@instafy/cli 0.1.11 → 0.2.1

package/dist/runtime.js

@@ -1,923 +0,0 @@
-import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import kleur from "kleur";
-import { fileURLToPath } from "node:url";
-import { randomUUID } from "node:crypto";
-import os from "node:os";
-import { ensureRatholeBinary } from "./rathole.js";
-import { resolveActiveProfileName, resolveConfiguredAccessToken } from "./config.js";
-import { formatAuthRejectedError } from "./errors.js";
-import { findProjectManifest } from "./project-manifest.js";
-import { fetchWithControllerAuth } from "./controller-fetch.js";
-const INSTAFY_DIR = path.join(os.homedir(), ".instafy");
-const STATE_FILE = path.join(INSTAFY_DIR, "cli-runtime-state.json");
-const LOG_DIR = path.join(INSTAFY_DIR, "cli-runtime-logs");
-function resolveRepoRoot() {
-    const __dirname = path.dirname(fileURLToPath(import.meta.url));
-    return path.resolve(__dirname, "../../..");
-}
-function resolveRuntimeBinary() {
-    // Reuse existing runtime-agent binary from workspace target (assumes `cargo build` done).
-    const repoRoot = resolveRepoRoot();
-    const candidates = [
-        path.join(repoRoot, "target", "debug", "runtime-agent"),
-        path.join(repoRoot, "target", "release", "runtime-agent"),
-        path.join(repoRoot, "packages", "runtime-agent", "target", "debug", "runtime-agent"),
-        path.join(repoRoot, "packages", "runtime-agent", "target", "release", "runtime-agent"),
-    ];
-    for (const candidate of candidates) {
-        if (existsSync(candidate)) {
-            return candidate;
-        }
-    }
-    throw new Error("runtime-agent binary not found. If you're in the instafy repo, run `cargo build -p runtime-agent`. Otherwise install Docker and rerun `instafy runtime start`.");
-}
-function tryResolveRuntimeBinary() {
-    try {
-        return resolveRuntimeBinary();
-    }
-    catch {
-        return null;
-    }
-}
-function isDockerAvailable() {
-    try {
-        const result = spawnSync("docker", ["version"], { stdio: "ignore" });
-        return result.status === 0;
-    }
-    catch {
-        return false;
-    }
-}
-function normalizeControllerUrlForDocker(controllerUrl) {
-    const trimmed = controllerUrl.trim().replace(/\/$/, "");
-    if (!trimmed) {
-        return trimmed;
-    }
-    try {
-        const url = new URL(trimmed);
-        const host = url.hostname.toLowerCase();
-        if (host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "0.0.0.0") {
-            url.hostname = "host.docker.internal";
-        }
-        return url.toString().replace(/\/$/, "");
-    }
-    catch {
-        return trimmed
-            .replace("127.0.0.1", "host.docker.internal")
-            .replace("localhost", "host.docker.internal")
-            .replace("0.0.0.0", "host.docker.internal")
-            .replace(/\/$/, "");
-    }
-}
-function resolveRuntimeAgentImage() {
-    const fromEnv = normalizeToken(process.env["INSTAFY_RUNTIME_AGENT_IMAGE"]) ??
-        normalizeToken(process.env["RUNTIME_AGENT_IMAGE"]) ??
-        null;
-    return fromEnv ?? "ghcr.io/instafy-dev/instafy-runtime-agent:latest";
-}
-function dockerContainerRunning(containerId) {
-    const id = containerId.trim();
-    if (!id) {
-        return false;
-    }
-    try {
-        const result = spawnSync("docker", ["inspect", "-f", "{{.State.Running}}", id], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-        });
-        if (result.status !== 0) {
-            return false;
-        }
-        return String(result.stdout ?? "").trim() === "true";
-    }
-    catch {
-        return false;
-    }
-}
-function stopDockerContainer(containerId) {
-    const id = containerId.trim();
-    if (!id) {
-        return;
-    }
-    try {
-        spawnSync("docker", ["rm", "-f", id], { stdio: "ignore" });
-    }
-    catch {
-        // ignore
-    }
-}
-function printStatus(label, value) {
-    console.log(`${kleur.cyan(label)} ${value}`);
-}
-function ensureStateDir() {
-    mkdirSync(INSTAFY_DIR, { recursive: true });
-}
-function ensureLogDir() {
-    mkdirSync(LOG_DIR, { recursive: true });
-}
-function writeState(state) {
-    ensureStateDir();
-    writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
-}
-function readState() {
-    try {
