@factiii/runner 0.2.1 → 0.6.0

package/dist/cli.js

@@ -963,8 +963,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path7 = require("node:path");
-    var fs6 = require("node:fs");
+    var path8 = require("node:path");
+    var fs7 = require("node:fs");
     var process2 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1896,11 +1896,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path7.resolve(baseDir, baseName);
-          if (fs6.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path7.extname(baseName))) return void 0;
+          const localBin = path8.resolve(baseDir, baseName);
+          if (fs7.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path8.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs6.existsSync(`${localBin}${ext}`)
+            (ext) => fs7.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1912,21 +1912,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs6.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs7.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path7.resolve(
-            path7.dirname(resolvedScriptPath),
+          executableDir = path8.resolve(
+            path8.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path7.basename(
+            const legacyName = path8.basename(
               this._scriptPath,
-              path7.extname(this._scriptPath)
+              path8.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1937,7 +1937,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path7.extname(executableFile));
+        launchWithNode = sourceExt.includes(path8.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2777,7 +2777,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path7.basename(filename, path7.extname(filename));
+        this._name = path8.basename(filename, path8.extname(filename));
         return this;
       }
       /**
@@ -2791,9 +2791,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path8) {
-        if (path8 === void 0) return this._executableDir;
-        this._executableDir = path8;
+      executableDir(path9) {
+        if (path9 === void 0) return this._executableDir;
+        this._executableDir = path9;
         return this;
       }
       /**
@@ -3026,7 +3026,7 @@ var require_commander = __commonJS({
 // ../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js
 var require_XMLHttpRequest = __commonJS({
   "../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js"(exports2, module2) {
-    var fs6 = require("fs");
+    var fs7 = require("fs");
     var Url = require("url");
     var spawn3 = require("child_process").spawn;
     module2.exports = XMLHttpRequest3;
@@ -3184,7 +3184,7 @@ var require_XMLHttpRequest = __commonJS({
             throw new Error("XMLHttpRequest: Only GET method is supported");
           }
           if (settings.async) {
-            fs6.readFile(unescape(url2.pathname), function(error, data2) {
+            fs7.readFile(unescape(url2.pathname), function(error, data2) {
               if (error) {
                 self.handleError(error, error.errno || -1);
               } else {
@@ -3196,7 +3196,7 @@ var require_XMLHttpRequest = __commonJS({
             });
           } else {
             try {
-              this.response = fs6.readFileSync(unescape(url2.pathname));
+              this.response = fs7.readFileSync(unescape(url2.pathname));
               this.responseText = this.response.toString("utf8");
               this.status = 200;
               setState(self.DONE);
@@ -3322,15 +3322,15 @@ var require_XMLHttpRequest = __commonJS({
         } else {
           var contentFile = ".node-xmlhttprequest-content-" + process.pid;
           var syncFile = ".node-xmlhttprequest-sync-" + process.pid;
-          fs6.writeFileSync(syncFile, "", "utf8");
+          fs7.writeFileSync(syncFile, "", "utf8");
           var execString = "var http = require('http'), https = require('https'), fs = require('fs');var doRequest = http" + (ssl ? "s" : "") + ".request;var options = " + JSON.stringify(options) + ";var responseText = '';var responseData = Buffer.alloc(0);var req = doRequest(options, function(response) {response.on('data', function(chunk) {  var data = Buffer.from(chunk);  responseText += data.toString('utf8');  responseData = Buffer.concat([responseData, data]);});response.on('end', function() {fs.writeFileSync('" + contentFile + "', JSON.stringify({err: null, data: {statusCode: response.statusCode, headers: response.headers, text: responseText, data: responseData.toString('base64')}}), 'utf8');fs.unlinkSync('" + syncFile + "');});response.on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});}).on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});" + (data ? "req.write('" + JSON.stringify(data).slice(1, -1).replace(/'/g, "\\'") + "');" : "") + "req.end();";
           var syncProc = spawn3(process.argv[0], ["-e", execString]);
           var statusText;
-          while (fs6.existsSync(syncFile)) {
+          while (fs7.existsSync(syncFile)) {
           }
-          self.responseText = fs6.readFileSync(contentFile, "utf8");
+          self.responseText = fs7.readFileSync(contentFile, "utf8");
           syncProc.stdin.end();
-          fs6.unlinkSync(contentFile);
+          fs7.unlinkSync(contentFile);
           if (self.responseText.match(/^NODE-XMLHTTPREQUEST-ERROR:/)) {
             var errorObj = JSON.parse(self.responseText.replace(/^NODE-XMLHTTPREQUEST-ERROR:/, ""));
             self.handleError(errorObj, 503);
@@ -8037,8 +8037,144 @@ function configExists() {
   return import_fs.default.existsSync(CONFIG_FILE);
 }
 
