@factiii/runner 0.12.0 → 0.12.1

package/dist/cli.js

@@ -6499,7 +6499,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net3 = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash: createHash2 } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash2 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -7037,7 +7037,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes2(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -13805,6 +13805,7 @@ async function teardownSession(s, target) {
 
 // ../../shared/all/helpers/board-agent-core/exec.ts
 var import_child_process2 = require("child_process");
+var import_crypto = require("crypto");
 var import_fs2 = require("fs");
 var import_promises2 = __toESM(require("fs/promises"));
 var import_net = __toESM(require("net"));
@@ -13845,6 +13846,22 @@ async function allocateSpacePorts(spaceDir) {
   await import_promises2.default.writeFile(portsFilePath(spaceDir), ports.join(","), "utf-8");
   return ports;
 }
+var SECRET_FILE = ".secret";
+function spaceSecret(spaceDir) {
+  const file = import_path4.default.join(spaceDir, SECRET_FILE);
+  try {
+    const existing = (0, import_fs2.readFileSync)(file, "utf-8").trim();
+    if (existing) return existing;
+  } catch {
+  }
+  const secret = (0, import_crypto.randomBytes)(24).toString("hex");
+  try {
+    (0, import_fs2.mkdirSync)(spaceDir, { recursive: true });
+    (0, import_fs2.writeFileSync)(file, secret, { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+  return secret;
+}
 function readSpacePorts(spaceDir) {
   try {
     return (0, import_fs2.readFileSync)(portsFilePath(spaceDir), "utf-8").split(",").map((p) => Number(p.trim())).filter((p) => Number.isInteger(p) && p > 0);
@@ -16903,7 +16920,7 @@ ${buildPrompt(prompts_default.implement)}`;
 };
 
 // ../../shared/all/helpers/terminal-ai/terminal-mode.ts
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 
 // ../../shared/all/helpers/board-agent-core/boardTerminal.ts
 function boardTerminalKey(spaceSlug) {
@@ -16959,12 +16976,12 @@ function drainStateMessages(buffer) {
 }
 