-        const raw = readFileSync(STATE_FILE, "utf8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-function clearState() {
-    try {
-        rmSync(STATE_FILE);
-    }
-    catch {
-        // ignore
-    }
-}
-function normalizeToken(value) {
-    if (typeof value !== "string") {
-        return null;
-    }
-    const trimmed = value.trim();
-    return trimmed.length > 0 ? trimmed : null;
-}
-export { findProjectManifest };
-function readTokenFromFile(filePath) {
-    const normalized = normalizeToken(filePath);
-    if (!normalized) {
-        return null;
-    }
-    const resolved = path.resolve(normalized);
-    const contents = readFileSync(resolved, "utf8").trim();
-    if (!contents) {
-        throw new Error(`token file ${resolved} was empty`);
-    }
-    return contents;
-}
-function resolveSupabaseAccessToken(options, env) {
-    const explicit = normalizeToken(options.supabaseAccessToken);
-    if (explicit) {
-        return explicit;
-    }
-    const fromFile = readTokenFromFile(options.supabaseAccessTokenFile);
-    if (fromFile) {
-        return fromFile;
-    }
-    const fromEnv = normalizeToken(env["SUPABASE_ACCESS_TOKEN"]);
-    if (fromEnv) {
-        return fromEnv;
-    }
-    return null;
-}
-function findRatholeOnPath() {
-    const names = process.platform === "win32" ? ["rathole.exe", "rathole"] : ["rathole"];
-    const pathEntries = (process.env.PATH ?? "")
-        .split(path.delimiter)
-        .map((entry) => entry.trim())
-        .filter(Boolean);
-    for (const entry of pathEntries) {
-        for (const name of names) {
-            const candidate = path.join(entry, name);
-            if (existsSync(candidate)) {
-                return candidate;
-            }
-        }
-    }
-    return null;
-}
-function resolveControllerAccessTokenForCliWithSource(options, env, supabaseAccessToken, profile, cwd) {
-    const explicit = normalizeToken(options.controllerAccessToken);
-    if (explicit) {
-        return { token: explicit, source: "explicit" };
-    }
-    const envToken = normalizeToken(env["INSTAFY_ACCESS_TOKEN"]) ??
-        normalizeToken(env["CONTROLLER_ACCESS_TOKEN"]);
-    if (envToken) {
-        return { token: envToken, source: "env" };
-    }
-    if (supabaseAccessToken) {
-        return { token: supabaseAccessToken, source: "explicit" };
-    }
-    const supabaseEnvToken = normalizeToken(env["SUPABASE_ACCESS_TOKEN"]);
-    if (supabaseEnvToken) {
-        return { token: supabaseEnvToken, source: "env" };
-    }
-    const stored = resolveConfiguredAccessToken({ profile, cwd });
-    if (stored) {
-        return { token: stored, source: "config" };
-    }
-    return { token: null, source: "none" };
-}
-export async function resolveRatholeBinaryForCli(options) {
-    const warn = options.warn ??
-        ((message) => {
-            console.warn(kleur.yellow(message));
-        });
-    const logger = options.logger ??
-        ((message) => {
-            console.log(kleur.cyan(`[rathole] ${message}`));
-        });
-    const existing = normalizeToken(options.env["RATHOLE_BIN"]);
-    if (existing) {
-        options.env["RATHOLE_BIN"] = existing;
-        return existing;
-    }
-    const finder = options.findBinary ?? findRatholeOnPath;
-    const detected = finder();
-    if (detected) {
-        options.env["RATHOLE_BIN"] = detected;
-        return detected;
-    }
-    const download = options.downloadBinary ??
-        ((params) => ensureRatholeBinary(params));
-    try {
-        const resolved = await download({
-            version: normalizeToken(options.version ?? undefined) ?? undefined,
-            cacheDir: normalizeToken(options.cacheDir ?? undefined) ?? undefined,
-            logger,
-        });
-        options.env["RATHOLE_BIN"] = resolved;
-        return resolved;
-    }
-    catch (error) {
-        const suffix = error instanceof Error
-            ? error.message
-            : typeof error === "string"
-                ? error
-                : JSON.stringify(error);
-        const osHint = process.platform === "darwin"
-            ? "Install with cargo (`cargo install --locked rathole`) or set RATHOLE_BIN to a downloaded binary."
-            : process.platform === "linux"
-                ? "Download from https://github.com/rapiz1/rathole/releases (matching your arch) or build via `cargo install --locked rathole`."
