@melaya/runner 1.1.76 → 1.1.77

package/dist/browserBridge.d.ts

@@ -1,6 +1,12 @@
 import type { BrowserGrant } from "./browserGrantVerify.js";
 import { type BrowserSessionRecord, type SpaceSpec } from "./sessionManager.js";
 import { type BrowserEngineId } from "./browserProvisioner.js";
+export declare const BATCH_MAX_STEPS = 5000;
+/** browser.py holds a batch call 165 s: a batch still going at 150 s stops
+ *  BEFORE its next step and says which steps ran, instead of running on after
+ *  the caller gave up (a long batch takes minutes at ~1 s a step). The runner
+ *  has no background run for its own browser: 150 s is this call's real limit. */
+export declare const BATCH_TIME_BUDGET_MS = 150000;
 export interface BrowserRunSpec {
     runId: string;
     grant: BrowserGrant;

package/dist/browserBridge.js

@@ -436,10 +436,16 @@ function buildDragPath(from, to, steps, moveMs, shape) {
     out[out.length - 1] = { x: to.x, y: to.y, dwellMs: last.dwellMs };
     return out;
 }
-// Mirrors shared/tools/browser.py's _BATCH_ALLOWED_KINDS / _BATCH_MAX_STEPS.
-// The tool layer validates too; this is the enforcement point, because the
-// bridge must not trust a caller that skipped it.
-const BATCH_MAX_STEPS = 10;
+// Mirrors shared/tools/browser.py's _BATCH_ALLOWED_KINDS / _BATCH_MAX_STEPS (5000,
+// the server's BROWSER_BATCH_MAX_STEPS, 2026-10-28). The tool layer validates
+// too; this is the enforcement point, because the bridge must not trust a
+// caller that skipped it.
+export const BATCH_MAX_STEPS = 5000;
+/** browser.py holds a batch call 165 s: a batch still going at 150 s stops
+ *  BEFORE its next step and says which steps ran, instead of running on after
+ *  the caller gave up (a long batch takes minutes at ~1 s a step). The runner
+ *  has no background run for its own browser: 150 s is this call's real limit. */
+export const BATCH_TIME_BUDGET_MS = 150_000;
 const BATCH_ALLOWED_KINDS = new Set([
     "navigate", "back", "forward", "click", "tap", "input_text", "press_key",
     "scroll", "select_option", "submit", "wait", "wait_for_network_idle",
@@ -1457,7 +1463,17 @@ export async function startBrowserBridge(opts) {
                 throw new BridgeError("act_args_invalid", `batch takes at most ${BATCH_MAX_STEPS} steps; split the flow into several batches`);
             }
             const done = [];
+            const batchStarted = Date.now();
             for (let i = 0; i < rawSteps.length; i++) {
+                if (i > 0 && Date.now() - batchStarted >= BATCH_TIME_BUDGET_MS) {
+                    // Out of time: nothing more runs, and the caller learns exactly where it stopped.
+                    return {
+                        batch: true, steps_run: done.length, steps: done, stopped_at_time_limit: true,
+                        note: `The batch stopped at the ${BATCH_TIME_BUDGET_MS / 1000} s limit of one call: steps 1-${done.length} of ` +
+                            `${rawSteps.length} ran, steps ${done.length + 1}-${rawSteps.length} were NOT run. Read the page, then send ` +
+                            "the remaining steps in another browser_batch call.",
+                    };
+                }
                 const raw = rawSteps[i];
                 if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
                     throw new BridgeError("act_args_invalid", `batch step ${i} is not an object`);

