@lumi.ai/runner 0.15.17 → 0.15.18

package/dist/cli.js

@@ -8,8 +8,8 @@ import os4 from "node:os";
 import {
   collection as collection7,
   deleteField as deleteField2,
-  doc as doc8,
-  getDoc as getDoc7,
+  doc as doc7,
+  getDoc as getDoc6,
   getDocs as getDocs6,
   onSnapshot as onSnapshot2,
   orderBy as orderBy4,
@@ -844,21 +844,6 @@ function firstStatusIn(statuses, category) {
 var RUNNER_OFFLINE_AFTER_MS = 2 * 60 * 1e3;
 
 // ../shared/dist/secrets.js
-var SECRET_DOCS = {
-  /** Captain-provided runner credentials (this file's shape). */
-  runner: "runner",
-  /** `{ tokenHash }` for the Workspace MCP bearer — backend-only, never client-readable. */
-  mcp: "mcp",
-  /**
-   * `{ runnerId, keyHash }` for THIS Ship's daemon credential (PRD §8.1) — backend-only.
-   *
-   * One document, not one per machine, because a Ship runs one daemon: issuing a key is
-   * therefore also how the previous one is revoked, exactly like rotating the MCP bearer.
-   * Only `docId == 'runner'` is released by packages/crew/firestore.rules, so this falls
-   * through to deny for every client without needing a rule of its own.
-   */
-  runnerKey: "runnerKey"
-};
 function missingSecretsFor(engineId, secrets) {
   const bag = secrets;
   return getEngine(engineId).requiredSecrets.filter((req) => !bag?.[req.key]).map((req) => req.label);
@@ -1038,7 +1023,7 @@ function mcpUrl(config2) {
 }
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.15.17" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.15.18" : "0.0.0-dev";
 
 // src/auth.ts
 import { signInWithCustomToken } from "firebase/auth";
@@ -2420,13 +2405,12 @@ async function resolveGithubToken(input) {
       throw e;
     }
   }
-  if (integration && !input.githubPat) {
+  if (integration) {
     return {
       source: "none",
       unavailable: `The Ship's GitHub connection is ${integration.status}. A captain can fix it in Ship Settings \u203A GitHub.`
     };
   }
-  if (input.githubPat) return { token: input.githubPat, source: "pat" };
   return null;
 }
 
