@lumi.ai/runner 0.3.5 → 0.4.0

package/README.md

@@ -37,10 +37,23 @@ runner id and Ship list from the approval — nothing is copied or pasted. If yo
 
 `setup` then runs `doctor` and offers to install the background service.
 
-For CI or headless provisioning there is a non-interactive path:
+### A server or VPS
+
+`setup` is interactive and refuses without a terminal, but it does not need a browser **on that
+machine**:
+
+```bash
+lumi-runner setup --no-browser
+```
+
+It prints the approval link and an 8-character code. Open the link anywhere you do have a browser,
+approve this Ship, and the server finishes on its own — nothing is pasted back.
+
+For CI or unattended provisioning, where nobody is at a terminal at all, paste a Ship key from the
+Daemons page instead:
 
 ```bash
-lumi-runner login --token <customToken> --api-key <key> --project <projectId>
+lumi-runner login --key <shipKey> --api-key <firebaseWebApiKey> --project <projectId>
 ```
 
 ## Commands
@@ -48,7 +61,7 @@ lumi-runner login --token <customToken> --api-key <key> --project <projectId>
 | Command | What it does |
 |---|---|
 | `setup` | One-time onboarding: login → pick Ships → doctor → background service |
-| `login` | Connect this machine (browser approval, or `--token` for CI) |
+| `login` | Connect this machine (browser approval, `--no-browser` for a server, or `--key` for CI) |
 | `ship add [ids…]` / `remove` / `list` | Which Ships this machine serves (omit ids to pick from a list) |
 | `doctor` | **Preflight** — can this machine actually run a job? Non-zero exit if not |
 | `service install` / `uninstall` / `restart` / `status` | Run the daemon in the background, always |

package/dist/cli.js

@@ -432,6 +432,10 @@ var SECRET_DOCS = {
    */
   runnerKey: "runnerKey"
 };
+function missingSecretsFor(engineId, secrets) {
+  const bag = secrets;
+  return getEngine(engineId).requiredSecrets.filter((req) => !bag?.[req.key]).map((req) => req.label);
+}
 
 // ../shared/dist/ship.js
 var DEFAULT_SHIP_SETTINGS = {
@@ -528,12 +532,17 @@ function saveConfig(config2) {
   fs.writeFileSync(configPath(), `${JSON.stringify(config2, null, 2)}
 `, { mode: 384 });
 }
+function forgetShip(config2, shipId) {
+  const shipKeys = { ...config2.shipKeys ?? {} };
+  delete shipKeys[shipId];
+  return { ...config2, shipKeys, ships: config2.ships.filter((id) => id !== shipId) };
+}
 function mcpUrl(config2) {
   return process.env.CREW_MCP_URL || config2.mcpUrl || `https://us-central1-${config2.projectId}.cloudfunctions.net/workspaceMcp`;
 }
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.3.5" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.4.0" : "0.0.0-dev";
 
 // src/auth.ts
 import { signInWithCustomToken } from "firebase/auth";
@@ -605,13 +614,11 @@ async function probeShipKey(config2, shipId) {
 }
 function pruneDeadShips(config2, failures) {
   const dropped = failures.filter((f) => f.gone).map((f) => f.shipId);
-  if (dropped.length === 0) return { config: config2, dropped };
-  const shipKeys = { ...config2.shipKeys ?? {} };
-  for (const shipId of dropped) delete shipKeys[shipId];
-  return {
-    config: { ...config2, shipKeys, ships: config2.ships.filter((id) => !dropped.includes(id)) },
-    dropped
-  };
+  return { config: dropped.reduce(forgetShip, config2), dropped };
+}
+function isEnrolmentGone(error) {
+  const code = error?.code;
+  return code === "permission-denied" || code === "firestore/permission-denied";
 }
 async function signInToShip(fb, config2, shipId) {
   const key = config2.shipKeys?.[shipId];
@@ -1594,9 +1601,6 @@ async function loadRunnerSecrets(db, shipId) {
   );
   return snap.exists() ? snap.data() : null;
 }
-function missingSecretsFor(engineId, secrets) {
-  return getEngine(engineId).requiredSecrets.filter((req) => !secrets?.[req.key]).map((req) => req.label);
-}
 
