@kynver-app/runtime 0.1.8 → 0.1.9

package/dist/index.js

@@ -146,6 +146,8 @@ function saveApiKey(apiKey) {
   saveCredentialsFile({ ...loadCredentialsFile(), apiKey });
 }
 function loadRunnerToken(agentOsId) {
+  const envToken = process.env.KYNVER_RUNNER_TOKEN?.trim();
+  if (envToken) return envToken;
   const creds = loadCredentialsFile();
   if (!creds.runnerToken) return void 0;
   if (agentOsId && creds.runnerTokenAgentOsId && creds.runnerTokenAgentOsId !== agentOsId) {
@@ -161,11 +163,15 @@ function saveRunnerToken(agentOsId, token) {
   });
 }
 function resolveBaseUrl(argsBaseUrl) {
-  const baseUrl = argsBaseUrl || process.env.KYNVER_API_URL || process.env.OPENCLAW_CRON_FIRE_BASE_URL || loadUserConfig().apiBaseUrl;
+  const baseUrl = resolveConfiguredBaseUrl(argsBaseUrl);
   if (!baseUrl) failConfig("requires --base-url, KYNVER_API_URL, OPENCLAW_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl");
-  return trimTrailingSlash(String(baseUrl));
+  return baseUrl;
 }
-function resolveCallbackSecret(argsSecret, agentOsId) {
+function resolveConfiguredBaseUrl(argsBaseUrl) {
+  const baseUrl = argsBaseUrl || process.env.KYNVER_API_URL || process.env.OPENCLAW_CRON_FIRE_BASE_URL || loadUserConfig().apiBaseUrl;
+  return baseUrl ? trimTrailingSlash(String(baseUrl)) : void 0;
+}
+function resolveConfiguredCallbackSecret(argsSecret, agentOsId) {
   const scoped = argsSecret || loadRunnerToken(agentOsId) || loadRunnerToken(loadUserConfig().agentOsId);
   if (scoped) return String(scoped);
   const globalSecret = process.env.KYNVER_RUNTIME_SECRET || process.env.OPENCLAW_CRON_SECRET;
@@ -175,8 +181,31 @@ function resolveCallbackSecret(argsSecret, agentOsId) {
     );
     return String(globalSecret);
   }
+  return void 0;
+}
+function resolveCallbackSecret(argsSecret, agentOsId) {
+  const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
+  if (configured) return configured;
+  failConfig(
+    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET"
+  );
+}
+async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
+  const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
+  if (configured) return configured;
+  const apiKey = loadApiKey();
+  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
+  if (apiKey && agentOsId && baseUrl) {
+    try {
+      const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
+      saveRunnerToken(agentOsId, token);
+      return token;
+    } catch (error) {
+      failConfig(`runner credential mint failed: ${error.message}`);
+    }
+  }
   failConfig(
-    "requires --secret, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, or (legacy) KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET"
+    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET"
   );
 }
 async function fetchRunnerCredential(agentOsId, opts) {
@@ -1050,7 +1079,7 @@ async function dispatchRun(args) {
     const run = loadRun(String(required(String(args.run || ""), "--run")));
     const agentOsId = String(required(String(args.agentOsId || ""), "--agent-os-id"));
     const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-    const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+    const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
     const execute = args.execute === true || args.execute === "true";
     const dryRun = !execute;
     const leaseOwner = `openclaw-harness:${run.id}`;
@@ -1278,7 +1307,7 @@ async function sweepRun(args) {
     const run = loadRun(String(required(String(args.run || ""), "--run")));
     const agentOsId = String(required(String(args.agentOsId || ""), "--agent-os-id"));
     const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-    const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+    const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
     const leaseOwner = `openclaw-harness:${run.id}`;
     const releasedLocalOrphans = [];
     for (const name of Object.keys(run.workers || {})) {
@@ -1339,7 +1368,7 @@ async function tryCompleteWorker(args) {
     return { ok: true, skipped: true, reason: "worker-not-finished" };
   }
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/harness/completion`;
   const body = {
     source: "openclaw-harness",
@@ -1501,7 +1530,7 @@ import path12 from "node:path";
 // src/plan-progress-sync.ts
 async function syncPlanProgress(args) {
   const base = resolveBaseUrl(args.baseUrl);
-  const secret = resolveCallbackSecret(args.secret, args.agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret, args.agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(args.agentOsId)}/tasks/${encodeURIComponent(args.taskId)}/plan-progress-sync`;
   const res = await postJson(url, secret, {
     phase: args.phase,
@@ -1550,7 +1579,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
 // src/workspace-runtime-config.ts
 async function fetchWorkspaceRuntimePreferences(agentOsId, args) {
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/runtime`;
   try {
     const res = await getJson(url, secret);
@@ -1593,7 +1622,7 @@ async function completeFinishedWorkers(runId, args) {
 }
 async function postOperatorTick(agentOsId, runId, resourceGate, args) {
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/operator/tick`;
   const res = await postJson(url, secret, {
     agentOsId,
@@ -1717,7 +1746,7 @@ async function emitPlanProgress(args) {
     evidence.push(parseEvidenceArg(rawEvidence));
   }
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/plans/${encodeURIComponent(planId)}/progress-events`;
   const cfg = loadUserConfig();
   const provider = cfg.workerProvider ? `provider:${cfg.workerProvider}` : void 0;
@@ -1884,6 +1913,7 @@ export {
   redactHarness,
   resolveBaseUrl,
   resolveCallbackSecret,
+  resolveCallbackSecretWithMint,
   resolveHarnessRoot,
   runDaemon,
   runStatus,