@mindexec/cli 0.2.150 → 0.2.152

package/codex-runtime.js

@@ -38,6 +38,11 @@ const MAX_LOG_CHARS = 4000;
 const MAX_EVENT_LOG = 120;
 const TEMP_DIR = '.ai/codex';
 const CODEX_CONFIG_PATH = path.join(os.homedir(), '.codex', 'config.toml');
+const CODEX_SOURCE_HOME = path.join(os.homedir(), '.codex');
+const CODEX_RUNTIME_HOME_ENV = 'MINDEXEC_CODEX_HOME';
+const DEFAULT_CODEX_RUNTIME_HOME = path.join(os.homedir(), '.mindexec', 'codex-runtime');
+const CODEX_RUNTIME_CONFIG_MARKER = '# Generated by MindExec LocalBridge for isolated AI node runs.';
+const CODEX_RUNTIME_AUTH_FILES = ['auth.json'];
 
 let cachedSdkModule = null;
 let cachedSdkLoadError = null;
@@ -153,6 +158,70 @@ function buildCodexSdkConfigOverrides() {
     return { mcp_servers: mcpServers };
 }
 
+function resolveCodexRuntimeHome() {
+    const configured = String(process.env[CODEX_RUNTIME_HOME_ENV] || '').trim();
+    return path.resolve(configured || DEFAULT_CODEX_RUNTIME_HOME);
+}
+
+async function copyCodexRuntimeFileIfPresent(fileName, runtimeHome) {
+    const source = path.join(CODEX_SOURCE_HOME, fileName);
+    const target = path.join(runtimeHome, fileName);
+    try {
+        const sourceStat = await fs.stat(source);
+        if (!sourceStat.isFile()) {
+            return false;
+        }
+
+        await fs.copyFile(source, target);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+async function ensureCodexRuntimeHome() {
+    const runtimeHome = resolveCodexRuntimeHome();
+    await fs.mkdir(runtimeHome, { recursive: true });
+    await fs.mkdir(path.join(runtimeHome, 'sessions'), { recursive: true });
+    await fs.mkdir(path.join(runtimeHome, 'generated_images'), { recursive: true });
+
+    for (const fileName of CODEX_RUNTIME_AUTH_FILES) {
+        await copyCodexRuntimeFileIfPresent(fileName, runtimeHome);
+    }
+
+    const configPath = path.join(runtimeHome, 'config.toml');
+    let shouldWriteConfig = true;
+    try {
+        const existing = await fs.readFile(configPath, 'utf8');
+        shouldWriteConfig = existing.trim().length === 0 || existing.includes(CODEX_RUNTIME_CONFIG_MARKER);
+    } catch {
+        shouldWriteConfig = true;
+    }
+
+    if (shouldWriteConfig) {
+        await fs.writeFile(
+            configPath,
+            `${CODEX_RUNTIME_CONFIG_MARKER}\n# User MCP server definitions are intentionally not inherited here.\n# LocalBridge passes model, sandbox, and reasoning options per run.\n`,
+            'utf8'
+        );
+    }
+
+    return runtimeHome;
+}
+
+function buildCodexChildEnv() {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+
+    env.CODEX_HOME = resolveCodexRuntimeHome();
+    env.MINDEXEC_CODEX_ISOLATED_HOME = '1';
+    return env;
+}
+
 function appendCodexIsolationConfigArgs(args) {
     for (const name of readConfiguredMcpServerNames()) {
         args.push('--config', `mcp_servers.${name}.enabled=false`);
@@ -562,7 +631,11 @@ export function createCodexRuntime(options) {
 
         if (providerKind === PROVIDER_KIND.typeScriptSdk) {
             const sdk = await loadCodexSdk();
-            const codex = new sdk.Codex({ config: buildCodexSdkConfigOverrides() });
+            await ensureCodexRuntimeHome();
+            const codex = new sdk.Codex({
+                env: buildCodexChildEnv(),
+                config: buildCodexSdkConfigOverrides()
+            });
             const thread = codex.startThread(threadOptions);
             const localThreadId = `local_${crypto.randomUUID()}`;
             threads.set(localThreadId, {
@@ -624,7 +697,11 @@ export function createCodexRuntime(options) {
         }
 
