@firefunc-agent/runner 0.5.1 → 0.7.0

package/README.md

@@ -21,20 +21,24 @@ This is the **self-hosted runner** for FireFunc's _Claude Code Channel_ engine.
 ## Quick start
 
 ```bash
-# Install once (or skip it and use npx, as below).
+# 1. Install the package. Use -g, not npx — see the note below.
 npm install -g @firefunc-agent/runner
 
-# 1. In FireFunc: Engines → "Add a machine". Copy the WHOLE command it shows —
-#    it already contains your one-time token (ffr_…) and your API URL.
-
-# 2. On your machine — the copied command looks like this:
-npx @firefunc-agent/runner connect ffr_xxxxx --api https://your-firefunc-host --repos-dir ~/code
+# 2. In FireFunc: Engines → "Add a machine". Copy the WHOLE command it shows —
+#    it already contains your one-time token (ffr_…) and your API URL:
+firefunc-runner connect ffr_xxxxx --api https://your-firefunc-host --repos-dir ~/code
 #    (or map a repo exactly: --repo acme/api=/Users/me/code/api)
 
-# 3. Go online:
-npx @firefunc-agent/runner start
+# 3. Go online — starts at login/sign-in and survives reboot:
+firefunc-runner install
 ```
 
+**`npm install -g`, not `npx`.** `npx` runs the package from a throwaway cache
+(`~/.npm/_npx/<hash>/…`) that npm is free to delete. A background service has to
+point at a path that still exists after a reboot, so `firefunc-runner install`
+refuses to run from there and tells you this. Everything else — `connect`,
+`start`, `status`, `logs` — works fine under `npx` if you prefer.
+
 `--api` is required: this package has no hard-coded FireFunc host, so it only
 ever talks to the deployment you point it at.
 
@@ -50,11 +54,16 @@ That's it. When your QA files a bug (labeled for FireFunc), it appears here with
 
 ## Commands
 
-| Command                                   | What it does                                                             |
-| ----------------------------------------- | ------------------------------------------------------------------------ |
-| `firefunc-runner connect <token> [flags]` | Save your token + settings (`~/.firefunc-runner/config.json`, mode 0600) |
-| `firefunc-runner start`                   | Start the always-on daemon                                               |
-| `firefunc-runner status`                  | Show the saved config                                                    |
+| Command                                   | What it does                                                              |
+| ----------------------------------------- | ------------------------------------------------------------------------- |
+| `firefunc-runner connect <token> [flags]` | Save your token + settings (`~/.firefunc-runner/config.json`, mode 0600)  |
+| `firefunc-runner install`                 | Install as a background service — starts at login/boot, restarts on crash |
+| `firefunc-runner start`                   | Run in THIS terminal (stops when you close it) — for watching it work     |
+| `firefunc-runner stop`                    | Stop the background service (stays stopped)                               |
+| `firefunc-runner start-service`           | Start the background service again                                        |
+| `firefunc-runner logs`                    | Recent runner output                                                      |
+| `firefunc-runner uninstall`               | Remove the background service                                             |
+| `firefunc-runner status`                  | Saved config **and** whether the service is installed + running           |
 
 ### `connect` flags
 
@@ -66,15 +75,62 @@ That's it. When your QA files a bug (labeled for FireFunc), it appears here with
 | `--repo <owner/repo=/path>` | —                | Map one repo to an exact checkout (repeatable)                 |
 | `--claude-bin <bin>`        | `claude`         | Claude Code binary                                             |
 
-## Run it as a service
+## Always-on
+
+`firefunc-runner start` runs in the foreground: it dies with the terminal and does
+**not** come back after a reboot. That matters more than it sounds, because
+FireFunc's queue is **pull** — nothing is pushed to your machine, the runner asks
+for work every few seconds. A runner that is not running is not a slow runner;
+it is an absent one, and work waits for a machine that will never ask again.
+
+So install it once:
 
-Keep it alive across reboots with launchd (macOS), systemd (Linux), or `pm2`:
+```bash
+firefunc-runner install
+```
+
+- **macOS** — a launchd LaunchAgent at `~/Library/LaunchAgents/com.firefunc.runner.plist`
+- **Linux** — a systemd `--user` unit at `~/.config/systemd/user/firefunc-runner.service`,
+  plus `loginctl enable-linger` so it starts at **boot**, not at first login
+- **Windows** — a Task Scheduler task (`FireFuncRunner`) that starts at sign-in.
+  No WSL, no admin rights, no service wrapper.
+
+It starts at login/boot and restarts itself if it crashes. It does **not** restart
+after a deliberate stop, or after FireFunc revokes the runner's token — that is a
+clean exit, not a fault, and respawning it would just log the same rejection
+forever.
+
+Per-user, not system-wide, on purpose: the runner uses **your** `claude` /
+`codex` / `gemini` login, **your** checkouts and **your** SSH keys. A root daemon
+— or a Windows _Service_, which is the same problem — would have none of those,
+and giving it them is exactly the concentration of access FireFunc is designed to
+avoid. That is also why Windows gets a Scheduled Task and not a Service: no admin
+rights needed, and it runs as you.
+
+On Windows the task overrides four Task Scheduler defaults that would otherwise
+break it silently: it refuses to start on battery and stops when unplugged
+(fatal on a laptop), it is killed after 3 days, and it stops when the machine
+goes idle.
 
 ```bash
-pm2 start "npx @firefunc-agent/runner start" --name firefunc-runner
-pm2 save
+firefunc-runner status    # installed? running?
+firefunc-runner logs      # what has it been doing
+firefunc-runner stop      # stop it; stays stopped
+firefunc-runner uninstall # remove the service entirely
 ```
 
+Two things the installer bakes into the unit, because a service has no shell
+profile: your current `PATH` (or the agent CLIs are not findable and every job
+fails with `claude: command not found`) and `HOME`/`USERPROFILE` (or they cannot
+find their own logins). If you install a new agent CLI somewhere new, re-run
+`install`.
+
+> **Tested:** the macOS path is verified end to end on a real Mac — installed,
+> killed with `kill -9`, and confirmed launchd brought it back. The Linux and
+> Windows paths are unit-tested (unit/XML contents and every `systemctl` /
+> `schtasks` verb) but have **not** yet been run on a real machine of either
+> kind. Please report anything that misbehaves.
+
 ## Licence
 
