@companyhelm/runner 0.1.3 → 0.2.0

package/RUNTIME_IMAGE_VERSION

@@ -1 +1 @@
-0.0.11
+0.0.12

package/dist/commands/root.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toErrorMessage = toErrorMessage;
+exports.formatWorkspaceStartupMessage = formatWorkspaceStartupMessage;
 exports.isRetryableApiConnectionError = isRetryableApiConnectionError;
 exports.formatApiConnectionFailureMessage = formatApiConnectionFailureMessage;
 exports.formatApiConnectionFailureDiagnostics = formatApiConnectionFailureDiagnostics;
@@ -42,6 +43,7 @@ exports.isNoActiveTurnSteerError = isNoActiveTurnSteerError;
 exports.isNoRunningTurnInterruptError = isNoRunningTurnInterruptError;
 exports.normalizeThreadAgentApiUrlForRuntime = normalizeThreadAgentApiUrlForRuntime;
 exports.extractThreadNameUpdateFromNotification = extractThreadNameUpdateFromNotification;
+exports.extractThreadTokenUsageUpdateFromNotification = extractThreadTokenUsageUpdateFromNotification;
 exports.runCommandLoop = runCommandLoop;
 exports.isInternalDaemonChildProcess = isInternalDaemonChildProcess;
 exports.runDetachedDaemonProcess = runDetachedDaemonProcess;
@@ -83,14 +85,9 @@ const auth_js_1 = require("./sdk/codex/auth.js");
 const COMMAND_CHANNEL_CONNECT_RETRY_DELAY_MS = 1000;
 const COMMAND_CHANNEL_OPEN_TIMEOUT_MS = 5000;
 const TURN_COMPLETION_TIMEOUT_MS = 2 * 60 * 60000;
-const GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS = 5 * 60000;
-const GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS = 30000;
-const GITHUB_INSTALLATIONS_REFRESH_WINDOW_MS = 15 * 60000;
 const WORKSPACE_INSTALLATIONS_DIRECTORY = ".companyhelm";
-const WORKSPACE_INSTALLATIONS_FILENAME = "installations.json";
 const THREAD_GIT_SKILLS_CONFIG_FILENAME = "thread-git-skills.json";
 const THREAD_MCP_CONFIG_FILENAME = "thread-mcp.json";
-const THREAD_AGENT_CLI_CONFIG_FILENAME = "thread-agent-cli.json";
 const THREAD_MCP_BEARER_TOKEN_ENV_PREFIX = "COMPANYHELM_MCP_TOKEN_";
 const THREAD_MCP_AUTH_TYPE_BEARER_TOKEN = 2;
 const THREAD_MCP_STARTUP_TIMEOUT_SECONDS = 60;
@@ -262,6 +259,20 @@ function normalizeReasoningLevels(value) {
 function toErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+function formatWorkspaceStartupMessage(cfg) {
+    if (cfg.use_dedicated_workspaces) {
+        const workspacesDirectory = (0, thread_lifecycle_js_1.resolveThreadsRootDirectory)(cfg.config_directory, cfg.workspaces_directory);
+        return `Workspace modality: dedicated (workspaces dir: ${workspacesDirectory})`;
+    }
+    const workspaceDirectory = (0, thread_workspace_provisioner_js_1.resolveThreadWorkspaceDirectory)({
+        configDirectory: cfg.config_directory,
+        workspacesDirectory: cfg.workspaces_directory,
+        workspacePath: cfg.workspace_path,
+        useDedicatedWorkspaces: false,
+        threadId: "startup",
+    });
+    return `Workspace modality: shared (workspace: ${workspaceDirectory})`;
+}
 function getGrpcStatusCode(error) {
     if (!error || typeof error !== "object" || !("code" in error)) {
         return undefined;
@@ -362,6 +373,36 @@ function normalizeNonEmptyString(value) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : undefined;
 }
+function normalizeNonNegativeNumber(value) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        return undefined;
+    }
+    return Math.floor(value);
+}
+function resolveTokenUsageBreakdown(value) {
+    if (!isRecord(value)) {
+        return null;
+    }
+    const inputTokens = normalizeNonNegativeNumber(value.inputTokens ?? value.input_tokens);
+    const cachedInputTokens = normalizeNonNegativeNumber(value.cachedInputTokens ?? value.cached_input_tokens);
+    const outputTokens = normalizeNonNegativeNumber(value.outputTokens ?? value.output_tokens);
+    const reasoningOutputTokens = normalizeNonNegativeNumber(value.reasoningOutputTokens ?? value.reasoning_output_tokens);
+    const totalTokens = normalizeNonNegativeNumber(value.totalTokens ?? value.total_tokens);
+    if (inputTokens === undefined ||
+        cachedInputTokens === undefined ||
+        outputTokens === undefined ||
+        reasoningOutputTokens === undefined ||
+        totalTokens === undefined) {
+        return null;
+    }
+    return {
+        inputTokens,
+        cachedInputTokens,
+        outputTokens,
+        reasoningOutputTokens,
+        totalTokens,
+    };
+}
 function rewriteLocalTargetForDockerRuntime(target) {
     const trimmed = target.trim();
     if (!trimmed) {
@@ -451,89 +492,34 @@ function extractThreadNameUpdateFromNotification(notification) {
         normalizeNonEmptyString(params.thread_name);
     return { sdkThreadId, threadName };
 }
-function isGrpcServiceError(error) {
-    return Boolean(error && typeof error === "object" && "code" in error);
-}
-function isUnimplementedGrpcMethod(error) {
-    return isGrpcServiceError(error) && error.code === grpc.status.UNIMPLEMENTED;
-}
-function normalizeAccessTokenExpiration(accessTokenExpiresUnixTimeMs) {
-    const rawUnixTimeMs = Number(accessTokenExpiresUnixTimeMs);
-    const expirationUnixTimeMs = Number.isFinite(rawUnixTimeMs) && rawUnixTimeMs > 0
-        ? Math.floor(rawUnixTimeMs)
-        : Date.now() + 60 * 60000;
-    return {
-        accessTokenExpiresUnixTimeMs: expirationUnixTimeMs.toString(),
-        accessTokenExpiration: new Date(expirationUnixTimeMs).toISOString(),
-    };
-}
-async function loadRuntimeGithubInstallations(apiClient, options, logger) {
-    let installationIds = [];
-    try {
-        const listResponse = await apiClient.listGithubInstallationsForRunner(options);
-        installationIds = listResponse.installations.map((installation) => installation.installationId);
+function extractThreadTokenUsageUpdateFromNotification(notification) {
+    if (notification.method !== "thread/tokenUsage/updated") {
+        return null;
     }
-    catch (error) {
-        const warning = isUnimplementedGrpcMethod(error)