         const sdk = await loadCodexSdk();
-        const codex = new sdk.Codex({ config: buildCodexSdkConfigOverrides() });
+        await ensureCodexRuntimeHome();
+        const codex = new sdk.Codex({
+            env: buildCodexChildEnv(),
+            config: buildCodexSdkConfigOverrides()
+        });
         const officialId = requestedThreadId && !requestedThreadId.startsWith('local_')
             ? requestedThreadId
             : '';
@@ -765,6 +842,7 @@ export function createCodexRuntime(options) {
         const tempDir = path.join(workingDirectory, TEMP_DIR);
         const schema = normalizeOutputSchema(body.outputSchema || body.outputSchemaJson);
         let schemaPath = null;
+        await ensureCodexRuntimeHome();
         const args = [
             'exec',
             '-',
@@ -806,6 +884,7 @@ export function createCodexRuntime(options) {
             const childResult = await new Promise((resolve) => {
                 const child = spawn('codex', args, {
                     cwd: workingDirectory,
+                    env: buildCodexChildEnv(),
                     windowsHide: true,
                     signal: abortController.signal
                 });
@@ -935,7 +1014,11 @@ export function createCodexRuntime(options) {
             const workingDirectory = await resolveWorkingDirectory(body.workingDir || body.workingDirectory || '');
             const threadOptions = buildThreadOptions(body, workingDirectory);
             const sdk = await loadCodexSdk();
-            const codex = new sdk.Codex({ config: buildCodexSdkConfigOverrides() });
+            await ensureCodexRuntimeHome();
+            const codex = new sdk.Codex({
+                env: buildCodexChildEnv(),
+                config: buildCodexSdkConfigOverrides()
+            });
             const thread = codex.resumeThread(threadId, threadOptions);
             threads.set(threadId, {
                 providerKind,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.150",
+  "version": "0.2.152",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/scripts/remote-registry-follower-smoke.mjs

@@ -83,10 +83,17 @@ function createRegistryTarget({ endpoint, endpointCandidates, leaseId, active =
     };
 }
 
-function startFakeSupabase(getTarget) {
+function startFakeSupabase(getTarget, setTarget = null) {
     const requests = [];
     const realtimeClients = new Set();
-    const server = createServer((req, res) => {
+    const server = createServer(async (req, res) => {
+        const readBody = () => new Promise(resolve => {
+            let body = '';
+            req.on('data', chunk => {
+                body += chunk.toString();
+            });
+            req.on('end', () => resolve(body));
+        });
         const parsed = new URL(req.url || '/', 'http://127.0.0.1');
         requests.push({
             method: req.method,
@@ -107,6 +114,40 @@ function startFakeSupabase(getTarget) {
             return;
         }
 
+        if (req.method === 'POST' && parsed.pathname === '/rest/v1/rpc/set_remote_host_target') {
+            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
+            assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
+            const body = JSON.parse(await readBody() || '{}');
+            const now = Date.now();
+            const existing = getTarget();
+            const sameLease = existing
+                && String(existing.lease_id || '') === String(body.p_lease_id || '')
+                && String(existing.host_instance_id || '') === String(body.p_host_instance_id || '');
+            const expired = !existing?.expires_at || Date.parse(existing.expires_at) <= now;
+            if (existing?.active === true && !sameLease && !expired && body.p_takeover !== true) {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify([{ ok: false, reason: 'host-target-taken' }]));
+                return;
+            }
+
+            setTarget?.({
+                user_id: USER_ID,
+                active: true,
+                endpoint: String(body.p_endpoint || ''),
+                endpoint_candidates: Array.isArray(body.p_endpoint_candidates)
+                    ? body.p_endpoint_candidates
+                    : [String(body.p_endpoint || '')].filter(Boolean),
+                pair_token: String(body.p_pair_token || ''),
+                lease_id: String(body.p_lease_id || ''),
+                node_id: String(body.p_node_id || ''),
+                host_instance_id: String(body.p_host_instance_id || ''),
+                expires_at: String(body.p_expires_at || new Date(Date.now() + 60_000).toISOString())
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify([{ ok: true, reason: 'ok' }]));
+            return;
+        }
+
         res.writeHead(404, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'not-found' }));
     });
@@ -230,7 +271,7 @@ function startFakeSupabase(getTarget) {
     });
 }
 