 `@firefunc-agent/runner` is the **client** half of FireFunc, published so the machines

package/dist/api.d.ts

@@ -59,6 +59,11 @@ export declare class RunnerApi {
     config(): Promise<{
         maxParallel: number;
     } | null>;
+    gitCredential(runId: string): Promise<{
+        token: string;
+        expiresAt: string;
+        repo: string;
+    } | null>;
     event(runId: string, event: RunnerEvent, detail?: Record<string, unknown>): Promise<void>;
     result(runId: string, payload: ResultPayload): Promise<void>;
 }

package/dist/api.js

@@ -56,6 +56,24 @@ export class RunnerApi {
             return null;
         }
     }
+    async gitCredential(runId) {
+        try {
+            const res = await fetch(`${this.apiUrl}/channel/runs/${runId}/git-credential`, {
+                method: 'POST',
+                headers: { ...this.headers(), 'content-type': 'application/json' },
+                body: '{}',
+            });
+            if (!res.ok)
+                return null;
+            const body = (await res.json());
+            if (!body.ok || !body.token || !body.repo)
+                return null;
+            return { token: body.token, expiresAt: body.expiresAt ?? '', repo: body.repo };
+        }
+        catch {
+            return null;
+        }
+    }
     async event(runId, event, detail) {
         await fetch(`${this.apiUrl}/channel/runs/${runId}/events`, {
             method: 'POST',

package/dist/cli.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { loadConfig, saveConfig, configPath } from './config.js';
+import { expandHome, loadConfig, saveConfig, configPath } from './config.js';
 import { startDaemon } from './daemon.js';
 import { runBrief } from './brief.js';
+import { currentPlatform, defaultServiceDeps, EPHEMERAL_INSTALL_MESSAGE, installService, isEphemeralInstall, readLogTail, renderLaunchdPlist, renderSystemdUnit, renderWindowsTaskXml, serviceStatus, servicePaths, startService, stopService, uninstallService, } from './service.js';
 const HELP = `firefunc-runner — run YOUR local coding agent on work FireFunc routes to you.
 (Claude Code, OpenAI Codex, Gemini CLI or Cursor CLI — whichever you have installed.)
 
@@ -9,10 +10,21 @@ Usage:
   firefunc-runner connect <token> [options]   Save your runner token + settings
   firefunc-runner repo <owner/repo> <path>    Point a repo at its local checkout
   firefunc-runner brief <owner/repo>          Draft a CLAUDE.md runner briefing as a draft PR
-  firefunc-runner start                       Start the always-on daemon
-  firefunc-runner status                      Show the saved config
+  firefunc-runner install                     Install as a background service (survives reboot)
+  firefunc-runner start                       Run in THIS terminal (stops when you close it)
+  firefunc-runner stop                        Stop the background service
+  firefunc-runner start-service               Start the background service again
+  firefunc-runner logs                        Show recent runner output
+  firefunc-runner uninstall                   Remove the background service
+  firefunc-runner status                      Show the saved config + service state
   firefunc-runner --help
 
