, request);
     if (deleteResult.kind === "not_found") {
         logger.warn(`Delete requested for missing thread '${request.threadId}'. Treating as deleted.`);
-        await sendThreadUpdate(commandChannel, request.threadId, protos_1.ThreadStatus.DELETED);
+        await sendThreadUpdate(commandChannel, request.threadId, protos_1.ThreadStatus.DELETED, requestId);
         return;
     }
     if (deleteResult.kind === "error") {
-        await sendRequestError(commandChannel, deleteResult.message);
+        await sendRequestError(commandChannel, deleteResult.message, requestId);
         return;
     }
-    await sendThreadUpdate(commandChannel, request.threadId, protos_1.ThreadStatus.DELETED);
+    await sendThreadUpdate(commandChannel, request.threadId, protos_1.ThreadStatus.DELETED, requestId);
 }
 async function reportNoRunningInterruptAsReady(cfg, commandChannel, request, threadState, logger, logMessage) {
     try {
@@ -2394,6 +2396,12 @@ async function handleCodexConfigurationRequest(cfg, commandChannel, request, req
             await sendRequestError(commandChannel, "Unsupported Codex auth type.", requestId);
             return;
         }
+        const codexSdk = await loadCodexSdkState(cfg);
+        if (!codexSdk || codexSdk.status !== "configured" || codexSdk.authentication === "unauthenticated") {
+            const sdkUpdate = await buildCodexAgentSdkUpdate(cfg, logger, protos_1.AgentSdkStatus.UNCONFIGURED);
+            await sendAgentSdkUpdate(commandChannel, sdkUpdate, requestId);
+            return;
+        }
         const codexRefreshErrorMessage = await refreshCodexModelsForRegistration(cfg, logger);
         const sdkUpdate = await buildCodexAgentSdkUpdate(cfg, logger, codexRefreshErrorMessage ? protos_1.AgentSdkStatus.ERROR : protos_1.AgentSdkStatus.READY, codexRefreshErrorMessage ?? undefined);
         await sendAgentSdkUpdate(commandChannel, sdkUpdate, requestId);
@@ -2413,7 +2421,7 @@ async function runCommandLoop(cfg, commandChannel, commandMessageSink, apiClient
                 await handleCreateThreadRequest(cfg, commandMessageSink, serverMessage.request.value, requestId, apiClient, apiCallOptions, logger);
                 break;
             case "deleteThreadRequest":
-                await handleDeleteThreadRequest(cfg, commandMessageSink, serverMessage.request.value, logger);
+                await handleDeleteThreadRequest(cfg, commandMessageSink, serverMessage.request.value, requestId, logger);
                 break;
             case "createUserMessageRequest":
                 void handleCreateUserMessageRequest(cfg, commandMessageSink, serverMessage.request.value, requestId, logger).catch((error) => {

package/dist/commands/runner/start.js

@@ -1,30 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRunnerStartCommand = runRunnerStartCommand;
 exports.registerRunnerStartCommand = registerRunnerStartCommand;
 const root_js_1 = require("../root.js");
 const common_js_1 = require("./common.js");
+async function runRunnerStartCommand(options) {
+    if (options.daemon && !(0, root_js_1.isInternalDaemonChildProcess)()) {
+        await (0, root_js_1.runDetachedDaemonProcess)(options);
+        return;
+    }
+    try {
+        await (0, root_js_1.runRootCommand)(options, (0, root_js_1.isInternalDaemonChildProcess)()
+            ? {
+                onDaemonReady: () => {
+                    (0, root_js_1.sendDaemonParentMessage)({ type: "daemon-ready" });
+                },
+            }
+            : undefined);
+    }
+    catch (error) {
+        if ((0, root_js_1.isInternalDaemonChildProcess)()) {
+            (0, root_js_1.sendDaemonParentMessage)({ type: "daemon-error", message: (0, root_js_1.toErrorMessage)(error) });
+        }
+        throw error;
+    }
+}
 function registerRunnerStartCommand(runnerCommand) {
     (0, common_js_1.addRunnerStartOptions)(runnerCommand
         .command("start")
-        .description("Start the local CompanyHelm runner daemon.")).action(async (options) => {
-        if (options.daemon && !(0, root_js_1.isInternalDaemonChildProcess)()) {
-            await (0, root_js_1.runDetachedDaemonProcess)(options);
-            return;
-        }
-        try {
-            await (0, root_js_1.runRootCommand)(options, (0, root_js_1.isInternalDaemonChildProcess)()
-                ? {
-                    onDaemonReady: () => {
-                        (0, root_js_1.sendDaemonParentMessage)({ type: "daemon-ready" });
-                    },
-                }
-                : undefined);
-        }
-        catch (error) {
-            if ((0, root_js_1.isInternalDaemonChildProcess)()) {
-                (0, root_js_1.sendDaemonParentMessage)({ type: "daemon-error", message: (0, root_js_1.toErrorMessage)(error) });
-            }
-            throw error;
-        }
-    });
+        .description("Start the local CompanyHelm runner daemon.")).action(runRunnerStartCommand);
 }