-// ../../shared/all/helpers/board-agent-core/claude.ts
+// src/setup.ts
 var import_child_process2 = require("child_process");
+var import_crypto = __toESM(require("crypto"));
+var import_fs2 = __toESM(require("fs"));
+var import_path2 = __toESM(require("path"));
+var DOCKERFILE_LABEL = "factiii.dockerfile-sha";
+function run(bin, args, opts) {
+  try {
+    return (0, import_child_process2.execFileSync)(bin, args, {
+      encoding: "utf-8",
+      stdio: opts?.silent ? "pipe" : "inherit",
+      // Avoids a cmd.exe window flash on Windows during silent checks.
+      windowsHide: true
+    });
+  } catch {
+    return "";
+  }
+}
+function check(cmd) {
+  const lookup2 = process.platform === "win32" ? "where" : "which";
+  try {
+    (0, import_child_process2.execFileSync)(lookup2, [cmd], { stdio: "pipe", windowsHide: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function setup(serverUrl) {
+  console.log("\n=== Factiii Runner \u2014 Setup ===\n");
+  console.log("[1/3] Checking Docker...");
+  if (!check("docker")) {
+    console.error(
+      "  Docker is not installed. Install it from https://docs.docker.com/get-docker/ and re-run setup."
+    );
+    process.exit(1);
+  }
+  if (!run("docker", ["info"], { silent: true })) {
+    console.error(
+      "  Docker is installed but the daemon is not running. Start Docker and re-run setup."
+    );
+    process.exit(1);
+  }
+  console.log("  Docker is ready.");
+  console.log("\n[2/3] Building factiii-claude Docker image...");
+  const dockerfilePath = findDockerfile();
+  if (!dockerfilePath) {
+    console.error(
+      "  Dockerfile.claude not found. Reinstall the package and re-run setup."
+    );
+    process.exit(1);
+  }
+  const wantedHash = import_crypto.default.createHash("sha256").update(import_fs2.default.readFileSync(dockerfilePath)).digest("hex");
+  const existingHash = run(
+    "docker",
+    [
+      "image",
+      "inspect",
+      "factiii-claude",
+      "--format",
+      `{{ index .Config.Labels "${DOCKERFILE_LABEL}" }}`
+    ],
+    { silent: true }
+  ).trim();
+  if (existingHash === wantedHash) {
+    console.log("  Image is up to date.");
+  } else {
+    console.log(
+      existingHash ? `  Dockerfile changed since last build, rebuilding from ${dockerfilePath}...` : `  Building from ${dockerfilePath}...`
+    );
+    run("docker", [
+      "build",
+      "-t",
+      "factiii-claude",
+      "-f",
+      dockerfilePath,
+      "--label",
+      `${DOCKERFILE_LABEL}=${wantedHash}`,
+      "."
+    ]);
+    console.log("  Image built.");
+  }
+  run("docker", ["volume", "create", "factiii-card-cache"], { silent: true });
+  console.log("\n[3/3] Pairing this runner with a Factiii account...");
+  const { token, runnerName } = await pairWithBrowser(serverUrl);
+  writeRunnerConfig({ serverUrl, authToken: token, runnerName });
+  console.log("  Paired and config saved.");
+  console.log("\n=== Setup complete ===\n");
+  console.log("Start the runner with: factiii-runner start\n");
+}
+function findDockerfile() {
+  const p = import_path2.default.join(__dirname, "..", "Dockerfile.claude");
+  return import_fs2.default.existsSync(p) ? p : null;
+}
+
+// src/selfUpdate.ts
+var import_node_child_process = require("node:child_process");
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+var PACKAGE_NAME = "@factiii/runner";
+var RESTART_FOR_UPDATE = 75;
+var WORKER_ENV = "FACTIII_RUNNER_WORKER";
+function markWorkerEnv(env) {
+  return { ...env, [WORKER_ENV]: "1" };
+}
+function isWorker() {
+  return process.env[WORKER_ENV] === "1";
+}
+function currentVersion() {
+  try {
+    const pkg = JSON.parse(
+      import_node_fs.default.readFileSync(import_node_path.default.join(__dirname, "..", "package.json"), "utf-8")
+    );
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function installLatest() {
+  console.log(`[update] installing ${PACKAGE_NAME}@latest...`);
+  const res = (0, import_node_child_process.spawnSync)("npm", ["install", "-g", `${PACKAGE_NAME}@latest`], {
+    stdio: "inherit",
+    // On Windows npm is npm.cmd, which spawnSync can't exec without a shell.
+    shell: process.platform === "win32"
+  });
+  if (res.status !== 0) {
+    console.error(
+      `[update] npm install failed (exit ${res.status ?? "signal"}). Staying on ${currentVersion()}.`
+    );
+    return false;
+  }
+  return true;
+}
+
+// src/supervisor.ts
+var import_node_child_process2 = require("node:child_process");
+
+// ../../shared/all/helpers/board-agent-core/claude.ts
+var import_child_process3 = require("child_process");
 
 // ../../shared/all/helpers/board-agent-core/claude-stream.ts
 function truncate(s, max) {
@@ -8514,7 +8650,7 @@ function spawnClaude(opts) {
   if (opts.resumeSessionId) {
     args.push("--resume", opts.resumeSessionId);
   }
-  const proc = (0, import_child_process2.spawn)("docker", args);
+  const proc = (0, import_child_process3.spawn)("docker", args);
   const result = new Promise(
     (resolve, reject) => {
       let errorOutput = "";
@@ -8546,7 +8682,7 @@ function spawnClaude(opts) {
 }
 function generateCommitMessage(containerName, diff) {
   return new Promise((resolve) => {
-    const proc = (0, import_child_process2.spawn)("docker", [
+    const proc = (0, import_child_process3.spawn)("docker", [
       "exec",
       "-i",
       "--user",
@@ -8575,16 +8711,16 @@ ${diff.slice(0, 8e3)}`);
 }
 
 // ../../shared/all/helpers/board-agent-core/docker.ts
-var import_child_process3 = require("child_process");
-var import_crypto = __toESM(require("crypto"));
+var import_child_process4 = require("child_process");
+var import_crypto2 = __toESM(require("crypto"));
 var import_promises = __toESM(require("fs/promises"));
 var import_net = __toESM(require("net"));
 var import_util = require("util");
-var execFileAsync = (0, import_util.promisify)(import_child_process3.execFile);
-var DOCKERFILE_LABEL = "factiii.dockerfile-sha";
+var execFileAsync = (0, import_util.promisify)(import_child_process4.execFile);
+var DOCKERFILE_LABEL2 = "factiii.dockerfile-sha";
 async function hashDockerfile(dockerfilePath) {
   const buf = await import_promises.default.readFile(dockerfilePath);
-  return import_crypto.default.createHash("sha256").update(buf).digest("hex");
+  return import_crypto2.default.createHash("sha256").update(buf).digest("hex");
 }
 async function getFreePort() {
   return new Promise((resolve, reject) => {
@@ -8623,7 +8759,7 @@ async function ensureDockerImage(dockerfilePath, onLog) {
         "inspect",
         "factiii-claude",
         "--format",
-        `{{ index .Config.Labels "${DOCKERFILE_LABEL}" }}`
+        `{{ index .Config.Labels "${DOCKERFILE_LABEL2}" }}`
       ],
       {}
     );
@@ -8649,7 +8785,7 @@ async function resetNixVolume() {
 }
 function buildImageStreaming(dockerfilePath, wantedHash, onLog) {
   return new Promise((resolve, reject) => {
-    const child = (0, import_child_process3.spawn)(
+    const child = (0, import_child_process4.spawn)(
       "docker",
       [
         "build",
@@ -8659,7 +8795,7 @@ function buildImageStreaming(dockerfilePath, wantedHash, onLog) {
         "-f",
         dockerfilePath,
         "--label",
-        `${DOCKERFILE_LABEL}=${wantedHash}`,
+        `${DOCKERFILE_LABEL2}=${wantedHash}`,
         "."
       ],
       { env: { ...process.env, DOCKER_BUILDKIT: "1" } }
@@ -8718,6 +8854,44 @@ async function killContainer(containerName) {
   } catch {
   }
 }
+async function listContainersByPrefix(namePrefix) {
+  try {
+    const { stdout } = await execFileAsync(
+      "docker",
+      [
+        "ps",
+        "-a",
+        "--no-trunc",
+        "--filter",
+        `name=${namePrefix}`,
+        "--format",
+        "{{.Names}}	{{.State}}	{{.Status}}"
+      ],
+      { encoding: "utf-8", maxBuffer: 10 * 1024 * 1024 }
+    );
+    const rows = [];
+    for (const line of stdout.split("\n")) {
+      if (!line.trim()) continue;
+      const [name, state, ...statusParts] = line.split("	");
+      if (!name || !name.startsWith(namePrefix)) continue;
+      rows.push({
+        name,
+        running: state === "running",
+        status: statusParts.join("	").trim() || state || ""
+      });
+    }
+    return rows;
+  } catch {
+    return [];
+  }
+}
+async function renameContainer(oldName, newName) {
+  if (oldName === newName) return;
+  try {
+    await execFileAsync("docker", ["rename", oldName, newName], {});
+  } catch {
+  }
+}
 async function spawnContainer(containerName, claudeToken, opts) {
   const NUM_PORTS = 6;
   const ports = [];
@@ -8792,7 +8966,7 @@ async function execInContainer(containerName, cmd) {
   return stdout;
 }
 function streamExecInContainer(containerName, cmd, onLine) {
-  const child = (0, import_child_process3.spawn)("docker", [
+  const child = (0, import_child_process4.spawn)("docker", [
     "exec",
     "--user",
     "claude",
@@ -8875,9 +9049,9 @@ async function getContainerPort(containerName, containerPort) {
 }
 
