@lumi.ai/runner 0.2.0 → 0.3.0

package/dist/cli.js

@@ -4,12 +4,13 @@
 import { Command } from "commander";
 
 // src/daemon.ts
-import os4 from "node:os";
+import os3 from "node:os";
 import {
   collection as collection5,
   deleteField,
   doc as doc7,
   getDoc as getDoc5,
+  getDocs as getDocs3,
   onSnapshot as onSnapshot2,
   orderBy as orderBy3,
   query as query3,
@@ -120,6 +121,17 @@ var COLLECTIONS = {
   ships: "ships",
   /** `ships/{shipId}/members/{uid}` — the humans of a Ship (captain | member). */
   members: "members",
+  /**
+   * `ships/{shipId}/invites/{inviteId}` — humans asked aboard but not yet arrived (PRD §15.24).
+   *
+   * Its OWN collection rather than a pending row inside `members`, and that is not tidiness:
+   * `members` is load-bearing in five places that all assume every document in it is a person who
+   * exists. `isMember()`/`isCaptain()` in firestore.rules key on the doc EXISTING, `captainUids()`
+   * fans notifications out to `role == 'captain'`, the "my Ships" collection-group query filters on
+   * `uid`, and the purge reads the member list to find `users/{uid}/runners`. A pending row would
+   * have to lie to all four.
+   */
+  invites: "invites",
   /** `ships/{shipId}/tasks/{taskId}` — the board's units of work. */
   tasks: "tasks",
   /** `ships/{shipId}/tasks/{taskId}/activity/{eventId}` — a task's feed (comments + status). */
@@ -170,7 +182,15 @@ var COLLECTIONS = {
   /** Top-level `githubInstallations/{installationId}` — installation→Ship index (backend only). */
   githubInstallations: "githubInstallations",
   /** Top-level `runnerLoginCodes/{userCode}` — CLI device-login handshakes (backend only). */
-  runnerLoginCodes: "runnerLoginCodes"
+  runnerLoginCodes: "runnerLoginCodes",
+  /**
+   * Top-level `shipDeletions/{shipId}` — one tombstone per Ship being purged (backend only).
+   *
+   * OUTSIDE the Ship subtree on purpose: `recursiveDelete` deletes the root document even when
+   * descendant deletes failed, so a marker stored on the Ship would be destroyed by exactly the
+   * partial failure it exists to survive.
+   */
+  shipDeletions: "shipDeletions"
 };
 
 // ../shared/dist/engineLimit.js
@@ -366,7 +386,16 @@ var SECRET_DOCS = {
   /** Captain-provided runner credentials (this file's shape). */
   runner: "runner",
   /** `{ tokenHash }` for the Workspace MCP bearer — backend-only, never client-readable. */
-  mcp: "mcp"
+  mcp: "mcp",
+  /**
+   * `{ runnerId, keyHash }` for THIS Ship's daemon credential (PRD §8.1) — backend-only.
+   *
+   * One document, not one per machine, because a Ship runs one daemon: issuing a key is
+   * therefore also how the previous one is revoked, exactly like rotating the MCP bearer.
+   * Only `docId == 'runner'` is released by packages/crew/firestore.rules, so this falls
+   * through to deny for every client without needing a rule of its own.
+   */
+  runnerKey: "runnerKey"
 };
 
 // ../shared/dist/task.js
@@ -415,6 +444,7 @@ var DEFAULT_SHIP_SETTINGS = {
   // The creation wizard offers the captain's own browser zone, which is what most Ships get.
   timezone: "UTC"
 };
+var SHIP_INVITE_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
 
 // ../shared/dist/usage.js
 var EMPTY_USAGE_TOTALS = {
@@ -502,10 +532,9 @@ function mcpUrl(config2) {
 }
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/auth.ts
-import os2 from "node:os";
 import { signInWithCustomToken } from "firebase/auth";
 
 // src/callables.ts
@@ -549,59 +578,39 @@ async function request(baseUrl, name, data, headers) {
 }
 