-            ? "CompanyHelm API does not implement listGithubInstallationsForRunner yet."
-            : `Failed to fetch GitHub installations: ${toErrorMessage(error)}`;
-        logger.warn(warning);
-        return [];
+    const rawParams = notification.params;
+    const sdkThreadId = normalizeNonEmptyString(rawParams.threadId) ??
+        normalizeNonEmptyString(rawParams.thread_id);
+    const sdkTurnId = normalizeNonEmptyString(rawParams.turnId) ??
+        normalizeNonEmptyString(rawParams.turn_id);
+    const tokenUsage = isRecord(rawParams.tokenUsage) ? rawParams.tokenUsage : rawParams.token_usage;
+    if (!sdkThreadId || !sdkTurnId || !isRecord(tokenUsage)) {
+        return null;
     }
-    const installationDetails = [];
-    for (const installationId of installationIds) {
-        try {
-            const accessTokenResponse = await apiClient.getGithubInstallationAccessTokenForRunner(installationId, options);
-            const accessToken = accessTokenResponse.accessToken.trim();
-            if (!accessToken) {
-                logger.warn(`Received empty GitHub access token for installation ${installationId.toString()}; skipping.`);
-                continue;
-            }
-            const expiration = normalizeAccessTokenExpiration(accessTokenResponse.accessTokenExpiresUnixTimeMs);
-            const repositories = [...new Set(accessTokenResponse.repositories.filter((repository) => repository.trim().length > 0))]
-                .sort((left, right) => left.localeCompare(right));
-            installationDetails.push({
-                installationId: accessTokenResponse.installationId.toString(),
-                accessToken,
-                accessTokenExpiresUnixTimeMs: expiration.accessTokenExpiresUnixTimeMs,
-                accessTokenExpiration: expiration.accessTokenExpiration,
-                repositories,
-            });
-        }
-        catch (error) {
-            const warning = isUnimplementedGrpcMethod(error)
-                ? "CompanyHelm API does not implement getGithubInstallationAccessTokenForRunner yet."
-                : `Failed to fetch GitHub access token for installation ${installationId.toString()}: ${toErrorMessage(error)}`;
-            logger.warn(warning);
-        }
+    const totalUsage = resolveTokenUsageBreakdown(tokenUsage.total);
+    const lastUsage = resolveTokenUsageBreakdown(tokenUsage.last);
+    if (!totalUsage || !lastUsage) {
+        return null;
     }
-    return installationDetails;
-}
-function buildWorkspaceGithubInstallationsPayload(installations) {
     return {
-        synced_at: new Date().toISOString(),
-        installations: installations.map((installation) => ({
-            installation_id: installation.installationId,
-            access_token: installation.accessToken,
-            access_token_expires_unix_time_ms: installation.accessTokenExpiresUnixTimeMs,
-            access_token_expiration: installation.accessTokenExpiration,
-            repositories: installation.repositories,
-        })),
+        sdkThreadId,
+        sdkTurnId,
+        totalUsage,
+        lastUsage,
+        modelContextWindow: normalizeNonNegativeNumber(tokenUsage.modelContextWindow ?? tokenUsage.model_context_window) ?? null,
     };
 }
-function writeWorkspaceGithubInstallationsPayload(workspaceDirectory, payload, logger) {
-    const installationsDirectory = (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY);
-    const installationsPath = (0, node_path_1.join)(installationsDirectory, WORKSPACE_INSTALLATIONS_FILENAME);
-    const temporaryPath = `${installationsPath}.tmp`;
-    const serializedPayload = `${JSON.stringify(payload, null, 2)}\n`;
-    try {
-        (0, node_fs_1.mkdirSync)(installationsDirectory, { recursive: true });
-        (0, node_fs_1.writeFileSync)(temporaryPath, serializedPayload, "utf8");
-        (0, node_fs_1.renameSync)(temporaryPath, installationsPath);
-    }
-    catch (error) {
-        logger.warn(`Failed writing GitHub installations file for workspace '${workspaceDirectory}': ${toErrorMessage(error)}`);
-    }
+function isGrpcServiceError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error);
 }
 function isHttpsRepositoryUrl(value) {
     try {
@@ -852,65 +838,6 @@ function readWorkspaceThreadMcpConfig(workspaceDirectory, logger) {
         return [];
     }
 }
-function resolveThreadAgentCliConfigPath(workspaceDirectory) {
-    return (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY, THREAD_AGENT_CLI_CONFIG_FILENAME);
-}
-function parseThreadAgentCliConfig(content) {
-    if (!isRecord(content)) {
-        return null;
-    }
-    const agentApiUrl = normalizeNonEmptyString(content.agent_api_url);
-    const token = normalizeNonEmptyString(content.token);
-    if (!agentApiUrl || !token) {
-        return null;
-    }
-    return {
-        agent_api_url: agentApiUrl,
-        token,
-    };
-}
-function writeWorkspaceThreadAgentCliConfig(workspaceDirectory, cliSecret, agentApiUrl, logger) {
-    const configPath = resolveThreadAgentCliConfigPath(workspaceDirectory);
-    const configDirectory = (0, node_path_1.join)(workspaceDirectory, WORKSPACE_INSTALLATIONS_DIRECTORY);
-    const temporaryPath = `${configPath}.tmp`;
-    try {
-        (0, node_fs_1.mkdirSync)(configDirectory, { recursive: true });
-        if (cliSecret.length === 0) {
-            (0, node_fs_1.rmSync)(configPath, { force: true });
-            (0, node_fs_1.rmSync)(temporaryPath, { force: true });
-            return;
-        }
-        const payload = {
-            agent_api_url: normalizeThreadAgentApiUrlForRuntime(agentApiUrl),
-            token: cliSecret,
-        };
-        (0, node_fs_1.writeFileSync)(temporaryPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
-        (0, node_fs_1.renameSync)(temporaryPath, configPath);
-    }
-    catch (error) {