 // ../../shared/all/helpers/board-agent-core/git.ts
-var import_child_process4 = require("child_process");
+var import_child_process5 = require("child_process");
 var import_util2 = require("util");
-var execFileAsync2 = (0, import_util2.promisify)(import_child_process4.execFile);
+var execFileAsync2 = (0, import_util2.promisify)(import_child_process5.execFile);
 function buildCloneUrl(repoUrl, githubToken) {
   const url2 = new URL(repoUrl);
   url2.username = githubToken;
@@ -9318,6 +9492,27 @@ function withTimeout(work, ms, label) {
   });
   return Promise.race([work.finally(() => clearTimeout(timer)), timeout]);
 }
+function computeInstancePrefix(instanceId) {
+  const raw = (instanceId || "shared").toLowerCase();
+  return raw.replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "shared";
+}
+function parseFactiiiContainerName(name, instancePrefix) {
+  const head = `factiii-${instancePrefix}-`;
+  if (!name.startsWith(head)) return null;
+  const rest = name.slice(head.length);
+  const withId = rest.match(/^(card|util)-(\d+)-(.+)$/);
+  if (withId) {
+    const kind = withId[1];
+    const spaceId = Number(withId[2]);
+    return kind === "card" ? { kind, spaceId, taskId: withId[3] } : { kind, spaceId, cacheKey: withId[3] };
+  }
+  const legacy = rest.match(/^(card|util)-(.+)$/);
+  if (legacy) {
+    const kind = legacy[1];
+    return kind === "card" ? { kind, spaceId: null, taskId: legacy[2] } : { kind, spaceId: null, cacheKey: legacy[2] };
+  }
+  return null;
+}
 var ContainerCore = class {
   constructor(options) {
     // Utility container state.
@@ -9325,12 +9520,17 @@ var ContainerCore = class {
     this.lastConfigKey = "";
     this.setupPromise = null;
     this.spaceSlug = options.spaceSlug;
+    this.spaceId = options.spaceId ?? null;
     this.emitter = options.emitter;
     this.configProvider = options.configProvider;
     this.dockerfilePath = options.dockerfilePath;
     this.runnerToken = options.runnerToken;
-    const raw = (options.instanceId || "shared").toLowerCase();
-    this.instancePrefix = raw.replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "shared";
+    this.instancePrefix = computeInstancePrefix(options.instanceId);
+  }
+  /** The space segment used in container names: the stable id when we have it,
+   *  else the slug (legacy / id-less callers). */
+  get spaceSegment() {
+    return this.spaceId != null ? String(this.spaceId) : this.spaceSlug;
   }
   readConfig() {
     return this.configProvider.readConfig(this.spaceSlug);
@@ -9430,7 +9630,11 @@ var ContainerCore = class {
     }
     const configKey = onedrive ? `onedrive|${this.spaceSlug}|${config.claudeToken}` : `${config.repoUrl}|${config.claudeToken}|${config.githubToken}`;
     const cacheKey = onedrive ? `onedrive-${this.spaceSlug}`.replace(/[^a-zA-Z0-9._-]/g, "_") : repoCacheKey(config.repoUrl);
-    const name = `factiii-${this.instancePrefix}-util-${this.spaceSlug}-${cacheKey}`;
+    const name = `factiii-${this.instancePrefix}-util-${this.spaceSegment}-${cacheKey}`;
+    if (this.spaceId != null) {
+      const legacyName = `factiii-${this.instancePrefix}-util-${this.spaceSlug}-${cacheKey}`;
+      await renameContainer(legacyName, name);
+    }
     if (this.containerName && this.lastConfigKey !== configKey) {
       await killContainer(this.containerName);
       this.containerName = null;
@@ -9661,9 +9865,9 @@ function createEventSink(send, spaceSlug, notify) {
 }
 
 // ../../shared/all/helpers/card-ai/frpc.ts
-var import_child_process5 = require("child_process");
-var import_fs2 = require("fs");
-var import_path2 = __toESM(require("path"));
+var import_child_process6 = require("child_process");
+var import_fs3 = require("fs");
+var import_path3 = __toESM(require("path"));
 var import_util3 = require("util");
 
 // ../../shared/all/helpers/card-ai/scripts.ts
@@ -9717,15 +9921,15 @@ fi
 `;
 
