@lumi.ai/runner 0.5.12 → 0.6.2

package/README.md

@@ -117,6 +117,36 @@ Each job is a separate `claude` process with its own empty working directory, so
 state — but they do share your CPU, your RAM and your Claude usage window. Start at 2 and watch a
 real job before going higher. Restart the daemon (`lumi-runner service restart`) to pick up a change.
 
+## MCP servers that run on this machine
+
+A Ship can register MCP connections its agents reach. Most are remote — an `https://` address the
+session talks to. Two kinds are **local**: a program this machine starts (`npx -y some-mcp-server`,
+`node ./my-server.mjs`), and a server already listening on this machine's own loopback address
+(`http://127.0.0.1:3000/mcp`).
+
+**Those are off until you allow them, one Ship at a time.**
+
+```bash
+lumi-runner config set local-mcp on --ship shp_abc123    # this Ship may run programs here
+lumi-runner config set local-mcp off --ship shp_abc123   # stop allowing it
+lumi-runner doctor                                       # which Ships have local connections, and whether they may run
+```
+
+There is no machine-wide form on purpose. A captain registers these in a browser and may not be the
+person who owns this computer — and if this daemon serves several Ships, a single switch would enrol
+every one of them, including any added later. So it is granted per Ship, by you, here.
+
+What a Ship gets when you allow it: the connections a captain registered **on that Ship**, activated
+on the agent running the job, and nothing else. The daemon writes them into the session's config
+file — your own `~/.claude.json` and any `.mcp.json` lying around are still invisible to every agent
+session, exactly as before.
+
+Credentials for these live on the Ship, not here: a captain marks a variable secret and it is stored
+where nothing reads it back, then handed to the program at start and scrubbed from the transcript.
+Press **Test** on the connection in Ship Settings and this machine runs the test and reports what it
+found — the Crew backend cannot reach a program on your laptop, so it asks you instead. Restart the
+daemon (`lumi-runner service restart`) after changing this.
+
 ## Staying current
 
 **This machine updates itself.** Every half hour the daemon asks npm whether there is a newer

package/dist/cli.js

@@ -442,8 +442,8 @@ ${ranked.length} document${ranked.length === 1 ? "" : "s"}. These are SUMMARIES
     room -= slug.length + 2;
   }
   const rest = dropped.length - named.length;
-  const tail = OVERFLOW_PREFIX + named.join(", ") + (rest > 0 ? ` \u2026 and ${rest} more.` : ".");
-  return head + lines.join("\n") + tail;
+  const tail2 = OVERFLOW_PREFIX + named.join(", ") + (rest > 0 ? ` \u2026 and ${rest} more.` : ".");
+  return head + lines.join("\n") + tail2;
 }
 
 // ../shared/dist/docMedia.js
@@ -466,6 +466,25 @@ var DOC_MEDIA_TYPES = [
 ];
 
 // ../shared/dist/mcpServer.js
+function isLocalMcpServer(server) {
+  if (server.transport === "stdio")
+    return true;
+  return isLoopbackUrl(server.url);
+}
+function isLoopbackUrl(value) {
+  if (typeof value !== "string" || !value.trim())
+    return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host === "::1")
+    return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
 function mcpToolGrants(server) {
   const tools = server.tools ?? [];
   if (tools.length === 0)
@@ -732,14 +751,20 @@ function forgetShip(config2, shipId) {
     delete overrides[shipId];
     next.shipParallelJobs = overrides;
   }
+  if (next.allowLocalMcp) {
+    next.allowLocalMcp = next.allowLocalMcp.filter((id) => id !== shipId);
+  }
   return next;
 }
+function allowsLocalMcp(config2, shipId) {
+  return Array.isArray(config2.allowLocalMcp) && config2.allowLocalMcp.includes(shipId);
+}
 function mcpUrl(config2) {
   return process.env.CREW_MCP_URL || config2.mcpUrl || `https://us-central1-${config2.projectId}.cloudfunctions.net/workspaceMcp`;
 }
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.5.12" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.6.2" : "0.0.0-dev";
 
 // src/auth.ts
 import { signInWithCustomToken } from "firebase/auth";
@@ -752,8 +777,8 @@ function functionsBaseUrlFor(projectId) {
   return process.env.CREW_FUNCTIONS_URL?.replace(/\/$/, "") || `https://us-central1-${projectId}.cloudfunctions.net`;
 }
 var CallableError = class extends Error {
-  constructor(status, message) {
-    super(message);
+  constructor(status, message2) {
+    super(message2);
     this.status = status;
   }
   status;
@@ -786,8 +811,8 @@ async function request(baseUrl, name, data, headers) {
 