-                : "Download a rathole binary for your OS/arch and set RATHOLE_BIN.";
-        warn(`rathole unavailable (set RATHOLE_BIN or install on PATH). ${osHint} ${suffix}`);
-        return null;
-    }
-}
-export async function mintRuntimeAccessToken(params) {
-    const url = params.controllerUrl.replace(/\/$/, "");
-    const target = `${url}/projects/${encodeURIComponent(params.projectId)}/runtime/token`;
-    const { response } = await fetchWithControllerAuth({
-        url: target,
-        init: {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-            },
-            body: JSON.stringify({
-                runtimeId: params.runtimeId,
-                leaseId: params.leaseId,
-                scopes: params.scopes,
-            }),
-        },
-        accessToken: params.controllerAccessToken,
-        tokenSource: params.tokenSource ?? "env",
-        profile: params.profile ?? null,
-        cwd: params.cwd ?? null,
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => "");
-        if (response.status === 401 || response.status === 403) {
-            throw formatAuthRejectedError({
-                status: response.status,
-                responseBody: text,
-            });
-        }
-        throw new Error(`Instafy server rejected runtime token request (${response.status} ${response.statusText}): ${text}`);
-    }
-    const payload = (await response.json());
-    const token = typeof payload.token === "string" ? payload.token.trim() : "";
-    if (!token) {
-        throw new Error("Instafy server response missing token field while minting runtime token.");
-    }
-    return token;
-}
-async function requestRuntimeLease(params) {
-    const url = params.controllerUrl.replace(/\/$/, "");
-    const target = `${url}/projects/${encodeURIComponent(params.projectId)}/runtime/request`;
-    const { response, accessToken } = await fetchWithControllerAuth({
-        url: target,
-        init: {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-            },
-            body: JSON.stringify({
-                provider: params.provider,
-                displayName: params.displayName,
-                idleTtlSeconds: params.idleTtlSeconds,
-                requestTunnel: params.requestTunnel,
-                runtimeId: params.runtimeId,
-            }),
-        },
-        accessToken: params.accessToken,
-        tokenSource: params.tokenSource,
-        profile: params.profile,
-        cwd: params.cwd,
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => "");
-        if (response.status === 401 || response.status === 403) {
-            throw formatAuthRejectedError({
-                status: response.status,
-                responseBody: text,
-            });
-        }
-        throw new Error(`Instafy server rejected runtime request (${response.status} ${response.statusText}): ${text}`);
-    }
-    const payload = (await response.json());
-    const runtime = (payload["runtime"] ?? payload);
-    const runtimeId = (typeof runtime?.["runtimeId"] === "string" ? runtime["runtimeId"] : null) ??
-        (typeof runtime?.["runtime_id"] === "string" ? runtime["runtime_id"] : null) ??
-        null;
-    const leaseId = (typeof runtime?.["leaseId"] === "string" ? runtime["leaseId"] : null) ??
-        (typeof runtime?.["lease_id"] === "string" ? runtime["lease_id"] : null) ??
-        null;
-    if (!runtimeId || !runtimeId.trim()) {
-        throw new Error("Instafy server response missing runtimeId while requesting runtime lease.");
-    }
-    if (!leaseId || !leaseId.trim()) {
-        throw new Error("Instafy server response missing leaseId while requesting runtime lease.");
-    }
-    return { runtimeId: runtimeId.trim(), leaseId: leaseId.trim(), accessToken };
-}
-function isProcessAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function runtimeStart(options) {
-    const env = { ...process.env };
-    const cwd = process.cwd();
-    const existing = readState();
-    if (existing) {
-        if (existing.runner === "docker" && existing.containerId && dockerContainerRunning(existing.containerId)) {
-            throw new Error(`Runtime already running (docker container ${existing.containerId}) for project ${existing.projectId}. Stop it first.`);
-        }
-        if ((!existing.runner || existing.runner === "process") && isProcessAlive(existing.pid)) {
-            throw new Error(`Runtime already running (pid ${existing.pid}) for project ${existing.projectId}. Stop it first.`);
-        }
-    }
-    const manifestInfo = findProjectManifest(cwd);
-    const projectId = options.project ?? env["PROJECT_ID"] ?? manifestInfo.manifest?.projectId ?? null;
-    if (!projectId) {
-        throw new Error("No project configured. Run `instafy project init` in this folder (recommended) or pass --project.");
-    }
-    env["PROJECT_ID"] = projectId;
-    const supabaseAccessToken = resolveSupabaseAccessToken(options, env);
-    if (supabaseAccessToken) {
-        env["SUPABASE_ACCESS_TOKEN"] = supabaseAccessToken;
-    }
-    const profile = resolveActiveProfileName({ cwd });
-    const controllerAccessTokenResult = resolveControllerAccessTokenForCliWithSource(options, env, supabaseAccessToken, profile, cwd);
-    let controllerAccessToken = controllerAccessTokenResult.token;
-    const controllerAccessTokenSource = controllerAccessTokenResult.source;
-    let runtimeAccessToken = normalizeToken(options.runtimeToken) ?? normalizeToken(env["RUNTIME_ACCESS_TOKEN"]);
-    const agentKey = options.controllerToken ??