-function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label, supabaseUrl = '', follower = false }) {
+function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label, supabaseUrl = '', follower = false, publicHost = '' }) {
     const child = spawn(process.execPath, ['server.js'], {
         cwd: LOCAL_BRIDGE_DIR,
         stdio: ['ignore', 'pipe', 'pipe'],
@@ -243,6 +284,7 @@ function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label
             MINDEXEC_REMOTE_HUB: '1',
             REMOTE_HUB_HOST: '127.0.0.1',
             REMOTE_HUB_PORT: String(remoteHubPort),
+            REMOTE_HUB_PUBLIC_HOST: publicHost,
             REMOTE_HUB_PAIR_TOKEN: PAIR_TOKEN,
             WORKSPACE_PATH: workspacePath,
             MINDEXEC_AUTH_DATA_ROOT: authRoot,
@@ -251,6 +293,7 @@ function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label
             MINDEXEC_REMOTE_REGISTRY_FAST_RETRY_MS: '250',
             MINDEXEC_REMOTE_REGISTRY_REALTIME_RECONNECT_MS: '250',
             MINDEXEC_REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS: '100',
+            MINDEXEC_REMOTE_HOST_TARGET_RENEW_MS: '5000',
             SUPABASE_URL: supabaseUrl,
             SUPABASE_KEY,
             NO_COLOR: '1'
@@ -353,10 +396,13 @@ function killProcess(pid) {
 async function main() {
     const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'mindexec-remote-registry-smoke-'));
     let fakeSupabase = null;
+    let renewHost = null;
     let hostA = null;
     let hostB = null;
     let client = null;
 
+    const renewHostBridgePort = await findFreePort();
+    const renewHostRemotePort = await findFreePort();
     const hostABridgePort = await findFreePort();
     const hostARemotePort = await findFreePort();
     const hostBBridgePort = await findFreePort();
@@ -364,23 +410,82 @@ async function main() {
     const clientBridgePort = await findFreePort();
     const clientRemotePort = await findFreePort();
     const stalePort = await findFreePort();
+    const renewPublicHost = '192.0.2.10';
+    const renewPublicEndpoint = `${renewPublicHost}:${renewHostRemotePort}`;
     const hostAEndpoint = `127.0.0.1:${hostARemotePort}`;
     const hostBEndpoint = `127.0.0.1:${hostBRemotePort}`;
     const staleEndpoint = `127.0.0.1:${stalePort}`;
-    let currentTarget = createRegistryTarget({
-        endpoint: hostAEndpoint,
-        endpointCandidates: [staleEndpoint, hostAEndpoint],
-        leaseId: 'lease-a'
-    });
+    let currentTarget = null;
 
     try {
-        fakeSupabase = await startFakeSupabase(() => currentTarget);
+        fakeSupabase = await startFakeSupabase(
+            () => currentTarget,
+            target => {
+                currentTarget = target;
+            });
 
+        const renewHostAuth = path.join(tempRoot, 'auth-renew-host');
         const hostAAuth = path.join(tempRoot, 'auth-host-a');
         const hostBAuth = path.join(tempRoot, 'auth-host-b');
         const clientAuth = path.join(tempRoot, 'auth-client');
+        await writeSession(renewHostAuth);
         await writeSession(clientAuth);
 