 // src/auth.ts
 var AuthError = class extends Error {
-  constructor(message, gone = false) {
-    super(message);
+  constructor(message2, gone = false) {
+    super(message2);
     this.gone = gone;
   }
   gone;
@@ -1105,8 +1130,8 @@ function isTransientFirestoreError(error) {
   if (code === "unavailable" || code === "deadline-exceeded" || code === "internal" || code === "cancelled" || code === "aborted" || code === "resource-exhausted") {
     return true;
   }
-  const message = error?.message;
-  return typeof message === "string" && message.toLowerCase().includes("client is offline");
+  const message2 = error?.message;
+  return typeof message2 === "string" && message2.toLowerCase().includes("client is offline");
 }
 async function withFirestoreRetry(read, sleep2 = (ms) => new Promise((r) => setTimeout(r, ms)), delays = FIRESTORE_RETRY_DELAYS_MS) {
   for (let i = 0; ; i++) {
@@ -1594,8 +1619,8 @@ import path3 from "node:path";
 function stepsFromClaudeEvent(event, opts) {
   const type = typeof event?.type === "string" ? event.type : "";
   if (type === "assistant") {
-    const message = event.message;
-    const content = Array.isArray(message?.content) ? message.content : [];
+    const message2 = event.message;
+    const content = Array.isArray(message2?.content) ? message2.content : [];
     const steps = [];
     for (const block of content) {
       if (!block || typeof block !== "object") continue;
@@ -1694,6 +1719,15 @@ function buildMcpConfig(input) {
   };
   for (const s of input.extraServers ?? []) {
     if (s.key === "workspace") continue;
+    if (s.transport === "stdio") {
+      mcpServers[s.key] = {
+        type: "stdio",
+        command: s.command,
+        ...s.args?.length ? { args: s.args } : {},
+        ...s.env && Object.keys(s.env).length > 0 ? { env: s.env } : {}
+      };
+      continue;
+    }
     mcpServers[s.key] = {
       type: s.transport === "sse" ? "sse" : "http",
       url: s.url,
@@ -1951,7 +1985,15 @@ async function resolveMcpServers(input) {
       functionsBaseUrl(input.config),
       input.idToken,
       "mintMcpJobConnections",
-      { shipId: input.shipId, jobId: input.jobId }
+      {
+        shipId: input.shipId,
+        jobId: input.jobId,
+        // §15.40: the backend needs this to decide whether this daemon may be handed a LOCAL
+        // connection. Sent rather than read from `runners/{id}`, which the heartbeat writes and
+        // which is therefore at its most stale immediately after an auto-update — exactly when a
+        // captain is waiting for their local connection to start working.
+        runnerVersion: RUNNER_VERSION
+      }
     );
   } catch (e) {
     input.log(
@@ -1962,17 +2004,265 @@ async function resolveMcpServers(input) {
   for (const s of res.skipped ?? []) {
     input.log(`MCP connection "${s.key}" skipped: ${s.reason}.`);
   }
-  return res.servers ?? [];
+  return filterLocal(res.servers ?? [], input);
+}
+function filterLocal(servers, input) {
+  if (servers.every((s) => !isLocalMcpServer(s))) return [...servers];
+  if (allowsLocalMcp(input.config, input.shipId)) return [...servers];
+  const kept = [];
+  for (const server of servers) {
+    if (!isLocalMcpServer(server)) {
+      kept.push(server);
+      continue;
+    }
+    input.log(
+      `MCP connection "${server.key}" skipped: local MCP is off for this Ship on this machine \u2014 run \`lumi-runner config set local-mcp on --ship ${input.shipId}\` here to allow it.`
+    );
+  }
+  return kept;
 }
 function mcpSecretsToRedact(servers) {
   const out = [];
   for (const s of servers) {
     out.push(...Object.values(s.headers ?? {}));
     if (s.secretValue) out.push(s.secretValue);
+    out.push(...s.secretEnvValues ?? []);
   }
   return out;
 }
 