 // ../../shared/all/helpers/card-ai/frpc.ts
-var execFileAsync3 = (0, import_util3.promisify)(import_child_process5.execFile);
+var execFileAsync3 = (0, import_util3.promisify)(import_child_process6.execFile);
 var FRP_SERVER_ADDR = "dev.factiii.com";
 var FRP_SERVER_PORT = 7443;
 var FRP_DOMAIN_SUFFIX = "dev.factiii.com";
-async function writeFileAsRoot(containerName, path7, contents) {
+async function writeFileAsRoot(containerName, path8, contents) {
   const b64 = Buffer.from(contents, "utf-8").toString("base64");
   await execInContainerAsRoot(
     containerName,
-    `echo '${b64}' | base64 -d > '${path7}'`
+    `echo '${b64}' | base64 -d > '${path8}'`
   );
 }
 async function installFrpcBinary(containerName) {
@@ -9738,8 +9942,8 @@ async function installFrpcBinary(containerName) {
   if (!binaryName) {
     throw new Error(`Unsupported container arch for frpc: ${arch}`);
   }
-  const src = import_path2.default.join(__dirname, "..", "vendor", binaryName);
-  if (!(0, import_fs2.existsSync)(src)) {
+  const src = import_path3.default.join(__dirname, "..", "vendor", binaryName);
+  if (!(0, import_fs3.existsSync)(src)) {
     throw new Error(
       `Vendored frpc missing (${src}). Run apps/runner/scripts/fetch-frpc.sh.`
     );
@@ -10483,10 +10687,10 @@ var TerminalModeEngine = class {
   }
   async bareFsList({
     postId,
-    path: path7
+    path: path8
   }) {
     const container = this.getBareContainer(postId);
-    const abs = this.resolveBarePath(path7);
+    const abs = this.resolveBarePath(path8);
     const relRoot = abs.slice(BARE_REPO_ROOT.length) || "/";
     const out = await execInContainer(
       container,
@@ -10536,21 +10740,21 @@ var TerminalModeEngine = class {
   }
   async bareFsRead({
     postId,
-    path: path7
+    path: path8
   }) {
     const container = this.getBareContainer(postId);
-    const abs = this.resolveBarePath(path7);
+    const abs = this.resolveBarePath(path8);
     const b64 = (await execInContainer(container, `base64 -w 0 ${shEscape(abs)}`)).trim();
     return { content: b64, encoding: "base64" };
   }
   async bareFsWrite({
     postId,
-    path: path7,
+    path: path8,
     content,
     encoding
   }) {
     const container = this.getBareContainer(postId);
-    const abs = this.resolveBarePath(path7);
+    const abs = this.resolveBarePath(path8);
     const b64 = encoding === "base64" ? content : Buffer.from(content, "utf-8").toString("base64");
     if (!/^[A-Za-z0-9+/=\n\r]*$/.test(b64)) {
       throw new Error("Invalid base64 payload.");
@@ -10560,7 +10764,7 @@ var TerminalModeEngine = class {
       `mkdir -p ${shEscape(posixDirname(abs))} && printf %s ${shEscape(b64)} | base64 -d > ${shEscape(abs)}`
     );
     const session = this.sessions.get(String(postId));
-    if (session) delete session.buffers[path7];
+    if (session) delete session.buffers[path8];
   }
   bareEditorState({
     postId: rawPostId
@@ -10577,38 +10781,38 @@ var TerminalModeEngine = class {
   }
   bareOpenFile({
     postId: rawPostId,
-    path: path7
+    path: path8
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    if (!session.openedFiles.includes(path7)) {
-      session.openedFiles.push(path7);
+    if (!session.openedFiles.includes(path8)) {
+      session.openedFiles.push(path8);
     }
   }
   bareCloseFile({
     postId: rawPostId,
-    path: path7
+    path: path8
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.openedFiles = session.openedFiles.filter((p) => p !== path7);
-    delete session.buffers[path7];
+    session.openedFiles = session.openedFiles.filter((p) => p !== path8);
+    delete session.buffers[path8];
   }
   bareBufferSet({
     postId: rawPostId,
-    path: path7,
+    path: path8,
     content
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.buffers[path7] = content;
+    session.buffers[path8] = content;
   }
   async bareFsDelete({
     postId,
-    path: path7
+    path: path8
   }) {
     const container = this.getBareContainer(postId);
-    const abs = this.resolveBarePath(path7);
+    const abs = this.resolveBarePath(path8);
     if (abs === BARE_REPO_ROOT) {
       throw new Error("Refusing to delete the repo root.");
     }
@@ -10616,10 +10820,10 @@ var TerminalModeEngine = class {
   }
   async bareFsMkdir({
     postId,
-    path: path7
+    path: path8
   }) {
     const container = this.getBareContainer(postId);
-    const abs = this.resolveBarePath(path7);
+    const abs = this.resolveBarePath(path8);
     await execInContainer(container, `mkdir -p ${shEscape(abs)}`);
   }
   async bareReview({
@@ -11032,7 +11236,9 @@ var BoardAgentEngine = class {
       targetBranch: targetBranch || "",
       effort: effort || "high",
       todos: [],
-      containerName: `factiii-${this.core.instancePrefix}-card-${taskId}`
+      // Name by stable spaceId when we have it; fall back to the id-less legacy
+      // form for old callers that only send the slug.
+      containerName: this.core.spaceId != null ? `factiii-${this.core.instancePrefix}-card-${this.core.spaceId}-${taskId}` : `factiii-${this.core.instancePrefix}-card-${taskId}`
     };
     if (mode === "bare") {
       this.terminal.start(base, {
@@ -11061,6 +11267,57 @@ var BoardAgentEngine = class {
   cardSessions() {
     return { ...this.terminal.listSummaries(), ...this.claude.listSummaries() };
   }
+  /** The stable board id this engine runs, if the caller provided one. */
+  get spaceId() {
+    return this.core.spaceId;
+  }
+  /**
+   * Every factiii container/VM on this host (running + stopped) for this
+   * runner's instance prefix - card and util, across ALL boards, since the
+   * prefix is shared by every engine on the host. Returns them decoded; the
+   * daemon scope-filters before handing them to a remote member. Electron
+   * (single owner) gets the raw list straight through.
+   */
+  async listContainers() {
+    const rows = await listContainersByPrefix(
+      `factiii-${this.core.instancePrefix}-`
+    );
+    const out = [];
+    for (const row of rows) {
+      const parsed = parseFactiiiContainerName(
+        row.name,
+        this.core.instancePrefix
+      );
+      if (!parsed) continue;
+      out.push({
+        containerName: row.name,
+        kind: parsed.kind,
+        spaceId: parsed.spaceId,
+        // This engine only knows its own board's slug; the daemon fills in
+        // slugs for other boards (cross-board) when scope-filtering.
+        spaceSlug: parsed.spaceId != null && parsed.spaceId === this.core.spaceId ? this.core.spaceSlug : void 0,
+        taskId: parsed.taskId,
+        cacheKey: parsed.cacheKey,
+        running: row.running,
+        status: row.status
+      });
+    }
+    return out;
+  }
+  /**
+   * Force-remove a container/VM by name. Guards the name against this runner's
+   * prefix so a peer can't `docker rm` an arbitrary container on the host. The
+   * daemon adds the per-board scope check on top for remote members.
+   */
+  async removeContainer({
+    containerName
+  }) {
+    if (!containerName.startsWith(`factiii-${this.core.instancePrefix}-`)) {
+      throw new Error("Refusing to remove a container outside this runner.");
+    }
+    await killContainer(containerName);
+    return { removed: true };
+  }
   cardSession({ postId }) {
     return this.claude.sessionWithLogs(String(postId)) ?? this.terminal.sessionWithLogs(String(postId));
   }
@@ -11305,6 +11562,12 @@ var BoardAgentEngine = class {
         return this.bareListExposed(
           payload
         );
+      case "listContainers":
+        return await this.listContainers();
+      case "removeContainer":
+        return await this.removeContainer(
+          payload
+        );
       default:
         throw new Error(`Unknown board-agent action: ${String(action)}`);
     }
@@ -11361,7 +11624,7 @@ function makeChunkReassembler() {
 