-        logger.warn(`Failed writing thread agent CLI config for workspace '${workspaceDirectory}': ${toErrorMessage(error)}`);
-    }
-}
-function readWorkspaceThreadAgentCliConfig(workspaceDirectory, logger) {
-    const configPath = resolveThreadAgentCliConfigPath(workspaceDirectory);
-    try {
-        const rawContent = (0, node_fs_1.readFileSync)(configPath, "utf8");
-        const parsedContent = JSON.parse(rawContent);
-        const parsedConfig = parseThreadAgentCliConfig(parsedContent);
-        if (!parsedConfig) {
-            logger.warn(`Thread agent CLI config has invalid shape at '${configPath}'.`);
-            return null;
-        }
-        return parsedConfig;
-    }
-    catch (error) {
-        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
-            return null;
-        }
-        logger.warn(`Failed reading thread agent CLI config at '${configPath}': ${toErrorMessage(error)}`);
-        return null;
-    }
-}
 function escapeTomlString(value) {
     return JSON.stringify(value);
 }
@@ -1112,7 +1039,6 @@ async function reconcileThreadRunningStateBeforeUserMessage(cfg, threadState, lo
     const persistedThreadMcpServers = metadataStore.readThreadMcpConfig(threadState.id);
     const persistedThreadGitSkillPackages = metadataStore.readThreadGitSkillsConfig(threadState.id);
     const threadMcpSetup = buildThreadCodexMcpSetup(persistedThreadMcpServers);
-    const threadAgentCliConfig = buildThreadAgentCliConfig(threadState.cliSecret, cfg.agent_api_url);
     const appServerSession = await getOrCreateThreadAppServerSession(threadState.id, threadState.runtimeContainer, threadMcpSetup.appServerEnv, cfg.codex.app_server_client_name, logger);
     const runtimeUser = buildThreadRuntimeUser(cfg, threadState);
     await (0, thread_runtime_js_1.ensureThreadRuntimeReady)({
@@ -1127,11 +1053,7 @@ async function reconcileThreadRunningStateBeforeUserMessage(cfg, threadState, lo
     await containerService.ensureRuntimeContainerThreadMetadata(threadState.runtimeContainer, runtimeUser, {
         mcpServers: persistedThreadMcpServers,
         gitSkillPackages: persistedThreadGitSkillPackages,
-        threadAgentCliConfig,
     });
-    if (threadAgentCliConfig) {
-        await containerService.ensureRuntimeContainerAgentCliConfig(threadState.runtimeContainer, runtimeUser, threadAgentCliConfig);
-    }
     if (!appServerSession.started) {
         await containerService.ensureRuntimeContainerCodexConfig(threadState.runtimeContainer, runtimeUser, threadMcpSetup.configToml);
     }
@@ -1163,73 +1085,6 @@ async function reconcileThreadRunningStateBeforeUserMessage(cfg, threadState, lo
         isCurrentTurnRunning: false,
     };
 }
-async function listTrackedThreadRuntimeTargets(cfg, logger) {
-    const { db, client } = await (0, db_js_1.initDb)(cfg.state_db_path);
-    try {
-        return await db
-            .select({
-            threadId: schema_js_1.threads.id,
-            runtimeContainer: schema_js_1.threads.runtimeContainer,
-            homeDirectory: schema_js_1.threads.homeDirectory,
-            uid: schema_js_1.threads.uid,
-            gid: schema_js_1.threads.gid,
-        })
-            .from(schema_js_1.threads)
-            .all();
-    }
-    catch (error) {
-        logger.warn(`Failed to list tracked thread runtimes for GitHub installation sync: ${toErrorMessage(error)}`);
-        return [];
-    }
-    finally {
-        client.close();
-    }
-}
-function resolveGithubInstallationsSyncDelayMs(installations) {
-    let syncDelayMs = GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS;
-    const now = Date.now();
-    for (const installation of installations) {
-        const expirationUnixTimeMs = Number(installation.accessTokenExpiresUnixTimeMs);
-        if (!Number.isFinite(expirationUnixTimeMs) || expirationUnixTimeMs <= 0) {
-            continue;
-        }
-        const refreshInMs = expirationUnixTimeMs - now - GITHUB_INSTALLATIONS_REFRESH_WINDOW_MS;
-        const boundedRefreshDelayMs = Math.max(GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS, Math.min(GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS, refreshInMs));
-        syncDelayMs = Math.min(syncDelayMs, boundedRefreshDelayMs);
-    }
-    return Math.max(GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS, Math.min(GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS, syncDelayMs));
-}
-async function syncGithubInstallationsForRuntimeTargets(cfg, apiClient, options, runtimeTargets, logger) {
-    const uniqueTargets = [
-        ...new Map(runtimeTargets
-            .filter((target) => target.runtimeContainer.trim().length > 0)
-            .map((target) => [target.runtimeContainer, target])).values(),
-    ];
-    if (uniqueTargets.length === 0) {
-        return [];
-    }
-    const installations = await loadRuntimeGithubInstallations(apiClient, options, logger);
-    const payload = buildWorkspaceGithubInstallationsPayload(installations);
-    const containerService = new thread_lifecycle_js_1.ThreadContainerService();
-    for (const target of uniqueTargets) {
-        try {
-            if (!await containerService.isContainerRunning(target.runtimeContainer)) {
-                continue;
-            }
-            await containerService.ensureRuntimeContainerGithubInstallations(target.runtimeContainer, {
-                uid: target.uid,
-                gid: target.gid,
-                agentUser: cfg.agent_user,
-                agentHomeDirectory: target.homeDirectory,
-            }, payload);
-        }
-        catch (error) {
-            logger.warn(`Failed syncing GitHub installations into runtime container '${target.runtimeContainer}': ${toErrorMessage(error)}`);
-        }
-    }
-    logger.debug(`Synced ${installations.length} GitHub installation token(s) to ${uniqueTargets.length} runtime container(s).`);
-    return installations;