+// src/jobs/localProbe.ts
+import { spawn as spawn4 } from "node:child_process";
+var PROBE_TIMEOUT_MS = 15e3;
+var PROTOCOL_VERSION = "2024-11-05";
+async function probeAndReport(input) {
+  const { shipId, server } = input;
+  if (!allowsLocalMcp(input.config, shipId)) {
+    await report(input, {
+      ok: false,
+      toolNames: [],
+      error: `This machine has not allowed this Ship to run local MCP connections. On the machine, run: lumi-runner config set local-mcp on --ship ${shipId}`
+    });
+    return;
+  }
+  let resolved;
+  try {
+    const res = await callFunction(
+      functionsBaseUrl(input.config),
+      input.idToken,
+      "mintShipMcpProbe",
+      { shipId, serverKey: server.id, runnerVersion: RUNNER_VERSION }
+    );
+    resolved = res.server;
+  } catch (e) {
+    await report(input, { ok: false, toolNames: [], error: message(e) });
+    return;
+  }
+  const result = await probe(resolved);
+  await report(input, result);
+  input.log(
+    result.ok ? `MCP connection "${server.id}" tested: ${result.toolNames.length} tool(s).` : `MCP connection "${server.id}" could not be started: ${result.error}`
+  );
+}
+async function probe(server) {
+  try {
+    const toolNames = server.transport === "stdio" ? await probeStdio(server) : await probeHttp(server);
+    return { ok: true, toolNames };
+  } catch (e) {
+    return { ok: false, toolNames: [], error: message(e) };
+  }
+}
+async function probeStdio(server) {
+  const child = spawn4(server.command ?? "", server.args ?? [], {
+    // The parent's environment PLUS the Ship's, not the Ship's alone: a program started with no
+    // PATH cannot find node, and `npx` cannot find anything at all. The Ship's values win, which is
+    // what lets a connection override a variable the operator happens to have set.
+    env: { ...process.env, ...server.env ?? {} },
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  let stderr = "";
+  child.stderr.on("data", (chunk) => {
+    if (stderr.length < 4e3) stderr += chunk.toString();
+  });
+  const replies = new RpcReader(child.stdout);
+  const spawnFailed = new Promise((_, reject) => {
+    child.on("error", (e) => reject(new Error(`the program could not be started: ${e.message}`)));
+  });
+  child.on("close", () => replies.close());
+  try {
+    return await withTimeout(
+      Promise.race([
+        spawnFailed,
+        (async () => {
+          send(child, 1, "initialize", {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: "lumi-runner", version: RUNNER_VERSION }
+          });
+          await replies.waitFor(1, () => stderr);
+          child.stdin.write(
+            `${JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })}
+`
+          );
+          send(child, 2, "tools/list", {});
+          return toolNamesFrom(await replies.waitFor(2, () => stderr));
+        })()
+      ]),
+      // The stderr tail is the useful half of a startup failure — "MODULE_NOT_FOUND", "missing
+      // CLICKUP_API_KEY" — and without it the captain gets "timed out" and nothing to act on.
+      () => `it did not respond within ${PROBE_TIMEOUT_MS / 1e3}s${stderr.trim() ? `: ${tail(stderr)}` : ""}`
+    );
+  } finally {
+    child.kill("SIGKILL");
+  }
+}
+async function probeHttp(server) {
+  const post = async (id, method, params) => {
+    const res = await fetch(server.url ?? "", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        // Streamable HTTP servers may answer either way, and a server that only speaks SSE will
+        // refuse a request that does not say it can read one.
+        accept: "application/json, text/event-stream",
+        ...server.headers ?? {}
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id, method, params }),
+      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+    });
+    if (!res.ok) throw new Error(`the server answered ${res.status} ${res.statusText}`);
+    const body = await res.text();
+    return parseRpc(body, id);
+  };
+  await post(1, "initialize", {
+    protocolVersion: PROTOCOL_VERSION,
+    capabilities: {},
+    clientInfo: { name: "lumi-runner", version: RUNNER_VERSION }
+  });
+  return toolNamesFrom(await post(2, "tools/list", {}));
+}
+function parseRpc(body, id) {
+  const candidates = body.includes("data:") ? body.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()) : [body.trim()];
+  for (const candidate of candidates) {
+    if (!candidate) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(candidate);
+    } catch {
+      continue;
+    }
+    if (parsed.id !== id) continue;
+    if (parsed.error) throw new Error(parsed.error.message ?? "the server returned an error");
+    return parsed.result;
+  }
+  throw new Error("the server did not answer in a shape this understands");
+}
+function send(child, id, method, params) {
+  child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}
+`);
+}
+var RpcReader = class {
+  buffer = "";
+  seen = [];
+  wake = [];
+  closed = false;
+  constructor(stream) {
+    stream.on("data", (chunk) => {
+      this.buffer += chunk.toString();
+      let index = this.buffer.indexOf("\n");
+      while (index >= 0) {
+        const line = this.buffer.slice(0, index).trim();
+        this.buffer = this.buffer.slice(index + 1);
+        if (line) this.accept(line);
+        index = this.buffer.indexOf("\n");
+      }
+    });
+  }
+  accept(line) {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (typeof parsed.id !== "number") return;
+    this.seen.push({
+      id: parsed.id,
+      ...parsed.error ? { error: parsed.error.message ?? "the server returned an error" } : {},
+      result: parsed.result
+    });
+    this.notify();
+  }
+  close() {
+    this.closed = true;
+    this.notify();
+  }
+  notify() {
+    const waiters = this.wake;
+    this.wake = [];
+    for (const w of waiters) w();
+  }
+  /** The response with this id, or a throw naming what the program said instead. */
+  async waitFor(id, stderr) {
+    for (; ; ) {
+      const hit = this.seen.find((r) => r.id === id);
+      if (hit) {
+        if (hit.error) throw new Error(hit.error);
+        return hit.result;
+      }
+      if (this.closed) {
+        const said = stderr().trim();
+        throw new Error(
+          `the program stopped without answering${said ? `: ${tail(said)}` : ""}`
+        );
+      }
+      await new Promise((resolve) => this.wake.push(resolve));
+    }
+  }
+};
+function toolNamesFrom(result) {
+  const tools = result?.tools ?? [];
+  return tools.map((t) => String(t?.name ?? "")).filter(Boolean);
+}
+async function withTimeout(work, onTimeout) {
+  let timer;
+  try {
+    return await Promise.race([
+      work,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(onTimeout())), PROBE_TIMEOUT_MS);
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function report(input, result) {
+  try {
+    await callFunction(
+      functionsBaseUrl(input.config),
+      input.idToken,
+      "reportShipMcpProbe",
+      {
+        shipId: input.shipId,
+        serverKey: input.server.id,
+        ok: result.ok,
+        toolNames: result.toolNames,
+        ...result.error ? { error: result.error } : {}
+      }
+    );
+  } catch (e) {
+    input.log(`Could not report the MCP test for "${input.server.id}": ${message(e)}`);
+  }
+}
+var message = (e) => e instanceof Error ? e.message : String(e);
+var tail = (s) => s.trim().slice(-300);
+function serversNeedingProbe(servers) {
+  return servers.filter(
+    (s) => s.enabled !== false && isLocalMcpServer(s) && typeof s.probeRequestedAt === "number" && s.probeRequestedAt > (s.probe?.at ?? 0)
+  );
+}
+
 // src/jobs/secrets.ts
 import { doc as doc4, getDoc as getDoc4 } from "firebase/firestore";
 async function loadRunnerSecrets(db, shipId) {
@@ -2038,6 +2328,48 @@ function subscribeEngineLimits(db, shipId, cb, onError) {
   );
 }
 