 // ../../shared/all/helpers/terminal-ai/digest.ts
-var import_crypto2 = __toESM(require("crypto"));
+var import_crypto3 = __toESM(require("crypto"));
 var import_promises8 = require("fs/promises");
 var import_path10 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/plugin.ts
-var import_crypto = __toESM(require("crypto"));
+var import_crypto2 = __toESM(require("crypto"));
 var import_fs4 = require("fs");
 var import_promises7 = require("fs/promises");
 var import_os3 = __toESM(require("os"));
@@ -17013,7 +17030,7 @@ async function treeFiles(dir) {
   return files.sort();
 }
 async function fingerprint(source, url2, version = "") {
-  const hash = import_crypto.default.createHash("sha256").update(url2).update(version);
+  const hash = import_crypto2.default.createHash("sha256").update(url2).update(version);
   for (const file of await treeFiles(source)) {
     hash.update(import_path9.default.relative(source, file));
     hash.update(await (0, import_promises7.readFile)(file));
@@ -17131,7 +17148,7 @@ async function pluginContribution() {
   return value2;
 }
 async function terminalDigest(target) {
-  const hash = import_crypto2.default.createHash("sha256").update(TMUX_CONF).update(terminalPrelude(CWD_PLACEHOLDER, target.paths.bin));
+  const hash = import_crypto3.default.createHash("sha256").update(TMUX_CONF).update(terminalPrelude(CWD_PLACEHOLDER, target.paths.bin));
   const env = target.stateEnv();
   for (const key of Object.keys(env).sort()) {
     if (VOLATILE_ENV_KEYS.has(key)) continue;
@@ -18330,7 +18347,7 @@ var TerminalModeEngine = class {
     }
     const safeExt = (ext || "png").toLowerCase().replace(/[^a-z0-9]/g, "") || "png";
     const oneShot = !dropId;
-    const safeId2 = oneShot ? (0, import_crypto3.randomUUID)() : dropId.toLowerCase().replace(/[^a-z0-9-]/g, "");
+    const safeId2 = oneShot ? (0, import_crypto4.randomUUID)() : dropId.toLowerCase().replace(/[^a-z0-9-]/g, "");
     if (!safeId2) throw new Error("Invalid drop id.");
     const dropsDir = `${target.paths.root}/drops`;
     const abs = `${dropsDir}/${safeId2}.${safeExt}`;
@@ -18531,15 +18548,7 @@ var TerminalModeEngine = class {
         `${tmuxCli(target)} list-panes -a -F '${TAB_LIST_FORMAT}' 2>/dev/null || true`
       );
       const rows = parseTerminalTabs(stdout, prefix);
-      const current = await terminalDigest(target).catch(() => "");
-      return rows.map(({ id, name, fp, dead }) => ({
-        id,
-        name,
-        // No stamp means a session older than the stamp, as blind to the
-        // current build as a mismatched one.
-        stale: !!current && fp !== current,
-        dead
-      }));
+      return rows.map(({ id, name, dead }) => ({ id, name, dead }));
     } catch {
       return [];
     }
@@ -19195,7 +19204,7 @@ async function listGithubBranches(token, fullName) {
 var import_path13 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/secrets-gate.ts
-var import_crypto4 = __toESM(require("crypto"));
+var import_crypto5 = __toESM(require("crypto"));
 var DEPLOY_ORIGIN = "Deploy run";
 var UNATTRIBUTED = "This runner did not start the session that asked, so the request was refused. `factiii-secrets` only works inside a session the runner spawned.";
 var SecretsGate = class {
@@ -19220,7 +19229,14 @@ var SecretsGate = class {
   /** Mint a token for one session, labelled with what the owner should see on
    *  the prompt - the label is most of the decision, so name the session. */
   issueToken(origin) {
-    const token = import_crypto4.default.randomBytes(24).toString("hex");
+    const token = import_crypto5.default.randomBytes(24).toString("hex");
+    this.tokens.set(token, origin);
+    return token;
+  }
+  /** Register a durable token the caller already holds, instead of minting a
+   *  fresh one. For the space token: terminals outlive this process, so a
+   *  minted one leaves them unattributed after a restart. Idempotent. */
+  adoptToken(token, origin) {
     this.tokens.set(token, origin);
     return token;
   }
@@ -19244,7 +19260,7 @@ var SecretsGate = class {
     return new Promise((resolve2) => {
       this.waiting = {
         request: {
-          id: import_crypto4.default.randomUUID(),
+          id: import_crypto5.default.randomUUID(),
           command: opts.command,
           keys: opts.keys,
           origin: opts.origin,
@@ -19288,7 +19304,7 @@ var import_path12 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/host-secrets.ts
 var import_child_process4 = require("child_process");
-var import_crypto5 = __toESM(require("crypto"));
+var import_crypto6 = __toESM(require("crypto"));
 var import_promises9 = __toESM(require("fs/promises"));
 var import_path11 = __toESM(require("path"));
 var import_util6 = require("util");
@@ -19316,7 +19332,7 @@ async function assertBinaries() {
   }
 }
 function deriveKey(password, salt) {
-  return import_crypto5.default.scryptSync(password, salt, 32, {
+  return import_crypto6.default.scryptSync(password, salt, 32, {
     N: SCRYPT_N,
     maxmem: 64 * 1024 * 1024
   });
@@ -19345,9 +19361,9 @@ async function initSecrets(configDir, password) {
   if (!identity || !recipient) {
     throw new Error("age-keygen returned no usable keypair.");
   }
-  const salt = import_crypto5.default.randomBytes(16);
-  const iv = import_crypto5.default.randomBytes(12);
-  const cipher = import_crypto5.default.createCipheriv(
+  const salt = import_crypto6.default.randomBytes(16);
+  const iv = import_crypto6.default.randomBytes(12);
+  const cipher = import_crypto6.default.createCipheriv(
     "aes-256-gcm",
     deriveKey(password, salt),
     iv
@@ -19372,7 +19388,7 @@ async function initSecrets(configDir, password) {
   return { success: true };
 }
 function decryptIdentity(box, password) {
-  const decipher = import_crypto5.default.createDecipheriv(
+  const decipher = import_crypto6.default.createDecipheriv(
     "aes-256-gcm",
     deriveKey(password, Buffer.from(box.salt, "base64")),
     Buffer.from(box.iv, "base64")
@@ -20037,6 +20053,7 @@ var SpaceCore = class {
     this.runnerToken = options.runnerToken;
     this.serverUrl = options.serverUrl;
     this.mcp = options.mcp;
+    this.mcpToken = options.mcpToken;
     this.requestSudo = options.requestSudo;
     this.activity = new ActivityTracker(this.emitter);
     this.gate.subscribe(() => {
@@ -20131,7 +20148,11 @@ var SpaceCore = class {
    * that DOES know itself - the deploy run - mints its own and overrides this.
    */
   secretsToken() {
-    this.spaceSecretsToken ||= this.gate.issueToken("A session on this board");
+    if (this.spaceSecretsToken) return this.spaceSecretsToken;
+    this.spaceSecretsToken = this.gate.adoptToken(
+      spaceSecret(this.spaceDir()),
+      "A session on this board"
+    );
     return this.spaceSecretsToken;
   }
   readConfig() {
@@ -20142,7 +20163,8 @@ var SpaceCore = class {
   target() {
     this.execTarget ??= hostTarget(this.spaceDir(), () => {
       const env = {};
-      for (const lane of this.mcpLanes()) env[lane.tokenEnv] = lane.mcp.token;
+      const onedrive = this.mcpToken?.();
+      if (onedrive) env[MCP_TOKEN_ENV] = onedrive;
       const board = this.boardMcp();
       if (board) env[BOARD_MCP_TOKEN_ENV] = board.token;
       env.FACTIII_SECRETS_TOKEN = this.secretsToken();
@@ -22306,7 +22328,7 @@ ${c.content.trim() || "(no description)"}`
 