-}
 async function waitForAbort(signal, delayMs) {
     if (signal.aborted) {
         return;
@@ -1247,21 +1102,6 @@ async function waitForAbort(signal, delayMs) {
         signal.addEventListener("abort", handleAbort);
     });
 }
-async function runGithubInstallationsSyncLoop(cfg, apiClient, options, logger, signal) {
-    while (!signal.aborted) {
-        let nextDelayMs = GITHUB_INSTALLATIONS_SYNC_INTERVAL_MS;
-        try {
-            const runtimeTargets = await listTrackedThreadRuntimeTargets(cfg, logger);
-            const installations = await syncGithubInstallationsForRuntimeTargets(cfg, apiClient, options, runtimeTargets, logger);
-            nextDelayMs = resolveGithubInstallationsSyncDelayMs(installations);
-        }
-        catch (error) {
-            logger.warn(`GitHub installation sync loop iteration failed: ${toErrorMessage(error)}`);
-            nextDelayMs = GITHUB_INSTALLATIONS_MIN_SYNC_INTERVAL_MS;
-        }
-        await waitForAbort(signal, nextDelayMs);
-    }
-}
 function normalizeReasoningEffort(value) {
     if (!value) {
         return null;
@@ -1279,21 +1119,12 @@ function normalizeAdditionalModelInstructions(value) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : null;
 }
-function buildThreadAgentCliConfig(cliSecret, agentApiUrl) {
-    const normalizedSecret = normalizeNonEmptyString(cliSecret);
-    if (!normalizedSecret) {
-        return null;
-    }
-    return {
-        agent_api_url: normalizeThreadAgentApiUrlForRuntime(agentApiUrl),
-        token: normalizedSecret,
-    };
-}
-function buildThreadDeveloperInstructions(cfg, additionalModelInstructions, cliSecret) {
+function buildThreadDeveloperInstructions(threadId, cfg, additionalModelInstructions, cliSecret) {
     return (0, system_prompt_js_1.buildCodexDeveloperInstructions)(additionalModelInstructions, {
         homeDirectory: cfg.agent_home_directory,
         agentApiUrl: normalizeThreadAgentApiUrlForRuntime(cfg.agent_api_url),
         agentToken: normalizeNonEmptyString(cliSecret) ?? "<thread-secret>",
+        threadId,
         workspaceMode: cfg.use_dedicated_workspaces ? "dedicated" : "shared",
     });
 }
@@ -1544,6 +1375,32 @@ async function sendThreadNameUpdate(commandChannel, threadId, threadName) {
     });
     await commandChannel.send(message);
 }
+function toProtoTokenUsageBreakdown(usage) {
+    return {
+        inputTokens: BigInt(usage.inputTokens),
+        cachedInputTokens: BigInt(usage.cachedInputTokens),
+        outputTokens: BigInt(usage.outputTokens),
+        reasoningOutputTokens: BigInt(usage.reasoningOutputTokens),
+        totalTokens: BigInt(usage.totalTokens),
+    };
+}
+async function sendThreadTokenUsageUpdate(commandChannel, threadId, tokenUsageUpdate) {
+    const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
+        payload: {
+            case: "threadTokenUsageUpdate",
+            value: {
+                threadId,
+                sdkTurnId: tokenUsageUpdate.sdkTurnId,
+                totalUsage: toProtoTokenUsageBreakdown(tokenUsageUpdate.totalUsage),
+                lastUsage: toProtoTokenUsageBreakdown(tokenUsageUpdate.lastUsage),
+                modelContextWindow: tokenUsageUpdate.modelContextWindow === null
+                    ? undefined
+                    : BigInt(tokenUsageUpdate.modelContextWindow),
+            },
+        },
+    });
+    await commandChannel.send(message);
+}
 async function sendTurnExecutionUpdate(commandChannel, threadId, sdkTurnId, status, requestId) {
     const message = (0, protobuf_1.create)(protos_1.ClientMessageSchema, {
         requestId,
@@ -1855,7 +1712,6 @@ async function handleCreateThreadRequest(cfg, commandChannel, request, requestId
         const persistedThreadMcpServers = metadataStore.readThreadMcpConfig(threadState.id);
         const persistedThreadGitSkillPackages = metadataStore.readThreadGitSkillsConfig(threadState.id);
         const threadMcpSetup = buildThreadCodexMcpSetup(persistedThreadMcpServers);
-        const threadAgentCliConfig = buildThreadAgentCliConfig(threadState.cliSecret, cfg.agent_api_url);
         const appServerSession = await getOrCreateThreadAppServerSession(threadId, threadState.runtimeContainer, threadMcpSetup.appServerEnv, cfg.codex.app_server_client_name, logger);
         const runtimeUser = {
             uid: threadState.uid,
@@ -1875,25 +1731,12 @@ async function handleCreateThreadRequest(cfg, commandChannel, request, requestId
         await containerService.ensureRuntimeContainerThreadMetadata(threadState.runtimeContainer, runtimeUser, {
             mcpServers: persistedThreadMcpServers,
             gitSkillPackages: persistedThreadGitSkillPackages,
-            threadAgentCliConfig,
         });
-        if (threadAgentCliConfig) {
-            await containerService.ensureRuntimeContainerAgentCliConfig(threadState.runtimeContainer, runtimeUser, threadAgentCliConfig);
-        }
-        await syncGithubInstallationsForRuntimeTargets(cfg, apiClient, apiCallOptions, [
-            {
-                threadId: threadState.id,
-                runtimeContainer: threadState.runtimeContainer,
-                homeDirectory: threadState.homeDirectory,
-                uid: threadState.uid,
-                gid: threadState.gid,
-            },
-        ], logger);
         if (!appServerSession.started) {
             await containerService.ensureRuntimeContainerCodexConfig(threadState.runtimeContainer, runtimeUser, threadMcpSetup.configToml);
         }
         await ensureThreadAppServerSessionStarted(appServerSession);
-        const developerInstructions = buildThreadDeveloperInstructions(cfg, threadState.additionalModelInstructions, threadState.cliSecret);
+        const developerInstructions = buildThreadDeveloperInstructions(threadId, cfg, threadState.additionalModelInstructions, threadState.cliSecret);