-        env["INSTAFY_SERVICE_TOKEN"] ??
-        env["AGENT_LOGIN_KEY"] ??
-        env["AGENT_KEY"];
-    if (!agentKey && !controllerAccessToken && !runtimeAccessToken) {
-        throw new Error("Login required. Run `instafy login`, or pass --access-token / --supabase-access-token, or provide --runtime-token.");
-    }
-    if (agentKey) {
-        env["AGENT_LOGIN_KEY"] = agentKey;
-    }
-    if (controllerAccessToken) {
-        env["CONTROLLER_ACCESS_TOKEN"] = controllerAccessToken;
-    }
-    env["CONTROLLER_BASE_URL"] =
-        options.controllerUrl ??
-            env["INSTAFY_SERVER_URL"] ??
-            env["CONTROLLER_BASE_URL"] ??
-            manifestInfo.manifest?.controllerUrl ??
-            "http://127.0.0.1:8788";
-    if (options.codexBin)
-        env["CODEX_BIN"] = options.codexBin;
-    if (options.proxyBaseUrl)
-        env["PROXY_BASE_URL"] = options.proxyBaseUrl;
-    if (!env["CODEX_REASONING_EFFORT"]) {
-        env["CODEX_REASONING_EFFORT"] = "low";
-    }
-    const workspace = path.resolve(options.workspace ?? env["WORKSPACE_DIR"] ?? path.join(process.cwd(), ".instafy", "workspace"));
-    mkdirSync(workspace, { recursive: true });
-    env["WORKSPACE_DIR"] = workspace;
-    const originId = options.originId ?? env["ORIGIN_ID"] ?? randomUUID();
-    env["ORIGIN_ID"] = originId;
-    env["ORIGIN_BIND_HOST"] = options.bindHost ?? env["ORIGIN_BIND_HOST"] ?? "127.0.0.1";
-    env["ORIGIN_BIND_PORT"] = String(options.bindPort ?? env["ORIGIN_BIND_PORT"] ?? 54332);
-    env["ORIGIN_PROTOCOLS"] = env["ORIGIN_PROTOCOLS"] ?? "http";
-    if (options.originEndpoint && options.originEndpoint.trim()) {
-        env["ORIGIN_ENDPOINT"] = options.originEndpoint.trim();
-    }
-    const skipAuthRaw = env["ORIGIN_SKIP_AUTH"]?.trim().toLowerCase();
-    const skipAuth = skipAuthRaw === "1" || skipAuthRaw === "true" || skipAuthRaw === "yes";
-    const usesTunnel = !env["ORIGIN_ENDPOINT"];
-    const usesExplicitEndpoint = Boolean(env["ORIGIN_ENDPOINT"]);
-    if (skipAuth && (usesTunnel || usesExplicitEndpoint)) {
-        console.warn(kleur.yellow("Warning: ORIGIN_SKIP_AUTH is enabled while the origin may be reachable remotely (tunnel or --origin-endpoint). " +
-            "This is unsafe; disable ORIGIN_SKIP_AUTH for any non-local usage."));
-    }
-    env["RUNTIME_DISPLAY_NAME"] =
-        options.displayName ?? env["RUNTIME_DISPLAY_NAME"] ?? "Instafy CLI Runtime";
-    env["RUNTIME_PROVIDER"] =
-        options.provider ?? env["RUNTIME_PROVIDER"] ?? "self-hosted";
-    env["RUNTIME_VERSION"] = env["RUNTIME_VERSION"] ?? "0.1.0";
-    env["RUNTIME_REQUIRE_CODEX_BIN"] = env["RUNTIME_REQUIRE_CODEX_BIN"] || "0";
-    env["RUNTIME_CAPABILITIES"] =
-        env["RUNTIME_CAPABILITIES"] ||
-            JSON.stringify({ fs: true, github: true, supabase: true, runs: true, agent: true, origin: true });
-    if (options.runtimeId && options.runtimeId.trim()) {
-        env["RUNTIME_ID"] = options.runtimeId.trim();
-    }
-    if (options.runtimeLeaseId && options.runtimeLeaseId.trim()) {
-        env["RUNTIME_LEASE_ID"] = options.runtimeLeaseId.trim();
-    }
-    const runtimeMode = (options.runtimeMode ?? "auto").toLowerCase();
-    const runtimeBin = runtimeMode === "docker" ? null : tryResolveRuntimeBinary();
-    const useDocker = runtimeMode === "docker" ||
-        (runtimeMode === "auto" && !runtimeBin);
-    if (useDocker && !isDockerAvailable()) {
-        throw new Error("runtime-agent is not available (no local binary and docker is not installed). Install Docker Desktop, or build runtime-agent from source.");
-    }
-    const originEnabledRaw = env["ORIGIN_ENABLED"]?.trim().toLowerCase();
-    const originEnabled = !originEnabledRaw ||
-        originEnabledRaw === "1" ||
-        originEnabledRaw === "true" ||
-        originEnabledRaw === "yes" ||
-        originEnabledRaw === "on";
-    if (originEnabled && usesTunnel && !useDocker) {
-        const ratholeResolved = await resolveRatholeBinaryForCli({
-            env,
-            version: process.env["RATHOLE_VERSION"] ?? null,
-            cacheDir: process.env["RATHOLE_CACHE_DIR"] ?? null,
-            logger: (message) => console.log(kleur.cyan(`[rathole] ${message}`)),
-            warn: (message) => console.warn(kleur.yellow(message)),
-        });
-        if (!ratholeResolved) {