+After "connect", run "install" once. The runner then starts at login/boot and
+restarts itself if it crashes — no terminal needs to stay open. Use "start"
+only when you want to watch it in the foreground.
+Works on macOS (launchd), Linux (systemd) and Windows (Task Scheduler) — no
+admin rights on any of them.
+
 connect options:
   --api <url>        FireFunc API URL — REQUIRED. Copy the whole connect
                      command from the Engines screen; it fills this in.
@@ -23,6 +35,10 @@ connect options:
   --claude-oauth-token <tok>  Subscription token from "claude setup-token". Usually NOT
                      needed — the runner already uses your machine's "claude" login.
                      Set only if this machine has no interactive Claude login.
+  --force            Replace an EXISTING connection on this machine. Without it,
+                     connecting with a different token is refused: a runner holds
+                     one token and serves one scope, and replacing it silently
+                     took the machine off its old project.
   --use-api-key      Bill pay-as-you-go API credits via ANTHROPIC_API_KEY instead of
                      your subscription. OFF by default — the runner hides any
                      ANTHROPIC_API_KEY from claude so it can't silently charge the API.
@@ -64,7 +80,7 @@ Examples:
   firefunc-runner connect ffr_xxx --repos-dir ~/code
   firefunc-runner connect ffr_xxx --repo acme/api=/Users/me/code/api
   firefunc-runner connect ffr_xxx --env AWS_PROFILE=app-ro --setup "npm ci" --bg "npm run dev"
-  firefunc-runner start
+  firefunc-runner install
 `;
 function parseFlags(args) {
     const out = {};
@@ -105,7 +121,7 @@ async function main() {
         for (const r of f.repo ?? []) {
             const [k, v] = r.split('=');
             if (k && v)
-                repos[k] = v;
+                repos[k] = expandHome(v);
         }
         const claudeEnv = {};
         for (const e of f.env ?? []) {
@@ -113,11 +129,24 @@ async function main() {
             if (i > 0)
                 claudeEnv[e.slice(0, i)] = e.slice(i + 1);
         }
-        const cfg = {
+        const existing = loadConfig();
+        if (existing && existing.token !== token && !f.force) {
+            process.stderr.write(`This machine is already connected to FireFunc with a different runner token.\n\n` +
+                `Connecting again would REPLACE that token, so this machine would stop\n` +
+                `taking work for whatever project the old one served — and would discard\n` +
+                `its saved settings (repos, engine, env, setup and background commands).\n\n` +
+                `A runner holds ONE token and serves ONE scope. To serve another project,\n` +
+                `connect a different machine — or widen this one's scope in FireFunc.\n\n` +
+                `If replacing it is genuinely what you want:\n` +
+                `  firefunc-runner connect <token> --api <url> --force\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const flagged = {
             apiUrl,
             token,
             name: f.name?.[0],
-            reposDir: f['repos-dir']?.[0],
+            reposDir: f['repos-dir']?.[0] ? expandHome(f['repos-dir'][0]) : undefined,
             repos: Object.keys(repos).length ? repos : undefined,
             claudeBin: f['claude-bin']?.[0],
             quiet: f.quiet ? true : undefined,
@@ -140,11 +169,17 @@ async function main() {
             setupCommands: f.setup,
             autoInstall: f['no-auto-install'] ? false : undefined,
             setupTimeoutMinutes: f['setup-timeout']?.[0] ? Number(f['setup-timeout'][0]) : undefined,
-            envFile: f['env-file']?.[0],
+            envFile: f['env-file']?.[0] ? expandHome(f['env-file'][0]) : undefined,
             backgroundCommands: f.bg,
         };
+        const provided = Object.fromEntries(Object.entries(flagged).filter(([, v]) => v !== undefined));
+        const cfg = { ...(existing ?? {}), ...provided, apiUrl, token };
         saveConfig(cfg);
-        process.stdout.write(`Saved to ${configPath()}.\nRun "firefunc-runner start" to go online.\n`);
+        process.stdout.write(`Saved to ${configPath()}.\n` +
+            (existing
+                ? 'Kept the settings you did not pass again (repos, engine, env, setup).\n'
+                : '') +
+            `Next: firefunc-runner install   (background service — survives reboot)\n`);
         return;
     }
     if (cmd === 'repo') {
@@ -163,7 +198,7 @@ async function main() {
             process.exitCode = 1;
             return;
         }
-        cfg.repos = { ...(cfg.repos ?? {}), [name]: localPath };
+        cfg.repos = { ...(cfg.repos ?? {}), [name]: expandHome(localPath) };
         saveConfig(cfg);
         process.stdout.write(`Mapped ${name} → ${localPath}\nRestart the runner to apply: firefunc-runner start\n`);
         return;
@@ -212,6 +247,19 @@ async function main() {
             `  autoInstall:${cfg.autoInstall === false ? ' off' : ' on (when no setup)'}\n` +
             `  background:${cfg.backgroundCommands?.length ? ' ' + cfg.backgroundCommands.join(' ; ') : ' (none)'}\n` +
             `  envFile:   ${cfg.envFile ?? '(none)'}\n`);
+        const os = currentPlatform();
+        const deps = defaultServiceDeps('', os);
+        const svc = await serviceStatus(deps);
+        process.stdout.write(!os
+            ? `\nservice:     not supported on this platform — keep "firefunc-runner start" running\n`
+            : !svc.installed
+                ? `\nservice:     NOT INSTALLED — the runner stops when you close the terminal\n` +
+                    `             and does not come back after a reboot.\n` +
+                    `             Fix: firefunc-runner install\n`
+                : `\nservice:     installed, ${svc.running ? 'RUNNING' : 'STOPPED'}\n` +
+                    `  unit:      ${svc.unit}\n` +
+                    `  logs:      ${svc.log}  (firefunc-runner logs)\n` +
+                    (svc.running ? '' : `             Start it: firefunc-runner start-service\n`));
         return;
     }
     if (cmd === 'start') {
@@ -221,9 +269,66 @@ async function main() {
             process.exitCode = 1;
             return;
         }
+        if (!process.env.FIREFUNC_RUNNER_SERVICE) {
+            process.stdout.write('Running in this terminal — it stops when you close the window and does\n' +
+                'not restart after a reboot. For an always-on runner: firefunc-runner install\n\n');
+        }
         await startDaemon(cfg);
         return;
     }
+    if (cmd === 'install' ||
+        cmd === 'uninstall' ||
+        cmd === 'stop' ||
+        cmd === 'start-service' ||
+        cmd === 'logs') {
+        const os = currentPlatform();
+        const paths = servicePaths(os ?? 'linux');
+        if (cmd === 'logs') {
+            process.stdout.write(`${readLogTail(paths.log)}\n`);
+            return;
+        }
+        const unitInput = {
+            nodePath: process.execPath,
+            scriptPath: process.argv[1] ?? '',
+            pathEnv: process.env.PATH ?? '',
+            logPath: paths.log,
+            home: process.env.HOME ?? process.env.USERPROFILE ?? '',
+        };
+        const unitBody = os === 'darwin'
+            ? renderLaunchdPlist(unitInput)
+            : os === 'win32'
+                ? renderWindowsTaskXml({
+                    ...unitInput,
+                    userId: process.env.USERDOMAIN
+                        ? `${process.env.USERDOMAIN}\\${process.env.USERNAME ?? ''}`
+                        : (process.env.USERNAME ?? ''),
+                })
+                : renderSystemdUnit(unitInput);
+        const deps = defaultServiceDeps(unitBody, os);
+        if (cmd === 'install') {
+            if (!loadConfig()) {
+                process.stderr.write('Not connected. Run "firefunc-runner connect <token>" first.\n');
+                process.exitCode = 1;
+                return;
+            }
+            if (isEphemeralInstall(process.argv[1] ?? '')) {
+                process.stderr.write(`${EPHEMERAL_INSTALL_MESSAGE}\n`);
+                process.exitCode = 1;
+                return;
+            }
+        }
+        const res = cmd === 'install'
+            ? await installService(deps)
+            : cmd === 'uninstall'
+                ? await uninstallService(deps)
+                : cmd === 'stop'
+                    ? await stopService(deps)
+                    : await startService(deps);
+        process.stdout.write(`${res.message}\n`);
+        if (!res.ok)
+            process.exitCode = 1;
+        return;
+    }
     process.stderr.write(`Unknown command "${cmd}".\n\n${HELP}`);
     process.exitCode = 1;
 }