package/dist/commands/sdk/codex/auth.js

@@ -40,12 +40,90 @@ exports.defaultUseDedicatedCodexAuthDependencies = {
     spawnCommand: node_child_process_1.spawn,
     spawnSyncCommand: node_child_process_1.spawnSync,
 };
+function resolveContainerPath(pathValue, containerHome) {
+    if (pathValue === "~") {
+        return containerHome;
+    }
+    if (pathValue.startsWith("~/")) {
+        return `${containerHome}${pathValue.slice(1)}`;
+    }
+    return pathValue;
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function buildCodexLoginShellCommand(cfg, loginCommand) {
+    const hostInfo = (0, host_js_1.getHostInfo)(cfg.codex.codex_auth_path);
+    const containerAuthPath = resolveContainerPath(cfg.codex.codex_auth_path, cfg.agent_home_directory);
+    return [
+        `AGENT_USER=${shellQuote(cfg.agent_user)}`,
+        `AGENT_HOME=${shellQuote(cfg.agent_home_directory)}`,
+        `AGENT_UID=${shellQuote(String(hostInfo.uid))}`,
+        `AGENT_GID=${shellQuote(String(hostInfo.gid))}`,
+        `CODEX_AUTH_PATH=${shellQuote(containerAuthPath)}`,
+        `CODEX_LOGIN_COMMAND=${shellQuote(`source "$NVM_DIR/nvm.sh"; ${loginCommand}`)}`,
+        'EXISTING_UID_USER=""',
+        'if getent passwd "$AGENT_UID" >/dev/null 2>&1; then',
+        '  EXISTING_UID_USER="$(getent passwd "$AGENT_UID" | cut -d: -f1)"',
+        '  AGENT_USER="$EXISTING_UID_USER"',
+        'fi',
+        'AGENT_GROUP="$AGENT_USER"',
+        'if getent group "$AGENT_GID" >/dev/null 2>&1; then',
+        '  AGENT_GROUP="$(getent group "$AGENT_GID" | cut -d: -f1)"',
+        'elif getent group "$AGENT_USER" >/dev/null 2>&1; then',
+        '  groupmod -g "$AGENT_GID" "$AGENT_USER"',
+        '  AGENT_GROUP="$AGENT_USER"',
+        'else',
+        '  groupadd -g "$AGENT_GID" "$AGENT_USER"',
+        '  AGENT_GROUP="$AGENT_USER"',
+        'fi',
+        'if id -u "$AGENT_USER" >/dev/null 2>&1; then',
+        '  usermod -u "$AGENT_UID" -g "$AGENT_GROUP" -d "$AGENT_HOME" -s /bin/bash "$AGENT_USER" || true',
+        'else',
+        '  useradd -m -d "$AGENT_HOME" -u "$AGENT_UID" -g "$AGENT_GROUP" -s /bin/bash "$AGENT_USER"',
+        'fi',
+        'mkdir -p "$AGENT_HOME" "$(dirname "$CODEX_AUTH_PATH")"',
+        'chown -R "$AGENT_UID:$AGENT_GID" "$AGENT_HOME" "$(dirname "$CODEX_AUTH_PATH")" || true',
+        'export HOME="$AGENT_HOME"',
+        'exec sudo -n -E -H -u "$AGENT_USER" bash -lc "$CODEX_LOGIN_COMMAND"',
+    ].join("\n");
+}
 function isErrnoException(error) {
     return error instanceof Error && "code" in error;
 }
 function buildDockerMissingError() {
     return new Error("Docker is not installed or not available on PATH. Install Docker and retry.");
 }
+function readSpawnSyncText(output) {
+    if (typeof output === "string") {
+        return output.trim();
+    }
+    if (Buffer.isBuffer(output)) {
+        return output.toString("utf8").trim();
+    }
+    return "";
+}
+function describeSpawnSyncFailure(command, args, result) {
+    if (isErrnoException(result.error)) {
+        return `${command} ${args.join(" ")} failed to start: ${result.error.message}`;