@@ -2738,17 +2722,8 @@ function serversNeedingProbe(servers) {
   );
 }
 
-// src/jobs/secrets.ts
-import { doc as doc4, getDoc as getDoc4 } from "firebase/firestore";
-async function loadRunnerSecrets(db, shipId) {
-  const snap = await withFirestoreRetry(
-    () => getDoc4(doc4(db, COLLECTIONS.ships, shipId, COLLECTIONS.secrets, SECRET_DOCS.runner))
-  );
-  return snap.exists() ? snap.data() : null;
-}
-
 // src/jobs/credentials.ts
-import { collection as collection4, doc as doc5, getDoc as getDoc5, getDocs as getDocs4 } from "firebase/firestore";
+import { collection as collection4, doc as doc4, getDoc as getDoc4, getDocs as getDocs4 } from "firebase/firestore";
 async function loadShipCredentials(db, shipId) {
   const snap = await withFirestoreRetry(
     () => getDocs4(collection4(db, COLLECTIONS.ships, shipId, COLLECTIONS.credentials))
@@ -2757,35 +2732,41 @@ async function loadShipCredentials(db, shipId) {
 }
 async function loadCredentialToken(db, shipId, credentialId) {
   const snap = await withFirestoreRetry(
-    () => getDoc5(doc5(db, COLLECTIONS.ships, shipId, COLLECTIONS.secrets, credentialId))
+    () => getDoc4(doc4(db, COLLECTIONS.ships, shipId, COLLECTIONS.secrets, credentialId))
   );
   if (!snap.exists()) return null;
   const token = snap.data().token;
   return typeof token === "string" && token.trim() ? token : null;
 }
 async function resolveJobSecrets(input) {
-  const { agent, credentials, runnerSecrets } = input;
+  const { agent, credentials } = input;
   const engineId = agentEngine(agent);
   const resolved = resolveAgentCredential(agent, credentials, DEFAULT_ENGINE_ID);
-  if (resolved === void 0) return { secrets: runnerSecrets };
+  if (resolved === void 0) {
+    return {
+      secrets: null,
+      problem: `This workspace has no AI credential for ${engineId}. Add one in Settings \u203A AI credentials and the crew starts taking work again.`
+    };
+  }
   if (resolved === null) {
     return {
-      secrets: runnerSecrets,
+      secrets: null,
       problem: `This agent is set to an AI credential that no longer exists on the Ship. Point it at another one in Settings \u203A AI credentials, or add the credential back.`
     };
   }
   const token = await loadCredentialToken(input.db, input.shipId, resolved.id);
   if (!token) {
     return {
-      secrets: runnerSecrets,
+      secrets: null,
       problem: `The AI credential "${resolved.label}" has no token stored. Erase it in Settings \u203A AI credentials and add it again.`
     };
   }
   const key = getEngine(engineId).requiredSecrets[0]?.key;
-  if (!key) return { secrets: runnerSecrets };
+  if (!key) return { secrets: null };
   return {
     secrets: {
-      ...runnerSecrets ?? { updatedAt: resolved.updatedAt, updatedBy: resolved.createdBy },
+      updatedAt: resolved.updatedAt,
+      updatedBy: resolved.createdBy,
       [key]: token,
       [`${key}Tail`]: resolved.tail
     }
@@ -2796,7 +2777,7 @@ async function resolveJobSecrets(input) {
 import {
   collection as collection5,
   deleteDoc,
-  doc as doc6,
+  doc as doc5,
   onSnapshot,
   setDoc
 } from "firebase/firestore";
@@ -2825,7 +2806,7 @@ function nextResetAt(limits, now) {
   return soonest;
 }
 function limitRef(db, shipId, engineId) {
-  return doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits, engineId);
+  return doc5(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits, engineId);
 }
 async function noteEngineLimit(db, shipId, engineId, limit3, runnerId) {
   await setDoc(limitRef(db, shipId, engineId), {
@@ -2924,8 +2905,8 @@ import {
   addDoc,
   collection as collection6,
   deleteField,
-  doc as doc7,
-  getDoc as getDoc6,
+  doc as doc6,
+  getDoc as getDoc5,
   getDocs as getDocs5,
   limit as fsLimit,
   orderBy as orderBy3,
@@ -2971,10 +2952,10 @@ function backstopReportContent(resultText2) {
   return { report: report4, summary };
 }
 async function finalizeJob(db, shipId, job, input) {
-  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