         logger.debug(`Starting app-server thread '${threadId}' with developer instructions: ${JSON.stringify(developerInstructions)}.`);
         const threadStartResponse = await appServerSession.appServer.startThreadWithResponse({
             model: threadState.model,
@@ -2105,6 +1948,12 @@ async function waitForThreadTurnCompletion(stateDbPath, appServer, commandChanne
                 receivedThreadNameUpdate = true;
                 await sendThreadNameUpdate(commandChannel, threadId, threadNameUpdate.threadName);
             }
+            const tokenUsageUpdate = extractThreadTokenUsageUpdateFromNotification(notification);
+            if (tokenUsageUpdate &&
+                tokenUsageUpdate.sdkThreadId === sdkThreadId &&
+                tokenUsageUpdate.sdkTurnId === sdkTurnId) {
+                await sendThreadTokenUsageUpdate(commandChannel, threadId, tokenUsageUpdate);
+            }
             if (notification.method === "item/started" &&
                 notification.params.threadId === sdkThreadId &&
                 notification.params.turnId === sdkTurnId) {
@@ -2149,7 +1998,6 @@ async function executeCreateUserMessageRequest(cfg, commandChannel, request, req
     const persistedThreadMcpServers = metadataStore.readThreadMcpConfig(threadState.id);
     const persistedThreadGitSkillPackages = metadataStore.readThreadGitSkillsConfig(threadState.id);
     const threadMcpSetup = buildThreadCodexMcpSetup(persistedThreadMcpServers);
-    const threadAgentCliConfig = buildThreadAgentCliConfig(threadState.cliSecret, cfg.agent_api_url);
     const appServerSession = await getOrCreateThreadAppServerSession(request.threadId, threadState.runtimeContainer, threadMcpSetup.appServerEnv, cfg.codex.app_server_client_name, logger);
     const appServer = appServerSession.appServer;
     const runtimeUser = buildThreadRuntimeUser(cfg, threadState);
@@ -2173,11 +2021,7 @@ async function executeCreateUserMessageRequest(cfg, commandChannel, request, req
         await containerService.ensureRuntimeContainerThreadMetadata(threadState.runtimeContainer, runtimeUser, {
             mcpServers: persistedThreadMcpServers,
             gitSkillPackages: persistedThreadGitSkillPackages,
-            threadAgentCliConfig,
         });
-        if (threadAgentCliConfig) {
-            await containerService.ensureRuntimeContainerAgentCliConfig(threadState.runtimeContainer, runtimeUser, threadAgentCliConfig);
-        }
         if (!appServerSession.started) {
             await containerService.ensureRuntimeContainerCodexConfig(threadState.runtimeContainer, runtimeUser, threadMcpSetup.configToml);
         }
@@ -2201,7 +2045,7 @@ async function executeCreateUserMessageRequest(cfg, commandChannel, request, req
             await updateThreadTurnState(cfg, request.threadId, { sdkThreadId });
         }
         else {
-            const developerInstructions = buildThreadDeveloperInstructions(cfg, threadState.additionalModelInstructions, threadState.cliSecret);
+            const developerInstructions = buildThreadDeveloperInstructions(request.threadId, cfg, threadState.additionalModelInstructions, threadState.cliSecret);
             const threadStartParams = {
                 model: request.model ?? threadState.model,
                 modelProvider: null,
@@ -2644,6 +2488,7 @@ function sendDaemonParentMessage(message) {
 async function runRootCommand(options, runtimeOptions) {
     const logger = (0, logger_js_1.createLogger)(options.logLevel ?? "INFO", { daemonMode: options.daemon ?? false });
     const cfg = buildRootConfig(options);
+    logger.info(formatWorkspaceStartupMessage(cfg));
     await (0, entrypoints_js_1.ensureRunnerStartupPreflight)(cfg);
     await (0, auth_js_1.ensureCodexRunnerStartState)(cfg, {
         useDedicatedAuth: options.useDedicatedAuth,
@@ -2674,8 +2519,6 @@ async function runRootCommand(options, runtimeOptions) {
             const apiClient = new companyhelm_api_client_js_1.CompanyhelmApiClient({ apiUrl: cfg.companyhelm_api_url, logger });
             activeApiClient = apiClient;
             let commandChannel = null;
-            let githubInstallationsSyncAbortController = null;
-            let githubInstallationsSyncTask = null;
             try {
                 reconnectAttempt += 1;
                 commandChannel = await apiClient.connect(registerRequest, apiCallOptions);
@@ -2690,12 +2533,6 @@ async function runRootCommand(options, runtimeOptions) {
                     logger.info(`Connected to CompanyHelm API at ${cfg.companyhelm_api_url}`);
                 }
                 reconnectAttempt = 0;
-                githubInstallationsSyncAbortController = new AbortController();
-                githubInstallationsSyncTask = runGithubInstallationsSyncLoop(cfg, apiClient, apiCallOptions, logger, githubInstallationsSyncAbortController.signal).catch((error) => {
-                    if (!githubInstallationsSyncAbortController?.signal.aborted) {
-                        logger.warn(`GitHub installation sync loop exited unexpectedly: ${toErrorMessage(error)}`);
-                    }
-                });
                 await raceWithAbort(runCommandLoop(cfg, commandChannel, commandMessageSink, apiClient, apiCallOptions, logger), interruptState.signal);
                 logger.warn("CompanyHelm API command channel closed. Reconnecting...");
             }
@@ -2715,10 +2552,6 @@ async function runRootCommand(options, runtimeOptions) {
                     "Retrying...");
             }
             finally {
-                if (githubInstallationsSyncAbortController) {
-                    githubInstallationsSyncAbortController.abort();
-                }
-                void githubInstallationsSyncTask;
                 if (commandChannel) {
                     commandChannel.cancel();
                     commandMessageSink.unbind(commandChannel);