package/dist/connection.js

@@ -15,7 +15,7 @@ import chalk from "chalk";
 import ora from "ora";
 // Every child spawned here leads its own process group (POSIX) and is tracked,
 // so shutdown and runner:kill stop the whole tree (audit P0.5).
-import { spawnTracked as spawn, terminateTree, terminateAllTracked, runShutdownSteps, formatShutdownResults, claimGracefulShutdown, killAllTrackedSync, setSetupBackground, lowerPriority, } from "./processTree.js";
+import { spawnTracked as spawn, terminateTree, terminateTreeVerified, terminateAllTracked, runShutdownSteps, formatShutdownResults, claimGracefulShutdown, killAllTrackedSync, setSetupBackground, lowerPriority, } from "./processTree.js";
 import { markStage } from "./startupTimings.js";
 import { writeFileSync, mkdirSync, existsSync, readFileSync, copyFileSync } from "fs";
 import { dirname, isAbsolute, join } from "path";
@@ -51,7 +51,7 @@ import { attachPlanSocketHandlers } from "./stepPlans.js";
 // Local REST API); the REST key stays in ~/.melaya-runner/vaults.
 import { ObsidianAppBridge } from "./obsidianApp.js";
 // Desktop app host channel: state changes for the app's tray and web UI (no-op under npx).
-import { hostStatus, isHosted, hostProgress, sendToHost, hostAppVersion } from "./hostChannel.js";
+import { hostStatus, isHosted, hostProgress, sendToHost, hostAppVersion, hostRunnerSource, startHostActivityReporter } from "./hostChannel.js";
 // Desktop app: files this runner wrote are offered to computer control as handles (no-op under npx).
 import { reportHostFile, reportOutputsSince } from "./hostFiles.js";
 // Computer control: computer:command / computer:stop relayed to the desktop app
@@ -85,6 +85,8 @@ const MAX_TRIGGER_JSON_BYTES = 48 * 1024;
 const EVENT_TRIGGERS_CAPABILITY = "event_triggers_v1";
 const HEARTBEAT_INTERVAL = 30_000;
 const activeProcesses = new Map();
+// Runs the server cancelled (runner:kill): their exit reports "canceled".
+const cancelledRunIds = new Set();
 // Melaya Browser: the versioned capability advertised in the runner hello
 // (plan Section 4). Bumped when the browser wire contract changes.
 const BROWSER_CONTROL_VERSION = 1;
@@ -483,6 +485,9 @@ export async function connect(opts) {
     // request needs the runtime first, it does the work itself and this never
     // runs (the request path already ensured the same things).
     const _runtimeIdle = () => activeProcesses.size === 0 && activeAssistants.size === 0 && bootingAssistants.size === 0;
+    // Desktop app: busy / idle on change, so a newer downloaded runner replaces
+    // this one only while nothing runs (no-op outside the app).
+    startHostActivityReporter(() => !_runtimeIdle());
     let bgTimer = null;
     const scheduleBackgroundSetup = () => {
         if (bgSetup || bgTimer || foregroundDemand)
@@ -626,7 +631,8 @@ export async function connect(opts) {
             // the server keeps that computer's app version current on every start
             // (the token row is minted once) and knows this runner updates with the
             // app, never with a restart command.
-            ...(isHosted() ? { host: { kind: "desktop", ...(hostAppVersion() ? { appVersion: hostAppVersion() } : {}) } } : {}),
+            // runnerSource: the app's bundled runner or a signed runner bundle it downloaded.
+            ...(isHosted() ? { host: { kind: "desktop", ...(hostAppVersion() ? { appVersion: hostAppVersion() } : {}), ...(hostRunnerSource() ? { runnerSource: hostRunnerSource() } : {}) } } : {}),
         });
         // Index statuses produced while disconnected (or before this socket).
         for (const ev of vaultService.latestStatuses())
@@ -867,6 +873,21 @@ export async function connect(opts) {
                 socket.emit("runner:runComplete", { runId: payload.runId, status: "failed" });
                 return;
             }
+            // Register the run in the DB + set the active project for event relay
+            // FIRST, before any pre-start work (browser grant, shared modules, Python
+            // env bootstrap, model preflight). The server drops every event of a run
+            // that is not registered: registering after the env bootstrap made its
+            // progress invisible and a bootstrap failure (its message and
+            // runComplete) vanish without a trace (Mac runner, prod 2026-10-27).