-  const jobRef = doc7(shipRef, COLLECTIONS.jobs, job.id);
+  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
+  const jobRef = doc6(shipRef, COLLECTIONS.jobs, job.id);
   const now = Date.now();
-  const usageRef = doc7(shipRef, COLLECTIONS.usageDaily, utcDay(now));
+  const usageRef = doc6(shipRef, COLLECTIONS.usageDaily, utcDay(now));
   await runTransaction(db, async (tx) => {
     const usageSnap = await tx.get(usageRef);
     const jobSnap = await tx.get(jobRef);
@@ -3036,7 +3017,7 @@ async function finalizeJob(db, shipId, job, input) {
 }
 async function requeueForRetry(db, shipId, job, error) {
   await runTransaction(db, async (tx) => {
-    tx.update(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+    tx.update(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
       status: "queued",
       attempt: job.attempt + 1,
       error: error.slice(0, 1500),
@@ -3046,7 +3027,7 @@ async function requeueForRetry(db, shipId, job, error) {
   });
 }
 async function releaseJob(db, shipId, job, reason) {
-  await updateDoc(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+  await updateDoc(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
     status: "queued",
     runnerId: "",
     startedAt: 0,
@@ -3062,13 +3043,13 @@ async function releaseJob(db, shipId, job, reason) {
   });
 }
 async function markTaskFailed(db, shipId, job, error, statuses) {
-  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
-  const taskRef = doc7(shipRef, COLLECTIONS.tasks, job.taskId);
+  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
+  const taskRef = doc6(shipRef, COLLECTIONS.tasks, job.taskId);
   const now = Date.now();
   const failedStatus = firstStatusIn(statuses, "failed")?.id ?? "failed";
   await runTransaction(db, async (tx) => {
     tx.update(taskRef, { status: failedStatus, updatedAt: now });
-    tx.set(doc7(collection6(taskRef, COLLECTIONS.activity)), {
+    tx.set(doc6(collection6(taskRef, COLLECTIONS.activity)), {
       author: { type: "agent", id: job.agentId },
       createdAt: now,
       kind: "comment",
@@ -3082,7 +3063,7 @@ ${error.slice(0, 800)}
   });
 }
 async function markTaskStopped(db, shipId, job, stoppedBy) {
-  const taskRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.tasks, job.taskId);
+  const taskRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.tasks, job.taskId);
   const who = await actorName(db, shipId, stoppedBy);
   await addDoc(collection6(taskRef, COLLECTIONS.activity), {
     author: { type: "agent", id: job.agentId },
@@ -3093,7 +3074,7 @@ async function markTaskStopped(db, shipId, job, stoppedBy) {
 }
 async function actorName(db, shipId, actorId) {
   try {
-    const snap = await getDoc6(doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.members, actorId));
+    const snap = await getDoc5(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.members, actorId));
     const m = snap.data();
     return m?.displayName || m?.email || actorId;
   } catch {
@@ -3101,7 +3082,7 @@ async function actorName(db, shipId, actorId) {
   }
 }
 async function markChatStopped(db, shipId, job, stoppedBy) {
-  const chatRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
+  const chatRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
   const who = await actorName(db, shipId, stoppedBy);
   const content = `Stopped by ${who} before I finished. Write again to start a fresh run.`;
   await addDoc(collection6(chatRef, COLLECTIONS.chatMessages), {
@@ -3116,8 +3097,8 @@ async function markChatStopped(db, shipId, job, stoppedBy) {
   });
 }
 async function markChatFailed(db, shipId, job, error) {
-  const shipRef = doc7(db, COLLECTIONS.ships, shipId);
-  const chatRef = doc7(shipRef, COLLECTIONS.chats, job.chatId);
+  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
+  const chatRef = doc6(shipRef, COLLECTIONS.chats, job.chatId);
   const now = Date.now();
   const content = `I could not finish replying \u2014 the run failed after ${job.attempt} attempt(s).
 