package/dist/provisioning/runtime_provisioning/script_renderer.js

@@ -42,16 +42,6 @@ class RuntimeProvisioningScriptRenderer {
             config_content: shellQuote(configToml),
         });
     }
-    renderAgentCliConfigScript(user, config) {
-        const configDirectory = (0, node_path_1.join)(user.agentHomeDirectory, ".config", "companyhelm-agent-cli");
-        const configPath = (0, node_path_1.join)(configDirectory, "config.json");
-        const configContent = `${JSON.stringify(config, null, 2)}\n`;
-        return this.templateRenderer.render("provisioning/runtime_agent_cli_config.sh.j2", {
-            config_dir: shellQuote(configDirectory),
-            config_path: shellQuote(configPath),
-            config_content: shellQuote(configContent),
-        });
-    }
     renderGitConfigScript(gitUserName, gitUserEmail) {
         return this.templateRenderer.render("provisioning/runtime_git_config.sh.j2", {
             default_git_user_name: shellQuote(gitUserName),

package/dist/provisioning/runtime_provisioning/system_prompt.js

@@ -20,6 +20,7 @@ class RuntimeSystemPromptRenderer {
             home_directory: options.homeDirectory,
             agent_api_url: options.agentApiUrl,
             agent_token: options.agentToken,
+            thread_id: options.threadId,
         };
         const common = this.templateRenderer.render("system_prompts/common.md.j2", context).trim();
         const workspaceSpecificTemplate = options.workspaceMode === "dedicated"