+    }
+    const parts = [`${command} ${args.join(" ")}`];
+    if (typeof result.status === "number") {
+        parts.push(`exit code ${result.status}`);
+    }
+    if (result.signal) {
+        parts.push(`signal ${result.signal}`);
+    }
+    const stderr = readSpawnSyncText(result.stderr);
+    if (stderr.length > 0) {
+        parts.push(`stderr: ${stderr}`);
+    }
+    const stdout = readSpawnSyncText(result.stdout);
+    if (stdout.length > 0) {
+        parts.push(`stdout: ${stdout}`);
+    }
+    return parts.join(", ");
+}
 function ensureDockerAvailable(spawnSyncCommand) {
     const result = spawnSyncCommand("docker", ["--version"], { stdio: "ignore" });
     if (isErrnoException(result.error) && result.error.code === "ENOENT") {
@@ -64,9 +142,10 @@ async function runContainerizedCodexLogin(cfg, deps, options) {
         (0, node_fs_1.mkdirSync)(configDir, { recursive: true });
     }
     const destPath = (0, node_path_1.join)(configDir, cfg.codex.codex_auth_file_path);
-    const containerAuthPath = cfg.codex.codex_auth_path;
+    const containerAuthPath = resolveContainerPath(cfg.codex.codex_auth_path, cfg.agent_home_directory);
     let authCopied = false;
     let combinedOutput = "";
+    let lastCopyFailure = null;
     await new Promise((resolve, reject) => {
         let settled = false;
         let poll;
@@ -77,19 +156,17 @@ async function runContainerizedCodexLogin(cfg, deps, options) {
             deps.spawnSyncCommand("docker", ["rm", "-f", options.containerName], { stdio: "ignore" });
         };
         const tryCopyAuthFile = () => {
-            const check = deps.spawnSyncCommand("docker", ["exec", options.containerName, "sh", "-c", `test -f ${containerAuthPath}`], {
-                stdio: "ignore",
-            });
-            if (check.status !== 0) {
-                return false;
-            }
-            const cpResult = deps.spawnSyncCommand("docker", ["cp", `${options.containerName}:${containerAuthPath}`, destPath], {
-                stdio: "ignore",
+            const cpArgs = ["cp", `${options.containerName}:${containerAuthPath}`, destPath];
+            const cpResult = deps.spawnSyncCommand("docker", cpArgs, {
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf8",
             });
             if (cpResult.status !== 0) {
+                lastCopyFailure = describeSpawnSyncFailure("docker", cpArgs, cpResult);
                 return false;
             }
             authCopied = true;
+            lastCopyFailure = null;
             cleanup();
             return true;
         };
@@ -141,7 +218,14 @@ async function runContainerizedCodexLogin(cfg, deps, options) {
                 resolveOnce();
                 return;
             }
-            rejectOnce(new Error(`Codex login failed or was cancelled.${combinedOutput.trim().length > 0 ? ` Output: ${combinedOutput.trim()}` : ""}`));
+            const details = [];
+            if (lastCopyFailure) {
+                details.push(`Auth file copy failed from ${containerAuthPath}: ${lastCopyFailure}`);
+            }