 // src/daemon.ts
 var import_node_datachannel = require("node-datachannel");
-var import_path5 = __toESM(require("path"));
+var import_path6 = __toESM(require("path"));
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
 var XMLHttpRequestModule = __toESM(require_XMLHttpRequest(), 1);
@@ -12541,12 +12804,12 @@ function parse2(str) {
   uri.queryKey = queryKey(uri, uri["query"]);
   return uri;
 }
-function pathNames(obj, path7) {
-  const regx = /\/{2,9}/g, names = path7.replace(regx, "/").split("/");
-  if (path7.slice(0, 1) == "/" || path7.length === 0) {
+function pathNames(obj, path8) {
+  const regx = /\/{2,9}/g, names = path8.replace(regx, "/").split("/");
+  if (path8.slice(0, 1) == "/" || path8.length === 0) {
     names.splice(0, 1);
   }
-  if (path7.slice(-1) == "/") {
+  if (path8.slice(-1) == "/") {
     names.splice(names.length - 1, 1);
   }
   return names;
@@ -13165,7 +13428,7 @@ var protocol2 = Socket.protocol;
 // ../../node_modules/socket.io-client/build/esm-debug/url.js
 var import_debug7 = __toESM(require_src(), 1);
 var debug7 = (0, import_debug7.default)("socket.io-client:url");
-function url(uri, path7 = "", loc) {
+function url(uri, path8 = "", loc) {
   let obj = uri;
   loc = loc || typeof location !== "undefined" && location;
   if (null == uri)
@@ -13199,7 +13462,7 @@ function url(uri, path7 = "", loc) {
   obj.path = obj.path || "/";
   const ipv6 = obj.host.indexOf(":") !== -1;
   const host = ipv6 ? "[" + obj.host + "]" : obj.host;
-  obj.id = obj.protocol + "://" + host + ":" + obj.port + path7;
+  obj.id = obj.protocol + "://" + host + ":" + obj.port + path8;
   obj.href = obj.protocol + "://" + host + (loc && loc.port === obj.port ? "" : ":" + obj.port);
   return obj;
 }
@@ -14833,8 +15096,8 @@ function lookup(uri, opts) {
   const parsed = url(uri, opts.path || "/socket.io");
   const source = parsed.source;
   const id = parsed.id;
-  const path7 = parsed.path;
-  const sameNamespace = cache[id] && path7 in cache[id]["nsps"];
+  const path8 = parsed.path;
+  const sameNamespace = cache[id] && path8 in cache[id]["nsps"];
   const newConnection = opts.forceNew || opts["force new connection"] || false === opts.multiplex || sameNamespace;
   let io;
   if (newConnection) {
@@ -14860,22 +15123,22 @@ Object.assign(lookup, {
 });
 
 // ../../shared/all/helpers/terminal-ai/terminal.ts
-var import_child_process6 = require("child_process");
+var import_child_process7 = require("child_process");
 var import_dockerode = __toESM(require("dockerode"));
-var import_fs3 = __toESM(require("fs"));
+var import_fs4 = __toESM(require("fs"));
 var import_os2 = __toESM(require("os"));
-var import_path3 = __toESM(require("path"));
+var import_path4 = __toESM(require("path"));
 function resolveDocker() {
   if (process.env.DOCKER_HOST) return new import_dockerode.default();
   try {
-    const out = (0, import_child_process6.execFileSync)(
+    const out = (0, import_child_process7.execFileSync)(
       "docker",
       ["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"],
       { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
     ).trim();
     if (out.startsWith("unix://")) {
       const p = out.slice("unix://".length);
-      if (import_fs3.default.existsSync(p)) return new import_dockerode.default({ socketPath: p });
+      if (import_fs4.default.existsSync(p)) return new import_dockerode.default({ socketPath: p });
     } else if (out) {
       process.env.DOCKER_HOST = out;
       return new import_dockerode.default();
@@ -14884,15 +15147,15 @@ function resolveDocker() {
   }
   const candidates = [
     "/var/run/docker.sock",
-    import_path3.default.join(import_os2.default.homedir(), ".docker/run/docker.sock"),
-    import_path3.default.join(import_os2.default.homedir(), ".docker/desktop/docker.sock"),
-    import_path3.default.join(import_os2.default.homedir(), ".orbstack/run/docker.sock"),
-    import_path3.default.join(import_os2.default.homedir(), ".colima/default/docker.sock"),
-    import_path3.default.join(import_os2.default.homedir(), ".rd/docker.sock")
+    import_path4.default.join(import_os2.default.homedir(), ".docker/run/docker.sock"),
+    import_path4.default.join(import_os2.default.homedir(), ".docker/desktop/docker.sock"),
+    import_path4.default.join(import_os2.default.homedir(), ".orbstack/run/docker.sock"),
+    import_path4.default.join(import_os2.default.homedir(), ".colima/default/docker.sock"),
+    import_path4.default.join(import_os2.default.homedir(), ".rd/docker.sock")
   ];
   for (const p of candidates) {
     try {
-      import_fs3.default.statSync(p);
+      import_fs4.default.statSync(p);
       return new import_dockerode.default({ socketPath: p });
     } catch {
     }
@@ -15093,50 +15356,119 @@ var TerminalManager = class {
 };
 