 // src/auth.ts
-var authEmulator = () => process.env.FIREBASE_AUTH_EMULATOR_HOST;
-function securetokenUrl(apiKey) {
-  const emu = authEmulator();
-  return emu ? `http://${emu}/securetoken.googleapis.com/v1/token?key=${apiKey}` : `https://securetoken.googleapis.com/v1/token?key=${apiKey}`;
-}
-async function login(fb, config2, customToken) {
-  const cred = await signInWithCustomToken(fb.auth, customToken);
-  config2.refreshToken = cred.user.refreshToken;
-  saveConfig(config2);
-  return cred.user;
-}
 var AuthError = class extends Error {
 };
-async function signInWithStoredSession(fb) {
-  const config2 = requireConfig();
-  if (!config2.refreshToken) {
-    throw new AuthError("No stored session. Run `lumi-runner setup`.");
-  }
-  const tokenRes = await fetch(securetokenUrl(config2.apiKey), {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: config2.refreshToken
-    })
-  });
-  if (!tokenRes.ok) {
-    throw new AuthError(`Session refresh failed (${tokenRes.status}). Run \`lumi-runner login\` again.`);
+async function signInToShip(fb, config2, shipId) {
+  const key = config2.shipKeys?.[shipId];
+  if (!key) {
+    throw new AuthError(
+      `No runner key for Ship ${shipId}. Run \`lumi-runner login\` and pick it, or ask a captain to approve this machine on that Ship's Daemons page.`
+    );
   }
-  const { id_token: idToken } = await tokenRes.json();
-  let mint;
+  let session;
   try {
-    mint = await callFunction(functionsBaseUrl(config2), idToken, "mintRunnerToken", {
-      runnerId: config2.runnerId,
-      hostname: os2.hostname(),
-      version: RUNNER_VERSION
-    });
+    session = await callPublicFunction(functionsBaseUrl(config2), "exchangeRunnerKey", { key });
   } catch (e) {
-    throw new AuthError(`mintRunnerToken failed: ${e instanceof Error ? e.message : e}`);
+    throw new AuthError(
+      `Ship ${shipId}: ${e instanceof Error ? e.message : String(e)}`
+    );
   }
-  const cred = await signInWithCustomToken(fb.auth, mint.customToken);
-  config2.runnerId = mint.runnerId;
-  config2.refreshToken = cred.user.refreshToken;
-  saveConfig(config2);
+  const cred = await signInWithCustomToken(fb.auth, session.customToken);
   return cred.user;
 }
-async function ensureSignedIn(fb) {
-  try {
-    return await signInWithStoredSession(fb);
-  } catch (e) {
-    console.error(e instanceof Error ? e.message : String(e));
-    process.exit(1);
+async function openShipSessions(config2, build) {
+  const sessions = [];
+  const failures = [];
+  for (const shipId of config2.ships) {
+    const fb = build(shipId);
+    try {
+      const user = await signInToShip(fb, config2, shipId);
+      sessions.push({ shipId, fb, user });
+    } catch (e) {
+      failures.push({ shipId, message: e instanceof Error ? e.message : String(e) });
+    }
   }
+  return { sessions, failures };
 }
 