+// src/jobs/claimBackoff.ts
+var BACKOFF_BASE_MS = 3e3;
+var BACKOFF_MAX_MS = 6e4;
+var BACKOFF_RETENTION_MS = 10 * 6e4;
+function backoffFor(releases) {
+  return Math.min(BACKOFF_MAX_MS, BACKOFF_BASE_MS * 2 ** Math.max(0, releases - 1));
+}
+function noteTransientRelease(backoff, jobId, now) {
+  const releases = (backoff.get(jobId)?.releases ?? 0) + 1;
+  const entry = { releases, eligibleAt: now + backoffFor(releases), poked: false };
+  backoff.set(jobId, entry);
+  return entry;
+}
+function isBackedOff(backoff, jobId, now) {
+  const entry = backoff.get(jobId);
+  return !!entry && entry.eligibleAt > now;
+}
+function clearBackoff(backoff, jobId) {
+  backoff.delete(jobId);
+}
+function pruneExpired2(backoff, now) {
+  const cleared = [];
+  for (const [key, entry] of backoff) {
+    if (entry.eligibleAt > now) continue;
+    if (!entry.poked) {
+      cleared.push(key);
+      entry.poked = true;
+    }
+    if (now - entry.eligibleAt >= BACKOFF_RETENTION_MS) backoff.delete(key);
+  }
+  return cleared;
+}
+function nextEligibleAt(backoff, now) {
+  let soonest = null;
+  for (const entry of backoff.values()) {
+    if (entry.eligibleAt > now && (soonest === null || entry.eligibleAt < soonest)) {
+      soonest = entry.eligibleAt;
+    }
+  }
+  return soonest;
+}
+
 // src/jobs/capacity.ts
 var DEFAULT_PARALLEL_JOBS = 1;
 var PARALLEL_MAX = 8;
@@ -2940,15 +3272,15 @@ function clearUpdateState() {
 }
 