 // src/jobs/engineLimits.ts
 import {
@@ -1820,9 +1824,9 @@ async function startDaemon() {
     if (!s) throw new Error(`No session for Ship ${shipId}`);
     return s;
   };
-  const liveShips = sessions.map((s) => s.shipId);
+  const serving = new Set(sessions.map((s) => s.shipId));
   console.log(
-    `Runner ${config2.runnerId} serving ${liveShips.length} Ship(s): ${liveShips.join(", ")}`
+    `Runner ${config2.runnerId} serving ${serving.size} Ship(s): ${[...serving].join(", ")}`
   );
   const logLines = [];
   const log2 = (line) => {
@@ -1835,7 +1839,7 @@ async function startDaemon() {
   if (moved?.migrated) log2(`Moved runner config from ${moved.from} to ${moved.to}.`);
   const startedAt = Date.now();
   let currentJob = null;
-  const secretsOk = /* @__PURE__ */ new Map();
+  let currentJobShip = null;
   const approved = /* @__PURE__ */ new Map();
   const warnedUnapproved = /* @__PURE__ */ new Set();
   const shipRunnerRef = (shipId) => doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId);
@@ -1846,44 +1850,53 @@ async function startDaemon() {
     beating = true;
     const now = Date.now();
     try {
-      for (const shipId of liveShips) {
-        await setDoc2(
-          shipRunnerRef(shipId),
-          {
-            hostname: os3.hostname(),
-            version: RUNNER_VERSION,
-            status: "online",
-            lastSeenAt: now,
-            startedAt,
-            keyPresent: secretsOk.get(shipId) ?? false,
-            currentJob: currentJob ?? null,
-            lastLogLines: [...logLines]
-          },
-          { merge: true }
-        );
-        const snap = await getDoc5(shipRunnerRef(shipId));
-        const isApproved = snap.data()?.approved === true;
-        const wasApproved = approved.get(shipId) === true;
-        approved.set(shipId, isApproved);
-        if (!isApproved && !warnedUnapproved.has(shipId)) {
-          warnedUnapproved.add(shipId);
-          log2(
-            `Ship ${shipId}: this machine's approval was withdrawn \u2014 idle here until a captain approves it again on the Daemons page.`
+      for (const shipId of [...serving]) {
+        try {
+          const snap = await getDoc5(shipRunnerRef(shipId));
+          if (!snap.exists()) {
+            forgetShipLocally(shipId, "a captain removed this machine on the Daemons page");
+            continue;
+          }
+          const isApproved = snap.data()?.approved === true;
+          const wasApproved = approved.get(shipId) === true;
+          approved.set(shipId, isApproved);
+          if (!isApproved && !warnedUnapproved.has(shipId)) {
+            warnedUnapproved.add(shipId);
+            log2(
+              `Ship ${shipId}: this machine's approval was withdrawn \u2014 idle here until a captain approves it again on the Daemons page.`
+            );
+          }
+          if (isApproved && !wasApproved) {
+            warnedUnapproved.delete(shipId);
+            needsRefill.add(shipId);
+          }
+          await setDoc2(
+            shipRunnerRef(shipId),
+            {
+              hostname: os3.hostname(),
+              version: RUNNER_VERSION,
+              status: "online",
+              lastSeenAt: now,
+              startedAt,
+              currentJob: currentJob ?? null,
+              lastLogLines: [...logLines]
+            },
+            { merge: true }
           );
-        }
-        if (isApproved && !wasApproved) {
-          warnedUnapproved.delete(shipId);
-          needsRefill.add(shipId);
+        } catch (e) {
+          if (isEnrolmentGone(e)) {
+            forgetShipLocally(shipId, "this machine is no longer enrolled on that Ship");
+            continue;
+          }
+          console.error(`heartbeat failed (${shipId}):`, e instanceof Error ? e.message : e);
         }
       }
-    } catch (e) {