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+export declare function expandHome(p: string): string;
 export type RunnerConfig = {
     apiUrl: string;
     token: string;

package/dist/config.js

@@ -1,6 +1,13 @@
 import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
+export function expandHome(p) {
+    if (p === '~')
+        return homedir();
+    if (p.startsWith('~/') || p.startsWith('~\\'))
+        return join(homedir(), p.slice(2));
+    return p;
+}
 export function configPath() {
     return process.env.FIREFUNC_RUNNER_CONFIG ?? join(homedir(), '.firefunc-runner', 'config.json');
 }

package/dist/daemon.js

@@ -115,8 +115,8 @@ export async function startDaemon(cfg) {
         onClaimError: async (err) => {
             const msg = err.message;
             if (/token rejected/.test(msg)) {
-                log(`FATAL: ${msg}. Re-run "firefunc-runner connect <token>".`);
-                process.exitCode = 1;
+                log(`STOPPING: ${msg}. Re-run "firefunc-runner connect <token>".`);
+                process.exitCode = 0;
                 return 'fatal';
             }
             log(`poll error: ${msg} — retrying in ${Math.round(backoffMs / 1000)}s`);

package/dist/engines/claude.js

@@ -98,10 +98,12 @@ export const claudeAdapter = {
         if (t.includes('invalid x-api-key') ||
             t.includes('invalid api key') ||
             t.includes('authentication_error') ||
-            t.includes('oauth token has expired') ||
-            t.includes('oauth token expired') ||
-            t.includes('please run /login')) {
-            return 'Claude Code could not authenticate. Fix the runner’s Claude auth — run `claude setup-token` and pass `--claude-oauth-token`, or clear a stale/invalid ANTHROPIC_API_KEY — then retry.';
+            /oauth\b.*\btoken\b.*\bexpired/.test(t) ||
+            t.includes('failed to authenticate') ||
+            t.includes('please run /login') ||
+            t.includes('not logged in') ||
+            /\b401\b/.test(t)) {
+            return 'Claude Code could not authenticate — its login has expired or is invalid. On the runner machine run `claude` and sign in (or `claude setup-token` and pass `--claude-oauth-token`); clear a stale ANTHROPIC_API_KEY if you set one. Then retry this item.';
         }
         return null;
     },

package/dist/git-auth.d.ts

@@ -0,0 +1,23 @@
+import { type ExecResult } from './exec.js';
+export type GitCredential = {
+    token: string;
+    expiresAt: string;
+    repo: string;
+};
+export declare function redact(text: string, token?: string): string;
+export declare function gitAuthEnv(token: string, repo: string): NodeJS.ProcessEnv;
+export declare function cloneRepo(repo: string, dest: string, cred: GitCredential): Promise<ExecResult>;
+export declare function pushBranch(worktree: string, branch: string, repo: string, cred: GitCredential): Promise<ExecResult>;
+export declare function openDraftPr(args: {
+    repo: string;
+    head: string;
+    base: string;
+    title: string;
+    body: string;
+    cred: GitCredential;
+}): Promise<{
+    url: string;
+    number: number;
+} | {
+    error: string;
+}>;

package/dist/git-auth.js

@@ -0,0 +1,74 @@
+import { exec } from './exec.js';
+export function redact(text, token) {
+    let out = text;
+    if (token)
+        out = out.split(token).join('***');
+    return out
+        .replace(/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, '***')
+        .replace(/\bghs_[A-Za-z0-9]{20,}\b/g, '***')
+        .replace(/(Authorization:\s*(?:Basic|Bearer)\s+)\S+/gi, '$1***')
+        .replace(/(https:\/\/)[^@\s/]+:[^@\s/]+@/g, '$1***@');
+}
+export function gitAuthEnv(token, repo) {
+    const basic = Buffer.from(`x-access-token:${token}`).toString('base64');
+    return {
+        GIT_CONFIG_COUNT: '3',
+        GIT_CONFIG_KEY_0: 'http.https://github.com/.extraheader',
+        GIT_CONFIG_VALUE_0: `Authorization: Basic ${basic}`,
+        GIT_CONFIG_KEY_1: 'credential.helper',
+        GIT_CONFIG_VALUE_1: '',
+        GIT_CONFIG_KEY_2: 'remote.origin.pushurl',
+        GIT_CONFIG_VALUE_2: `https://github.com/${repo}.git`,
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_ASKPASS: undefined,
+        SSH_ASKPASS: undefined,
+        GIT_TRACE: undefined,
+        GIT_TRACE_CURL: undefined,
+        GIT_TRACE_PACKET: undefined,
+        GIT_CURL_VERBOSE: undefined,
+    };
+}
+export async function cloneRepo(repo, dest, cred) {
+    const res = await exec('git', ['clone', '--no-tags', `https://github.com/${repo}.git`, dest], {
+        timeoutMs: 600_000,
+        env: gitAuthEnv(cred.token, repo),
+    });
+    return { ...res, stderr: redact(res.stderr, cred.token), stdout: redact(res.stdout, cred.token) };
+}
+export async function pushBranch(worktree, branch, repo, cred) {
+    const res = await exec('git', ['-C', worktree, 'push', '--force-with-lease', 'origin', `${branch}:${branch}`], { timeoutMs: 120_000, env: gitAuthEnv(cred.token, repo) });
+    return { ...res, stderr: redact(res.stderr, cred.token), stdout: redact(res.stdout, cred.token) };
+}
+export async function openDraftPr(args) {
+    const { repo, head, base, title, body, cred } = args;
+    const headers = {
+        authorization: `Bearer ${cred.token}`,
+        accept: 'application/vnd.github+json',
+        'x-github-api-version': '2022-11-28',
+        'content-type': 'application/json',
+        'user-agent': 'firefunc-runner',
+    };
+    const res = await fetch(`https://api.github.com/repos/${repo}/pulls`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ title, head, base, body, draft: true }),
+    });
+    if (res.ok) {
+        const j = (await res.json());
+        if (typeof j.html_url === 'string' && Number.isFinite(j.number))
+            return { url: j.html_url, number: Number(j.number) };
+        return { error: 'pr created but the response carried no url/number' };
+    }
+    if (res.status === 422) {
+        const owner = repo.split('/')[0];
+        const list = await fetch(`https://api.github.com/repos/${repo}/pulls?head=${encodeURIComponent(`${owner}:${head}`)}&state=open`, { headers });
+        if (list.ok) {
+            const rows = (await list.json());
+            const hit = rows.find((r) => typeof r.html_url === 'string' && Number.isFinite(r.number));
+            if (hit)
+                return { url: hit.html_url, number: Number(hit.number) };
+        }
+    }
+    return { error: `github refused to open the pull request (${res.status})` };
+}
+//# sourceMappingURL=git-auth.js.map