+            if (combinedOutput.trim().length > 0) {
+                details.push(`Output: ${combinedOutput.trim()}`);
+            }
+            rejectOnce(new Error(`Codex login failed or was cancelled.${details.length > 0 ? ` ${details.join(" ")}` : ""}`));
         });
     });
     return destPath;
@@ -232,6 +316,8 @@ async function runSetCodexHostAuth(cfg, overrides = {}) {
 }
 async function runDedicatedCodexAuth(cfg, db, deps) {
     const containerName = `companyhelm-codex-auth-${Date.now()}`;
+    ensureDockerAvailable(deps.spawnSyncCommand);
+    const loginCommand = buildCodexLoginShellCommand(cfg, "codex login --device-auth");
     deps.logInfo("Starting Codex login inside a container...");
     deps.logInfo("A browser URL and device code will appear -- open it to complete authentication.");
     const destPath = await runContainerizedCodexLogin(cfg, deps, {
@@ -244,7 +330,7 @@ async function runDedicatedCodexAuth(cfg, db, deps) {
             "bash",
             cfg.runtime_image,
             "-lc",
-            'source "$NVM_DIR/nvm.sh"; codex login --device-auth',
+            loginCommand,
         ],
     });
     await setCodexDedicatedAuthInDb(db);
@@ -257,6 +343,8 @@ async function runCodexApiKeyAuth(cfg, apiKey, overrides = {}) {
     try {
         deps.logInfo("Starting Codex API key login inside a container...");
         const containerName = `companyhelm-codex-auth-${Date.now()}`;
+        ensureDockerAvailable(deps.spawnSyncCommand);
+        const loginCommand = buildCodexLoginShellCommand(cfg, 'printf \'%s\\n\' "$CODEX_API_KEY" | codex login --with-api-key');
         const destPath = await runContainerizedCodexLogin(cfg, deps, {
             containerName,
             dockerArgs: [
@@ -269,7 +357,7 @@ async function runCodexApiKeyAuth(cfg, apiKey, overrides = {}) {
                 "bash",
                 cfg.runtime_image,
                 "-lc",
-                'source "$NVM_DIR/nvm.sh"; printf \'%s\\n\' "$CODEX_API_KEY" | codex login --with-api-key',
+                loginCommand,
             ],
         });
         await setCodexApiKeyAuthInDb(db);
@@ -288,6 +376,8 @@ async function runCodexDeviceCodeAuth(cfg, onDeviceCode, overrides = {}) {
         let onDeviceCodePromise = Promise.resolve();
         deps.logInfo("Starting Codex device login inside a container...");
         const containerName = `companyhelm-codex-auth-${Date.now()}`;
+        ensureDockerAvailable(deps.spawnSyncCommand);
+        const loginCommand = buildCodexLoginShellCommand(cfg, "codex login --device-auth");
         const destPath = await runContainerizedCodexLogin(cfg, deps, {
             containerName,
             dockerArgs: [
@@ -298,7 +388,7 @@ async function runCodexDeviceCodeAuth(cfg, onDeviceCode, overrides = {}) {
                 "bash",
                 cfg.runtime_image,
                 "-lc",
-                'source "$NVM_DIR/nvm.sh"; codex login --device-auth',
+                loginCommand,
             ],
             onOutput: (output) => {
                 const deviceCode = extractCodexDeviceCodeFromOutput(output);