 // src/agent-adapter.ts
-var import_fs4 = __toESM(require("fs"));
+var import_fs5 = __toESM(require("fs"));
 var import_os3 = __toESM(require("os"));
-var import_path4 = __toESM(require("path"));
-var CONFIG_DIR2 = import_path4.default.join(import_os3.default.homedir(), ".factiii-runner");
+var import_path5 = __toESM(require("path"));
+var CONFIG_DIR2 = import_path5.default.join(import_os3.default.homedir(), ".factiii-runner");
+var RUNNER_CONFIG_PATH = import_path5.default.join(CONFIG_DIR2, "runner-config.json");
 function safeSlug(spaceSlug) {
   return spaceSlug.replace(/[^a-zA-Z0-9_.-]/g, "_");
 }
-function configPath(spaceSlug) {
-  return import_path4.default.join(CONFIG_DIR2, `space-${safeSlug(spaceSlug)}.json`);
-}
 function connectionPath(spaceSlug) {
-  return import_path4.default.join(CONFIG_DIR2, `space-${safeSlug(spaceSlug)}.onedrive.json`);
+  return import_path5.default.join(CONFIG_DIR2, `space-${safeSlug(spaceSlug)}.onedrive.json`);
 }
 function writeJson(filePath, value2) {
-  import_fs4.default.mkdirSync(CONFIG_DIR2, { recursive: true });
-  import_fs4.default.writeFileSync(filePath, JSON.stringify(value2, null, 2));
-  import_fs4.default.chmodSync(filePath, 384);
+  import_fs5.default.mkdirSync(CONFIG_DIR2, { recursive: true });
+  import_fs5.default.writeFileSync(filePath, JSON.stringify(value2, null, 2));
+  import_fs5.default.chmodSync(filePath, 384);
 }
-var localConfigProvider = {
-  readConfig(spaceSlug) {
-    let config = {};
+var CONFIG_FIELDS = [
+  "repoUrl",
+  "mainBranch",
+  "gitName",
+  "gitEmail",
+  "claudeToken",
+  "githubToken",
+  "storageBackend"
+];
+function fillDefaults(config) {
+  return {
+    repoUrl: config.repoUrl || "",
+    mainBranch: config.mainBranch || "main",
+    gitName: config.gitName || "",
+    gitEmail: config.gitEmail || "",
+    claudeToken: config.claudeToken || "",
+    githubToken: config.githubToken || "",
+    storageBackend: config.storageBackend || "github"
+  };
+}
+function migrateLegacyConfigs() {
+  const file = { boards: {} };
+  let legacy = [];
+  try {
+    legacy = import_fs5.default.readdirSync(CONFIG_DIR2).filter((f) => f.startsWith("space-") && f.endsWith(".json")).filter((f) => !f.endsWith(".onedrive.json"));
+  } catch {
+    return file;
+  }
+  for (const name of legacy) {
+    const slug = name.slice("space-".length, -".json".length);
+    let parsed = {};
     try {
-      config = JSON.parse(
-        import_fs4.default.readFileSync(configPath(spaceSlug), "utf-8")
+      parsed = JSON.parse(
+        import_fs5.default.readFileSync(import_path5.default.join(CONFIG_DIR2, name), "utf-8")
       );
     } catch {
+      continue;
     }
-    return {
-      repoUrl: config.repoUrl || "",
-      mainBranch: config.mainBranch || "main",
-      gitName: config.gitName || "",
-      gitEmail: config.gitEmail || "",
-      claudeToken: config.claudeToken || "",
-      githubToken: config.githubToken || "",
-      storageBackend: config.storageBackend || "github"
-    };
+    if (!file.defaultSlug) {
+      file.defaultSlug = slug;
+      file.default = parsed;
+    } else {
+      file.boards[slug] = parsed;
+    }
+  }
+  if (file.defaultSlug) writeJson(RUNNER_CONFIG_PATH, file);
+  return file;
+}
+function readRunnerConfig2() {
+  try {
+    return JSON.parse(
+      import_fs5.default.readFileSync(RUNNER_CONFIG_PATH, "utf-8")
+    );
+  } catch {
+    return migrateLegacyConfigs();
+  }
+}
+var localConfigProvider = {
+  readConfig(spaceSlug) {
+    const file = readRunnerConfig2();
+    const base = file.default ?? {};
+    const over = file.boards?.[spaceSlug] ?? {};
+    return fillDefaults({
+      repoUrl: over.repoUrl || base.repoUrl,
+      mainBranch: over.mainBranch || base.mainBranch,
+      gitName: over.gitName || base.gitName,
+      gitEmail: over.gitEmail || base.gitEmail,
+      claudeToken: over.claudeToken || base.claudeToken,
+      githubToken: over.githubToken || base.githubToken,
+      storageBackend: over.storageBackend || base.storageBackend
+    });
   },
   writeConfig(spaceSlug, config) {
-    writeJson(configPath(spaceSlug), config);
+    const file = readRunnerConfig2();
+    file.boards ??= {};
+    if (!file.defaultSlug) {
+      file.defaultSlug = spaceSlug;
+      file.default = config;
+    } else if (spaceSlug === file.defaultSlug) {
+      file.default = config;
+    } else {
+      const base = file.default ?? {};
+      const diff = {};
+      for (const f of CONFIG_FIELDS) {
+        if (config[f] && config[f] !== base[f]) {
+          diff[f] = config[f];
+        }
+      }
+      if (Object.keys(diff).length) file.boards[spaceSlug] = diff;
+      else delete file.boards[spaceSlug];
+    }
+    writeJson(RUNNER_CONFIG_PATH, file);
   },
   readOneDriveConnection(spaceSlug) {
     try {
       return JSON.parse(
-        import_fs4.default.readFileSync(connectionPath(spaceSlug), "utf-8")
+        import_fs5.default.readFileSync(connectionPath(spaceSlug), "utf-8")
       );
     } catch {
       return null;
@@ -15145,7 +15477,7 @@ var localConfigProvider = {
   writeOneDriveConnection(spaceSlug, connection) {
     const filePath = connectionPath(spaceSlug);
     if (!connection) {
-      import_fs4.default.rmSync(filePath, { force: true });
+      import_fs5.default.rmSync(filePath, { force: true });
       return;
     }
     writeJson(filePath, connection);
@@ -15153,6 +15485,13 @@ var localConfigProvider = {
 };
 