 // ../../shared/all/helpers/board-agent-core/index-service.ts
 var import_child_process5 = require("child_process");
-var import_crypto6 = require("crypto");
+var import_crypto7 = require("crypto");
 var import_fs5 = require("fs");
 var import_promises11 = __toESM(require("fs/promises"));
 var import_net3 = require("net");
@@ -22324,7 +22346,7 @@ var IndexService = class {
   /** Per-space bearer for MCP + file, derived from the control token (the
    *  service computes the same). */
   bearerToken(spaceSlug) {
-    return (0, import_crypto6.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
+    return (0, import_crypto7.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
   }
   /** MCP bridge for a space. Null until the service is up (which it kicks
    *  off), so a bad :0 URL is never baked in; provisionMcpLane re-runs. */
@@ -22602,13 +22624,13 @@ var import_os6 = __toESM(require("os"));
 var import_path21 = __toESM(require("path"));
 
 // src/secureFile.ts
-var import_crypto9 = __toESM(require("crypto"));
+var import_crypto10 = __toESM(require("crypto"));
 var import_fs8 = __toESM(require("fs"));
 var import_path20 = __toESM(require("path"));
 
 // src/keychain.ts
 var import_child_process7 = require("child_process");
-var import_crypto7 = __toESM(require("crypto"));
+var import_crypto8 = __toESM(require("crypto"));
 var import_fs6 = __toESM(require("fs"));
 var import_os4 = __toESM(require("os"));
 var import_path17 = __toESM(require("path"));
@@ -22860,7 +22882,7 @@ function resolve() {
       cached = { key: null, status: diagnose() };
       return cached;
     }
-    const fresh = import_crypto7.default.randomBytes(32);
+    const fresh = import_crypto8.default.randomBytes(32);
     writeKey(fresh);
     const verify = readKey();
     if (verify.state !== "found" || !verify.key.equals(fresh)) {
@@ -22882,7 +22904,7 @@ function keychainStatus() {
 }
 
 // src/secureStore.ts
-var import_crypto8 = __toESM(require("crypto"));
+var import_crypto9 = __toESM(require("crypto"));
 var import_fs7 = __toESM(require("fs"));
 var import_path19 = __toESM(require("path"));
 