 // src/firebase.ts
@@ -613,15 +622,16 @@ import {
   terminate
 } from "firebase/firestore";
 import { getStorage, connectStorageEmulator } from "firebase/storage";
-function initFirebase(config2) {
-  const app = initializeApp({
+function initFirebase(config2, name) {
+  const options = {
     apiKey: config2.apiKey,
     projectId: config2.projectId,
     authDomain: `${config2.projectId}.firebaseapp.com`,
     // The modern default bucket (post-2024 Firebase projects) — matches what the functions
     // runtime's admin getStorage().bucket() resolves for getTranscript.
     storageBucket: `${config2.projectId}.firebasestorage.app`
-  });
+  };
+  const app = name ? initializeApp(options, name) : initializeApp(options);
   const auth = getAuth(app);
   const db = getFirestore(app, CREW_DATABASE_ID);
   const storage = getStorage(app);
@@ -1225,7 +1235,7 @@ Note: a chat session has no task, so it is never granted write access \u2014 you
 // src/engines/claude.ts
 import { spawn as spawn3 } from "node:child_process";
 import fs3 from "node:fs";
-import os3 from "node:os";
+import os2 from "node:os";
 import path3 from "node:path";
 function normalizeClaudeUsage(resultEvent, model, fallbackDurationS) {
   const result = resultEvent ?? {};
@@ -1278,8 +1288,8 @@ function allowedTools(agent) {
   return [...new Set(tools)];
 }
 function createSessionDirs(jobId) {
-  const workdir = fs3.mkdtempSync(path3.join(os3.tmpdir(), `crew-job-${jobId}-`));
-  const configDir2 = fs3.mkdtempSync(path3.join(os3.tmpdir(), `crew-cfg-${jobId}-`));
+  const workdir = fs3.mkdtempSync(path3.join(os2.tmpdir(), `crew-job-${jobId}-`));
+  const configDir2 = fs3.mkdtempSync(path3.join(os2.tmpdir(), `crew-cfg-${jobId}-`));
   return { workdir, configDir: configDir2, mcpConfigPath: path3.join(configDir2, "mcp.json") };
 }
 function buildMcpConfig(input) {
@@ -1748,9 +1758,25 @@ async function startDaemon() {
     console.error("No Ships assigned. Run: lumi-runner ship add <shipId>");
     process.exit(1);
   }
-  const fb = initFirebase(config2);
-  let user = await ensureSignedIn(fb);
-  console.log(`Signed in as ${user.uid}, runner ${config2.runnerId}, ships: ${config2.ships.join(", ")}`);
+  const { sessions, failures } = await openShipSessions(
+    config2,
+    (shipId) => initFirebase(config2, `ship-${shipId}`)
+  );
+  for (const f of failures) console.error(f.message);
+  if (sessions.length === 0) {
+    console.error("No Ship could be signed in to. Run: lumi-runner login");
+    process.exit(1);
+  }
+  const byShip = new Map(sessions.map((s) => [s.shipId, s]));
+  const sess = (shipId) => {
+    const s = byShip.get(shipId);
+    if (!s) throw new Error(`No session for Ship ${shipId}`);
+    return s;
+  };
+  const liveShips = sessions.map((s) => s.shipId);
+  console.log(
+    `Runner ${config2.runnerId} serving ${liveShips.length} Ship(s): ${liveShips.join(", ")}`
+  );
   const logLines = [];
   const log2 = (line) => {
     const stamped = `${(/* @__PURE__ */ new Date()).toISOString()} ${line}`;
@@ -1763,53 +1789,21 @@ async function startDaemon() {
   const startedAt = Date.now();
   let currentJob = null;
   const secretsOk = /* @__PURE__ */ new Map();
-  const enrolled = /* @__PURE__ */ new Set();
   const approved = /* @__PURE__ */ new Map();
   const warnedUnapproved = /* @__PURE__ */ new Set();
-  const shipRunnerRef = (shipId) => doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId);
-  async function ensureEnrolled(shipId) {
-    if (enrolled.has(shipId)) return;
-    const snap = await getDoc5(shipRunnerRef(shipId));
-    if (!snap.exists()) {
-      await setDoc2(shipRunnerRef(shipId), {
-        ownerUserId: user.uid,
-        hostname: os4.hostname(),
-        version: RUNNER_VERSION,
-        status: "online",
-        lastSeenAt: Date.now(),
-        startedAt,
-        keyPresent: secretsOk.get(shipId) ?? false,
-        currentJob: null,
-        lastLogLines: [],
-        approved: false
-      });
-    }
-    enrolled.add(shipId);
-  }
-  let becameEligible = false;
-  let tokenStale = false;
+  const shipRunnerRef = (shipId) => doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId);
+  const needsRefill = /* @__PURE__ */ new Set();
   let beating = false;
   async function heartbeat() {
     if (beating) return;
     beating = true;
     const now = Date.now();
     try {
-      await setDoc2(
-        doc7(fb.db, COLLECTIONS.users, user.uid, COLLECTIONS.runners, config2.runnerId),
-        {
-          hostname: os4.hostname(),
-          version: RUNNER_VERSION,
-          status: "online",
-          lastSeenAt: now,
-          ships: config2.ships
-        }
-      );
-      for (const shipId of config2.ships) {
-        await ensureEnrolled(shipId);
+      for (const shipId of liveShips) {
         await setDoc2(
           shipRunnerRef(shipId),
           {
-            hostname: os4.hostname(),
+            hostname: os3.hostname(),
             version: RUNNER_VERSION,
             status: "online",
             lastSeenAt: now,
@@ -1822,19 +1816,17 @@ async function startDaemon() {
         );
         const snap = await getDoc5(shipRunnerRef(shipId));
         const isApproved = snap.data()?.approved === true;
-        const seen = approved.has(shipId);
         const wasApproved = approved.get(shipId) === true;
         approved.set(shipId, isApproved);
         if (!isApproved && !warnedUnapproved.has(shipId)) {
           warnedUnapproved.add(shipId);
           log2(
-            `Ship ${shipId}: awaiting captain approval \u2014 this machine is enrolled but idle. Approve it on the Ship's Daemons page.`
+            `Ship ${shipId}: this machine's approval was withdrawn \u2014 idle here until a captain approves it again on the Daemons page.`
           );
         }
         if (isApproved && !wasApproved) {
           warnedUnapproved.delete(shipId);
-          becameEligible = true;
-          if (seen) tokenStale = true;
+          needsRefill.add(shipId);
         }
       }
     } catch (e) {
@@ -1842,17 +1834,27 @@ async function startDaemon() {
     } finally {
       beating = false;
     }
-    if (tokenStale) {
-      tokenStale = false;
+    for (const shipId of [...needsRefill]) {
+      needsRefill.delete(shipId);
+      if (approved.get(shipId) !== true) continue;
       try {
-        user = await ensureSignedIn(fb);
-        log2("Approval granted \u2014 session refreshed, picking up queued work.");
+        const snap = await getDocs3(
+          query3(
+            collection5(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
+            where3("status", "==", "queued"),
+            orderBy3("createdAt", "asc")
+          )
+        );
+        for (const d of snap.docs) {
+          pending.set(`${shipId}/${d.id}`, {
+            shipId,
+            job: { id: d.id, ...d.data() }
+          });
+        }
+        log2(`Ship ${shipId}: approved \u2014 picking up ${snap.size} queued job(s).`);
       } catch (e) {
-        console.error("re-mint after approval failed:", e instanceof Error ? e.message : e);
+        console.error(`queue refill failed (${shipId}):`, e instanceof Error ? e.message : e);
       }
-    }
-    if (becameEligible) {
-      becameEligible = false;
       poke();
     }
   }
@@ -1860,9 +1862,9 @@ async function startDaemon() {
   const engineLimits = /* @__PURE__ */ new Map();
   const agentEngines = /* @__PURE__ */ new Map();
   const unsubs = [];
-  for (const shipId of config2.ships) {
+  for (const shipId of liveShips) {
     const q = query3(
-      collection5(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
+      collection5(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
       where3("status", "==", "queued"),
       orderBy3("createdAt", "asc")
     );
@@ -1886,7 +1888,7 @@ async function startDaemon() {
     );
     unsubs.push(
       onSnapshot2(
-        collection5(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
+        collection5(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
         (snap) => {
           for (const d of snap.docs) {
             agentEngines.set(`${shipId}/${d.id}`, agentEngine(d.data()));
@@ -1898,7 +1900,7 @@ async function startDaemon() {
     );
     unsubs.push(
       subscribeEngineLimits(
-        fb.db,
+        sess(shipId).fb.db,
         shipId,
         (docs) => {
           for (const key of [...engineLimits.keys()]) {