 // src/update/install.ts
-import { spawn as spawn4, spawnSync as spawnSync2 } from "node:child_process";
+import { spawn as spawn5, spawnSync as spawnSync2 } from "node:child_process";
 import fs6 from "node:fs";
 import path7 from "node:path";
 var INSTALL_TIMEOUT_MS = 5 * 6e4;
 var STDERR_KEEP = 400;
 function npmPresent() {
-  const probe = process.platform === "win32" ? "where" : "which";
+  const probe2 = process.platform === "win32" ? "where" : "which";
   try {
-    return spawnSync2(probe, ["npm"], { encoding: "utf8" }).status === 0;
+    return spawnSync2(probe2, ["npm"], { encoding: "utf8" }).status === 0;
   } catch {
     return false;
   }
@@ -2964,7 +3296,7 @@ async function installGlobal(target, cliPath2, options = {}) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn4("npm", args, { stdio: ["ignore", "ignore", "pipe"] });
+      child = spawn5("npm", args, { stdio: ["ignore", "ignore", "pipe"] });
     } catch (e) {
       resolve({ ok: false, detail: e instanceof Error ? e.message : String(e) });
       return;
@@ -3155,6 +3487,7 @@ async function startDaemon() {
   }
   const pending = /* @__PURE__ */ new Map();
   const engineLimits = /* @__PURE__ */ new Map();
+  const claimBackoff = /* @__PURE__ */ new Map();
   const agentEngines = /* @__PURE__ */ new Map();
   const unsubsByShip = /* @__PURE__ */ new Map();
   const listenerError = (shipId, what) => (e) => {
@@ -3198,6 +3531,55 @@ async function startDaemon() {
         },
         listenerError(shipId, "agents")
       ),
+      /**
+       * MCP connections, for the ONE thing only this machine can answer (§15.40): a captain
+       * pressing Test on a connection that runs here.
+       *
+       * A third listener on a small collection — at most 20 documents per Ship — and it earns its
+       * place by being the only route the question has. The cloud cannot reach a program on this
+       * laptop, so without this the Test button on a local connection is a button that does nothing.
+       *
+       * `serversNeedingProbe` deliberately answers "nothing" for a connection nobody asked about,
+       * INCLUDING at startup: a daemon coming up must not spawn every program on the Ship to see
+       * what happens. Testing is somebody's decision, and `doctor` is where it is made on purpose.
+       */
+      onSnapshot2(
+        collection5(sess(shipId).fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers),
+        (snap) => {
+          const servers = snap.docs.map(
+            (d) => ({ id: d.id, ...d.data() })
+          );
+          for (const server of serversNeedingProbe(servers)) {
+            void (async () => {
+              try {
+                const idToken = await sess(shipId).user.getIdToken();
+                await probeAndReport({ config: config2, idToken, shipId, server, log: log2 });
+              } catch (e) {
+                log2(
+                  `MCP test for "${server.id}" (${shipId}) failed to start: ${e instanceof Error ? e.message : String(e)}`
+                );
+              }
+            })();
+          }
+        },
+        /**
+         * ITS OWN ERROR HANDLER, and NOT `listenerError` — this is the important line.
+         *
+         * `listenerError` treats any `permission-denied` as "a captain removed this machine" and
+         * calls `forgetShipLocally`, which stops serving the Ship until the daemon restarts. That
+         * inference is sound for the listeners it was written for; it is badly wrong here.
+         *
+         * `mcp_servers` is gated on `isShipReader`, which a REVOKED machine fails — and revocation
+         * is a state the daemon is expected to sit through and recover from, without a restart and
+         * without re-minting (e2e-runner asserts exactly that: approve → revoke → re-approve, same
+         * process). Reading a denial here as removal would turn a temporary revocation into a
+         * permanent one.
+         *
+         * The blast radius is the whole argument. This listener exists to make a captain's Test
+         * button answer promptly. Losing it costs that button; it must never cost the Ship.
+         */
+        (e) => console.error(`mcp connections listener error (${shipId}):`, e.message)
+      ),
       // Exhausted usage windows. The FIRST snapshot is the startup seed: a restarted daemon —
       // and a second daemon on this Ship — inherits the pause instead of running a doomed
       // session to rediscover it.
@@ -3288,6 +3670,23 @@ async function startDaemon() {
     limitTimer = setTimeout(sweepLimits, Math.max(0, at - Date.now()) + 1e3);
     limitTimer.unref();
   }
+  let backoffTimer = null;
+  function armBackoffTimer() {
+    if (backoffTimer) {
+      clearTimeout(backoffTimer);
+      backoffTimer = null;
+    }
+    const at = nextEligibleAt(claimBackoff, Date.now());
+    if (at === null) return;
+    backoffTimer = setTimeout(sweepBackoff, Math.max(0, at - Date.now()) + 1e3);
+    backoffTimer.unref();
+  }
+  function sweepBackoff() {
+    backoffTimer = null;
+    const cleared = pruneExpired2(claimBackoff, Date.now());
+    armBackoffTimer();
+    if (cleared.length > 0) poke();
+  }
   function sweepLimits() {
     limitTimer = null;
     const cleared = pruneExpired(engineLimits, Date.now());
@@ -3319,7 +3718,11 @@ async function startDaemon() {
           // the limit map is keyed by (Ship, engine) and the engine comes from the registry via
           // the agent, so the job loop still knows nothing about Claude. Skipped entries STAY in