+            setActiveProject(payload.project);
+            socket.emit("runner:registerRun", {
+                runId: payload.runId,
+                project: payload.project,
+                pipelineName: payload.pipelineName,
+                ...(typeof payload.openedFrom === "string" && /^[a-z][a-z_]{0,15}$/.test(payload.openedFrom)
+                    ? { openedFrom: payload.openedFrom }
+                    : {}),
+            });
             // ── Melaya Browser grant verification + bridge start ──────────────
             // (plan Section 4) A browser run carries a signed browserGrant. We
             // VERIFY it BEFORE any Python spawns and reject on ANY failure. The
@@ -987,16 +1008,7 @@ export async function connect(opts) {
             }
             // Replace the system python with the venv python for THIS spawn.
             const pipelinePython = envResult.pythonPath;
-            // Register run in DB + set active project for event relay
-            setActiveProject(payload.project);
-            socket.emit("runner:registerRun", {
-                runId: payload.runId,
-                project: payload.project,
-                pipelineName: payload.pipelineName,
-                ...(typeof payload.openedFrom === "string" && /^[a-z][a-z_]{0,15}$/.test(payload.openedFrom)
-                    ? { openedFrom: payload.openedFrom }
-                    : {}),
-            });
+            // (runner:registerRun was sent at the top of this handler.)
             // Write main.py to temp dir
             const runDir = join(tmpdir(), `melaya-run-${payload.runId}`);
             mkdirSync(runDir, { recursive: true });
@@ -1372,7 +1384,8 @@ export async function connect(opts) {
                 if (browserBridge && browserBridge.hasRun(payload.runId)) {
                     browserBridge.teardownRun(payload.runId, `run_exit:${code}`).catch(() => { });
                 }
-                const status = code === 0 ? "done" : "failed";
+                // A run the server cancelled reports "canceled", whatever its exit code.
+                const status = cancelledRunIds.delete(payload.runId) ? "canceled" : code === 0 ? "done" : "failed";
                 // On non-zero exit, relay the captured stderr tail to the FE
                 // as a system agent_message so the operator sees the actual
                 // failure reason. Without this, a Python crash before
@@ -2118,6 +2131,15 @@ export async function connect(opts) {
             _spareBundle = v;
         }).catch(() => { });
     };
+    // Desktop app only: the server announced a signed runner bundle. The app
+    // re-reads GET /api/v1/desktop/config itself (the one source); this only
+    // says "look now" instead of at the next 6-hourly check.
+    socket.on("runner:bundle", (p) => {
+        if (!isHosted())
+            return;
+        const v = typeof p?.version === "string" && /^\d{1,4}\.\d{1,5}\.\d{1,6}$/.test(p.version) ? p.version : undefined;
+        sendToHost({ type: "bundle_hint", ...(v ? { version: v } : {}) });
+    });
     // Server push: download a new shared bundle in the background (after an
     // agents deploy, and on connect) so the next chat does not pay for it.
     socket.on("runner:prefetch_bundle", (p) => {
@@ -3318,7 +3340,15 @@ export async function connect(opts) {
         const proc = activeProcesses.get(data.runId);
         if (proc) {
             // The whole tree: a run's own children (CLI providers, browsers) too.
-            void terminateTree(proc, { graceMs: SHUTDOWN_CHILD_GRACE_MS });
+            // Verified: a kill that did not take is retried and reported (run
+            // 939e9d3f6ddb4c45 logged "Killed run" and kept running to the end).
+            cancelledRunIds.add(data.runId);
+            const runId = data.runId;
+            void terminateTreeVerified(proc, { graceMs: SHUTDOWN_CHILD_GRACE_MS }).then((gone) => {
+                if (!gone) {
+                    console.log(chalk.red(`  ✗ Run ${runId.slice(0, 10)}... is still running after the kill; it stops at its next approval check.`));
+                }
+            });
             activeProcesses.delete(data.runId);
             console.log(chalk.yellow(`  ■ Killed run ${data.runId.slice(0, 10)}...`));
         }