@@ -1950,7 +1952,7 @@ async function startDaemon() {
       log2(
         `${getEngine(entry.engineId).label} usage window on Ship ${entry.shipId} has reset \u2014 resuming.`
       );
-      void clearEngineLimit(fb.db, entry.shipId, entry.engineId).catch(() => {
+      void clearEngineLimit(sess(entry.shipId).fb.db, entry.shipId, entry.engineId).catch(() => {
       });
     }
     armLimitTimer();
@@ -1980,10 +1982,10 @@ async function startDaemon() {
     }
   }
   async function claim(shipId, job) {
-    const jobRef = doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
+    const jobRef = doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
     try {
       let claimed = null;
-      await runTransaction2(fb.db, async (tx) => {
+      await runTransaction2(sess(shipId).fb.db, async (tx) => {
         const snap = await tx.get(jobRef);
         if (!snap.exists() || snap.data().status !== "queued") {
           claimed = null;
@@ -1996,18 +1998,19 @@ async function startDaemon() {
       return claimed;
     } catch (e) {
       log2(`claim failed for ${job.id}: ${e instanceof Error ? e.message : e}`);
+      needsRefill.add(shipId);
       return null;
     }
   }
   async function setAgentStatus(shipId, agentId, status) {
     try {
-      await updateDoc2(doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
+      await updateDoc2(doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
     } catch (e) {
       log2(`agent status update failed: ${e instanceof Error ? e.message : e}`);
     }
   }
   async function loadSecrets(shipId) {
-    const secrets = await loadRunnerSecrets(fb.db, shipId);
+    const secrets = await loadRunnerSecrets(sess(shipId).fb.db, shipId);
     secretsOk.set(shipId, missingSecretsFor(DEFAULT_ENGINE_ID, secrets).length === 0);
     return secrets;
   }
@@ -2017,7 +2020,7 @@ async function startDaemon() {
     const target = jobTarget(job);
     if (!target) {
       log2(`Job ${job.id} names neither a task nor a chat (or both) \u2014 failing it.`);
-      await finalizeJob(fb.db, shipId, job, {
+      await finalizeJob(sess(shipId).fb.db, shipId, job, {
         status: "failed",
         usage: {
           engine: DEFAULT_ENGINE_ID,
@@ -2071,7 +2074,7 @@ async function startDaemon() {
     let statuses = DEFAULT_TASK_STATUSES;
     try {
       const secrets = await loadSecrets(shipId);
-      const packed = target.kind === "chat" ? { kind: "chat", ctx: await loadChatContext(fb.db, shipId, { ...job, chatId: target.chatId }) } : { kind: "task", ctx: await loadJobContext(fb.db, shipId, { ...job, taskId: target.taskId }) };
+      const packed = target.kind === "chat" ? { kind: "chat", ctx: await loadChatContext(sess(shipId).fb.db, shipId, { ...job, chatId: target.chatId }) } : { kind: "task", ctx: await loadJobContext(sess(shipId).fb.db, shipId, { ...job, taskId: target.taskId }) };
       if (packed.kind === "task" && !isWorkflowSentinel(job.workflowId) && !packed.ctx.workflow) {
         log2(
           `Playbook ${job.workflowId} is missing, disabled or empty \u2014 running a generic session.`
@@ -2088,10 +2091,10 @@ async function startDaemon() {
         );
       }
       const prompt = packed.kind === "chat" ? buildChatPrompt(packed.ctx) : buildPrompt(packed.ctx, job.reason);
-      const idToken = await user.getIdToken();
+      const idToken = await sess(shipId).user.getIdToken();
       try {
         const gh = await resolveGithubToken({
-          db: fb.db,
+          db: sess(shipId).fb.db,
           config: config2,
           idToken,
           shipId,
@@ -2149,7 +2152,7 @@ async function startDaemon() {
     try {
       if (shuttingDown) {
         await releaseJob(
-          fb.db,
+          sess(shipId).fb.db,
           shipId,
           job,
           "Runner shut down mid-job \u2014 released back to the queue without consuming a retry."
@@ -2158,9 +2161,9 @@ async function startDaemon() {
       } else if (sessionLimit) {
         const engineLabel = getEngine(engineId).label;
         const resetsAt = new Date(sessionLimit.resetsAt).toISOString();
-        await noteEngineLimit(fb.db, shipId, engineId, sessionLimit, config2.runnerId);
+        await noteEngineLimit(sess(shipId).fb.db, shipId, engineId, sessionLimit, config2.runnerId);
         await releaseJob(
-          fb.db,
+          sess(shipId).fb.db,
           shipId,
           job,
           `${engineLabel} usage limit reached \u2014 released without consuming a retry; resumes ${resetsAt}.`
@@ -2173,8 +2176,8 @@ async function startDaemon() {
           `${engineLabel} usage limit reached \u2014 work resumes automatically.`
         );
       } else if (!failure) {
-        const transcriptPath = await uploadTranscript(fb.storage, shipId, job.id, transcript);
-        await finalizeJob(fb.db, shipId, job, { status: "done", usage, transcriptPath });
+        const transcriptPath = await uploadTranscript(sess(shipId).fb.storage, shipId, job.id, transcript);
+        await finalizeJob(sess(shipId).fb.db, shipId, job, { status: "done", usage, transcriptPath });
         log2(`Job ${job.id} done (${usage.inputTokens}in/${usage.outputTokens}out tokens).`);
         notify(
           "Crew job finished",
@@ -2182,14 +2185,14 @@ async function startDaemon() {
         );
       } else if (!terminal && job.attempt < MAX_ATTEMPTS) {
         log2(`Job ${job.id} failed (attempt ${job.attempt}) \u2014 re-queueing: ${failure.slice(0, 120)}`);
-        await requeueForRetry(fb.db, shipId, job, failure);
+        await requeueForRetry(sess(shipId).fb.db, shipId, job, failure);
       } else {
-        const transcriptPath = transcript ? await uploadTranscript(fb.storage, shipId, job.id, transcript) : "";
-        await finalizeJob(fb.db, shipId, job, { status: "failed", usage, transcriptPath, error: failure });
+        const transcriptPath = transcript ? await uploadTranscript(sess(shipId).fb.storage, shipId, job.id, transcript) : "";
+        await finalizeJob(sess(shipId).fb.db, shipId, job, { status: "failed", usage, transcriptPath, error: failure });
         if (target.kind === "chat") {
-          await markChatFailed(fb.db, shipId, { ...job, chatId: target.chatId }, failure);
+          await markChatFailed(sess(shipId).fb.db, shipId, { ...job, chatId: target.chatId }, failure);
         } else {
-          await markTaskFailed(fb.db, shipId, { ...job, taskId: target.taskId }, failure, statuses);
+          await markTaskFailed(sess(shipId).fb.db, shipId, { ...job, taskId: target.taskId }, failure, statuses);
         }
         log2(`Job ${job.id} FAILED terminally: ${failure.slice(0, 120)}`);
         notify("Crew job failed", `${targetLabel}: ${failure.slice(0, 120)}`);
@@ -2201,7 +2204,7 @@ async function startDaemon() {
     await setAgentStatus(shipId, job.agentId, "idle");
     if (!shuttingDown) void heartbeat();
   }
-  await Promise.all(config2.ships.map((shipId) => loadSecrets(shipId).catch(() => null)));
+  await Promise.all(liveShips.map((shipId) => loadSecrets(shipId).catch(() => null)));
   await heartbeat();
   const heartbeatTimer = setInterval(() => {
     void heartbeat();
@@ -2230,15 +2233,10 @@ async function startDaemon() {
     }
     const now = Date.now();
     try {
-      await setDoc2(
-        doc7(fb.db, COLLECTIONS.users, user.uid, COLLECTIONS.runners, config2.runnerId),
-        { status: "offline", lastSeenAt: now },
-        { merge: true }
-      );
-      for (const shipId of config2.ships) {
+      for (const shipId of liveShips) {
         await setDoc2(
-          doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId),
-          { ownerUserId: user.uid, status: "offline", lastSeenAt: now, currentJob: deleteField() },
+          doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId),
+          { status: "offline", lastSeenAt: now, currentJob: deleteField() },
           { merge: true }
         );
       }
@@ -2248,7 +2246,7 @@ async function startDaemon() {
   };
   process.on("SIGINT", () => void shutdown("SIGINT"));
   process.on("SIGTERM", () => void shutdown("SIGTERM"));
-  log2(`Runner online \u2014 watching ${config2.ships.length} Ship(s), MCP: ${mcpUrl(config2)}`);
+  log2(`Runner online \u2014 watching ${liveShips.length} Ship(s), MCP: ${mcpUrl(config2)}`);
   await new Promise(() => {
   });
 }
@@ -2426,12 +2424,12 @@ async function runConfigSet(key, value) {
 