@@ -3145,7 +3126,7 @@ function backstopReplyContent(resultText2) {
   return `${text.slice(0, MAX_CHAT_MESSAGE_CHARS - marker.length)}${marker}`;
 }
 async function ensureChatReply(db, shipId, job, resultText2) {
-  const chatRef = doc7(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
+  const chatRef = doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.chats, job.chatId);
   const messagesCol = collection6(chatRef, COLLECTIONS.chatMessages);
   const snap = await getDocs5(
     query3(
@@ -3971,7 +3952,7 @@ async function startDaemon() {
   const warnedUnapproved = /* @__PURE__ */ new Set();
   const shipRunnerRef = (shipId) => {
     const session = sess(shipId);
-    return doc8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId);
+    return doc7(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId);
   };
   const needsRefill = /* @__PURE__ */ new Set();
   let beating = false;
@@ -3982,7 +3963,7 @@ async function startDaemon() {
     try {
       for (const shipId of [...serving]) {
         try {
-          const snap = await getDoc7(shipRunnerRef(shipId));
+          const snap = await getDoc6(shipRunnerRef(shipId));
           if (!snap.exists()) {
             forgetShipLocally(shipId, "a captain removed this machine on the Daemons page");
             continue;
@@ -4327,7 +4308,7 @@ async function startDaemon() {
       pending.set(`${shipId}/${job.id}`, { shipId, job });
       return null;
     }
-    const jobRef = doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
+    const jobRef = doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
     try {
       let claimed = null;
       await runTransaction2(sess(shipId).fb.db, async (tx) => {
@@ -4350,14 +4331,11 @@ async function startDaemon() {
   }
   async function setAgentStatus(shipId, agentId, status) {
     try {
-      await updateDoc2(doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
+      await updateDoc2(doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
     } catch (e) {
       log2(`agent status update failed: ${e instanceof Error ? e.message : e}`);
     }
   }
-  async function loadSecrets(shipId) {
-    return loadRunnerSecrets(sess(shipId).fb.db, shipId);
-  }
   async function processJob(shipId, queuedJob, slot) {
     const job = await claim(shipId, queuedJob);
     if (!job) return;
@@ -4397,8 +4375,8 @@ async function startDaemon() {
       void (async () => {
         if (slot.stop) return;
         try {
-          const snap = await getDoc7(
-            doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
+          const snap = await getDoc6(
+            doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
           );
           const fresh = snap.data();
           if (!fresh?.stopRequestedAt || slot.stop) return;
@@ -4438,7 +4416,7 @@ async function startDaemon() {
     let statuses = DEFAULT_TASK_STATUSES;
     let knownSecrets = [];
     const progress = createProgressWriter({
-      write: (p) => updateDoc2(doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+      write: (p) => updateDoc2(doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
         progress: p
       }),
       secrets: () => knownSecrets,
@@ -4452,8 +4430,8 @@ async function startDaemon() {
       onDenied: () => {
         void (async () => {
           try {
-            const snap = await getDoc7(
-              doc8(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
+            const snap = await getDoc6(
+              doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id)
             );
             const fresh = snap.data();
             if (!fresh || fresh.status !== "running" || fresh.runnerId !== sess(shipId).runnerId) {
@@ -4468,7 +4446,7 @@ async function startDaemon() {
     });
     progress.push({ kind: "start", label: "Starting up" });
     try {
-      let secrets = await loadSecrets(shipId);
+      let secrets = null;
       const packed = target.kind === "chat" ? { kind: "chat", ctx: await loadChatContext(sess(shipId).fb.db, shipId, { ...job, chatId: target.chatId }) } : { kind: "task", ctx: await loadJobContext(sess(shipId).fb.db, shipId, { ...job, taskId: target.taskId }) };
       if (packed.kind === "task" && !isWorkflowSentinel(job.workflowId) && !packed.ctx.workflow) {
         log2(
@@ -4483,7 +4461,6 @@ async function startDaemon() {
         db: sess(shipId).fb.db,
         shipId,
         agent,
-        runnerSecrets: secrets,
         credentials: await loadShipCredentials(sess(shipId).fb.db, shipId).catch(() => [])
       });
       if (resolvedSecrets.problem) {
@@ -4521,8 +4498,7 @@ async function startDaemon() {
         idToken,
         shipId,
         jobId: job.id,
-        agent,
-        githubPat: secrets?.githubPat
+        agent
       });
       githubToken = gh?.token;
       githubRepos = gh?.repos;
@@ -4562,7 +4538,6 @@ async function startDaemon() {
         idToken,
         secrets?.claudeToken,
         githubToken,
-        secrets?.githubPat,
         // §15.31. BOTH the composed header value and the bare credential — see
         // `mcpSecretsToRedact` for why one of them is not enough.
         ...mcpSecretsToRedact(extraMcpServers)
@@ -4747,7 +4722,6 @@ async function startDaemon() {
     if (serving.has(shipId)) await setAgentStatus(shipId, job.agentId, "idle");
     if (!shuttingDown) void heartbeat();
   }
-  await Promise.all([...serving].map((shipId) => loadSecrets(shipId).catch(() => null)));
   await heartbeat();
   const heartbeatTimer = setInterval(() => {
     void heartbeat();
@@ -5288,7 +5262,7 @@ function setParallel(config2, value, ship2) {
 import { spawnSync as spawnSync3 } from "node:child_process";
 import fs7 from "node:fs";
 import path8 from "node:path";
-import { collection as collection8, doc as doc9, getDoc as getDoc8, getDocs as getDocs7 } from "firebase/firestore";
+import { collection as collection8, doc as doc8, getDoc as getDoc7, getDocs as getDocs7 } from "firebase/firestore";
 