-      console.error("heartbeat failed:", e instanceof Error ? e.message : e);
     } finally {
       beating = false;
     }
     for (const shipId of [...needsRefill]) {
       needsRefill.delete(shipId);
-      if (approved.get(shipId) !== true) continue;
+      if (!serving.has(shipId) || approved.get(shipId) !== true) continue;
       try {
         const snap = await getDocs3(
           query3(
@@ -1908,14 +1921,21 @@ async function startDaemon() {
   const pending = /* @__PURE__ */ new Map();
   const engineLimits = /* @__PURE__ */ new Map();
   const agentEngines = /* @__PURE__ */ new Map();
-  const unsubs = [];
-  for (const shipId of liveShips) {
+  const unsubsByShip = /* @__PURE__ */ new Map();
+  const listenerError = (shipId, what) => (e) => {
+    if (isEnrolmentGone(e)) {
+      forgetShipLocally(shipId, "a captain removed this machine on the Daemons page");
+      return;
+    }
+    console.error(`${what} listener error (${shipId}):`, e.message);
+  };
+  for (const shipId of serving) {
     const q = query3(
       collection5(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
       where3("status", "==", "queued"),
       orderBy3("createdAt", "asc")
     );
-    unsubs.push(
+    unsubsByShip.set(shipId, [
       onSnapshot2(
         q,
         (snap) => {
@@ -1930,10 +1950,9 @@ async function startDaemon() {
           }
           poke();
         },
-        (e) => console.error(`jobs listener error (${shipId}):`, e.message)
-      )
-    );
-    unsubs.push(
+        listenerError(shipId, "jobs")
+      ),
+      // Agents, purely so the claim gate can resolve a queued job's engine without a read.
       onSnapshot2(
         collection5(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
         (snap) => {
@@ -1942,10 +1961,11 @@ async function startDaemon() {
           }
           poke();
         },
-        (e) => console.error(`agents listener error (${shipId}):`, e.message)
-      )
-    );
-    unsubs.push(
+        listenerError(shipId, "agents")
+      ),
+      // Exhausted usage windows. The FIRST snapshot is the startup seed: a restarted daemon —
+      // and a second daemon on this Ship — inherits the pause instead of running a doomed
+      // session to rediscover it.
       subscribeEngineLimits(
         sess(shipId).fb.db,
         shipId,
@@ -1964,9 +1984,46 @@ async function startDaemon() {
           }
           sweepLimits();
         },
-        (e) => console.error(`engine limits listener error (${shipId}):`, e.message)
+        listenerError(shipId, "engine limits")
       )
+    ]);
+  }
+  function forgetShipLocally(shipId, why) {
+    if (!serving.delete(shipId)) return;
+    for (const unsub of unsubsByShip.get(shipId) ?? []) unsub();
+    unsubsByShip.delete(shipId);
+    for (const key of [...pending.keys()]) {
+      if (pending.get(key)?.shipId === shipId) pending.delete(key);
+    }
+    for (const key of [...engineLimits.keys()]) {
+      if (engineLimits.get(key)?.shipId === shipId) engineLimits.delete(key);
+    }
+    for (const key of [...agentEngines.keys()]) {
+      if (key.startsWith(`${shipId}/`)) agentEngines.delete(key);
+    }
+    approved.delete(shipId);
+    warnedUnapproved.delete(shipId);
+    needsRefill.delete(shipId);
+    config2 = forgetShip(config2, shipId);
+    try {
+      saveConfig(config2);
+    } catch (e) {
+      log2(`Could not rewrite the config after leaving Ship ${shipId}: ${e instanceof Error ? e.message : e}`);
+    }
+    log2(
+      `Ship ${shipId}: ${why}. Deleted its runner key, its assignment and its queued work from this machine. To serve it again, run \`lumi-runner login\` here and have a captain approve this machine in the browser.`
     );
+    if (currentJobShip === shipId && sessionAbort) {
+      log2(
+        `Stopping the job it was running \u2014 this machine can no longer write to Ship ${shipId}, so the Ship put that job back on the queue itself.`