 // src/cli/commands/doctor.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { collection as collection6, doc as doc8, getDoc as getDoc6, getDocs as getDocs3 } from "firebase/firestore";
+import { collection as collection6, doc as doc8, getDoc as getDoc6, getDocs as getDocs4 } from "firebase/firestore";
 
 // src/service.ts
 import { spawnSync } from "node:child_process";
 import fs4 from "node:fs";
-import os5 from "node:os";
+import os4 from "node:os";
 import path4 from "node:path";
 import { fileURLToPath } from "node:url";
 var SERVICE_LABEL = "com.lumi.runner";
@@ -2456,16 +2454,16 @@ function uid() {
   return String(process.getuid?.() ?? 0);
 }
 function launchAgentPath() {
-  return path4.join(os5.homedir(), "Library/LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return path4.join(os4.homedir(), "Library/LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function systemdUnitPath() {
-  return path4.join(os5.homedir(), ".config/systemd/user", LINUX_UNIT);
+  return path4.join(os4.homedir(), ".config/systemd/user", LINUX_UNIT);
 }
 function legacyLaunchAgentPath() {
-  return path4.join(os5.homedir(), "Library/LaunchAgents", `${LEGACY_SERVICE_LABEL}.plist`);
+  return path4.join(os4.homedir(), "Library/LaunchAgents", `${LEGACY_SERVICE_LABEL}.plist`);
 }
 function legacySystemdUnitPath() {
-  return path4.join(os5.homedir(), ".config/systemd/user", LEGACY_LINUX_UNIT);
+  return path4.join(os4.homedir(), ".config/systemd/user", LEGACY_LINUX_UNIT);
 }
 function serviceEnv() {
   const env = { PATH: process.env.PATH ?? "" };
@@ -2677,10 +2675,10 @@ function installService() {
     if (!reload.ok) throw new ServiceError(`systemctl daemon-reload failed: ${reload.out}`);
     const enable = run("systemctl", ["--user", "enable", "--now", LINUX_UNIT]);
     if (!enable.ok) throw new ServiceError(`systemctl enable failed: ${enable.out}`);
-    const linger = run("loginctl", ["show-user", os5.userInfo().username, "--property=Linger"]);
+    const linger = run("loginctl", ["show-user", os4.userInfo().username, "--property=Linger"]);
     if (!linger.out.includes("Linger=yes")) {
       notes.push(
-        `Run \`sudo loginctl enable-linger ${os5.userInfo().username}\` so the daemon survives logout and starts at boot.`
+        `Run \`sudo loginctl enable-linger ${os4.userInfo().username}\` so the daemon survives logout and starts at boot.`
       );
     }
     return { unitPath, notes };
@@ -2747,11 +2745,26 @@ function restartService() {
 }
 
