@melaya/runner 1.0.18 → 1.0.20

package/dist/connection.js

@@ -42,7 +42,7 @@ export async function connect(opts) {
         socket.emit("runner:models", opts.models);
         // Start local event relay
         if (!relay) {
-            relay = await startLocalRelay(socket, opts.verbose);
+            relay = await startLocalRelay(socket, opts.verbose, opts.serverUrl);
             if (opts.verbose) {
                 console.log(chalk.gray(`  [relay] Listening on 127.0.0.1:${relay.port} (nonce: ${relay.nonce})`));
             }
@@ -188,6 +188,34 @@ export async function connect(opts) {
             });
         }
     });
+    // ── Luma cookie capture (one-time) ────────────────────────────────
+    // Same shape as the LinkedIn flow above. Cookies persist envelope-encrypted
+    // in agents.credentials → flow into pipeline subprocess env as
+    // LUMA_AUTH_SESSION_KEY / LUMA_USER_ID → consumed by shared/tools/luma.py.
+    socket.on("luma:start-login", async (req) => {
+        const sid = req?.session_id;
+        if (!sid)
+            return;
+        console.log(chalk.hex("#FFD43B")(`\n  ▶ Luma login requested (session ${sid.slice(0, 8)}…)`));
+        const emitProgress = (msg) => {
+            socket.emit("luma:login-progress", { session_id: sid, message: msg });
+            if (opts.verbose)
+                console.log(chalk.gray(`  [luma] ${msg}`));
+        };
+        try {
+            const { runLumaLoginFlow, describeOutcome } = await import("./lumaLogin.js");
+            const outcome = await runLumaLoginFlow(emitProgress);
+            console.log(describeOutcome(outcome));
+            socket.emit("luma:login-result", { session_id: sid, ...outcome });
+        }
+        catch (e) {
+            const msg = e?.message || "luma_login_unhandled_error";
+            console.log(chalk.red(`  ✗ Luma login failed: ${msg}`));
+            socket.emit("luma:login-result", {
+                session_id: sid, ok: false, error: "login_unhandled_error", detail: msg,
+            });
+        }
+    });
     // ── Kill command ───────────────────────────────────────────────────
     socket.on("runner:kill", (data) => {
         const proc = activeProcesses.get(data.runId);
@@ -197,102 +225,13 @@ export async function connect(opts) {
             console.log(chalk.yellow(`  ■ Killed run ${data.runId.slice(0, 10)}...`));
         }
     });
-    // ── LLM stream relay ───────────────────────────────────────────────
-    //
-    // The cloud server picked the user's local Ollama / LM Studio model
-    // for an AI feature (Build-with-AI architect, etc.) — but the LLM
-    // server only exists on this machine, so we proxy the chat-completion
-    // here: fetch the local URL, stream chunks back over the existing
-    // socket. The server-side `streamLLMViaRunner()` consumes them.
+    // ── AI build-pipeline LLM-relay ────────────────────────────────────
     //
-    // Protocol:
-    //   server → runner: runner:llm-stream-request { reqId, url, headers, body }
-    //   runner → server: runner:llm-stream-chunk   { reqId, chunk: string }
-    //   runner → server: runner:llm-stream-end     { reqId, status }
-    //   runner → server: runner:llm-stream-error   { reqId, error }
-    //   server → runner: runner:llm-stream-cancel  { reqId }
-    const _activeLLMStreams = new Map();
-    socket.on("runner:llm-stream-request", async (req) => {
-        const reqId = req?.reqId;
-        if (!reqId || typeof req.url !== "string")
-            return;
-        // Defense-in-depth: only allow loopback URLs. The server already
-        // generates these as `http://localhost:1234` / `http://localhost:11434`,