package/dist/job.d.ts

@@ -2,6 +2,9 @@ import type { RunnerApi, ClaimedJob } from './api.js';
 import { type RunnerConfig } from './config.js';
 import type { SessionViewer } from './viewer.js';
 export declare function resolveRepoPath(repo: string | null | undefined, cfg: RunnerConfig): string | null;
+export declare function cloneDestination(repo: string, cfg: RunnerConfig): string | null;
+export declare function rememberRepoPath(repo: string, path: string, cfg: RunnerConfig): void;
+export declare function hasGh(cwd: string): Promise<boolean>;
 export declare function runJob(job: ClaimedJob, cfg: RunnerConfig, api: RunnerApi, viewer?: SessionViewer, opts?: {
     devServerPort?: number;
 }): Promise<void>;

package/dist/job.js

@@ -2,7 +2,8 @@ import { mkdtempSync, rmSync, existsSync, mkdirSync, writeFileSync, copyFileSync
 import { tmpdir } from 'node:os';
 import { join, basename, dirname } from 'node:path';
 import { exec, execOut, spawnBackground, killProcessTree } from './exec.js';
-import { configPath } from './config.js';
+import { configPath, loadConfig, saveConfig } from './config.js';
+import { cloneRepo, openDraftPr, pushBranch, redact } from './git-auth.js';
 import { createKeyedMutex } from './locks.js';
 import { getAdapter, stripForeignEngineCreds } from './engines/index.js';
 function log(msg) {
@@ -52,6 +53,40 @@ export function resolveRepoPath(repo, cfg) {
     }
     return null;
 }
+export function cloneDestination(repo, cfg) {
+    const name = basename(repo);
+    if (!name)
+        return null;
+    const root = cfg.reposDir ?? join(dirname(configPath()), 'repos');
+    try {
+        mkdirSync(root, { recursive: true });
+    }
+    catch {
+        return null;
+    }
+    return join(root, name);
+}
+export function rememberRepoPath(repo, path, cfg) {
+    try {
+        const onDisk = loadConfig();
+        if (!onDisk)
+            return;
+        onDisk.repos = { ...(onDisk.repos ?? {}), [repo]: path };
+        saveConfig(onDisk);
+        cfg.repos = { ...(cfg.repos ?? {}), [repo]: path };
+    }
+    catch {
+    }
+}
+export async function hasGh(cwd) {
+    try {
+        const res = await exec('gh', ['auth', 'status'], { cwd, timeoutMs: 15_000 });
+        return res.code === 0;
+    }
+    catch {
+        return false;
+    }
+}
 function installCmdFor(dir) {
     if (existsSync(join(dir, 'pnpm-lock.yaml')))
         return 'pnpm install --frozen-lockfile';
@@ -96,12 +131,33 @@ export async function runJob(job, cfg, api, viewer, opts) {
         log(`job ${job.runId} FAILED — ${error.replace(/\s+/g, ' ').slice(0, 300)}`);
         return report({ status: 'failed', error });
     };
-    const repoPath = resolveRepoPath(job.repo, cfg);
+    let repoPath = resolveRepoPath(job.repo, cfg);
+    if (!repoPath && job.repo) {
+        const cred = await api.gitCredential(job.runId);
+        const dest = cloneDestination(job.repo, cfg);
+        if (cred && dest) {
+            log(`no local checkout for ${job.repo} — cloning into ${dest}`);
+            await api.event(job.runId, 'cloning', { repo: job.repo });
+            const cloned = await cloneRepo(job.repo, dest, cred);
+            if (cloned.code === 0) {
+                repoPath = dest;
+                rememberRepoPath(job.repo, dest, cfg);
+            }
+            else {
+                return report({
+                    status: 'failed',
+                    error: `Could not clone ${job.repo}: ${redact(cloned.stderr, cred.token).slice(0, 300)}`,
+                });
+            }
+        }
+    }
     if (!repoPath) {
-        log(`no local checkout for ${job.repo} — set it in config.repos or reposDir`);
+        log(`no local checkout for ${job.repo} and no credential to clone with`);
         return report({
             status: 'failed',
-            error: `Runner has no local checkout configured for ${job.repo}.`,
+            error: `Runner has no local checkout for ${job.repo} and could not obtain a ` +
+                `credential to clone it. Either map it with \`firefunc-runner repo ` +
+                `${job.repo} <path>\`, set --repos-dir, or connect GitHub in FireFunc.`,
         });
     }
     const adapter = getAdapter(job.engine ?? cfg.engine);
@@ -310,11 +366,44 @@ export async function runJob(job, cfg, api, viewer, opts) {
             log(`agent already committed its changes for ${job.runId} — reconciling to a PR`);
         }
         await api.event(job.runId, 'pushing', { branch });
-        const push = await exec('git', ['-C', worktree, 'push', '--force-with-lease', 'origin', `${branch}:${branch}`], { timeoutMs: 120_000 });
+        const gitCred = job.repo ? await api.gitCredential(job.runId) : null;
+        if (gitCred)
+            log(`using a FireFunc-issued git credential for ${gitCred.repo}`);
+        const push = gitCred
+            ? await pushBranch(worktree, branch, gitCred.repo, gitCred)
+            : await exec('git', ['-C', worktree, 'push', '--force-with-lease', 'origin', `${branch}:${branch}`], { timeoutMs: 120_000 });
         if (push.code !== 0) {
-            return fail(`git push failed: ${push.stderr.slice(0, 400)}`);
+            return fail(`git push failed: ${redact(push.stderr, gitCred?.token).slice(0, 400)}`);
         }
         const body = `Automated fix by FireFunc (self-hosted ${engineName} runner) for ${job.externalId ?? 'a reported bug'}.\n\nReview before merging.`;
+        if (gitCred) {
+            const pr = await openDraftPr({
+                repo: gitCred.repo,
+                head: branch,
+                base,
+                title,
+                body,
+                cred: gitCred,
+            });
+            if (!('error' in pr)) {
+                await api.event(job.runId, 'pr_opened', { url: pr.url, branch });
+                log(`opened PR for ${job.runId}: ${pr.url}`);
+                return report({
+                    status: 'pr_opened',
+                    pr: {
+                        repo: job.repo ?? undefined,
+                        number: pr.number,
+                        url: pr.url,
+                        branch,
+                        summary: title,
+                    },
+                });
+            }
+            const why = redact(pr.error, gitCred.token);
+            if (!(await hasGh(worktree)))
+                return fail(why);
+            log(`could not open the PR as FireFunc (${why}); falling back to gh`);
+        }
         const create = await exec('gh', [
             'pr',
             'create',

