@melaya/runner 1.0.19 → 1.0.20

package/dist/connection.js

@@ -42,7 +42,7 @@ export async function connect(opts) {
         socket.emit("runner:models", opts.models);
         // Start local event relay
         if (!relay) {
-            relay = await startLocalRelay(socket, opts.verbose);
+            relay = await startLocalRelay(socket, opts.verbose, opts.serverUrl);
             if (opts.verbose) {
                 console.log(chalk.gray(`  [relay] Listening on 127.0.0.1:${relay.port} (nonce: ${relay.nonce})`));
             }

package/dist/localRelay.d.ts

@@ -16,4 +16,4 @@ export interface LocalRelay {
     close: () => void;
 }
 export declare function setActiveProject(project: string): void;
-export declare function startLocalRelay(socket: Socket, verbose: boolean): Promise<LocalRelay>;
+export declare function startLocalRelay(socket: Socket, verbose: boolean, serverUrl?: string): Promise<LocalRelay>;

package/dist/localRelay.js

@@ -55,11 +55,56 @@ function _flushThrottle(socket, verbose) {
     _throttleQueue = [];
     _throttleTimer = null;
 }
-export function startLocalRelay(socket, verbose) {
+export function startLocalRelay(socket, verbose, serverUrl) {
     const nonce = crypto.randomUUID().replace(/-/g, "");
     return new Promise((resolve, reject) => {
         const expectedPath = `/events/relay/${nonce}`;
+        // Strip trailing slash and convert ws:// → http:// for the upstream
+        // poll proxy below. The cloud Node API is the source of truth for
+        // approval decisions; the runner just forwards.
+        const upstream = (serverUrl || "https://api.melaya.org")
+            .replace(/^wss:\/\//, "https://")
+            .replace(/^ws:\/\//, "http://")
+            .replace(/\/+$/, "");
         const server = http.createServer((req, res) => {
+            // ── HITL approval-poll proxy ────────────────────────────────────
+            // The python middleware on the agent subprocess polls
+            // `GET ${MEL_BUILDER_URL}/pipelines/<name>/approvals/<request_id>`
+            // to learn when the operator approved a tool call. MEL_BUILDER_URL
+            // is wired to this local relay (so per-token POSTs land here). We
+            // forward the GET to the cloud Node API's `hitl.pollApproval` tRPC
+            // endpoint (event-secret-gated upstream — we attach the secret
+            // server-side). Without this proxy the GET 404s here, the python
+            // poll loop never breaks, the run stays stuck after approval, and
+            // the operator sees "approved but nothing happened" — exactly the
+            // bug observed on run 1fd397d67db24b9a (May 2026).
+            const m = req.method === "GET" && req.url
+                ? req.url.match(/^\/pipelines\/[^/]+\/approvals\/([A-Za-z0-9_-]{1,200})\/?$/)
+                : null;
+            if (m) {
+                const requestId = m[1];
+                // Forward via socket.io rather than direct HTTP — the runner is
+                // already authenticated to the cloud server, so we use it as
+                // the trust anchor. Server-side this is `runner:pollApproval`,
+                // which calls _validateEventSecret-equivalent before the DB read.
+                const replyOnce = (status, body) => {
+                    if (res.headersSent)
+                        return;
+                    res.writeHead(status, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify(body));
+                };
+                const t = setTimeout(() => replyOnce(504, { status: "pending", error: "upstream_timeout" }), 6000);
+                socket.emit("runner:pollApproval", { requestId }, (resp) => {
+                    clearTimeout(t);
+                    if (resp && typeof resp === "object") {
+                        replyOnce(200, resp);
+                    }
+                    else {
+                        replyOnce(502, { status: "pending", error: "no_response" });
+                    }
+                });
+                return;
+            }
             if (req.method !== "POST" || req.url !== expectedPath) {
                 res.writeHead(404);
                 res.end("Not found");
@@ -94,6 +139,10 @@ export function startLocalRelay(socket, verbose) {
                     res.end("Invalid JSON");
                 }
             });
+            // Suppress: `serverUrl` only consumed once at relay start to build
+            // the upstream URL — keep the variable referenced so TS doesn't
+            // flag it as unused if the GET proxy is removed in the future.
+            void upstream;
         });
         server.listen(0, "127.0.0.1", () => {
             const addr = server.address();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,