-        // but enforcing it here means a compromised server connection can't
-        // pivot the runner into making outbound requests on its behalf.
-        let parsed;
-        try {
-            parsed = new URL(req.url);
-        }
-        catch {
-            socket.emit("runner:llm-stream-error", { reqId, error: "invalid_url" });
-            return;
-        }
-        if (parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1" && parsed.hostname !== "::1") {
-            socket.emit("runner:llm-stream-error", { reqId, error: "non_loopback_url_rejected" });
-            return;
-        }
-        if (opts.verbose)
-            console.log(chalk.gray(`  [llm-relay] ${reqId.slice(0, 12)} → ${req.url}`));
-        const ac = new AbortController();
-        _activeLLMStreams.set(reqId, ac);
-        try {
-            const upstream = await fetch(req.url, {
-                method: "POST",
-                headers: req.headers || { "content-type": "application/json" },
-                body: req.body || "",
-                signal: ac.signal,
-            });
-            if (!upstream.body) {
-                const text = await upstream.text().catch(() => "");
-                socket.emit("runner:llm-stream-error", {
-                    reqId,
-                    error: `upstream_no_body status=${upstream.status} ${text.slice(0, 200)}`,
-                });
-                return;
-            }
-            // Pipe chunks back as decoded text. The cloud server's parser is
-            // text-oriented (SSE `data:` lines) so we decode here and ship
-            // strings rather than base64 — keeps the WS payload small + lets
-            // the server keep its existing line-buffer code path.
-            const reader = upstream.body.getReader();
-            const decoder = new TextDecoder();
-            while (true) {
-                const { value, done } = await reader.read();
-                if (done)
-                    break;
-                const chunk = decoder.decode(value, { stream: true });
-                if (chunk.length > 0) {
-                    socket.emit("runner:llm-stream-chunk", { reqId, chunk });
-                }
-            }
-            // Flush any tail bytes.
-            const tail = decoder.decode();
-            if (tail.length > 0)
-                socket.emit("runner:llm-stream-chunk", { reqId, chunk: tail });
-            socket.emit("runner:llm-stream-end", { reqId, status: upstream.status });
-            if (opts.verbose)
-                console.log(chalk.gray(`  [llm-relay] ${reqId.slice(0, 12)} ◄ end ${upstream.status}`));
-        }
-        catch (e) {
-            if (e?.name === "AbortError") {
-                socket.emit("runner:llm-stream-error", { reqId, error: "aborted" });
-            }
-            else {
-                socket.emit("runner:llm-stream-error", { reqId, error: String(e?.message || e) });
-            }
-        }
-        finally {
-            _activeLLMStreams.delete(reqId);
-        }
-    });
-    socket.on("runner:llm-stream-cancel", (req) => {
-        const ac = _activeLLMStreams.get(req?.reqId);
-        if (ac) {
-            ac.abort();
-            _activeLLMStreams.delete(req.reqId);
-        }
-    });
+    // No new socket events — the build-pipeline relay rides on the
+    // EXISTING `runner:run` event. builder_server packages a thin Python
+    // script that fetches `localhost:1234`/`11434` and POSTs each SSE
+    // line back as an HTTP callback to the cloud server. Same pattern
+    // as the BacktestOptimizer dispatch.
     // ── Graceful shutdown ──────────────────────────────────────────────
     const cleanup = () => {
         console.log(chalk.gray("\n  Shutting down..."));