package/dist/service.d.ts

@@ -0,0 +1,55 @@
+export type ServicePlatform = 'darwin' | 'linux' | 'win32';
+export declare const SERVICE_LABEL = "com.firefunc.runner";
+export declare const WINDOWS_TASK_NAME = "FireFuncRunner";
+export type ServicePaths = {
+    unit: string;
+    log: string;
+};
+export declare function servicePaths(os: ServicePlatform, home?: string): ServicePaths;
+export type UnitInput = {
+    nodePath: string;
+    scriptPath: string;
+    pathEnv: string;
+    logPath: string;
+    home: string;
+};
+export declare function renderLaunchdPlist(i: UnitInput): string;
+export declare function renderSystemdUnit(i: UnitInput): string;
+export declare function renderWindowsTaskXml(i: UnitInput & {
+    userId: string;
+}): string;
+export declare function isEphemeralInstall(scriptPath: string): boolean;
+export declare const EPHEMERAL_INSTALL_MESSAGE: string;
+export declare function currentPlatform(): ServicePlatform | null;
+export type ServiceResult = {
+    ok: boolean;
+    message: string;
+};
+export type ServiceDeps = {
+    os: ServicePlatform | null;
+    paths: ServicePaths;
+    unitBody: string;
+    exec: (cmd: string, args: string[]) => Promise<{
+        code: number;
+        out: string;
+    }>;
+    ensureDir: (path: string) => void;
+    writeFile: (path: string, body: string, encoding: BufferEncoding) => void;
+    unitEncoding: BufferEncoding;
+    removeFile: (path: string) => void;
+    fileExists: (path: string) => boolean;
+};
+export declare function defaultServiceDeps(unitBody: string, os?: ServicePlatform | null): ServiceDeps;
+export declare function installService(d: ServiceDeps): Promise<ServiceResult>;
+export declare function uninstallService(d: ServiceDeps): Promise<ServiceResult>;
+export declare function stopService(d: ServiceDeps): Promise<ServiceResult>;
+export declare function startService(d: ServiceDeps): Promise<ServiceResult>;
+export type ServiceStatus = {
+    installed: boolean;
+    running: boolean;
+    unit: string;
+    log: string;
+    detail?: string;
+};
+export declare function serviceStatus(d: ServiceDeps): Promise<ServiceStatus>;
+export declare function readLogTail(logPath: string, lines?: number): string;