+        renewHost = spawnBridge({
+            bridgePort: renewHostBridgePort,
+            remoteHubPort: renewHostRemotePort,
+            workspacePath: path.join(tempRoot, 'renew-host'),
+            authRoot: renewHostAuth,
+            label: 'renew-host',
+            supabaseUrl: fakeSupabase.url,
+            follower: true,
+            publicHost: renewPublicHost
+        });
+        await waitForBridge(renewHost);
+
+        const renewSetHost = await fetchJson(`${renewHost.baseUrl}/api/remote/host-target`, {
+            method: 'POST',
+            token: BRIDGE_TOKEN,
+            body: JSON.stringify({
+                nodeId: 'remote-registry-renew-node',
+                enabled: true,
+                leaseMs: 60000
+            })
+        });
+        assert.equal(renewSetHost.ok, true, JSON.stringify(renewSetHost.payload));
+        assert.equal(renewSetHost.payload?.ok, true, JSON.stringify(renewSetHost.payload));
+        assert.equal(renewSetHost.payload?.active, true, JSON.stringify(renewSetHost.payload));
+        assert.equal(renewSetHost.payload?.hostTargetRenew?.status, 'active', JSON.stringify(renewSetHost.payload?.hostTargetRenew));
+        assert.equal(currentTarget?.endpoint, renewPublicEndpoint, JSON.stringify(currentTarget));
+        assert.equal(currentTarget?.node_id, 'remote-registry-renew-node', JSON.stringify(currentTarget));
+        await waitFor(() => {
+            const publishCount = fakeSupabase.requests.filter(request =>
+                request.method === 'POST'
+                && request.pathname === '/rest/v1/rpc/set_remote_host_target').length;
+            return publishCount >= 2 ? publishCount : null;
+        }, 8000, `host-target auto renew publish\n${renewHost.details()}`);
+        const renewStatus = await fetchJson(`${renewHost.baseUrl}/api/status`);
+        assert.equal(renewStatus.payload?.remoteHostTargetRenew?.status, 'active', JSON.stringify(renewStatus.payload?.remoteHostTargetRenew));
+        assert.equal(renewStatus.payload?.remoteHostTargetRenew?.endpoint, renewPublicEndpoint, JSON.stringify(renewStatus.payload?.remoteHostTargetRenew));
+
+        const renewClear = await fetchJson(`${renewHost.baseUrl}/api/remote/host-target`, {
+            method: 'DELETE',
+            token: BRIDGE_TOKEN,
+            body: JSON.stringify({
+                nodeId: 'remote-registry-renew-node'
+            })
+        });
+        assert.equal(renewClear.ok, true, JSON.stringify(renewClear.payload));
+        assert.equal(renewClear.payload?.ok, true, JSON.stringify(renewClear.payload));
+        await renewHost.stop();
+        renewHost = null;
+
+        currentTarget = createRegistryTarget({
+            endpoint: hostAEndpoint,
+            endpointCandidates: [staleEndpoint, hostAEndpoint],
+            leaseId: 'lease-a'
+        });
+
         hostA = spawnBridge({
             bridgePort: hostABridgePort,
             remoteHubPort: hostARemotePort,
@@ -465,6 +570,7 @@ async function main() {
         if (client) await client.stop();
         if (hostB) await hostB.stop();
         if (hostA) await hostA.stop();
+        if (renewHost) await renewHost.stop();
         if (fakeSupabase) await fakeSupabase.stop();
         await rm(tempRoot, { recursive: true, force: true });
     }

package/server.js

@@ -3146,6 +3146,15 @@ const REMOTE_REGISTRY_REALTIME_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
 const REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS = Math.max(10000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS || 25000) || 25000);
 const REMOTE_REGISTRY_REALTIME_RECONNECT_MS = Math.max(1000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_RECONNECT_MS || 2500) || 2500);
 const REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS = Math.max(100, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS || 250) || 250);
+const REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
+    && !/^(0|false|no|off)$/i.test(String(process.env.MINDEXEC_REMOTE_HOST_TARGET_AUTO_RENEW || 'true'));
+const REMOTE_HOST_TARGET_LEASE_MS = Math.max(60000, Number(process.env.MINDEXEC_REMOTE_HOST_TARGET_LEASE_MS || 120000) || 120000);
+const REMOTE_HOST_TARGET_RENEW_MS = Math.max(
+    5000,
+    Math.min(
+        Math.floor(REMOTE_HOST_TARGET_LEASE_MS / 2),
+        Number(process.env.MINDEXEC_REMOTE_HOST_TARGET_RENEW_MS || 25000) || 25000));
+const REMOTE_HOST_TARGET_RENEW_LOG_REPEAT_MS = 60000;
 let remoteAgentState = createRemoteAgentIdleState();
 let remoteAgentSyncReportState = null;
 let remoteAgentSyncReportLogKey = '';
@@ -3168,6 +3177,10 @@ let remoteRegistryRealtimeHeartbeatTimer = null;
 let remoteRegistryRealtimeReconnectTimer = null;
 let remoteRegistryRealtimeReconnectContext = null;
 let remoteRegistryRealtimeLastWakeAt = 0;
+let remoteHostTargetRenewTimer = null;
+let remoteHostTargetRenewInFlight = false;
+let remoteHostTargetRenewLogKey = '';
+let remoteHostTargetRenewLogAt = 0;
 let remoteRegistryFollowerState = {
     enabled: REMOTE_REGISTRY_FOLLOWER_ENABLED,
     status: REMOTE_REGISTRY_FOLLOWER_ENABLED ? 'idle' : 'disabled',
@@ -3201,6 +3214,20 @@ let remoteRegistryRealtimeState = {
     changes: 0,
     wakeups: 0
 };
+let remoteHostTargetRenewState = {
+    enabled: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED,
+    status: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED ? 'idle' : 'disabled',
+    reason: '',
+    nodeId: '',
+    leaseId: '',
+    hostInstanceId: '',
+    endpoint: '',
+    endpointCandidates: [],
+    expiresAt: '',
+    lastAttemptAt: '',
+    lastSuccessAt: '',
+    lastError: ''
+};
 
 function createRemoteAgentIdleState(overrides = {}) {
     return {
@@ -4499,6 +4526,23 @@ function updateRemoteRegistryFollowerState(patch = {}) {
     emitBridgeEvent('RemoteRegistryFollowerUpdated', serializeRemoteRegistryFollowerState());
 }
 