-            throw new Error("Tunnel is required but rathole is unavailable. Set RATHOLE_BIN (recommended) or pass --origin-endpoint to use a reachable URL.");
-        }
-    }
-    if (originEnabled && usesTunnel && !env["RUNTIME_LEASE_ID"]) {
-        const bearer = controllerAccessToken ?? runtimeAccessToken;
-        const tokenSource = controllerAccessToken ? controllerAccessTokenSource : "env";
-        if (!bearer) {
-            throw new Error("Login required to request a tunnel-enabled runtime lease. Run `instafy login` or pass --controller-access-token/--runtime-token.");
-        }
-        const ttl = typeof env["RUNTIME_LEASE_SECONDS"] === "string" ? Number(env["RUNTIME_LEASE_SECONDS"]) : NaN;
-        const idleTtlSeconds = Number.isFinite(ttl) && ttl > 0 ? ttl : undefined;
-        const lease = await requestRuntimeLease({
-            controllerUrl: env["CONTROLLER_BASE_URL"],
-            accessToken: bearer,
-            tokenSource,
-            profile,
-            cwd,
-            projectId,
-            provider: env["RUNTIME_PROVIDER"],
-            displayName: env["RUNTIME_DISPLAY_NAME"],
-            idleTtlSeconds,
-            requestTunnel: false,
-            runtimeId: env["RUNTIME_ID"],
-        });
-        env["RUNTIME_ID"] = lease.runtimeId;
-        env["RUNTIME_LEASE_ID"] = lease.leaseId;
-        if (controllerAccessToken && bearer === controllerAccessToken) {
-            controllerAccessToken = lease.accessToken;
-            env["CONTROLLER_ACCESS_TOKEN"] = controllerAccessToken;
-        }
-    }
-    if (!runtimeAccessToken && controllerAccessToken) {
-        runtimeAccessToken = await mintRuntimeAccessToken({
-            controllerUrl: env["CONTROLLER_BASE_URL"],
-            controllerAccessToken,
-            projectId,
-            runtimeId: env["RUNTIME_ID"],
-            leaseId: env["RUNTIME_LEASE_ID"],
-            tokenSource: controllerAccessTokenSource,
-            profile,
-            cwd,
-        });
-    }
-    if (runtimeAccessToken) {
-        env["RUNTIME_ACCESS_TOKEN"] = runtimeAccessToken;
-    }
-    let originToken = normalizeToken(options.originToken) ?? normalizeToken(env["ORIGIN_INTERNAL_TOKEN"]);
-    if (!originToken && runtimeAccessToken) {
-        originToken = runtimeAccessToken;
-    }
-    if (!originToken && controllerAccessToken) {
-        originToken = await mintRuntimeAccessToken({
-            controllerUrl: env["CONTROLLER_BASE_URL"],
-            controllerAccessToken,
-            projectId,
-            runtimeId: env["RUNTIME_ID"],
-            leaseId: env["RUNTIME_LEASE_ID"],
-            tokenSource: controllerAccessTokenSource,
-            profile,
-            cwd,
-        });
-    }
-    if (!originToken) {
-        throw new Error("Runtime/origin token is required (--origin-token or ORIGIN_INTERNAL_TOKEN), or provide --runtime-token/--controller-access-token to mint/use one");
-    }
-    env["ORIGIN_INTERNAL_TOKEN"] = originToken;
-    if (!useDocker) {
-        if (!env["ORIGIN_ENDPOINT"]) {
-            const ratholeResolved = await resolveRatholeBinaryForCli({
-                env,
-                version: process.env["RATHOLE_VERSION"] ?? null,
-                cacheDir: process.env["RATHOLE_CACHE_DIR"] ?? null,
-                logger: (message) => console.log(kleur.cyan(`[rathole] ${message}`)),
-                warn: (message) => console.warn(kleur.yellow(message)),
-            });
-            if (!ratholeResolved) {
-                throw new Error("Tunnel is required but rathole is unavailable. Set RATHOLE_BIN (recommended) or pass --origin-endpoint to use a reachable URL.");
-            }
-        }
-        const bin = runtimeBin ?? resolveRuntimeBinary();
-        printStatus("Starting runtime-agent:", bin);
-        printStatus("Project:", projectId);
-        printStatus("Workspace:", workspace);
-        printStatus("Origin:", originId);
-        const detached = Boolean(options.detach);
-        const logFile = options.logFile?.trim()
-            ? path.resolve(options.logFile)
-            : detached
-                ? path.join(LOG_DIR, `runtime-${Date.now()}.log`)
-                : undefined;
-        if (logFile) {
-            ensureLogDir();
-        }
-        let stdio;
-        if (!logFile && !detached) {
-            stdio = "inherit";