package/dist/hostChannel.d.ts

@@ -14,6 +14,22 @@
  * build (tsc, rootDir src) cannot import that package, so keep both in step.
  */
 export type HostedRunnerState = "starting" | "online" | "reconnecting" | "blocked" | "error";
+/**
+ * Host channel wire version this runner speaks. A signed runner bundle declares
+ * it (manifest.hostProtocol, read from dist/hostChannel.js by
+ * desktop/scripts/runner-bundle.mjs) and the desktop app runs the bundle only
+ * when it supports it. Mirror: RUNNER_HOST_PROTOCOL in packages/desktop-contract.
+ * Bump only on a breaking change of the messages below.
+ */
+export declare const HOST_PROTOCOL = 1;
+/**
+ * Oldest desktop app that may run this runner as a downloaded bundle
+ * (manifest.minAppVersion). 0.1.7 is the first app with the bundle loader;
+ * raise it when this runner needs something only a newer app provides.
+ */
+export declare const MIN_HOST_APP_VERSION = "0.1.7";
+/** Where the desktop app took this runner from (its start message). */
+export type HostRunnerSource = "bundled" | "downloaded";
 /** Why a terminal "error" happened, so the app can react without parsing text. */
 export type HostedStatusCode = "token_rejected" | "server_disconnect";
 /** Mirror of the contract's RunnerToHostMessage (computer messages kept loose). */
@@ -80,16 +96,28 @@ export type RunnerToHostMessage = {
  | {
     type: "notice";
     code: "browser_not_installed";
+}
+/** Additive: work in flight (runs, Assistant hosts), sent on change; the app swaps runners only while idle. */
+ | {
+    type: "activity";
+    busy: boolean;
+}
+/** Additive: the server announced a runner bundle (runner:bundle); the app re-reads its config. */
+ | {
+    type: "bundle_hint";
+    version?: string;
 };
 /** Mirror of the contract's HostToRunnerMessage (computer messages kept loose). */
 export type HostToRunnerMessage = {
     type: "stop";
 }
-/** `appVersion`: the desktop app's own version (additive; reported in runner:hello's `host` block). */
+/** `appVersion`: the desktop app's own version; `runnerSource`: bundled or downloaded
+ *  (both additive; reported in runner:hello's `host` block). */
  | {
     type: "start";
     token: string;
     appVersion?: string;
+    runnerSource?: HostRunnerSource;
 }
 /** Additive: rescan model providers now and publish the list through runner:models. */
  | {
@@ -118,6 +146,15 @@ export declare function redactReason(s: string): string;
 export declare function hostStatus(state: HostedRunnerState, lastError?: string, code?: HostedStatusCode): void;
 /** Background setup progress for the desktop app. No-op outside the app. */
 export declare function hostProgress(state: "running" | "done" | "failed", step?: string, waiting?: boolean): void;
+/** bundled | downloaded, as the desktop app's start message said; null outside
+ *  the app and with an app older than the field. */
+export declare function hostRunnerSource(): HostRunnerSource | null;
+/**
+ * Reports busy / idle to the desktop app whenever it changes (checked every
+ * `intervalMs`), so the app swaps to a newer downloaded runner only while
+ * nothing runs. No-op outside the app. Returns a stop function.
+ */
+export declare function startHostActivityReporter(isBusy: () => boolean, intervalMs?: number): () => void;
 /** The desktop app's own version, as its start message said; null outside the
  *  app and with an app older than the field. */
 export declare function hostAppVersion(): string | null;

package/dist/hostChannel.js

@@ -13,6 +13,20 @@
  * (RunnerToHostMessage / HostToRunnerMessage) and src/computer.ts. The runner
  * build (tsc, rootDir src) cannot import that package, so keep both in step.
  */
+/**
+ * Host channel wire version this runner speaks. A signed runner bundle declares
+ * it (manifest.hostProtocol, read from dist/hostChannel.js by
+ * desktop/scripts/runner-bundle.mjs) and the desktop app runs the bundle only
+ * when it supports it. Mirror: RUNNER_HOST_PROTOCOL in packages/desktop-contract.
+ * Bump only on a breaking change of the messages below.
+ */
+export const HOST_PROTOCOL = 1;
+/**
+ * Oldest desktop app that may run this runner as a downloaded bundle
+ * (manifest.minAppVersion). 0.1.7 is the first app with the bundle loader;
+ * raise it when this runner needs something only a newer app provides.
+ */
+export const MIN_HOST_APP_VERSION = "0.1.7";
 function parentPort() {
     const p = process.parentPort;
     return p && typeof p.postMessage === "function" ? p : null;
@@ -89,6 +103,39 @@ export function hostProgress(state, step, waiting) {
     });
 }
 let _hostAppVersion = null;
+let _hostRunnerSource = null;
+/** bundled | downloaded, as the desktop app's start message said; null outside
+ *  the app and with an app older than the field. */
+export function hostRunnerSource() {
+    return _hostRunnerSource;
+}
+/**
+ * Reports busy / idle to the desktop app whenever it changes (checked every
+ * `intervalMs`), so the app swaps to a newer downloaded runner only while
+ * nothing runs. No-op outside the app. Returns a stop function.
+ */
+export function startHostActivityReporter(isBusy, intervalMs = 5000) {
+    if (!isHosted())
+        return () => { };
+    let last = null;
+    const tick = () => {
+        let busy = true;
+        try {
+            busy = isBusy();
+        }
+        catch {
+            busy = true;
+        }
+        if (busy === last)
+            return;
+        last = busy;
+        sendToHost({ type: "activity", busy });
+    };
+    tick();
+    const t = setInterval(tick, intervalMs);
+    t.unref?.();
+    return () => clearInterval(t);
+}
 /** The desktop app's own version, as its start message said; null outside the
  *  app and with an app older than the field. */
 export function hostAppVersion() {
@@ -110,6 +157,8 @@ export function waitForHostToken(timeoutMs = 30_000) {
                 return;
             const appVersion = msg.appVersion;
             _hostAppVersion = typeof appVersion === "string" && /^[0-9A-Za-z.+-]{1,32}$/.test(appVersion) ? appVersion : null;
+            const source = msg.runnerSource;
+            _hostRunnerSource = source === "bundled" || source === "downloaded" ? source : null;
             clearTimeout(timer);
             off();
             resolve(token);