 // src/cli/session.ts
+async function openShipSession(shipId) {
+  const config2 = requireConfig();
+  const fb = initFirebase(config2, `cli-${shipId}`);
+  const user = await signInToShip(fb, config2, shipId);
+  return { shipId, config: config2, fb, user };
+}
 async function openSession() {
   const config2 = requireConfig();
-  const fb = initFirebase(config2);
-  const user = await signInWithStoredSession(fb);
-  return { config: config2, fb, user };
+  if (config2.ships.length === 0) {
+    throw new AuthError("No Ships assigned. Run: lumi-runner ship add <shipId>");
+  }
+  let last;
+  for (const shipId of config2.ships) {
+    try {
+      return await openShipSession(shipId);
+    } catch (e) {
+      last = e;
+    }
+  }
+  throw last instanceof Error ? last : new AuthError("Could not sign in to any Ship.");
 }
 
 // src/cli/commands/doctor.ts
@@ -2818,8 +2831,7 @@ function serviceCheckFrom(status) {
 function checkService() {
   return serviceCheckFrom(serviceStatus());
 }
-async function checkShips(session) {
-  const { config: config2, fb, user } = session;
+async function checkShips(config2) {
   const checks = [];
   const engines = /* @__PURE__ */ new Set();
   let needsGithub = false;
@@ -2830,6 +2842,21 @@ async function checkShips(session) {
     return { checks, engines, needsGithub };
   }
   for (const shipId of config2.ships) {
+    let fb;
+    try {
+      ({ fb } = await openShipSession(shipId));
+      checks.push(ok(`key:${shipId}`, `Ship ${shipId} \u2014 key`, "Runner key accepted."));
+    } catch (e) {
+      checks.push(
+        fail(
+          `key:${shipId}`,
+          `Ship ${shipId} \u2014 key`,
+          e instanceof Error ? e.message : String(e),
+          "Ask a captain to approve this machine on that Ship's Daemons page, then re-run `lumi-runner login`."
+        )
+      );
+      continue;
+    }
     try {
       const snap = await getDoc6(
         doc8(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId)
@@ -2839,8 +2866,8 @@ async function checkShips(session) {
           warn(
             `approval:${shipId}`,
             `Ship ${shipId} \u2014 approval`,
-            "This machine has not enrolled yet.",
-            "Start the daemon once; it enrols on its first heartbeat, then a captain approves it."
+            "This machine has no record on that Ship.",
+            "Re-run `lumi-runner login` \u2014 approving is what enrols it."
           )
         );
       } else if (snap.data().approved !== true) {
@@ -2848,17 +2875,8 @@ async function checkShips(session) {
           fail(
             `approval:${shipId}`,
             `Ship ${shipId} \u2014 approval`,
-            "Enrolled but awaiting captain approval \u2014 no jobs will be claimed.",
-            `Approve this machine on the Ship's Daemons page.`
-          )
-        );
-      } else if (snap.data().ownerUserId !== user.uid) {
-        checks.push(
-          fail(
-            `approval:${shipId}`,
-            `Ship ${shipId} \u2014 approval`,
-            "The approval record belongs to another user.",
-            "Re-run `lumi-runner login` on this machine."
+            "Approval was withdrawn \u2014 no jobs will be claimed.",
+            `Approve this machine again on the Ship's Daemons page.`
           )
         );
       } else {
@@ -2870,13 +2888,13 @@ async function checkShips(session) {
           `approval:${shipId}`,
           `Ship ${shipId} \u2014 approval`,
           `Could not read the approval record (${e instanceof Error ? e.message : e}).`,
-          "Are you still a member of this Ship?"
+          "The key exchanged but the read was refused \u2014 report this."
         )
       );
     }
     let agents = [];
     try {
-      const snap = await getDocs3(collection6(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents));
+      const snap = await getDocs4(collection6(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents));
       agents = snap.docs.map((d) => ({ id: d.id, ...d.data() }));
     } catch {
     }
@@ -2920,26 +2938,14 @@ async function runDoctor() {
   checks.push(ok("config", "Configuration", `Runner ${config2.runnerId} on project ${config2.projectId}`));
   const progress = spinner2();
   progress.start("Running checks\u2026");
-  let session = null;
-  try {
-    session = await openSession();
-    checks.push(ok("session", "Session", `Signed in as ${session.user.uid}`));
-  } catch (e) {
-    checks.push(
-      fail("session", "Session", e instanceof Error ? e.message : String(e), "Run `lumi-runner login`.")
-    );
-  }
   const engines = /* @__PURE__ */ new Set([DEFAULT_ENGINE_ID]);
-  let needsGithub = false;
-  if (session) {
-    const shipResults = await checkShips(session);
-    checks.push(...shipResults.checks);
-    if (shipResults.engines.size > 0) {
-      engines.clear();
-      for (const id of shipResults.engines) engines.add(id);
-    }
-    needsGithub = shipResults.needsGithub;
+  const shipResults = await checkShips(config2);
+  checks.push(...shipResults.checks);
+  if (shipResults.engines.size > 0) {
+    engines.clear();
+    for (const id of shipResults.engines) engines.add(id);
   }
+  const needsGithub = shipResults.needsGithub;
   for (const engineId of engines) {
     const health = await getDriver(engineId).healthCheck();
     checks.push(
@@ -2993,7 +2999,7 @@ function report(checks) {
 