-        }
-        else {
-            const out = logFile ? openSync(logFile, "a") : "ignore";
-            stdio = ["ignore", out, out];
-        }
-        const spawnOptions = { env, stdio, detached };
-        const child = spawn(bin, spawnOptions);
-        if (detached) {
-            child.unref();
-        }
-        const startedAt = new Date().toISOString();
-        writeState({
-            runner: "process",
-            pid: child.pid ?? -1,
-            projectId,
-            workspace,
-            controllerUrl: env["CONTROLLER_BASE_URL"],
-            originId,
-            runtimeId: env["RUNTIME_ID"] ?? null,
-            displayName: env["RUNTIME_DISPLAY_NAME"],
-            startedAt,
-            logFile,
-            detached,
-        });
-        child.on("exit", (code, signal) => {
-            const msg = code !== null ? `code ${code}` : `signal ${signal}`;
-            console.log(kleur.yellow(`runtime-agent exited (${msg})`));
-            const current = readState();
-            if (current && current.pid === child.pid) {
-                clearState();
-            }
-        });
-        return;
-    }
-    const image = resolveRuntimeAgentImage();
-    const containerName = `instafy-runtime-${originId}`;
-    const hostPort = String(options.bindPort ?? env["ORIGIN_BIND_PORT"] ?? 54332);
-    const hostBindHost = options.bindHost ?? "127.0.0.1";
-    const dockerEnv = { ...env };
-    dockerEnv["WORKSPACE_DIR"] = "/workspace";
-    dockerEnv["CODEX_HOME"] = "/workspace/.codex";
-    dockerEnv["TMPDIR"] = "/tmp";
-    dockerEnv["TMP"] = "/tmp";
-    dockerEnv["TEMP"] = "/tmp";
-    dockerEnv["ORIGIN_BIND_HOST"] = "0.0.0.0";
-    dockerEnv["CONTROLLER_BASE_URL"] = normalizeControllerUrlForDocker(env["CONTROLLER_BASE_URL"] ?? "");
-    const envArgs = [];
-    for (const [key, value] of Object.entries(dockerEnv)) {
-        if (typeof value !== "string" || value.length === 0)
-            continue;
-        envArgs.push("-e", `${key}=${value}`);
-    }
-    const runArgs = [
-        "run",
-        "--detach",
-        "--name",
-        containerName,
-        "--add-host",
-        "host.docker.internal:host-gateway",
-        "-p",
-        `${hostBindHost}:${hostPort}:${hostPort}`,
-        "-v",
-        `${workspace}:/workspace`,
-        ...envArgs,
-        image,
-    ];
-    printStatus("Starting runtime-agent (docker):", image);
-    printStatus("Project:", projectId);
-    printStatus("Workspace:", workspace);
-    printStatus("Origin:", originId);
-    const started = spawnSync("docker", runArgs, { encoding: "utf8" });
-    if (started.status !== 0) {
-        const stderr = String(started.stderr ?? "").trim();
-        const normalized = (stderr || "").toLowerCase();
-        const hints = [];
-        if (image.startsWith("ghcr.io/") && (normalized.includes("not found") || normalized.includes("denied") || normalized.includes("unauthorized") || normalized.includes("manifest unknown"))) {
-            hints.push("If this is a GHCR image, ensure it's published and you are authenticated (`docker login ghcr.io`).");
-        }
-        hints.push("Override the image with `INSTAFY_RUNTIME_AGENT_IMAGE=... instafy runtime start`.");
-        const suffix = hints.length > 0 ? `\n\nNext:\n- ${hints.join("\n- ")}` : "";
-        throw new Error(`docker run failed: ${stderr || "unknown error"}${suffix}`);
-    }
-    const containerId = String(started.stdout ?? "").trim();
-    if (!containerId) {
-        throw new Error("docker run did not return a container id");
-    }
-    const startedAt = new Date().toISOString();
-    writeState({
-        runner: "docker",
-        pid: -1,
-        projectId,
-        workspace,
-        controllerUrl: env["CONTROLLER_BASE_URL"],
-        originId,
-        runtimeId: env["RUNTIME_ID"] ?? null,
-        displayName: env["RUNTIME_DISPLAY_NAME"],
-        startedAt,
-        detached: Boolean(options.detach),
-        containerId,
-        containerName,
-    });
-    if (options.detach) {
-        printStatus("Container:", containerId);
-        console.log(kleur.gray(`Use: docker logs -f ${containerId}`));
-        return;
-    }
-    const logs = spawn("docker", ["logs", "-f", containerId], { stdio: "inherit" });
-    const handleExit = async () => {
-        stopDockerContainer(containerId);
