@firefunc-agent/runner 0.5.1 → 0.6.0

package/dist/api.d.ts

@@ -59,6 +59,11 @@ export declare class RunnerApi {
     config(): Promise<{
         maxParallel: number;
     } | null>;
+    gitCredential(runId: string): Promise<{
+        token: string;
+        expiresAt: string;
+        repo: string;
+    } | null>;
     event(runId: string, event: RunnerEvent, detail?: Record<string, unknown>): Promise<void>;
     result(runId: string, payload: ResultPayload): Promise<void>;
 }

package/dist/api.js

@@ -56,6 +56,24 @@ export class RunnerApi {
             return null;
         }
     }
+    async gitCredential(runId) {
+        try {
+            const res = await fetch(`${this.apiUrl}/channel/runs/${runId}/git-credential`, {
+                method: 'POST',
+                headers: { ...this.headers(), 'content-type': 'application/json' },
+                body: '{}',
+            });
+            if (!res.ok)
+                return null;
+            const body = (await res.json());
+            if (!body.ok || !body.token || !body.repo)
+                return null;
+            return { token: body.token, expiresAt: body.expiresAt ?? '', repo: body.repo };
+        }
+        catch {
+            return null;
+        }
+    }
     async event(runId, event, detail) {
         await fetch(`${this.apiUrl}/channel/runs/${runId}/events`, {
             method: 'POST',

package/dist/engines/claude.js

@@ -98,10 +98,12 @@ export const claudeAdapter = {
         if (t.includes('invalid x-api-key') ||
             t.includes('invalid api key') ||
             t.includes('authentication_error') ||
-            t.includes('oauth token has expired') ||
-            t.includes('oauth token expired') ||
-            t.includes('please run /login')) {
-            return 'Claude Code could not authenticate. Fix the runner’s Claude auth — run `claude setup-token` and pass `--claude-oauth-token`, or clear a stale/invalid ANTHROPIC_API_KEY — then retry.';
+            /oauth\b.*\btoken\b.*\bexpired/.test(t) ||
+            t.includes('failed to authenticate') ||
+            t.includes('please run /login') ||
+            t.includes('not logged in') ||
+            /\b401\b/.test(t)) {
+            return 'Claude Code could not authenticate — its login has expired or is invalid. On the runner machine run `claude` and sign in (or `claude setup-token` and pass `--claude-oauth-token`); clear a stale ANTHROPIC_API_KEY if you set one. Then retry this item.';
         }
         return null;
     },

package/dist/git-auth.d.ts

@@ -0,0 +1,23 @@
+import { type ExecResult } from './exec.js';
+export type GitCredential = {
+    token: string;
+    expiresAt: string;
+    repo: string;
+};
+export declare function redact(text: string, token?: string): string;
+export declare function gitAuthEnv(token: string, repo: string): NodeJS.ProcessEnv;
+export declare function cloneRepo(repo: string, dest: string, cred: GitCredential): Promise<ExecResult>;
+export declare function pushBranch(worktree: string, branch: string, repo: string, cred: GitCredential): Promise<ExecResult>;
+export declare function openDraftPr(args: {
+    repo: string;
+    head: string;
+    base: string;
+    title: string;
+    body: string;
+    cred: GitCredential;
+}): Promise<{
+    url: string;
+    number: number;
+} | {
+    error: string;
+}>;