           // `pending`, which is what lets a reset resume them with only a poke.
-          eligible: (p) => approved.get(p.shipId) === true && !isLimited(engineLimits, p.shipId, engineForJob(p.shipId, p.job), now)
+          eligible: (p) => approved.get(p.shipId) === true && !isLimited(engineLimits, p.shipId, engineForJob(p.shipId, p.job), now) && // The connection cooldown. Same "skip, don't stop" shape as the limit gate above, and
+          // skipped entries STAY in `pending` for the same reason — `sweepBackoff` resumes them
+          // with a poke. Without this the `transient` release below re-claims what it just put
+          // down, every three seconds, forever (jobs/claimBackoff.ts).
+          !isBackedOff(claimBackoff, p.job.id, now)
         });
         for (const pick of picks) {
           pending.delete(`${pick.shipId}/${pick.job.id}`);
@@ -3675,14 +4078,16 @@ async function startDaemon() {
           target.kind === "task" ? `Task ${target.taskId} is done.` : delivery === "agent-replied" ? "Agent replied in a chat." : "Agent finished a chat run without replying \u2014 its answer was posted for it."
         );
       } else if (transient) {
+        const held = noteTransientRelease(claimBackoff, job.id, Date.now());
         await releaseJob(
           sess(shipId).fb.db,
           shipId,
           job,
           `Lost the connection to Firestore \u2014 released without consuming a retry: ${failure.slice(0, 120)}`
         );
+        armBackoffTimer();
         log2(
-          `Job ${job.id} released: lost the connection to Firestore. Attempt ${job.attempt} preserved \u2014 ${failure.slice(0, 120)}`
+          `Job ${job.id} released: lost the connection to Firestore. Attempt ${job.attempt} preserved \u2014 ${failure.slice(0, 120)}. Not re-claiming it here for ${Math.round((held.eligibleAt - Date.now()) / 1e3)}s (drop ${held.releases} on this machine); another daemon may take it meanwhile.`
         );
       } else if (!terminal && job.attempt < MAX_ATTEMPTS) {
         log2(`Job ${job.id} failed (attempt ${job.attempt}) \u2014 re-queueing: ${failure.slice(0, 120)}`);
@@ -3704,6 +4109,7 @@ async function startDaemon() {
         log2(`Job ${job.id} FAILED terminally: ${failure.slice(0, 120)}`);
         notify("Crew job failed", `${targetLabel}: ${failure.slice(0, 120)}`);
       }
+      if (!transient) clearBackoff(claimBackoff, job.id);
     } catch (e) {
       log2(`finalize failed for ${job.id}: ${e instanceof Error ? e.message : e}`);
     }
@@ -3906,8 +4312,8 @@ async function startDaemon() {
 import * as clack from "@clack/prompts";
 import { createColors } from "picocolors";
 var CliError = class extends Error {
-  constructor(message, exitCode = 1) {
-    super(message);
+  constructor(message2, exitCode = 1) {
+    super(message2);
     this.exitCode = exitCode;
     this.name = "CliError";
   }
@@ -3952,30 +4358,30 @@ var say = {
   intro(title) {
     if (!jsonMode) clack.intro(pc.bgCyan(pc.black(` ${title} `)));
   },
-  outro(message) {
-    if (!jsonMode) clack.outro(message);
+  outro(message2) {
+    if (!jsonMode) clack.outro(message2);
   },
-  info(message) {
-    if (!jsonMode) clack.log.info(message);
+  info(message2) {
+    if (!jsonMode) clack.log.info(message2);
   },
-  success(message) {
-    if (!jsonMode) clack.log.success(message);
+  success(message2) {
+    if (!jsonMode) clack.log.success(message2);
   },
-  warn(message) {
-    if (!jsonMode) clack.log.warn(message);
+  warn(message2) {
+    if (!jsonMode) clack.log.warn(message2);
   },
-  error(message) {
-    if (!jsonMode) clack.log.error(message);
+  error(message2) {
+    if (!jsonMode) clack.log.error(message2);
   },
-  step(message) {
-    if (!jsonMode) clack.log.step(message);
+  step(message2) {
+    if (!jsonMode) clack.log.step(message2);
   },
   note(body, title) {
     if (!jsonMode) clack.note(body, title);
   },
   /** Raw line straight to stdout — for `logs`, where the content IS the output. */
-  line(message) {
-    process.stdout.write(`${message}
+  line(message2) {
+    process.stdout.write(`${message2}
 `);
   }
 };
@@ -4041,6 +4447,8 @@ var CHANNEL = "channel";
 var CHANNEL_HELP = "Which npm release channel to follow (default: derived from the version)";
 var CHECK_EVERY = "checkEvery";
 var CHECK_EVERY_HELP = `Minutes between update checks (${CHECK_MINUTES_MIN}-${CHECK_MINUTES_MAX})`;
+var LOCAL_MCP = "local-mcp";
+var LOCAL_MCP_HELP = "Allow a Ship to run MCP servers on this machine (needs --ship)";
 var DEFAULT_WORDS = ["default", "auto", "reset"];
 function isToggle(key) {
   return Object.hasOwn(TOGGLES, key);
@@ -4085,7 +4493,8 @@ async function runConfigList() {
   const ships = config2.ships.map((shipId) => ({
     shipId,
     parallel: shipCap(config2, shipId),
-    explicit: config2.shipParallelJobs?.[shipId] !== void 0
+    explicit: config2.shipParallelJobs?.[shipId] !== void 0,
+    localMcp: allowsLocalMcp(config2, shipId)
   }));
   const channel = resolveChannel(RUNNER_VERSION, config2, process.env);
   const checkEvery = checkIntervalMs(config2) / 6e4;
@@ -4101,22 +4510,29 @@ async function runConfigList() {
   say.line(`  ${PARALLEL.padEnd(16)} ${String(machine).padEnd(2)}   ${PARALLEL_HELP}`);
   say.line(`  ${CHANNEL.padEnd(16)} ${channel.padEnd(2)}   ${CHANNEL_HELP}`);
   say.line(`  ${CHECK_EVERY.padEnd(16)} ${String(checkEvery).padEnd(2)}   ${CHECK_EVERY_HELP}`);
+  say.line(`  ${LOCAL_MCP.padEnd(16)} ${"--".padEnd(2)}   ${LOCAL_MCP_HELP}`);
   if (ships.length > 0) {
     say.line("");
     for (const ship2 of ships) {