package/dist/commands/sdk/codex/use-dedicated-auth.js

@@ -5,6 +5,7 @@ exports.registerSdkCodexUseDedicatedAuthCommand = registerSdkCodexUseDedicatedAu
 const config_js_1 = require("../../../config.js");
 const auth_js_1 = require("./auth.js");
 async function runSdkCodexUseDedicatedAuthCommand(cfg = config_js_1.config.parse({}), overrides = {}) {
+    cfg = config_js_1.config.parse(cfg);
     const deps = { ...auth_js_1.defaultUseDedicatedCodexAuthDependencies, ...overrides };
     await (0, auth_js_1.runUseDedicatedCodexAuth)(cfg, deps);
 }

package/dist/commands/sdk/codex/use-host-auth.js

@@ -5,6 +5,7 @@ exports.registerSdkCodexUseHostAuthCommand = registerSdkCodexUseHostAuthCommand;
 const config_js_1 = require("../../../config.js");
 const auth_js_1 = require("./auth.js");
 async function runSdkCodexUseHostAuthCommand(cfg = config_js_1.config.parse({}), overrides = {}) {
+    cfg = config_js_1.config.parse(cfg);
     const deps = { ...auth_js_1.defaultSetCodexHostAuthDependencies, ...overrides };
     const authPath = await (0, auth_js_1.runSetCodexHostAuth)(cfg, deps);
     console.log(`Codex SDK configured with host authentication using ${authPath}.`);

package/dist/commands/startup.js

@@ -96,6 +96,7 @@ async function selectStartupAuthMode(options, deps) {
     return authMode;
 }
 async function startup(cfg = config_js_1.config.parse({}), overrides = {}) {
+    cfg = config_js_1.config.parse(cfg);
     const deps = { ...defaultStartupDependencies, ...overrides };
     banner();
     const s = deps.promptApi.spinner();

package/dist/service/docker/app_server_container.js

@@ -216,6 +216,7 @@ class AppServerContainerService {
         const hostInfo = (0, host_js_1.getHostInfo)(cfg.codex.codex_auth_path);
         const containerHome = cfg.agent_home_directory;
         const containerAuthPath = resolveContainerPath(cfg.codex.codex_auth_path, containerHome);
+        const hostAuthPath = (0, path_js_1.expandHome)(cfg.codex.codex_auth_path);
         const hostDedicatedAuthPath = `${(0, path_js_1.expandHome)(cfg.config_directory)}/${cfg.codex.codex_auth_file_path}`;
         const mountArgs = [];
         if (codexAuthMode === "dedicated") {
@@ -224,6 +225,12 @@ class AppServerContainerService {
             }
             mountArgs.push("--mount", `type=bind,src=${hostDedicatedAuthPath},dst=${containerAuthPath}`);
         }
+        else if (codexAuthMode === "host") {
+            if (!hostInfo.codexAuthExists) {
+                throw new Error(`Codex host auth file was not found at ${hostAuthPath}`);
+            }
+            mountArgs.push("--mount", `type=bind,src=${hostAuthPath},dst=${containerAuthPath}`);
+        }
         this.containerName = `companyhelm-codex-app-server-${Date.now()}`;
         const bootstrapTemplate = (0, node_fs_1.readFileSync)(resolveTemplatePath(), "utf8");
         const bootstrapScript = renderJinjaTemplate(bootstrapTemplate, {

package/dist/service/thread_lifecycle.js

@@ -108,7 +108,7 @@ function buildSharedThreadMounts(options) {
     mounts.push({
         Type: "bind",
         Source: hostAuthPath,
-        Target: hostAuthPath,
+        Target: resolveContainerPath(options.codexAuthPath, options.containerHomeDirectory),
     });
     return mounts;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companyhelm/runner",
-  "version": "0.0.15",
+  "version": "0.0.18",
   "description": "Run the CompanyHelm runner in fully isolated Docker sandboxes.",
   "license": "MIT",
   "repository": {
@@ -24,6 +24,7 @@
     "test": "npm run build && vitest run",
     "test:unit": "npm run build && vitest run tests/unit",
     "test:integration": "npm run build && vitest run tests/integration",
+    "test:system:device-auth": "npm run build && COMPANYHELM_RUN_MANUAL_DEVICE_AUTH_TEST=1 vitest run --reporter=verbose tests/system/codex-device-auth.system.test.ts",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
     "generate:codex-app-server": "docker run --rm --user \"$(id -u):$(id -g)\" -e CODEX_HOME=/workspace/node_modules/.cache/codex -v \"$PWD:/workspace\" -w /workspace companyhelm/runner:$(tr -d '[:space:]' < RUNTIME_IMAGE_VERSION) bash -lc 'mkdir -p /workspace/node_modules/.cache/codex; source \"$NVM_DIR/nvm.sh\"; codex app-server generate-ts --out src/generated/codex-app-server'"