 // src/cli/session.ts
 async function openShipSession(shipId) {
@@ -5457,8 +5431,8 @@ async function checkShips(config2) {
       continue;
     }
     try {
-      const snap = await getDoc8(
-        doc9(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId)
+      const snap = await getDoc7(
+        doc8(session.fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, session.runnerId)
       );
       if (!snap.exists()) {
         checks.push(
@@ -5508,14 +5482,12 @@ async function checkShips(config2) {
     for (const id of shipEngines) engines.add(id);
     if (agents.some((agent) => effectiveAgentTools(agent).github.enabled)) needsGithub = true;
     try {
-      const secrets = await loadRunnerSecrets(session.fb.db, shipId);
       const credentials = await loadShipCredentials(session.fb.db, shipId).catch(() => []);
       const missing = [
         ...new Set(
-          [...shipEngines].flatMap((id) => {
-            if (credentials.some((c) => c.engine === id)) return [];
-            return missingSecretsFor(id, secrets);
-          })
+          [...shipEngines].flatMap(
+            (id) => credentials.some((c) => c.engine === id) ? [] : missingSecretsFor(id, null)
+          )
         )
       ];
       const orphaned = agents.filter(
@@ -5999,7 +5971,7 @@ async function runUninstall(options) {
 }
 
 // src/cli/commands/ship.ts
-import { doc as doc10, getDoc as getDoc9 } from "firebase/firestore";
+import { doc as doc9, getDoc as getDoc8 } from "firebase/firestore";
 async function listMyShips() {
   const config2 = requireConfig();
   const ids = Object.keys(config2.shipKeys ?? {});
@@ -6007,7 +5979,7 @@ async function listMyShips() {
     ids.map(async (id) => {
       try {
         const { fb } = await openShipSession(id);
-        const snap = await getDoc9(doc10(fb.db, COLLECTIONS.ships, id));
+        const snap = await getDoc8(doc9(fb.db, COLLECTIONS.ships, id));
         return { id, ...snap.data() };
       } catch {
         return null;
@@ -6168,9 +6140,9 @@ async function runSetup(options) {
 // src/cli/commands/status.ts
 import {
   collection as collection9,
-  doc as doc11,
+  doc as doc10,
   getCountFromServer as getCountFromServer2,
-  getDoc as getDoc10,
+  getDoc as getDoc9,
   getDocs as getDocs8,
   query as query5,
   where as where5
@@ -6208,8 +6180,8 @@ async function runStatus() {
       });
       continue;
     }
-    const shipRef = doc11(session.fb.db, COLLECTIONS.ships, shipId);
-    const mirrorSnap = await getDoc10(doc11(shipRef, COLLECTIONS.runners, session.runnerId));
+    const shipRef = doc10(session.fb.db, COLLECTIONS.ships, shipId);
+    const mirrorSnap = await getDoc9(doc10(shipRef, COLLECTIONS.runners, session.runnerId));
     const mirror = mirrorSnap.data();
     let queued = 0;
     try {
@@ -6220,7 +6192,7 @@ async function runStatus() {
     } catch {
       queued = 0;
     }
-    const usageSnap = await getDoc10(doc11(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
+    const usageSnap = await getDoc9(doc10(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
     const today = { ...EMPTY_USAGE_TOTALS, ...usageSnap.data()?.totals ?? {} };
     const now = Date.now();
     const limitsSnap = await getDocs8(collection9(shipRef, COLLECTIONS.engineLimits));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi.ai/runner",
-  "version": "0.15.17",
+  "version": "0.15.18",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless Claude sessions on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",