package/dist/localRelay.d.ts

@@ -16,4 +16,4 @@ export interface LocalRelay {
     close: () => void;
 }
 export declare function setActiveProject(project: string): void;
-export declare function startLocalRelay(socket: Socket, verbose: boolean): Promise<LocalRelay>;
+export declare function startLocalRelay(socket: Socket, verbose: boolean, serverUrl?: string): Promise<LocalRelay>;

package/dist/localRelay.js

@@ -55,11 +55,56 @@ function _flushThrottle(socket, verbose) {
     _throttleQueue = [];
     _throttleTimer = null;
 }
-export function startLocalRelay(socket, verbose) {
+export function startLocalRelay(socket, verbose, serverUrl) {
     const nonce = crypto.randomUUID().replace(/-/g, "");
     return new Promise((resolve, reject) => {
         const expectedPath = `/events/relay/${nonce}`;
+        // Strip trailing slash and convert ws:// → http:// for the upstream
+        // poll proxy below. The cloud Node API is the source of truth for
+        // approval decisions; the runner just forwards.
+        const upstream = (serverUrl || "https://api.melaya.org")
+            .replace(/^wss:\/\//, "https://")
+            .replace(/^ws:\/\//, "http://")
+            .replace(/\/+$/, "");
         const server = http.createServer((req, res) => {
+            // ── HITL approval-poll proxy ────────────────────────────────────
+            // The python middleware on the agent subprocess polls
+            // `GET ${MEL_BUILDER_URL}/pipelines/<name>/approvals/<request_id>`
+            // to learn when the operator approved a tool call. MEL_BUILDER_URL
+            // is wired to this local relay (so per-token POSTs land here). We
+            // forward the GET to the cloud Node API's `hitl.pollApproval` tRPC
+            // endpoint (event-secret-gated upstream — we attach the secret
+            // server-side). Without this proxy the GET 404s here, the python
+            // poll loop never breaks, the run stays stuck after approval, and
+            // the operator sees "approved but nothing happened" — exactly the
+            // bug observed on run 1fd397d67db24b9a (May 2026).
+            const m = req.method === "GET" && req.url
+                ? req.url.match(/^\/pipelines\/[^/]+\/approvals\/([A-Za-z0-9_-]{1,200})\/?$/)
+                : null;
+            if (m) {
+                const requestId = m[1];
+                // Forward via socket.io rather than direct HTTP — the runner is
+                // already authenticated to the cloud server, so we use it as
+                // the trust anchor. Server-side this is `runner:pollApproval`,
+                // which calls _validateEventSecret-equivalent before the DB read.
+                const replyOnce = (status, body) => {
+                    if (res.headersSent)
+                        return;
+                    res.writeHead(status, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify(body));
+                };
+                const t = setTimeout(() => replyOnce(504, { status: "pending", error: "upstream_timeout" }), 6000);
+                socket.emit("runner:pollApproval", { requestId }, (resp) => {
+                    clearTimeout(t);
+                    if (resp && typeof resp === "object") {
+                        replyOnce(200, resp);
+                    }
+                    else {
+                        replyOnce(502, { status: "pending", error: "no_response" });
+                    }
+                });
+                return;
+            }
             if (req.method !== "POST" || req.url !== expectedPath) {
                 res.writeHead(404);
                 res.end("Not found");
@@ -94,6 +139,10 @@ export function startLocalRelay(socket, verbose) {
                     res.end("Invalid JSON");
                 }
             });
+            // Suppress: `serverUrl` only consumed once at relay start to build
+            // the upstream URL — keep the variable referenced so TS doesn't
+            // flag it as unused if the GET proxy is removed in the future.
+            void upstream;
         });
         server.listen(0, "127.0.0.1", () => {
             const addr = server.address();

package/dist/lumaLogin.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Luma cookie capture via a controlled Chromium window.
+ *
+ * Architecture mirrors `linkedinLogin.ts` — Luma auth is cookie-only,
+ * not OAuth, and the cookies can only be obtained by completing a real
+ * sign-in (Google OAuth handoff, passkey challenge, or magic-link email)
+ * through Luma's UI. Once captured, every subsequent Luma API call is
+ * direct aiohttp HTTPS via `melayaAgents/shared/tools/luma.py` — no
+ * browser needed for ongoing pipeline work.
+ *
+ * Flow
+ * ----
+ * 1. The Melaya server emits `luma:start-login` to this runner.
+ * 2. We launch a HEADED Chromium window pointed at https://luma.com/signin.
+ * 3. Poll the page URL — Luma redirects to /home (or /events/manage) once
+ *    the user is authenticated.
+ * 4. Extract `luma.auth-session-key` and `luma.user-id` cookies and
+ *    return them via `luma:login-result`.
+ *
+ * The chromium-install bootstrap is shared with the LinkedIn flow — if
+ * the user has already done a LinkedIn sign-in once, the second connector
+ * runs in <2s.
+ */
+export interface LumaLoginResult {
+    ok: true;
+    cookies: {
+        auth_session_key: string;
+        user_id?: string;
+    };
+    profileName?: string;
+}
+export interface LumaLoginError {
+    ok: false;
+    error: string;
+    detail?: string;
+}
+export type LumaLoginOutcome = LumaLoginResult | LumaLoginError;
+interface ProgressEmitter {
+    (msg: string): void;
+}
+export declare function runLumaLoginFlow(progress: ProgressEmitter): Promise<LumaLoginOutcome>;
+export declare function describeOutcome(outcome: LumaLoginOutcome): string;
+export {};