       const note2 = ship2.explicit ? "" : " (machine default)";
       say.line(`  ${`${PARALLEL} --ship`.padEnd(16)} ${ship2.shipId} = ${ship2.parallel}${note2}`);
     }
+    for (const ship2 of ships) {
+      say.line(
+        `  ${`${LOCAL_MCP} --ship`.padEnd(16)} ${ship2.shipId} = ${ship2.localMcp ? "on" : "off"}`
+      );
+    }
   }
   return 0;
 }
 async function runConfigSet(key, value, options = {}) {
   const config2 = requireConfig();
   if (key === PARALLEL) return setParallel(config2, value, options.ship);
+  if (key === LOCAL_MCP) return setLocalMcp(config2, value, options.ship);
   if (key === CHANNEL || key === CHECK_EVERY) return setUpdateSetting(config2, key, value, options.ship);
   if (!isToggle(key)) {
     throw new CliError(
-      `Unknown setting "${key}". Known: ${[...Object.keys(TOGGLES), PARALLEL, CHANNEL, CHECK_EVERY].join(", ")}.`
+      `Unknown setting "${key}". Known: ${[...Object.keys(TOGGLES), PARALLEL, LOCAL_MCP, CHANNEL, CHECK_EVERY].join(", ")}.`
     );
   }
   if (options.ship) {
@@ -4161,6 +4577,37 @@ function setUpdateSetting(config2, key, value, ship2) {
   say.line("  Restart the daemon for this to take effect: `lumi-runner service restart`.");
   return 0;
 }
+function setLocalMcp(config2, value, ship2) {
+  if (!ship2) {
+    throw new CliError(
+      `"${LOCAL_MCP}" is granted one Ship at a time: \`lumi-runner config set ${LOCAL_MCP} ${value} --ship <shipId>\`. There is no machine-wide form \u2014 allowing a Ship to run programs here should be a decision about that Ship. \`lumi-runner ship list\` shows the ids.`
+    );
+  }
+  if (!config2.ships.includes(ship2)) {
+    throw new CliError(
+      `This machine does not serve Ship "${ship2}". Run \`lumi-runner ship list\` to see which Ships it serves, or \`lumi-runner ship add ${ship2}\` to add it.`
+    );
+  }
+  const allowed = parseBool(value);
+  const current = new Set(config2.allowLocalMcp ?? []);
+  if (allowed) current.add(ship2);
+  else current.delete(ship2);
+  if (current.size > 0) config2.allowLocalMcp = [...current].sort();
+  else delete config2.allowLocalMcp;
+  saveConfig(config2);
+  if (isJson()) {
+    emitJson({ localMcp: allowed, shipId: ship2 });
+    return 0;
+  }
+  say.success(`${LOCAL_MCP} = ${allowed ? "on" : "off"} for Ship ${ship2}`);
+  if (allowed) {
+    say.line(
+      "  This Ship may now start MCP servers as programs on this machine, and reach servers on its loopback address. Only the connections a captain registered on that Ship, and only the ones activated on the agent running the job."
+    );
+  }
+  say.line("  Restart the daemon for this to take effect: `lumi-runner service restart`.");
+  return 0;
+}
 function setParallel(config2, value, ship2) {
   const parsed = parseParallel(value);
   if (ship2) {
@@ -4226,8 +4673,8 @@ var fail = (id, label, detail, fix) => ({
   fix
 });
 function onPath(binary) {
-  const probe = process.platform === "win32" ? "where" : "which";
-  return spawnSync3(probe, [binary], { stdio: "ignore" }).status === 0;
+  const probe2 = process.platform === "win32" ? "where" : "which";
+  return spawnSync3(probe2, [binary], { stdio: "ignore" }).status === 0;
 }
 function checkNode() {
   const major = Number(process.versions.node.split(".")[0]);
@@ -4290,6 +4737,19 @@ function versionCheckFrom(input) {
     autoUpdate ? "Nothing to do \u2014 this machine installs it by itself. `lumi-runner update` does it now." : "Auto-update is off. Run `lumi-runner update`."
   );
 }
+function localMcpCheckFrom(shipId, servers, allowed) {
+  const local = servers.filter((s) => s.enabled !== false && isLocalMcpServer(s));
+  if (local.length === 0) return null;
+  const id = `localmcp:${shipId}`;
+  const label = `Ship ${shipId} \u2014 local MCP`;
+  const names = local.map((s) => s.id).join(", ");
+  return allowed ? ok(id, label, `Allowed on this machine: ${names}.`) : warn(
+    id,
+    label,
+    `${local.length} connection(s) run on this machine and are not allowed here: ${names}.`,
+    `lumi-runner config set local-mcp on --ship ${shipId}`
+  );
+}
 async function checkVersion(config2) {
   const channel = resolveChannel(RUNNER_VERSION, config2, process.env);
   const tags = await fetchDistTags();
@@ -4392,6 +4852,17 @@ async function checkShips(config2) {
         )
       );
     }
+    try {
+      const snap = await getDocs5(
+        collection6(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.mcpServers)
+      );
+      const servers = snap.docs.map(
+        (d) => ({ id: d.id, ...d.data() })
+      );
+      const check = localMcpCheckFrom(shipId, servers, allowsLocalMcp(config2, shipId));
+      if (check) checks.push(check);
+    } catch {
+    }
   }
   return { checks, engines, needsGithub };
 }
@@ -4402,7 +4873,7 @@ async function runDoctor() {
     checks.push(
       fail("config", "Configuration", "This machine is not connected.", "Run `lumi-runner setup`.")
     );
-    return report(checks);
+    return report2(checks);
   }
   checks.push(ok("config", "Configuration", `Runner ${config2.runnerId} on project ${config2.projectId}`));
   const progress = spinner2();
@@ -4437,9 +4908,9 @@ async function runDoctor() {
   checks.push(checkService());
   checks.push(await checkVersion(config2));
   progress.stop("Checks complete.");
-  return report(checks);
+  return report2(checks);
 }
-function report(checks) {
+function report2(checks) {
   const failed = checks.filter((c) => c.level === "fail");
   const warned = checks.filter((c) => c.level === "warn");
   if (isJson()) {
@@ -4468,7 +4939,7 @@ function report(checks) {
 }
 