package/dist/service.js

@@ -0,0 +1,363 @@
+import { execFile } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir, platform } from 'node:os';
+import { dirname, join } from 'node:path';
+import { promisify } from 'node:util';
+const run = promisify(execFile);
+export const SERVICE_LABEL = 'com.firefunc.runner';
+export const WINDOWS_TASK_NAME = 'FireFuncRunner';
+export function servicePaths(os, home = homedir()) {
+    const log = join(home, '.firefunc-runner', 'runner.log');
+    if (os === 'darwin') {
+        return { unit: join(home, 'Library', 'LaunchAgents', `${SERVICE_LABEL}.plist`), log };
+    }
+    if (os === 'win32') {
+        return { unit: join(home, '.firefunc-runner', 'firefunc-runner-task.xml'), log };
+    }
+    return { unit: join(home, '.config', 'systemd', 'user', 'firefunc-runner.service'), log };
+}
+function xmlEscape(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+export function renderLaunchdPlist(i) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${SERVICE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xmlEscape(i.nodePath)}</string>
+    <string>${xmlEscape(i.scriptPath)}</string>
+    <string>start</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${xmlEscape(i.pathEnv)}</string>
+    <key>HOME</key>
+    <string>${xmlEscape(i.home)}</string>
+    <key>FIREFUNC_RUNNER_SERVICE</key>
+    <string>1</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>30</integer>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(i.logPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(i.logPath)}</string>
+</dict>
+</plist>
+`;
+}
+export function renderSystemdUnit(i) {
+    return `[Unit]
+Description=FireFunc runner — runs your local coding agent on work FireFunc routes to you
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${i.nodePath} ${i.scriptPath} start
+Environment=PATH=${i.pathEnv}
+Environment=HOME=${i.home}
+Environment=FIREFUNC_RUNNER_SERVICE=1
+Restart=on-failure
+RestartSec=30
+StandardOutput=append:${i.logPath}
+StandardError=append:${i.logPath}
+
+[Install]
+WantedBy=default.target
+`;
+}
+export function renderWindowsTaskXml(i) {
+    const command = [
+        `set "PATH=${i.pathEnv}"`,
+        `set "FIREFUNC_RUNNER_SERVICE=1"`,
+        `"${i.nodePath}" "${i.scriptPath}" start >> "${i.logPath}" 2>&1`,
+    ].join(' && ');
+    return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>FireFunc runner - runs your local coding agent on work FireFunc routes to you</Description>
+    <URI>\\${WINDOWS_TASK_NAME}</URI>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${xmlEscape(i.userId)}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${xmlEscape(i.userId)}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>true</Hidden>
+    <RunOnlyIfIdle>false</RunOnlyIfIdle>
+    <WakeToRun>false</WakeToRun>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Priority>7</Priority>
+    <RestartOnFailure>
+      <Interval>PT1M</Interval>
+      <Count>999</Count>
+    </RestartOnFailure>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>cmd.exe</Command>
+      <Arguments>/c "${xmlEscape(command)}"</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`;
+}
+export function isEphemeralInstall(scriptPath) {
+    return /[\\/]_npx[\\/]/.test(scriptPath);
+}
+export const EPHEMERAL_INSTALL_MESSAGE = `This copy is running from npx's temporary cache, which npm can delete at any\n` +
+    `time. A background service has to point at a path that will still be there\n` +
+    `after a reboot, so install the package properly first:\n\n` +
+    `  npm install -g @firefunc-agent/runner\n` +
+    `  firefunc-runner install\n\n` +
+    `Everything else (connect, start, status, logs) works fine under npx.`;
+export function currentPlatform() {
+    const p = platform();
+    return p === 'darwin' || p === 'linux' || p === 'win32' ? p : null;
+}
+const UNSUPPORTED = `Installing as a background service is supported on macOS, Linux and Windows.\n` +
+    `This platform is none of those, so keep "firefunc-runner start" running in a\n` +
+    `terminal.`;
+async function exec(cmd, args) {
+    try {
+        const { stdout, stderr } = await run(cmd, args);
+        return { code: 0, out: `${stdout}${stderr}` };
+    }
+    catch (err) {
+        const e = err;
+        return { code: typeof e.code === 'number' ? e.code : 1, out: e.stderr ?? e.message ?? '' };
+    }
+}
+export function defaultServiceDeps(unitBody, os = currentPlatform()) {
+    return {
+        os,
+        paths: servicePaths(os ?? 'linux'),
+        unitBody,
+        exec,
+        ensureDir: (path) => mkdirSync(path, { recursive: true }),
+        unitEncoding: os === 'win32' ? 'utf16le' : 'utf8',
+        writeFile: (path, body, encoding) => {
+            mkdirSync(dirname(path), { recursive: true });
+            const text = encoding === 'utf16le' ? `\ufeff${body}` : body;
+            writeFileSync(path, text, { encoding, mode: 0o644 });
+        },
+        removeFile: (path) => rmSync(path, { force: true }),
+        fileExists: (path) => existsSync(path),
+    };
+}
+export async function installService(d) {
+    if (!d.os)
+        return { ok: false, message: UNSUPPORTED };
+    d.ensureDir(dirname(d.paths.log));
+    d.writeFile(d.paths.unit, d.unitBody, d.unitEncoding);
+    if (d.os === 'darwin') {
+        const uid = process.getuid?.() ?? 501;
+        await d.exec('launchctl', ['bootout', `gui/${uid}/${SERVICE_LABEL}`]);
+        const boot = await d.exec('launchctl', ['bootstrap', `gui/${uid}`, d.paths.unit]);
+        if (boot.code !== 0) {
+            return { ok: false, message: `launchctl bootstrap failed:\n${boot.out}` };
+        }
+        await d.exec('launchctl', ['enable', `gui/${uid}/${SERVICE_LABEL}`]);
+        return {
+            ok: true,
+            message: `Installed. The runner starts at login and restarts if it crashes.\n` +
+                `  unit: ${d.paths.unit}\n  logs: ${d.paths.log}\n\n` +
+                `  firefunc-runner logs     watch it work\n` +
+                `  firefunc-runner stop     stop it (stays stopped until you start it)\n` +
+                `  firefunc-runner uninstall  remove the service entirely`,
+        };
+    }
+    if (d.os === 'win32') {
+        const create = await d.exec('schtasks', [
+            '/Create',
+            '/TN',
+            WINDOWS_TASK_NAME,
+            '/XML',
+            d.paths.unit,
+            '/F',
+        ]);
+        if (create.code !== 0) {
+            return { ok: false, message: `schtasks /Create failed:\n${create.out}` };
+        }
+        const run = await d.exec('schtasks', ['/Run', '/TN', WINDOWS_TASK_NAME]);
+        const runNote = run.code === 0
+            ? ''
+            : `\nNOTE: registered, but could not start it right now — it will start at your next sign-in.\n${run.out.trim()}`;
+        return {
+            ok: true,
+            message: `Installed. The runner starts when you sign in and restarts if it crashes.\n` +