+      );
+      sessionAbort.abort();
+    }
+    if (serving.size === 0) {
+      log2(
+        "This machine now serves no Ships. Staying up and idle \u2014 run `lumi-runner login` to connect it again, or `lumi-runner uninstall` to retire it."
+      );
+    }
   }
   const engineForJob = (shipId, job) => agentEngines.get(`${shipId}/${job.agentId}`) ?? DEFAULT_ENGINE_ID;
   let working = false;
@@ -2057,9 +2114,7 @@ async function startDaemon() {
     }
   }
   async function loadSecrets(shipId) {
-    const secrets = await loadRunnerSecrets(sess(shipId).fb.db, shipId);
-    secretsOk.set(shipId, missingSecretsFor(DEFAULT_ENGINE_ID, secrets).length === 0);
-    return secrets;
+    return loadRunnerSecrets(sess(shipId).fb.db, shipId);
   }
   async function processJob(shipId, queuedJob) {
     const job = await claim(shipId, queuedJob);
@@ -2095,6 +2150,7 @@ async function startDaemon() {
       ...job.workflowName ? { workflowName: job.workflowName } : {},
       startedAt: Date.now()
     };
+    currentJobShip = shipId;
     await setAgentStatus(shipId, job.agentId, "working");
     void heartbeat();
     const wake = config2.keepAwake === false ? null : inhibitSleep(`Crew job ${job.id}`);
@@ -2197,7 +2253,11 @@ async function startDaemon() {
     wake?.release();
     sessionAbort = null;
     try {
-      if (shuttingDown) {
+      if (!serving.has(shipId)) {
+        log2(
+          `Job ${job.id} stopped \u2014 Ship ${shipId} removed this machine mid-run. The Ship has put the job back on its own queue; nothing more is written from here.`
+        );
+      } else if (shuttingDown) {
         await releaseJob(
           sess(shipId).fb.db,
           shipId,
@@ -2248,10 +2308,11 @@ async function startDaemon() {
       log2(`finalize failed for ${job.id}: ${e instanceof Error ? e.message : e}`);
     }
     currentJob = null;
-    await setAgentStatus(shipId, job.agentId, "idle");
+    currentJobShip = null;
+    if (serving.has(shipId)) await setAgentStatus(shipId, job.agentId, "idle");
     if (!shuttingDown) void heartbeat();
   }
-  await Promise.all(liveShips.map((shipId) => loadSecrets(shipId).catch(() => null)));
+  await Promise.all([...serving].map((shipId) => loadSecrets(shipId).catch(() => null)));
   await heartbeat();
   const heartbeatTimer = setInterval(() => {
     void heartbeat();
@@ -2264,7 +2325,7 @@ async function startDaemon() {
     shuttingDown = true;
     clearInterval(heartbeatTimer);
     if (limitTimer) clearTimeout(limitTimer);
-    unsubs.forEach((u) => u());
+    for (const shipUnsubs of unsubsByShip.values()) shipUnsubs.forEach((u) => u());
     if (sessionAbort) {
       log2(`${signal} received with a job in flight \u2014 stopping the session and releasing it.`);
       notify("Crew runner stopping", "A job was in progress; it has been returned to the queue.");
@@ -2280,7 +2341,7 @@ async function startDaemon() {
     }
     const now = Date.now();
     try {
-      for (const shipId of liveShips) {
+      for (const shipId of serving) {
         await setDoc2(
           doc7(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId),
           { status: "offline", lastSeenAt: now, currentJob: deleteField() },
@@ -2293,7 +2354,7 @@ async function startDaemon() {
   };
   process.on("SIGINT", () => void shutdown("SIGINT"));
   process.on("SIGTERM", () => void shutdown("SIGTERM"));
-  log2(`Runner online \u2014 watching ${liveShips.length} Ship(s), MCP: ${mcpUrl(config2)}`);
+  log2(`Runner online \u2014 watching ${serving.size} Ship(s), MCP: ${mcpUrl(config2)}`);
   await new Promise(() => {
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi.ai/runner",
-  "version": "0.3.5",
+  "version": "0.4.0",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless Claude sessions on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",