 // src/cli/commands/login.ts
 import { spawn as spawn4 } from "node:child_process";
-import os6 from "node:os";
+import os5 from "node:os";
 import { signInWithCustomToken as signInWithCustomToken2 } from "firebase/auth";
 function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
@@ -3009,14 +3015,14 @@ var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 async function runLogin(options) {
   const moved = migrateLegacyDir();
   if (moved?.migrated) say.info(`Moved your runner config from ${moved.from} to ${moved.to}.`);
-  return options.token ? loginWithToken(options) : loginWithDeviceFlow(options);
+  return options.key ? loginWithKey(options) : loginWithDeviceFlow(options);
 }
 async function loginWithDeviceFlow(options) {
   const existingConfig = loadConfig();
   const projectId = options.project || existingConfig?.projectId || DEFAULT_PROJECT_ID;
   const baseUrl = functionsBaseUrlFor(projectId);
   const start = await callPublicFunction(baseUrl, "startRunnerLogin", {
-    hostname: os6.hostname(),
+    hostname: os5.hostname(),
     // Offer the id this machine already has: re-logging in should keep its identity, and with
     // it the captain approvals it has already earned.
     ...existingConfig?.runnerId ? { runnerId: existingConfig.runnerId } : {}
@@ -3062,7 +3068,10 @@ Code: ${pc.bold(start.displayCode)}`,
     apiKey: approved.apiKey || existingConfig?.apiKey || "",
     projectId: approved.projectId || projectId,
     runnerId: approved.runnerId,
-    refreshToken: "",
+    // THE CREDENTIALS (PRD §8.1) — one Ship key per approved Ship, handed over on this one hop
+    // and nowhere else. Merged over any we already held so that approving a SECOND Ship does not
+    // silently revoke the first: this response only carries keys for what was just approved.
+    shipKeys: { ...existingConfig?.shipKeys ?? {}, ...approved.shipKeys },
     // What the human PICKED on the approval page. Their choice replaces whatever this machine
     // was serving — that page is where the decision is now made.
     ships: approved.selectedShips.length > 0 ? approved.selectedShips : existingConfig?.ships ?? [],
@@ -3074,34 +3083,62 @@ Code: ${pc.bold(start.displayCode)}`,
     );
   }
   const fb = initFirebase(config2);
-  const credential = await signInWithCustomToken2(fb.auth, approved.customToken);
-  config2.refreshToken = credential.user.refreshToken;
+  const first = approved.approvedShips[0];
+  const uid2 = first ? (await signInWithCustomToken2(fb.auth, (await exchange(config2, first)).customToken)).user.uid : "(no Ship approved yet)";
   saveConfig(config2);
   return report2({
     runnerId: config2.runnerId,
-    uid: credential.user.uid,
+    uid: uid2,
     ships: config2.ships,
     approvedShips: approved.approvedShips,
     pendingShips: approved.pendingShips.filter((id) => config2.ships.includes(id))
   });
 }
-async function loginWithToken(options) {
+async function exchange(config2, shipId) {
+  return callPublicFunction(
+    functionsBaseUrlFor(config2.projectId),
+    "exchangeRunnerKey",
+    { key: config2.shipKeys[shipId] }
+  );
+}
+async function loginWithKey(options) {
   if (!options.apiKey || !options.project) {
-    throw new CliError("--token also needs --api-key and --project. Omit --token to use the browser flow.");
+    throw new CliError("--key also needs --api-key and --project. Omit --key to use the browser flow.");
+  }
+  const parsed = parseKeyShipId(options.key);
+  if (!parsed) {
+    throw new CliError("That does not look like a runner key. Expected `crewrunner_<shipId>_<secret>`.");
   }
   const existing = loadConfig();
   const config2 = {
     ...existing,
     apiKey: options.apiKey,
     projectId: options.project,
-    runnerId: options.runnerId || existing?.runnerId || `runner-${os6.hostname().toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, 12)}-${Math.random().toString(36).slice(2, 6)}`,
-    refreshToken: "",
-    ships: existing?.ships ?? [],
+    runnerId: options.runnerId || existing?.runnerId || `runner-${os5.hostname().toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, 12)}-${Math.random().toString(36).slice(2, 6)}`,
+    shipKeys: { ...existing?.shipKeys ?? {}, [parsed]: options.key },
+    ships: [.../* @__PURE__ */ new Set([...existing?.ships ?? [], parsed])],
     ...options.mcpUrl ? { mcpUrl: options.mcpUrl } : {}
   };
+  const session = await callPublicFunction(
+    functionsBaseUrlFor(config2.projectId),
+    "exchangeRunnerKey",
+    { key: options.key }
+  );
+  config2.runnerId = session.runnerId;
   const fb = initFirebase(config2);
-  const user = await login(fb, config2, options.token);
-  return report2({ runnerId: config2.runnerId, uid: user.uid, ships: config2.ships });
+  const cred = await signInWithCustomToken2(fb.auth, session.customToken);
+  saveConfig(config2);
+  return report2({
+    runnerId: config2.runnerId,
+    uid: cred.user.uid,
+    ships: config2.ships,
+    approvedShips: [parsed],
+    pendingShips: []
+  });
+}
+function parseKeyShipId(key) {
+  const parts = (key ?? "").split("_");
+  return parts.length === 3 && parts[0] === "crewrunner" && parts[1] && parts[2] ? parts[1] : null;
 }
 function report2(result) {
   if (isJson()) {
@@ -3234,10 +3271,10 @@ async function runUninstall(options) {
 }
 