package/dist/git-auth.js

@@ -0,0 +1,74 @@
+import { exec } from './exec.js';
+export function redact(text, token) {
+    let out = text;
+    if (token)
+        out = out.split(token).join('***');
+    return out
+        .replace(/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, '***')
+        .replace(/\bghs_[A-Za-z0-9]{20,}\b/g, '***')
+        .replace(/(Authorization:\s*(?:Basic|Bearer)\s+)\S+/gi, '$1***')
+        .replace(/(https:\/\/)[^@\s/]+:[^@\s/]+@/g, '$1***@');
+}
+export function gitAuthEnv(token, repo) {
+    const basic = Buffer.from(`x-access-token:${token}`).toString('base64');
+    return {
+        GIT_CONFIG_COUNT: '3',
+        GIT_CONFIG_KEY_0: 'http.https://github.com/.extraheader',
+        GIT_CONFIG_VALUE_0: `Authorization: Basic ${basic}`,
+        GIT_CONFIG_KEY_1: 'credential.helper',
+        GIT_CONFIG_VALUE_1: '',
+        GIT_CONFIG_KEY_2: 'remote.origin.pushurl',
+        GIT_CONFIG_VALUE_2: `https://github.com/${repo}.git`,
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_ASKPASS: undefined,
+        SSH_ASKPASS: undefined,
+        GIT_TRACE: undefined,
+        GIT_TRACE_CURL: undefined,
+        GIT_TRACE_PACKET: undefined,
+        GIT_CURL_VERBOSE: undefined,
+    };
+}
+export async function cloneRepo(repo, dest, cred) {
+    const res = await exec('git', ['clone', '--no-tags', `https://github.com/${repo}.git`, dest], {
+        timeoutMs: 600_000,
+        env: gitAuthEnv(cred.token, repo),
+    });
+    return { ...res, stderr: redact(res.stderr, cred.token), stdout: redact(res.stdout, cred.token) };
+}
+export async function pushBranch(worktree, branch, repo, cred) {
+    const res = await exec('git', ['-C', worktree, 'push', '--force-with-lease', 'origin', `${branch}:${branch}`], { timeoutMs: 120_000, env: gitAuthEnv(cred.token, repo) });
+    return { ...res, stderr: redact(res.stderr, cred.token), stdout: redact(res.stdout, cred.token) };
+}
+export async function openDraftPr(args) {
+    const { repo, head, base, title, body, cred } = args;
+    const headers = {
+        authorization: `Bearer ${cred.token}`,
+        accept: 'application/vnd.github+json',
+        'x-github-api-version': '2022-11-28',
+        'content-type': 'application/json',
+        'user-agent': 'firefunc-runner',
+    };
+    const res = await fetch(`https://api.github.com/repos/${repo}/pulls`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ title, head, base, body, draft: true }),
+    });
+    if (res.ok) {
+        const j = (await res.json());
+        if (typeof j.html_url === 'string' && Number.isFinite(j.number))
+            return { url: j.html_url, number: Number(j.number) };
+        return { error: 'pr created but the response carried no url/number' };
+    }
+    if (res.status === 422) {
+        const owner = repo.split('/')[0];
+        const list = await fetch(`https://api.github.com/repos/${repo}/pulls?head=${encodeURIComponent(`${owner}:${head}`)}&state=open`, { headers });
+        if (list.ok) {
+            const rows = (await list.json());
+            const hit = rows.find((r) => typeof r.html_url === 'string' && Number.isFinite(r.number));
+            if (hit)
+                return { url: hit.html_url, number: Number(hit.number) };
+        }
+    }
+    return { error: `github refused to open the pull request (${res.status})` };
+}
+//# sourceMappingURL=git-auth.js.map

package/dist/job.d.ts

@@ -2,6 +2,9 @@ import type { RunnerApi, ClaimedJob } from './api.js';
 import { type RunnerConfig } from './config.js';
 import type { SessionViewer } from './viewer.js';
 export declare function resolveRepoPath(repo: string | null | undefined, cfg: RunnerConfig): string | null;
+export declare function cloneDestination(repo: string, cfg: RunnerConfig): string | null;
+export declare function rememberRepoPath(repo: string, path: string, cfg: RunnerConfig): void;
+export declare function hasGh(cwd: string): Promise<boolean>;
 export declare function runJob(job: ClaimedJob, cfg: RunnerConfig, api: RunnerApi, viewer?: SessionViewer, opts?: {
     devServerPort?: number;
 }): Promise<void>;