-        const current = readState();
-        if (current?.containerId === containerId) {
-            clearState();
-        }
-    };
-    process.once("SIGINT", () => {
-        void handleExit();
-    });
-    process.once("SIGTERM", () => {
-        void handleExit();
-    });
-    logs.on("exit", () => {
-        void handleExit();
-    });
-}
-function formatStatus(state, running) {
-    return {
-        running,
-        runner: state.runner ?? "process",
-        pid: state.pid,
-        containerId: state.containerId ?? null,
-        containerName: state.containerName ?? null,
-        projectId: state.projectId,
-        workspace: state.workspace,
-        controllerUrl: state.controllerUrl ?? null,
-        originId: state.originId ?? null,
-        runtimeId: state.runtimeId ?? null,
-        displayName: state.displayName ?? null,
-        startedAt: state.startedAt,
-        logFile: state.logFile ?? null,
-        detached: state.detached ?? false,
-    };
-}
-async function sendOfflineBeat(state) {
-    if (!state.controllerUrl || !state.projectId || !state.originId) {
-        return;
-    }
-    const directToken = normalizeToken(process.env["RUNTIME_ACCESS_TOKEN"]) ??
-        normalizeToken(process.env["ORIGIN_INTERNAL_TOKEN"]);
-    let bearer = directToken;
-    if (!bearer) {
-        const controllerAccessToken = normalizeToken(process.env["CONTROLLER_ACCESS_TOKEN"]) ??
-            normalizeToken(process.env["SUPABASE_ACCESS_TOKEN"]) ??
-            resolveConfiguredAccessToken();
-        if (controllerAccessToken) {
-            try {
-                bearer = await mintRuntimeAccessToken({
-                    controllerUrl: state.controllerUrl,
-                    controllerAccessToken,
-                    projectId: state.projectId,
-                    runtimeId: state.runtimeId ?? undefined,
-                });
-            }
-            catch (error) {
-                const suffix = error instanceof Error ? `: ${error.message}` : error ? `: ${String(error)}` : "";
-                console.warn(kleur.yellow(`Could not mint runtime token for offline beat${suffix}`));
-            }
-        }
-    }
-    if (!bearer) {
-        return;
-    }
-    const offlinePayload = {
-        projectId: state.projectId,
-        originId: state.originId,
-        status: "offline",
-        latencyMs: null,
-        region: "iad",
-        metadata: { cli: true },
-    };
-    try {
-        await fetch(`${state.controllerUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(state.projectId)}/origin/presence/beat`, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${bearer}`,
-                "content-type": "application/json",
-            },
-            body: JSON.stringify(offlinePayload),
-        });
-    }
-    catch {
-        // ignore failures
-    }
-}
-async function waitForExit(pid, timeoutMs) {
-    const start = Date.now();
-    while (Date.now() - start < timeoutMs) {
-        if (!isProcessAlive(pid))
-            return true;
-        await new Promise((resolve) => setTimeout(resolve, 200));
-    }
-    return !isProcessAlive(pid);
-}
-export async function runtimeStatus(options) {
-    const state = readState();
-    if (!state) {
-        if (options?.json) {
-            console.log(JSON.stringify({ running: false }));
-        }
-        else {
-            console.log(kleur.yellow("No runtime state found."));
-        }
-        return;
-    }
-    const alive = state.runner === "docker"
-        ? Boolean(state.containerId && dockerContainerRunning(state.containerId))
-        : isProcessAlive(state.pid);
-    const payload = formatStatus(state, alive);
-    if (options?.json) {
-        console.log(JSON.stringify(payload));
-        return;
-    }
-    console.log(alive ? kleur.green("Runtime is running") : kleur.red("Runtime is not running"));
-    printStatus("Runner:", state.runner ?? "process");
-    if (state.runner === "docker") {
-        if (state.containerId)
-            printStatus("Container:", state.containerId);
-        if (state.containerName)
-            printStatus("Name:", state.containerName);
-    }
-    else {
-        printStatus("PID:", String(state.pid));
-    }
-    printStatus("Project:", state.projectId);
-    printStatus("Workspace:", state.workspace);
-    if (state.controllerUrl)