 // src/daemon.ts
+function toChannelScope(raw) {
+  if (!raw || raw.role === "owner") return { role: "owner" };
+  return { role: "member", spaceSlugs: new Set(raw.spaceSlugs) };
+}
+function scopeAllows(scope, spaceSlug) {
+  return scope.role === "owner" || scope.spaceSlugs.has(spaceSlug);
+}
 async function startDaemon(config) {
   console.log(`Connecting to ${config.serverUrl} as "${config.runnerName}"...`);
   const socket = lookup(config.serverUrl, {
@@ -15162,10 +15501,11 @@ async function startDaemon(config) {
     autoConnect: false
   });
   const engines = /* @__PURE__ */ new Map();
-  const openChannels = /* @__PURE__ */ new Set();
+  const channelScopes = /* @__PURE__ */ new Map();
   const terminalByChannel = /* @__PURE__ */ new WeakMap();
-  const findCardContainer = (postId) => {
-    for (const engine of engines.values()) {
+  const findCardContainerInScope = (scope, postId) => {
+    for (const [spaceSlug, engine] of engines) {
+      if (!scopeAllows(scope, spaceSlug)) continue;
       const name = engine.getCardContainerName(postId);
       if (name) return name;
     }
@@ -15173,7 +15513,7 @@ async function startDaemon(config) {
   };
   const broadcastToAll = (msg) => {
     const frames = chunkWire(msg);
-    for (const dc of openChannels) {
+    for (const dc of channelScopes.keys()) {
       for (const frame of frames) {
         try {
           dc.sendMessage(frame);
@@ -15182,7 +15522,19 @@ async function startDaemon(config) {
       }
     }
   };
-  function getEngine(spaceSlug) {
+  const broadcastToBoard = (spaceSlug, msg) => {
+    const frames = chunkWire(msg);
+    for (const [dc, scope] of channelScopes) {
+      if (!scopeAllows(scope, spaceSlug)) continue;
+      for (const frame of frames) {
+        try {
+          dc.sendMessage(frame);
+        } catch {
+        }
+      }
+    }
+  };
+  function getEngine(spaceSlug, spaceId) {
     let engine = engines.get(spaceSlug);
     if (!engine) {
       const send = (event, data) => {
@@ -15192,10 +15544,13 @@ async function startDaemon(config) {
           event,
           payload: data
         };
-        broadcastToAll(JSON.stringify(msg));
+        broadcastToBoard(spaceSlug, JSON.stringify(msg));
       };
       engine = new BoardAgentEngine({
         spaceSlug,
+        // Stable id for durable container naming (slugs can change); the engine
+        // falls back to the slug when absent.
+        spaceId,
         emitter: createEventSink(send, spaceSlug),
         configProvider: localConfigProvider,
         dockerfilePath: getDockerfilePath(),
@@ -15209,6 +15564,7 @@ async function startDaemon(config) {
     }
     return engine;
   }
+  const instancePrefix = computeInstancePrefix(`runner-${config.runnerName}`);
   socket.on("connect", () => {
     console.log(`Connected. Runner "${config.runnerName}" is online.`);
     console.log("Waiting for connections from UI clients...\n");
@@ -15221,6 +15577,7 @@ async function startDaemon(config) {
   });
   socket.on("runnerOffer", (data) => {
     console.log(`Received WebRTC offer from ${data.fromSocketId}`);
+    const scope = toChannelScope(data.scope);
     try {
       const peer = new import_node_datachannel.PeerConnection("runner", {
         iceServers: ["stun:stun.l.google.com:19302"]
@@ -15268,7 +15625,7 @@ async function startDaemon(config) {
         console.log(
           `Data channel "${dc.getLabel()}" opened with ${data.fromSocketId}`
         );
-        openChannels.add(dc);
+        channelScopes.set(dc, scope);
         const reassembler = makeChunkReassembler();
         const sendToChannel = (msg) => {
           for (const frame of chunkWire(msg)) {
@@ -15286,10 +15643,17 @@ async function startDaemon(config) {
         };
         terminalByChannel.set(
           dc,
-          new TerminalManager(sendRawToChannel, findCardContainer)
+          new TerminalManager(
+            sendRawToChannel,
+            (postId) => findCardContainerInScope(scope, postId)
+          )
         );
         dc.onOpen(() => {
+          sendToChannel(
+            JSON.stringify({ type: "runner-info", version: currentVersion() })
+          );
           for (const [spaceSlug, engine] of engines.entries()) {
+            if (!scopeAllows(scope, spaceSlug)) continue;
             const sessions = engine.cardSessions();
             for (const summary of Object.values(sessions)) {
               const msg = JSON.stringify({
@@ -15317,15 +15681,21 @@ async function startDaemon(config) {
               }
               return;
             }
+            if (parsed.type === "runner-control" && parsed.action === "update") {
+              applyUpdateAndRestart();
+              return;
+            }
             if (parsed.type === "broadcast" && parsed.spaceSlug && parsed.event) {
+              if (!scopeAllows(scope, parsed.spaceSlug)) return;
               const eventMsg = JSON.stringify({
                 type: "event",
                 event: `board-agent:${parsed.spaceSlug}:${parsed.event}`,
                 payload: parsed.payload
               });
               const frames = chunkWire(eventMsg);
-              for (const other of openChannels) {
+              for (const [other, otherScope] of channelScopes) {
                 if (other === dc) continue;
+                if (!scopeAllows(otherScope, parsed.spaceSlug)) continue;
                 for (const frame of frames) {
                   try {
                     other.sendMessage(frame);
@@ -15340,14 +15710,17 @@ async function startDaemon(config) {
           }
           handleDataChannelMessage(
             msgStr,
+            scope,
             sendToChannel,
-            broadcastToAll,
-            getEngine
+            broadcastToBoard,
+            getEngine,
+            engines,
+            instancePrefix
           );
         });
         dc.onClosed(() => {
           console.log(`Data channel closed with ${data.fromSocketId}`);
-          openChannels.delete(dc);
+          channelScopes.delete(dc);
           const mgr = terminalByChannel.get(dc);
           if (mgr) {
             mgr.destroyAll();
@@ -15373,6 +15746,25 @@ async function startDaemon(config) {
     }
     socket.disconnect();
   };
+  const applyUpdateAndRestart = () => {
+    console.log("[update] update approved by a client \u2014 installing latest...");
+    const status = (state) => broadcastToAll(JSON.stringify({ type: "runner-update", state }));
+    status("installing");
+    if (!installLatest()) {
+      status("failed");
+      return;
+    }
+    status("restarting");
+    cleanup();
+    process.exit(RESTART_FOR_UPDATE);
+  };
+  socket.on("runnerRevoked", () => {
+    console.log(
+      "\nThis runner was disconnected from your Factiii account. Stopping all jobs and removing containers..."
+    );
+    cleanup();
+    process.exit(0);
+  });
   process.on("SIGINT", () => {
     console.log("\nShutting down...");
     cleanup();
@@ -15382,8 +15774,27 @@ async function startDaemon(config) {
     cleanup();
     process.exit(0);
   });
+  await new Promise(() => {
+  });
 }
-async function handleDataChannelMessage(raw, sendToChannel, broadcastToAll, getEngine) {
+function spaceIdToSlug(engines) {
+  const map = /* @__PURE__ */ new Map();
+  for (const [slug, engine] of engines) {
+    if (engine.spaceId != null) map.set(engine.spaceId, slug);
+  }
+  return map;
+}
+function scopeFilterContainers(all, scope, engines) {
+  const idToSlug = spaceIdToSlug(engines);
+  return all.flatMap((c) => {
+    const slug = c.spaceId != null ? idToSlug.get(c.spaceId) : void 0;
+    if (scope.role !== "owner") {
+      if (!slug || !scopeAllows(scope, slug)) return [];
+    }
+    return [{ ...c, spaceId: slug ? c.spaceId : null, spaceSlug: slug }];
+  });
+}
+async function handleDataChannelMessage(raw, scope, sendToChannel, broadcastToBoard, getEngine, engines, instancePrefix) {
   let msg;
   try {
     msg = JSON.parse(raw);
@@ -15391,9 +15802,76 @@ async function handleDataChannelMessage(raw, sendToChannel, broadcastToAll, getE
     return;
   }
   if (msg.type !== "dispatch") return;
-  const engine = getEngine(msg.spaceSlug);
   const { action, payload, requestId } = msg;
   const ts = () => (/* @__PURE__ */ new Date()).toLocaleTimeString();
+  const sendResult = (res) => sendToChannel(JSON.stringify(res));
+  if (action === "listContainers") {
+    try {
+      const rows = await listContainersByPrefix(`factiii-${instancePrefix}-`);
+      const all = rows.flatMap((row) => {
+        const parsed = parseFactiiiContainerName(row.name, instancePrefix);
+        if (!parsed) return [];
+        return [
+          {
+            containerName: row.name,
+            kind: parsed.kind,
+            spaceId: parsed.spaceId,
+            taskId: parsed.taskId,
+            cacheKey: parsed.cacheKey,
+            running: row.running,
+            status: row.status
+          }
+        ];
+      });
+      sendResult({
+        type: "result",
+        requestId,
+        result: scopeFilterContainers(all, scope, engines)
+      });
+    } catch (err) {
+      sendResult({
+        type: "result",
+        requestId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return;
+  }
+  if (action === "removeContainer") {
+    const { containerName } = payload;
+    try {
+      if (!containerName.startsWith(`factiii-${instancePrefix}-`)) {
+        throw new Error("Refusing to remove a container outside this runner.");
+      }
+      if (scope.role !== "owner") {
+        const parsed = parseFactiiiContainerName(containerName, instancePrefix);
+        const slug = parsed?.spaceId != null ? spaceIdToSlug(engines).get(parsed.spaceId) : void 0;
+        if (!slug || !scopeAllows(scope, slug)) {
+          throw new Error("Not authorized to remove this container");
+        }
+      }
+      await killContainer(containerName);
+      sendResult({ type: "result", requestId, result: { removed: true } });
+    } catch (err) {
+      sendResult({
+        type: "result",
+        requestId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return;
+  }
+  if (!scopeAllows(scope, msg.spaceSlug)) {
+    console.warn(`[${ts()}] \u20E0 ${action} denied for board "${msg.spaceSlug}"`);
+    const denied = {
+      type: "result",
+      requestId,
+      error: "Not authorized for this board on this runner"
+    };
+    sendToChannel(JSON.stringify(denied));
+    return;
+  }
+  const engine = getEngine(msg.spaceSlug, msg.spaceId);
   console.log(`[${ts()}] \u2190 ${action} (${requestId})`);
   const askLogSender = (entry) => {
     const event = {
@@ -15402,7 +15880,7 @@ async function handleDataChannelMessage(raw, sendToChannel, broadcastToAll, getE
       event: `board-agent:${msg.spaceSlug}:log`,
       payload: entry
     };
-    broadcastToAll(JSON.stringify(event));
+    broadcastToBoard(msg.spaceSlug, JSON.stringify(event));
   };
   try {
     const result = await engine.dispatch(
@@ -15425,107 +15903,41 @@ async function handleDataChannelMessage(raw, sendToChannel, broadcastToAll, getE
   }
 }
 function getDockerfilePath() {
-  return import_path5.default.join(__dirname, "..", "Dockerfile.claude");
+  return import_path6.default.join(__dirname, "..", "Dockerfile.claude");
 }
 