package/dist/job.js

@@ -2,7 +2,8 @@ import { mkdtempSync, rmSync, existsSync, mkdirSync, writeFileSync, copyFileSync
 import { tmpdir } from 'node:os';
 import { join, basename, dirname } from 'node:path';
 import { exec, execOut, spawnBackground, killProcessTree } from './exec.js';
-import { configPath } from './config.js';
+import { configPath, loadConfig, saveConfig } from './config.js';
+import { cloneRepo, openDraftPr, pushBranch, redact } from './git-auth.js';
 import { createKeyedMutex } from './locks.js';
 import { getAdapter, stripForeignEngineCreds } from './engines/index.js';
 function log(msg) {
@@ -52,6 +53,40 @@ export function resolveRepoPath(repo, cfg) {
     }
     return null;
 }
+export function cloneDestination(repo, cfg) {
+    const name = basename(repo);
+    if (!name)
+        return null;
+    const root = cfg.reposDir ?? join(dirname(configPath()), 'repos');
+    try {
+        mkdirSync(root, { recursive: true });
+    }
+    catch {
+        return null;
+    }
+    return join(root, name);
+}
+export function rememberRepoPath(repo, path, cfg) {
+    try {
+        const onDisk = loadConfig();
+        if (!onDisk)
+            return;
+        onDisk.repos = { ...(onDisk.repos ?? {}), [repo]: path };
+        saveConfig(onDisk);
+        cfg.repos = { ...(cfg.repos ?? {}), [repo]: path };
+    }
+    catch {
+    }
+}
+export async function hasGh(cwd) {
+    try {
+        const res = await exec('gh', ['auth', 'status'], { cwd, timeoutMs: 15_000 });
+        return res.code === 0;
+    }
+    catch {
+        return false;
+    }
+}
 function installCmdFor(dir) {
     if (existsSync(join(dir, 'pnpm-lock.yaml')))
         return 'pnpm install --frozen-lockfile';
@@ -96,12 +131,33 @@ export async function runJob(job, cfg, api, viewer, opts) {
         log(`job ${job.runId} FAILED — ${error.replace(/\s+/g, ' ').slice(0, 300)}`);
         return report({ status: 'failed', error });
     };
-    const repoPath = resolveRepoPath(job.repo, cfg);
+    let repoPath = resolveRepoPath(job.repo, cfg);
+    if (!repoPath && job.repo) {
+        const cred = await api.gitCredential(job.runId);
+        const dest = cloneDestination(job.repo, cfg);
+        if (cred && dest) {
+            log(`no local checkout for ${job.repo} — cloning into ${dest}`);
+            await api.event(job.runId, 'cloning', { repo: job.repo });
+            const cloned = await cloneRepo(job.repo, dest, cred);
+            if (cloned.code === 0) {
+                repoPath = dest;
+                rememberRepoPath(job.repo, dest, cfg);
+            }
+            else {
+                return report({
+                    status: 'failed',
+                    error: `Could not clone ${job.repo}: ${redact(cloned.stderr, cred.token).slice(0, 300)}`,
+                });
+            }
+        }
+    }
     if (!repoPath) {
-        log(`no local checkout for ${job.repo} — set it in config.repos or reposDir`);
+        log(`no local checkout for ${job.repo} and no credential to clone with`);
         return report({
             status: 'failed',
-            error: `Runner has no local checkout configured for ${job.repo}.`,
+            error: `Runner has no local checkout for ${job.repo} and could not obtain a ` +
+                `credential to clone it. Either map it with \`firefunc-runner repo ` +
+                `${job.repo} <path>\`, set --repos-dir, or connect GitHub in FireFunc.`,
         });
     }
     const adapter = getAdapter(job.engine ?? cfg.engine);
@@ -310,11 +366,40 @@ export async function runJob(job, cfg, api, viewer, opts) {
             log(`agent already committed its changes for ${job.runId} — reconciling to a PR`);
         }
         await api.event(job.runId, 'pushing', { branch });
-        const push = await exec('git', ['-C', worktree, 'push', '--force-with-lease', 'origin', `${branch}:${branch}`], { timeoutMs: 120_000 });
+        const gitCred = job.repo ? await api.gitCredential(job.runId) : null;
+        if (gitCred)
+            log(`using a FireFunc-issued git credential for ${gitCred.repo}`);
+        const push = gitCred
+            ? await pushBranch(worktree, branch, gitCred.repo, gitCred)
+            : await exec('git', ['-C', worktree, 'push', '--force-with-lease', 'origin', `${branch}:${branch}`], { timeoutMs: 120_000 });
         if (push.code !== 0) {
-            return fail(`git push failed: ${push.stderr.slice(0, 400)}`);
+            return fail(`git push failed: ${redact(push.stderr, gitCred?.token).slice(0, 400)}`);
         }
         const body = `Automated fix by FireFunc (self-hosted ${engineName} runner) for ${job.externalId ?? 'a reported bug'}.\n\nReview before merging.`;
+        if (gitCred && !(await hasGh(worktree))) {
+            const pr = await openDraftPr({
+                repo: gitCred.repo,
+                head: branch,
+                base,
+                title,
+                body,
+                cred: gitCred,
+            });
+            if ('error' in pr)
+                return fail(redact(pr.error, gitCred.token));
+            await api.event(job.runId, 'pr_opened', { url: pr.url, branch });
+            log(`opened PR for ${job.runId}: ${pr.url}`);
+            return report({
+                status: 'pr_opened',
+                pr: {
+                    repo: job.repo ?? undefined,
+                    number: pr.number,
+                    url: pr.url,
+                    branch,
+                    summary: title,
+                },
+            });
+        }
         const create = await exec('gh', [
             'pr',
             'create',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firefunc-agent/runner",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "private": false,
   "type": "module",
   "description": "FireFunc self-hosted runner — an always-on daemon that runs YOUR local coding agent (Claude Code, Codex, Gemini CLI, Cursor CLI) on work FireFunc routes to it, opens pull requests, and reports back. Your machine, your subscriptions.",