package/dist/lumaLogin.js

@@ -0,0 +1,190 @@
+/**
+ * Luma cookie capture via a controlled Chromium window.
+ *
+ * Architecture mirrors `linkedinLogin.ts` — Luma auth is cookie-only,
+ * not OAuth, and the cookies can only be obtained by completing a real
+ * sign-in (Google OAuth handoff, passkey challenge, or magic-link email)
+ * through Luma's UI. Once captured, every subsequent Luma API call is
+ * direct aiohttp HTTPS via `melayaAgents/shared/tools/luma.py` — no
+ * browser needed for ongoing pipeline work.
+ *
+ * Flow
+ * ----
+ * 1. The Melaya server emits `luma:start-login` to this runner.
+ * 2. We launch a HEADED Chromium window pointed at https://luma.com/signin.
+ * 3. Poll the page URL — Luma redirects to /home (or /events/manage) once
+ *    the user is authenticated.
+ * 4. Extract `luma.auth-session-key` and `luma.user-id` cookies and
+ *    return them via `luma:login-result`.
+ *
+ * The chromium-install bootstrap is shared with the LinkedIn flow — if
+ * the user has already done a LinkedIn sign-in once, the second connector
+ * runs in <2s.
+ */
+import { spawn } from "child_process";
+import chalk from "chalk";
+const LOGIN_TIMEOUT_MS = 5 * 60_000;
+const POLL_INTERVAL_MS = 750;
+// Pages that mean "logged in to Luma". Luma's web app routes the user to
+// /home after sign-in; some flows (especially Google OAuth) bounce through
+// /events or /home depending on the entry point.
+const LOGGED_IN_PATHS = [
+    "/home",
+    "/manage",
+    "/events/manage",
+    "/calendar/",
+    "/u/",
+    "/settings",
+];
+async function _ensurePlaywrightAvailable(progress) {
+    try {
+        return await import("playwright");
+    }
+    catch (e) {
+        progress("Playwright module not found in node_modules. Re-installing the runner usually fixes this.");
+        throw new Error(`playwright_unavailable: ${e?.message || e}`);
+    }
+}
+function _installChromium(progress) {
+    return new Promise((resolve, reject) => {
+        progress("Preparing browser for Luma sign-in (one-time setup, ~140 MB)…");
+        const child = spawn("npx", ["playwright", "install", "chromium"], {
+            shell: true,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        child.stdout?.on("data", (b) => {
+            const line = b.toString().trim();
+            if (line)
+                progress(line);
+        });
+        child.stderr?.on("data", (b) => {
+            const line = b.toString().trim();
+            if (line)
+                progress(line);
+        });
+        child.on("error", (e) => reject(new Error(`chromium_install_error: ${e.message}`)));
+        child.on("exit", (code) => {
+            if (code === 0) {
+                progress("Browser ready.");
+                resolve();
+            }
+            else {
+                reject(new Error(`chromium_install_failed: exit code ${code}`));
+            }
+        });
+    });
+}
+function _pageLooksLoggedIn(url) {
+    try {
+        const u = new URL(url);
+        if (u.hostname !== "luma.com" && u.hostname !== "lu.ma" && u.hostname !== "www.luma.com")
+            return false;
+        return LOGGED_IN_PATHS.some((p) => u.pathname.startsWith(p));
+    }
+    catch {
+        return false;
+    }
+}
+export async function runLumaLoginFlow(progress) {
+    let playwright;
+    try {
+        playwright = await _ensurePlaywrightAvailable(progress);
+    }
+    catch (e) {
+        return { ok: false, error: "playwright_unavailable", detail: e?.message };
+    }
+    try {
+        await _installChromium(progress);
+    }
+    catch (e) {
+        return { ok: false, error: "chromium_install_failed", detail: e?.message };
+    }
+    let browser = null;
+    try {
+        progress("Opening Luma login window…");
+        browser = await playwright.chromium.launch({