-// src/setup.ts
-var import_child_process7 = require("child_process");
-var import_crypto2 = __toESM(require("crypto"));
-var import_fs5 = __toESM(require("fs"));
-var import_path6 = __toESM(require("path"));
-var DOCKERFILE_LABEL2 = "factiii.dockerfile-sha";
-function run(bin, args, opts) {
-  try {
-    return (0, import_child_process7.execFileSync)(bin, args, {
-      encoding: "utf-8",
-      stdio: opts?.silent ? "pipe" : "inherit",
-      // Avoids a cmd.exe window flash on Windows during silent checks.
-      windowsHide: true
-    });
-  } catch {
-    return "";
-  }
-}
-function check(cmd) {
-  const lookup2 = process.platform === "win32" ? "where" : "which";
-  try {
-    (0, import_child_process7.execFileSync)(lookup2, [cmd], { stdio: "pipe", windowsHide: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function setup(serverUrl) {
-  console.log("\n=== Factiii Runner \u2014 Setup ===\n");
-  console.log("[1/3] Checking Docker...");
-  if (!check("docker")) {
-    console.error(
-      "  Docker is not installed. Install it from https://docs.docker.com/get-docker/ and re-run setup."
-    );
-    process.exit(1);
-  }
-  if (!run("docker", ["info"], { silent: true })) {
-    console.error(
-      "  Docker is installed but the daemon is not running. Start Docker and re-run setup."
-    );
-    process.exit(1);
-  }
-  console.log("  Docker is ready.");
-  console.log("\n[2/3] Building factiii-claude Docker image...");
-  const dockerfilePath = findDockerfile();
-  if (!dockerfilePath) {
-    console.error(
-      "  Dockerfile.claude not found. Reinstall the package and re-run setup."
-    );
-    process.exit(1);
+// src/supervisor.ts
+async function runSupervised(workerArgs) {
+  if (isWorker()) {
+    const config = readRunnerConfig();
+    if (!config) {
+      console.error('Failed to read config. Run "factiii-runner setup" again.');
+      process.exit(1);
+    }
+    await startDaemon(config);
+    process.exit(0);
   }
-  const wantedHash = import_crypto2.default.createHash("sha256").update(import_fs5.default.readFileSync(dockerfilePath)).digest("hex");
-  const existingHash = run(
-    "docker",
-    [
-      "image",
-      "inspect",
-      "factiii-claude",
-      "--format",
-      `{{ index .Config.Labels "${DOCKERFILE_LABEL2}" }}`
-    ],
-    { silent: true }
-  ).trim();
-  if (existingHash === wantedHash) {
-    console.log("  Image is up to date.");
-  } else {
-    console.log(
-      existingHash ? `  Dockerfile changed since last build, rebuilding from ${dockerfilePath}...` : `  Building from ${dockerfilePath}...`
+  for (; ; ) {
+    const child = (0, import_node_child_process2.spawnSync)(
+      process.execPath,
+      [...process.execArgv, ...workerArgs],
+      {
+        stdio: "inherit",
+        env: markWorkerEnv(process.env)
+      }
     );
-    run("docker", [
-      "build",
-      "-t",
-      "factiii-claude",
-      "-f",
-      dockerfilePath,
-      "--label",
-      `${DOCKERFILE_LABEL2}=${wantedHash}`,
-      "."
-    ]);
-    console.log("  Image built.");
+    if (child.status === RESTART_FOR_UPDATE) {
+      console.log("[update] relaunching the runner on the new version...");
+      continue;
+    }
+    process.exit(child.signal ? 0 : child.status ?? 0);
   }
-  run("docker", ["volume", "create", "factiii-card-cache"], { silent: true });
-  console.log("\n[3/3] Pairing this runner with a Factiii account...");
-  const { token, runnerName } = await pairWithBrowser(serverUrl);
-  writeRunnerConfig({ serverUrl, authToken: token, runnerName });
-  console.log("  Paired and config saved.");
-  console.log("\n=== Setup complete ===\n");
-  console.log("Start the runner with: factiii-runner start\n");
-}
-function findDockerfile() {
-  const p = import_path6.default.join(__dirname, "..", "Dockerfile.claude");
-  return import_fs5.default.existsSync(p) ? p : null;
 }
 
 // src/cli.ts
 import_node_dns.default.setDefaultResultOrder("ipv4first");
 var program2 = new Command();
-program2.name("factiii-runner").description("Factiii Runner - run Board AI agents on remote servers").version("0.0.1");
+program2.name("factiii-runner").description("Factiii Runner - run Board AI agents on remote servers").version(currentVersion());
 program2.command("setup").description("Verify Docker, build the Claude image, and pair this runner").option("-s, --server <url>", "API server URL", "https://api.factiii.com").action(async (opts) => {
   try {
     await setup(opts.server);
@@ -15560,12 +15972,7 @@ program2.command("start").description("Start the runner daemon").action(async ()
     console.error('No config found. Run "factiii-runner setup" first.');
     process.exit(1);
   }
-  const config = readRunnerConfig();
-  if (!config) {
-    console.error('Failed to read config. Run "factiii-runner setup" again.');
-    process.exit(1);
-  }
-  await startDaemon(config);
+  await runSupervised(process.argv.slice(1));
 });
 program2.command("status").description("Show current runner configuration").action(() => {
   if (!configExists()) {