package/dist/service/companyhelm_api_client.js

@@ -120,24 +120,6 @@ function createAgentRunnerControlServiceDefinition(pathPrefix = "") {
             responseSerialize: (response) => Buffer.from((0, protobuf_1.toBinary)(protos_1.ServerMessageSchema, response)),
             responseDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.ServerMessageSchema, bytes),
         },
-        listGithubInstallationsForRunner: {
-            path: buildRpcPath(methods.listGithubInstallations.name, pathPrefix),
-            requestStream: false,
-            responseStream: false,
-            requestSerialize: (request) => Buffer.from((0, protobuf_1.toBinary)(protos_1.ListGithubInstallationsRequestSchema, request)),
-            requestDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.ListGithubInstallationsRequestSchema, bytes),
-            responseSerialize: (response) => Buffer.from((0, protobuf_1.toBinary)(protos_1.ListGithubInstallationsResponseSchema, response)),
-            responseDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.ListGithubInstallationsResponseSchema, bytes),
-        },
-        getGithubInstallationAccessTokenForRunner: {
-            path: buildRpcPath(methods.githubInstallationAccessToken.name, pathPrefix),
-            requestStream: false,
-            responseStream: false,
-            requestSerialize: (request) => Buffer.from((0, protobuf_1.toBinary)(protos_1.GithubInstallationAccessTokenRequestSchema, request)),
-            requestDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.GithubInstallationAccessTokenRequestSchema, bytes),
-            responseSerialize: (response) => Buffer.from((0, protobuf_1.toBinary)(protos_1.GithubInstallationAccessTokenResponseSchema, response)),
-            responseDeserialize: (bytes) => (0, protobuf_1.fromBinary)(protos_1.GithubInstallationAccessTokenResponseSchema, bytes),
-        },
     };
 }
 function createAgentRunnerControlClient(endpoint, credentials, channelOptions) {
@@ -300,36 +282,6 @@ class CompanyhelmApiClient {
         const stream = this.client.controlChannel(options?.metadata, options?.callOptions);
         return new CompanyhelmCommandChannel(stream, this.logger);
     }
-    listGithubInstallationsForRunner(options) {
-        const metadata = options?.metadata ?? new grpc.Metadata();
-        const callOptions = options?.callOptions ?? {};
-        const request = (0, protobuf_1.create)(protos_1.ListGithubInstallationsRequestSchema, {});
-        return new Promise((resolve, reject) => {
-            this.client.listGithubInstallationsForRunner(request, metadata, callOptions, (error, response) => {
-                if (error) {
-                    reject(error);
-                    return;
-                }
-                resolve(response ?? (0, protobuf_1.create)(protos_1.ListGithubInstallationsResponseSchema, {}));
-            });
-        });
-    }
-    getGithubInstallationAccessTokenForRunner(installationId, options) {
-        const metadata = options?.metadata ?? new grpc.Metadata();
-        const callOptions = options?.callOptions ?? {};
-        const request = (0, protobuf_1.create)(protos_1.GithubInstallationAccessTokenRequestSchema, {
-            installationId,
-        });
-        return new Promise((resolve, reject) => {
-            this.client.getGithubInstallationAccessTokenForRunner(request, metadata, callOptions, (error, response) => {
-                if (error) {
-                    reject(error);
-                    return;
-                }
-                resolve(response ?? (0, protobuf_1.create)(protos_1.GithubInstallationAccessTokenResponseSchema, {}));
-            });
-        });
-    }
     close() {
         this.client.close();
     }

package/dist/service/thread_lifecycle.js

@@ -313,21 +313,6 @@ function buildRuntimeThreadGitSkillsLinkScript(user, options) {
     }
     return scriptLines.join("\n");
 }
-function buildRuntimeAgentCliConfigScript(user, config) {
-    const configDirectory = (0, node_path_1.join)(user.agentHomeDirectory, ".config", "companyhelm-agent-cli");
-    const configPath = (0, node_path_1.join)(configDirectory, "config.json");
-    const configContent = `${JSON.stringify(config, null, 2)}\n`;
-    return [
-        "set -euo pipefail",
-        `CONFIG_DIR=${shellQuote(configDirectory)}`,
-        `CONFIG_PATH=${shellQuote(configPath)}`,
-        `CONFIG_CONTENT=${shellQuote(configContent)}`,
-        "",
-        'install -d -m 0755 "$CONFIG_DIR"',
-        'printf \'%s\' "$CONFIG_CONTENT" > "$CONFIG_PATH"',
-        'chmod 0600 "$CONFIG_PATH"',
-    ].join("\n");
-}
 function buildDindContainerOptions(options) {
     return {
         name: options.names.dind,
@@ -627,10 +612,6 @@ class ThreadContainerService {
         const script = this.scriptRenderer.renderCodexConfigScript(user, configToml);
         this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], `Failed to write runtime Codex config.toml in container '${name}'`);
     }
-    async ensureRuntimeContainerAgentCliConfig(name, user, config) {
-        const script = this.scriptRenderer.renderAgentCliConfigScript(user, config);
-        this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], `Failed to write runtime agent config in container '${name}'`);
-    }
     async ensureRuntimeContainerGitConfig(name, user, gitUserName, gitUserEmail) {
         const script = this.scriptRenderer.renderGitConfigScript(gitUserName, gitUserEmail);
         this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], `Failed to configure git author defaults in runtime container '${name}'`);
@@ -651,14 +632,6 @@ class ThreadContainerService {
         const script = this.scriptRenderer.renderAgentMetadataScript(user, files);
         this.runDockerExecScript(["exec", "-u", user.agentUser, name, "bash", "-lc", script], contextMessage);
     }
-    async ensureRuntimeContainerGithubInstallations(name, user, payload) {
-        await this.ensureRuntimeContainerAgentMetadataFiles(name, user, [
-            {
-                filename: "installations.json",
-                content: `${JSON.stringify(payload, null, 2)}\n`,
-            },
-        ], `Failed to write runtime GitHub installations metadata in container '${name}'`);
-    }
     async ensureRuntimeContainerThreadMetadata(name, user, payload) {
         const files = [
             {
@@ -670,12 +643,6 @@ class ThreadContainerService {
                 content: `${JSON.stringify({ packages: payload.gitSkillPackages }, null, 2)}\n`,
             },
         ];
-        if (payload.threadAgentCliConfig) {
-            files.push({
-                filename: "thread-agent-cli.json",
-                content: `${JSON.stringify(payload.threadAgentCliConfig, null, 2)}\n`,
-            });
-        }
         await this.ensureRuntimeContainerAgentMetadataFiles(name, user, files, `Failed to write runtime thread metadata in container '${name}'`);
     }
     async stopContainer(name) {