package/dist/processTree.d.ts

@@ -27,11 +27,23 @@ export declare const spawnTracked: typeof rawSpawn;
 /**
  * Stop a child and every descendant: a graceful request first, then a forced
  * kill once `graceMs` has passed. Resolves when the tree is gone (or the forced
- * kill was issued). Never throws.
+ * kill was issued), with whether the child itself has exited. Never throws.
  */
 export declare function terminateTree(child: ChildProcess, opts?: {
     graceMs?: number;
-}): Promise<void>;
+}): Promise<boolean>;
+/**
+ * Stop a run's process tree and make sure it is gone: terminateTree, then a
+ * forced tree kill again, then a direct kill of the child (on Windows the venv
+ * launcher kills its interpreter with it). Run 939e9d3f6ddb4c45 was cancelled,
+ * the runner logged "Killed run", yet the process kept running for 9 minutes
+ * and finished: a single unchecked kill is not enough. Resolves with whether
+ * the child has exited. Never throws.
+ */
+export declare function terminateTreeVerified(child: ChildProcess, opts?: {
+    graceMs?: number;
+    terminate?: typeof terminateTree;
+}): Promise<boolean>;
 /** Stop every tracked child tree, in parallel, within the grace period. */
 export declare function terminateAllTracked(opts?: {
     graceMs?: number;

package/dist/processTree.js

@@ -96,24 +96,24 @@ function waitExit(child, ms) {
 /**
  * Stop a child and every descendant: a graceful request first, then a forced
  * kill once `graceMs` has passed. Resolves when the tree is gone (or the forced
- * kill was issued). Never throws.
+ * kill was issued), with whether the child itself has exited. Never throws.
  */
 export async function terminateTree(child, opts = {}) {
     const graceMs = Math.max(0, opts.graceMs ?? 2000);
     const pid = child?.pid;
     if (typeof pid !== "number")
-        return;
+        return true;
     if (isWin) {
         if (alive(child)) {
             if (graceMs > 0) {
                 await taskkill(pid, false);
                 if (await waitExit(child, graceMs))
-                    return;
+                    return true;
             }
             await taskkill(pid, true);
             await waitExit(child, 1000);
         }
-        return;
+        return !alive(child);
     }
     if (graceMs > 0 && alive(child)) {
         signalTree(child, "SIGTERM");
@@ -131,6 +131,30 @@ export async function terminateTree(child, opts = {}) {
         catch { /* gone */ }
         await waitExit(child, 1000);
     }
+    return !alive(child);
+}
+/**
+ * Stop a run's process tree and make sure it is gone: terminateTree, then a
+ * forced tree kill again, then a direct kill of the child (on Windows the venv
+ * launcher kills its interpreter with it). Run 939e9d3f6ddb4c45 was cancelled,
+ * the runner logged "Killed run", yet the process kept running for 9 minutes
+ * and finished: a single unchecked kill is not enough. Resolves with whether
+ * the child has exited. Never throws.
+ */
+export async function terminateTreeVerified(child, opts = {}) {
+    const terminate = opts.terminate ?? terminateTree;
+    if (await terminate(child, { graceMs: opts.graceMs }))
+        return true;
+    if (await terminate(child, { graceMs: 0 }))
+        return true;
+    if (alive(child)) {
+        try {
+            child.kill("SIGKILL");
+        }
+        catch { /* gone */ }
+        await waitExit(child, 2000);
+    }
+    return !alive(child);
 }
 /** Stop every tracked child tree, in parallel, within the grace period. */
 export async function terminateAllTracked(opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.76",
+  "version": "1.1.77",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "Apache-2.0",
   "author": "Melaya Labs LLC",