 // src/cli/commands/login.ts
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6 } from "node:child_process";
 import os5 from "node:os";
 import { signInWithCustomToken as signInWithCustomToken2 } from "firebase/auth";
 function buildLoginResult(approved, existing, fallbackProjectId, mcpUrl2) {
@@ -4494,7 +4965,7 @@ function buildLoginResult(approved, existing, fallbackProjectId, mcpUrl2) {
 function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    const child = spawn5(command, args, { stdio: "ignore", detached: true });
+    const child = spawn6(command, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -4571,7 +5042,7 @@ Code: ${pc.bold(start.displayCode)}`,
   const first = approvedShips[0];
   const uid2 = first ? (await signInWithCustomToken2(fb.auth, (await exchange(config2, first)).customToken)).user.uid : "(no Ship approved yet)";
   saveConfig(config2);
-  return report2({ runnerId: config2.runnerId, uid: uid2, ships: config2.ships, approvedShips, pendingShips });
+  return report3({ runnerId: config2.runnerId, uid: uid2, ships: config2.ships, approvedShips, pendingShips });
 }
 async function exchange(config2, shipId) {
   return callPublicFunction(
@@ -4607,7 +5078,7 @@ async function loginWithKey(options) {
   const fb = initFirebase(config2);
   const cred = await signInWithCustomToken2(fb.auth, session.customToken);
   saveConfig(config2);
-  return report2({
+  return report3({
     runnerId: config2.runnerId,
     uid: cred.user.uid,
     ships: config2.ships,
@@ -4619,7 +5090,7 @@ function parseKeyShipId(key) {
   const parts = (key ?? "").split("_");
   return parts.length === 3 && parts[0] === "crewrunner" && parts[1] && parts[2] ? parts[1] : null;
 }
-function report2(result) {
+function report3(result) {
   if (isJson()) {
     emitJson({ version: RUNNER_VERSION, ...result });
     return 0;
@@ -4639,12 +5110,12 @@ function report2(result) {
 
 // src/cli/commands/logs.ts
 async function runLogs(options) {
-  const tail = readTail(options.lines);
-  if (tail.length === 0 && !options.follow) {
+  const tail2 = readTail(options.lines);
+  if (tail2.length === 0 && !options.follow) {
     say.warn(`No log output yet at ${logFile()}.`);
     return 0;
   }
-  for (const line of tail) say.line(line);
+  for (const line of tail2) say.line(line);
   if (!options.follow) return 0;
   await new Promise((resolve) => {
     const stop = followLog((line) => say.line(line));
@@ -5112,10 +5583,10 @@ function action(handler) {
     try {
       process.exitCode = await handler(...args);
     } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (isJson()) process.stderr.write(`${JSON.stringify({ error: message })}
+      const message2 = error instanceof Error ? error.message : String(error);
+      if (isJson()) process.stderr.write(`${JSON.stringify({ error: message2 })}
 `);
-      else say.error(message);
+      else say.error(message2);
       process.exitCode = error instanceof CliError ? error.exitCode : 1;
     } finally {
       await closeFirebase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi.ai/runner",
-  "version": "0.5.12",
+  "version": "0.6.2",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless Claude sessions on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",