-        printStatus("Server:", state.controllerUrl);
-    if (state.originId)
-        printStatus("Origin:", state.originId);
-    if (state.runtimeId)
-        printStatus("Runtime:", state.runtimeId);
-    if (state.displayName)
-        printStatus("Display:", state.displayName);
-    printStatus("Started:", state.startedAt);
-    if (state.logFile)
-        printStatus("Log:", state.logFile);
-    printStatus("Detached:", state.detached ? "yes" : "no");
-    if (!alive) {
-        console.log(kleur.yellow(`State file exists but ${state.runner === "docker" ? "container" : "process"} is not alive.`));
-    }
-}
-export async function runtimeStop(options) {
-    const state = readState();
-    if (!state) {
-        if (options?.json) {
-            console.log(JSON.stringify({ stopped: false, reason: "not_running" }));
-        }
-        else {
-            console.log(kleur.yellow("Runtime not running."));
-        }
-        return;
-    }
-    if (state.runner === "docker") {
-        const running = Boolean(state.containerId && dockerContainerRunning(state.containerId));
-        if (state.containerId) {
-            stopDockerContainer(state.containerId);
-        }
-        clearState();
-        await sendOfflineBeat(state);
-        const result = { stopped: running, containerId: state.containerId ?? null };
-        if (options?.json) {
-            console.log(JSON.stringify(result));
-        }
-        else {
-            console.log(running ? kleur.green("Runtime stopped.") : kleur.yellow("Runtime not running."));
-        }
-        return;
-    }
-    if (!isProcessAlive(state.pid)) {
-        clearState();
-        if (options?.json) {
-            console.log(JSON.stringify({ stopped: false, reason: "not_running" }));
-        }
-        else {
-            console.log(kleur.yellow("Runtime process already stopped. State cleared."));
-        }
-        return;
-    }
-    try {
-        process.kill(state.pid, "SIGINT");
-    }
-    catch (error) {
-        if (options?.json) {
-            console.log(JSON.stringify({ stopped: false, error: String(error) }));
-            return;
-        }
-        throw error;
-    }
-    const exited = await waitForExit(state.pid, 5000);
-    if (!exited) {
-        try {
-            process.kill(state.pid, "SIGTERM");
-        }
-        catch {
-            // ignore
-        }
-    }
-    const alive = isProcessAlive(state.pid);
-    if (!alive) {
-        clearState();
-    }
-    await sendOfflineBeat(state);
-    const result = { stopped: !alive, pid: state.pid };
-    if (options?.json) {
-        console.log(JSON.stringify(result));
-    }
-    else {
-        console.log(!alive ? kleur.green("Runtime stopped.") : kleur.red("Failed to stop runtime."));
-    }
-}
-export async function runtimeToken(options) {
-    const cwd = process.cwd();
-    const controllerUrl = options.controllerUrl ??
-        process.env["INSTAFY_SERVER_URL"] ??
-        process.env["CONTROLLER_BASE_URL"] ??
-        "http://127.0.0.1:8788";
-    const profile = resolveActiveProfileName({ cwd });
-    const stored = resolveConfiguredAccessToken({ profile, cwd });
-    const tokenSource = options.controllerAccessToken
-        ? "explicit"
-        : process.env["INSTAFY_ACCESS_TOKEN"] ||
-            process.env["CONTROLLER_ACCESS_TOKEN"] ||
-            process.env["SUPABASE_ACCESS_TOKEN"]
-            ? "env"
-            : stored
-                ? "config"
-                : "none";
-    const token = options.controllerAccessToken ??
-        process.env["INSTAFY_ACCESS_TOKEN"] ??
-        process.env["CONTROLLER_ACCESS_TOKEN"] ??
-        process.env["SUPABASE_ACCESS_TOKEN"] ??
-        stored;
-    if (!token) {
-        throw new Error("Login required. Run `instafy login` or pass --access-token / set SUPABASE_ACCESS_TOKEN.");
-    }
-    const minted = await mintRuntimeAccessToken({
-        controllerUrl,
-        controllerAccessToken: token,
-        projectId: options.project,
-        runtimeId: options.runtimeId,
-        scopes: options.scopes,
-        tokenSource: tokenSource === "none" ? "env" : tokenSource,
-        profile,
-        cwd,
-    });
-    if (options.json) {
-        console.log(JSON.stringify({ token: minted }));
-    }
-    else {
-        console.log(minted);
-    }
-    return minted;
-}