+                `  task: ${WINDOWS_TASK_NAME} (Task Scheduler)\n  logs: ${d.paths.log}\n\n` +
+                `  firefunc-runner logs     watch it work\n` +
+                `  firefunc-runner stop     stop it (stays stopped until you start it)\n` +
+                `  firefunc-runner uninstall  remove the task entirely${runNote}`,
+        };
+    }
+    await d.exec('systemctl', ['--user', 'daemon-reload']);
+    const enable = await d.exec('systemctl', ['--user', 'enable', '--now', 'firefunc-runner']);
+    if (enable.code !== 0) {
+        return { ok: false, message: `systemctl enable failed:\n${enable.out}` };
+    }
+    const linger = await d.exec('loginctl', ['enable-linger', process.env.USER ?? '']);
+    const lingerNote = linger.code === 0
+        ? ''
+        : `\nNOTE: "loginctl enable-linger" failed, so the runner will only run while\n` +
+            `you are logged in. Run it yourself with sudo to make it start at boot:\n` +
+            `  sudo loginctl enable-linger ${process.env.USER ?? '$USER'}`;
+    return {
+        ok: true,
+        message: `Installed. The runner starts at boot and restarts if it crashes.\n` +
+            `  unit: ${d.paths.unit}\n  logs: ${d.paths.log}\n\n` +
+            `  firefunc-runner logs     watch it work\n` +
+            `  firefunc-runner stop     stop it (stays stopped until you start it)\n` +
+            `  firefunc-runner uninstall  remove the service entirely${lingerNote}`,
+    };
+}
+export async function uninstallService(d) {
+    if (!d.os)
+        return { ok: false, message: UNSUPPORTED };
+    if (!d.fileExists(d.paths.unit)) {
+        return { ok: true, message: 'No service installed — nothing to remove.' };
+    }
+    if (d.os === 'darwin') {
+        const uid = process.getuid?.() ?? 501;
+        await d.exec('launchctl', ['bootout', `gui/${uid}/${SERVICE_LABEL}`]);
+    }
+    else if (d.os === 'win32') {
+        await d.exec('schtasks', ['/End', '/TN', WINDOWS_TASK_NAME]);
+        await d.exec('schtasks', ['/Delete', '/TN', WINDOWS_TASK_NAME, '/F']);
+    }
+    else {
+        await d.exec('systemctl', ['--user', 'disable', '--now', 'firefunc-runner']);
+        await d.exec('systemctl', ['--user', 'daemon-reload']);
+    }
+    d.removeFile(d.paths.unit);
+    return { ok: true, message: `Removed. ${d.paths.unit} deleted; the runner will not restart.` };
+}
+export async function stopService(d) {
+    if (!d.os)
+        return { ok: false, message: UNSUPPORTED };
+    if (!d.fileExists(d.paths.unit)) {
+        return {
+            ok: false,
+            message: 'No service installed. If you started the runner in a terminal, stop it there (Ctrl-C).',
+        };
+    }
+    if (d.os === 'darwin') {
+        const uid = process.getuid?.() ?? 501;
+        const r = await d.exec('launchctl', ['bootout', `gui/${uid}/${SERVICE_LABEL}`]);
+        if (r.code !== 0 && !/no such process|not find/i.test(r.out)) {
+            return { ok: false, message: `Could not stop the service:\n${r.out}` };
+        }
+    }
+    else if (d.os === 'win32') {
+        await d.exec('schtasks', ['/End', '/TN', WINDOWS_TASK_NAME]);
+        const r = await d.exec('schtasks', ['/Change', '/TN', WINDOWS_TASK_NAME, '/DISABLE']);
+        if (r.code !== 0)
+            return { ok: false, message: `Could not stop the task:\n${r.out}` };
+    }
+    else {
+        const r = await d.exec('systemctl', ['--user', 'stop', 'firefunc-runner']);
+        if (r.code !== 0)
+            return { ok: false, message: `Could not stop the service:\n${r.out}` };
+    }
+    return { ok: true, message: 'Stopped. Run "firefunc-runner start-service" to start it again.' };
+}
+export async function startService(d) {
+    if (!d.os)
+        return { ok: false, message: UNSUPPORTED };
+    if (!d.fileExists(d.paths.unit)) {
+        return { ok: false, message: 'No service installed. Run "firefunc-runner install" first.' };
+    }
+    if (d.os === 'darwin') {
+        const uid = process.getuid?.() ?? 501;
+        await d.exec('launchctl', ['bootout', `gui/${uid}/${SERVICE_LABEL}`]);
+        const r = await d.exec('launchctl', ['bootstrap', `gui/${uid}`, d.paths.unit]);
+        if (r.code !== 0)
+            return { ok: false, message: `Could not start the service:\n${r.out}` };
+    }
+    else if (d.os === 'win32') {
+        await d.exec('schtasks', ['/Change', '/TN', WINDOWS_TASK_NAME, '/ENABLE']);
+        const r = await d.exec('schtasks', ['/Run', '/TN', WINDOWS_TASK_NAME]);
+        if (r.code !== 0)
+            return { ok: false, message: `Could not start the task:\n${r.out}` };
+    }
+    else {
+        const r = await d.exec('systemctl', ['--user', 'start', 'firefunc-runner']);
+        if (r.code !== 0)
+            return { ok: false, message: `Could not start the service:\n${r.out}` };
+    }
+    return { ok: true, message: 'Started.' };
+}
+export async function serviceStatus(d) {
+    const base = { unit: d.paths.unit, log: d.paths.log };
+    if (!d.os)
+        return { ...base, installed: false, running: false, detail: 'unsupported platform' };
+    const installed = d.fileExists(d.paths.unit);
+    if (!installed)
+        return { ...base, installed: false, running: false };
+    if (d.os === 'darwin') {
+        const uid = process.getuid?.() ?? 501;
+        const r = await d.exec('launchctl', ['print', `gui/${uid}/${SERVICE_LABEL}`]);
+        const running = r.code === 0 && /state\s*=\s*running/i.test(r.out);
+        return { ...base, installed: true, running };
+    }
+    if (d.os === 'win32') {
+        const r = await d.exec('schtasks', ['/Query', '/TN', WINDOWS_TASK_NAME, '/FO', 'LIST']);
+        if (r.code !== 0)
+            return { ...base, installed: true, running: false, detail: 'task not found' };
+        const status = /Status:\s*(\S+)/i.exec(r.out)?.[1] ?? '';
+        return {
+            ...base,
+            installed: true,
+            running: /^running$/i.test(status),
+            detail: status ? status.toLowerCase() : undefined,
+        };
+    }
+    const r = await d.exec('systemctl', ['--user', 'is-active', 'firefunc-runner']);
+    return { ...base, installed: true, running: r.out.trim() === 'active' };
+}
+export function readLogTail(logPath, lines = 80) {
+    if (!existsSync(logPath))
+        return '(no log yet — has the service been started?)';
+    const all = readFileSync(logPath, 'utf8').split('\n');
+    return all.slice(Math.max(0, all.length - lines)).join('\n');
+}
+//# sourceMappingURL=service.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firefunc-agent/runner",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "private": false,
   "type": "module",
   "description": "FireFunc self-hosted runner — an always-on daemon that runs YOUR local coding agent (Claude Code, Codex, Gemini CLI, Cursor CLI) on work FireFunc routes to it, opens pull requests, and reports back. Your machine, your subscriptions.",