 // src/cli/commands/ship.ts
-import { collectionGroup, doc as doc9, getDoc as getDoc7, getDocs as getDocs4, query as query4, where as where4 } from "firebase/firestore";
+import { collectionGroup, doc as doc9, getDoc as getDoc7, getDocs as getDocs5, query as query4, where as where4 } from "firebase/firestore";
 async function listMyShips() {
   const { fb, user } = await openSession();
-  const memberships = await getDocs4(
+  const memberships = await getDocs5(
     query4(collectionGroup(fb.db, COLLECTIONS.members), where4("uid", "==", user.uid))
   );
   const shipIds = memberships.docs.map((d) => d.ref.parent.parent?.id).filter((id) => !!id);
@@ -3314,8 +3351,8 @@ async function runSetup(options) {
   const moved = migrateLegacyDir();
   if (moved?.migrated) say.info(`Moved your runner config from ${moved.from} to ${moved.to}.`);
   const existing = loadConfig();
-  const reuse = existing?.refreshToken && await promptConfirm({
-    message: `This machine is already connected as ${existing.runnerId}. Keep that session?`,
+  const reuse = Object.keys(existing?.shipKeys ?? {}).length > 0 && await promptConfirm({
+    message: `This machine is already connected as ${existing?.runnerId}. Keep its Ship keys?`,
     initialValue: true,
     yesFlagApplies: false
   });
@@ -3362,7 +3399,7 @@ import {
   doc as doc10,
   getCountFromServer as getCountFromServer2,
   getDoc as getDoc8,
-  getDocs as getDocs5,
+  getDocs as getDocs6,
   query as query5,
   where as where5
 } from "firebase/firestore";
@@ -3396,7 +3433,7 @@ async function runStatus() {
     const usageSnap = await getDoc8(doc10(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
     const today = { ...EMPTY_USAGE_TOTALS, ...usageSnap.data()?.totals ?? {} };
     const now = Date.now();
-    const limitsSnap = await getDocs5(collection7(shipRef, COLLECTIONS.engineLimits));
+    const limitsSnap = await getDocs6(collection7(shipRef, COLLECTIONS.engineLimits));
     const engineLimits = limitsSnap.docs.map((d) => ({ id: d.id, ...d.data() })).filter((l) => isEngineLimited(l, now));
     ships.push({
       shipId,
@@ -3464,13 +3501,11 @@ function action(handler) {
     try {
       process.exitCode = await handler(...args);
     } catch (error) {
-      if (error instanceof CliError) {
-        say.error(error.message);
-        process.exitCode = error.exitCode;
-      } else {
-        say.error(error instanceof Error ? error.message : String(error));
-        process.exitCode = 1;
-      }
+      const message = error instanceof Error ? error.message : String(error);
+      if (isJson()) process.stderr.write(`${JSON.stringify({ error: message })}
+`);
+      else say.error(message);
+      process.exitCode = error instanceof CliError ? error.exitCode : 1;
     } finally {
       await closeFirebase();
     }
@@ -3479,12 +3514,12 @@ function action(handler) {
 program.command("setup").description("Connect this machine and set it up to run jobs (interactive)").option("--project <projectId>", "Firebase project to connect to").option("--no-browser", "print the approval URL instead of opening a browser").action(action(
   async (options) => runSetup({ project: options.project, noBrowser: options.browser === false })
 ));
-program.command("login").description("Connect this machine (opens a browser to approve it)").option("--project <projectId>", "Firebase project to connect to").option("--no-browser", "print the approval URL instead of opening a browser").option("--token <customToken>", "skip the browser: use a token from mintRunnerToken (CI)").option("--api-key <key>", "Firebase web API key (only with --token)").option("--runner-id <id>", "reuse an existing runner id (only with --token)").option("--mcp-url <url>", "override the Workspace MCP endpoint").action(
+program.command("login").description("Connect this machine (opens a browser to approve it)").option("--project <projectId>", "Firebase project to connect to").option("--no-browser", "print the approval URL instead of opening a browser").option("--key <shipKey>", "skip the browser: paste a Ship key from the Daemons page (CI)").option("--api-key <key>", "Firebase web API key (only with --key)").option("--runner-id <id>", "reuse an existing runner id (only with --key)").option("--mcp-url <url>", "override the Workspace MCP endpoint").action(
   action(
     async (options) => runLogin({
       project: options.project,
       noBrowser: options.browser === false,
-      token: options.token,
+      key: options.key,
       apiKey: options.apiKey,
       runnerId: options.runnerId,
       mcpUrl: options.mcpUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi.ai/runner",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless Claude sessions on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",