+            headless: false,
+            args: ["--disable-blink-features=AutomationControlled"],
+        });
+        const context = await browser.newContext({
+            userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
+                "(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
+            viewport: { width: 1280, height: 820 },
+        });
+        const page = await context.newPage();
+        await page.goto("https://luma.com/signin", { waitUntil: "domcontentloaded" });
+        progress("Sign in with your Luma account in the window that just opened (Google / passkey / magic-link email all work).");
+        const start = Date.now();
+        let succeeded = false;
+        while (Date.now() - start < LOGIN_TIMEOUT_MS) {
+            let url;
+            try {
+                url = page.url();
+            }
+            catch {
+                return { ok: false, error: "user_cancelled", detail: "Login window was closed before sign-in completed." };
+            }
+            if (_pageLooksLoggedIn(url)) {
+                succeeded = true;
+                break;
+            }
+            await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+        }
+        if (!succeeded) {
+            return { ok: false, error: "login_timeout", detail: "5-minute sign-in window expired." };
+        }
+        // Cookie names captured 2026-05-01 from luma.com after signin:
+        //   luma.auth-session-key  — required for every api2.luma.com call
+        //   luma.user-id           — informational, lets tools short-circuit /me
+        // Read both luma.com and api2.luma.com cookies — the session is shared
+        // across both subdomains via the registrable parent.
+        const allCookies = await context.cookies();
+        const auth_c = allCookies.find((c) => c.name === "luma.auth-session-key");
+        const uid_c = allCookies.find((c) => c.name === "luma.user-id");
+        if (!auth_c?.value) {
+            return {
+                ok: false, error: "cookies_not_found",
+                detail: "Sign-in completed but luma.auth-session-key cookie was missing. Try again and ensure the sign-in fully redirects to luma.com/home.",
+            };
+        }
+        let profileName;
+        try {
+            profileName = await page.evaluate(() => {
+                const sel = (s) => {
+                    const el = document.querySelector(s);
+                    return el ? (el.textContent || "").trim() : "";
+                };
+                return (sel('[data-testid="user-menu-name"]')
+                    || sel('header [class*="UserMenu"] [class*="name"]')
+                    || sel('a[href*="/u/"] [class*="name"]')
+                    || undefined);
+            });
+        }
+        catch { /* swallow */ }
+        progress(profileName ? `Captured session for ${profileName}.` : "Captured session.");
+        await context.close();
+        await browser.close();
+        return {
+            ok: true,
+            cookies: { auth_session_key: auth_c.value, user_id: uid_c?.value },
+            profileName,
+        };
+    }
+    catch (e) {
+        return { ok: false, error: "login_flow_error", detail: e?.message || String(e) };
+    }
+    finally {
+        if (browser) {
+            try {
+                await browser.close();
+            }
+            catch { /* already closed */ }
+        }
+    }
+}
+export function describeOutcome(outcome) {
+    if (outcome.ok) {
+        return chalk.green(`  ✓ Luma session captured${outcome.profileName ? ` (${outcome.profileName})` : ""}.`);
+    }
+    return chalk.red(`  ✗ Luma login: ${outcome.error}${outcome.detail ? ` — ${outcome.detail}` : ""}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,