@@ -22925,7 +22947,7 @@ function requireKeychainKey() {
   );
 }
 function passwordKey(password, salt) {
-  return import_crypto8.default.scryptSync(password, salt, 32, {
+  return import_crypto9.default.scryptSync(password, salt, 32, {
     N: SCRYPT_N2,
     maxmem: 64 * 1024 * 1024
   });
@@ -22933,7 +22955,7 @@ function passwordKey(password, salt) {
 function wrapKey(machineKey, pwKey) {
   const ikm = pwKey ? Buffer.concat([machineKey, pwKey]) : machineKey;
   return Buffer.from(
-    import_crypto8.default.hkdfSync(
+    import_crypto9.default.hkdfSync(
       "sha256",
       ikm,
       Buffer.alloc(0),
@@ -22943,8 +22965,8 @@ function wrapKey(machineKey, pwKey) {
   );
 }
 function seal(plaintext, key) {
-  const iv = import_crypto8.default.randomBytes(12);
-  const cipher = import_crypto8.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto9.default.randomBytes(12);
+  const cipher = import_crypto9.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   return {
     iv: iv.toString("base64"),
@@ -22954,7 +22976,7 @@ function seal(plaintext, key) {
 }
 function unseal(box, key) {
   try {
-    const decipher = import_crypto8.default.createDecipheriv(
+    const decipher = import_crypto9.default.createDecipheriv(
       "aes-256-gcm",
       key,
       Buffer.from(box.iv, "base64")
@@ -22987,7 +23009,7 @@ function writeVaultFile(file) {
 }
 var unlockedDek = null;
 function createVault(machineKey) {
-  const dek = import_crypto8.default.randomBytes(32);
+  const dek = import_crypto9.default.randomBytes(32);
   writeVaultFile({
     v: 1,
     passwordEnabled: false,
@@ -23082,7 +23104,7 @@ function enablePassword(password) {
     );
   }
   const dek = dataKey();
-  const salt = import_crypto8.default.randomBytes(16);
+  const salt = import_crypto9.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -23110,7 +23132,7 @@ function changePassword(current, next) {
       "The current password is not correct."
     );
   }
-  const salt = import_crypto8.default.randomBytes(16);
+  const salt = import_crypto9.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -23187,8 +23209,8 @@ function storeStatus() {
 // src/secureFile.ts
 var MAGIC = "FACTIII1";
 function encrypt(plain, key, version) {
-  const iv = import_crypto9.default.randomBytes(12);
-  const cipher = import_crypto9.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto10.default.randomBytes(12);
+  const cipher = import_crypto10.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plain), cipher.final()]);
   const envelope = {
     v: version,
@@ -23199,7 +23221,7 @@ function encrypt(plain, key, version) {
   return `${MAGIC}${JSON.stringify(envelope)}`;
 }
 function decrypt(envelope, key) {
-  const decipher = import_crypto9.default.createDecipheriv(
+  const decipher = import_crypto10.default.createDecipheriv(
     "aes-256-gcm",
     key,
     Buffer.from(envelope.iv, "base64")
@@ -23457,7 +23479,7 @@ function installLatest() {
 var import_node_child_process2 = require("node:child_process");
 
 // src/daemon.ts
-var import_crypto10 = require("crypto");
+var import_crypto11 = require("crypto");
 var import_fs11 = __toESM(require("fs"));
 var import_node_datachannel = require("node-datachannel");
 var import_path23 = __toESM(require("path"));
@@ -27372,7 +27394,7 @@ async function startDaemon(config) {
   ];
   const indexDir = indexCandidates.find((p) => import_fs11.default.existsSync(p)) ?? indexCandidates[0];
   const odIndex = new IndexService({
-    controlToken: (0, import_crypto10.createHash)("sha256").update(config.authToken).digest("hex"),
+    controlToken: (0, import_crypto11.createHash)("sha256").update(config.authToken).digest("hex"),
     embedUrl: () => config.serverUrl,
     indexDir,
     dataDir: import_path23.default.join(CONFIG_DIR, "index-data")
@@ -27472,7 +27494,9 @@ async function startDaemon(config) {
         // Board MCP is server-hosted, so the base URL is all it needs.
         serverUrl: config.serverUrl,
         // Point the agent at the index MCP endpoint (lazy for the port).
-        mcp: () => odIndex.mcpBridge(spaceSlug)
+        mcp: () => odIndex.mcpBridge(spaceSlug),
+        // The bearer alone, available before the service has a port for a URL.
+        mcpToken: () => odIndex.bearerToken(spaceSlug)
       });
       engines.set(spaceSlug, engine);
       void engine.reattachAndHydrate();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factiii/runner",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Factiii Runner, run Board AI agents on a machine you control. Pairs with the Factiii web/mobile clients over WebRTC.",
   "license": "ISC",
   "keywords": [