package/dist/templates/system_prompts/common.md.j2

@@ -1,5 +1,10 @@
 # Agent Instructions
 
+## Identity
+
+- Your CompanyHelm API thread id is `{{thread_id}}`.
+- Use this thread id when you need to correlate your own runtime actions with CompanyHelm thread state.
+
 ## Workspace Structure
 
 - You are running in a thread-specific container and workspace.
@@ -14,22 +19,8 @@ Docker is available, the docker host runs in a separate container. The network i
 - Nested DinD is not supported in this environment because the outer runtime already uses rootless DinD.
 - If you need Docker in Docker, mount the configured host runtime instead of trying nested DinD.
 
-## GitHub Installations
-
-- Synced GitHub installation credentials are stored at `{{home_directory}}/.companyhelm/agent/installations.json`.
-- Use `list-installations` to inspect installation IDs, repository scopes, tokens, and expiration timestamps.
-- Use `gh-use-installation <installation-id>` to configure `gh` authentication for a specific installation.
-
-```bash
-list-installations
-gh-use-installation {installation_id}
-gh auth status --hostname github.com
-```
-
 ## Available CLI Tools
 
-- `list-installations`: list synced GitHub installations with repositories, access tokens, and expirations.
-- `gh-use-installation <installation-id>`: configure `gh` authentication for a selected GitHub installation token.
 - `aws`: AWS CLI is pre-installed and available in `PATH`.
 - For scripted PR creation and updates, use `gh pr create --body-file <path>` and `gh pr edit --body-file <path>`.
 - Playwright CLI is already installed and available with Chromium pre-installed.

package/dist/templates/system_prompts/shared_workspace.md.j2

@@ -3,3 +3,4 @@
 - This runtime is using a shared host workspace mounted directly at `/workspace`.
 - Changes made in `/workspace` may be visible to multiple threads that use the same runner workspace path.
 - Do not assume `/workspace` is isolated per thread.
+- you need to use git worktrees to isolate your working directory from the shared workspace.

package/dist/testing/vitest_reporter.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VitestReporterResolver = void 0;
+class VitestReporterResolver {
+    constructor(options) {
+        this.stdoutIsTTY = options.stdoutIsTTY;
+        this.env = options.env ?? process.env;
+    }
+    resolve() {
+        const configured = this.env.COMPANYHELM_VITEST_REPORTER?.trim();
+        if (configured && configured.length > 0) {
+            return configured
+                .split(",")
+                .map((value) => value.trim())
+                .filter((value) => value.length > 0);
+        }
+        if (this.stdoutIsTTY) {
+            return ["basic"];
+        }
+        return undefined;
+    }
+}
+exports.VitestReporterResolver = VitestReporterResolver;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@companyhelm/runner",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Run the CompanyHelm runner in fully isolated Docker sandboxes.",
   "license": "MIT",
   "repository": {
@@ -32,7 +32,7 @@
   "dependencies": {
     "@bufbuild/protobuf": "^2.11.0",
     "@clack/prompts": "^1.0.1",
-    "@companyhelm/protos": "^0.5.20",
+    "@companyhelm/protos": "^0.5.26",
     "@grpc/grpc-js": "^1.14.3",
     "@libsql/client": "^0.17.0",
     "commander": "^14.0.0",

package/dist/templates/provisioning/runtime_agent_cli_config.sh.j2

@@ -1,8 +0,0 @@
-set -euo pipefail
-CONFIG_DIR={{config_dir}}
-CONFIG_PATH={{config_path}}
-CONFIG_CONTENT={{config_content}}
-
-install -d -m 0755 "$CONFIG_DIR"
-printf '%s' "$CONFIG_CONTENT" > "$CONFIG_PATH"
-chmod 0600 "$CONFIG_PATH"