+function serializeRemoteHostTargetRenewState() {
+    return {
+        ...remoteHostTargetRenewState,
+        leaseMs: REMOTE_HOST_TARGET_LEASE_MS,
+        renewMs: REMOTE_HOST_TARGET_RENEW_MS
+    };
+}
+
+function updateRemoteHostTargetRenewState(patch = {}) {
+    remoteHostTargetRenewState = {
+        ...remoteHostTargetRenewState,
+        ...patch,
+        enabled: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED
+    };
+    emitBridgeEvent('RemoteHostTargetRenewUpdated', serializeRemoteHostTargetRenewState());
+}
+
 function serializeRemoteRegistryRealtimeState() {
     return {
         ...remoteRegistryRealtimeState,
@@ -5094,6 +5138,328 @@ async function fetchRemoteRegistryTarget(config, session) {
     return normalizeRemoteRegistryTarget(Array.isArray(payload) ? payload[0] : payload);
 }
 
+async function callRemoteRegistryRpc(config, session, functionName, payload) {
+    const url = new URL(`/rest/v1/rpc/${functionName}`, config.url);
+    const response = await fetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            apikey: config.key,
+            Authorization: `Bearer ${session.accessToken}`,
+            Accept: 'application/json',
+            'Content-Type': 'application/json'
+        },
+        body: JSON.stringify(payload)
+    });
+
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        const error = new Error(`registry-rpc-${functionName}-${response.status}${text ? `:${shortenText(text, 160)}` : ''}`);
+        error.statusCode = response.status;
+        throw error;
+    }
+
+    const rpcPayload = await response.json().catch(() => null);
+    const row = Array.isArray(rpcPayload) ? rpcPayload[0] : rpcPayload;
+    return {
+        ok: row?.ok === true || row?.Ok === true,
+        reason: safeRemoteAgentField(row?.reason || row?.Reason || '', 160)
+    };
+}
+
+async function readRemoteRegistryContext() {
+    const config = readSupabaseRuntimeConfig();
+    if (!config.url || !config.key) {
+        return { ok: false, reason: 'supabase-config-missing' };
+    }
+
+    const sessionPayload = await readStableAuthSessionPayload();
+    const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+    if (!session) {
+        return { ok: false, reason: 'registry-not-authenticated' };
+    }
+
+    if (session.expiresAtMs && session.expiresAtMs <= Date.now()) {
+        return { ok: false, reason: 'session-expired' };
+    }
+
+    return { ok: true, config, session };
+}
+
+function getRemoteHostTargetEndpointReason(endpoint) {
+    const normalized = normalizeRemoteManagerEndpoint(endpoint);
+    if (!normalized) {
+        return 'invalid-manager-endpoint';
+    }
+
+    const match = normalized.match(/^(\[[^\]]+\]|[^:\s]+):(\d{1,5})$/);
+    const host = String(match?.[1] || '').replace(/^\[|\]$/g, '').toLowerCase();
+    if (!host || host === 'localhost' || host === '::1' || host === '0:0:0:0:0:0:0:1' || /^127\./.test(host)) {
+        return 'loopback-endpoint';
+    }
+
+    if (host === '0.0.0.0' || host === '::' || host === '*') {
+        return 'wildcard-endpoint';
+    }
+
+    if (/^169\.254\./.test(host)) {
+        return 'link-local-endpoint';
+    }
+
+    return 'ok';
+}
+
+function buildRemoteHostTargetRegistryPayload(hub) {
+    const rawEndpointCandidates = normalizeRemoteManagerEndpointList(
+        hub?.hostTargetEndpointCandidates,
+        hub?.agentEndpointCandidates,
+        hub?.hostTargetEndpoint,
+        hub?.agentEndpoint);
+    const endpointCandidates = rawEndpointCandidates
+        .filter(endpoint => getRemoteHostTargetEndpointReason(endpoint) === 'ok')
+        .slice(0, 12);
+    const endpoint = endpointCandidates[0] || '';
+    const pairToken = safeRemoteAgentField(hub?.pairToken, 512);
+    const leaseId = safeRemoteAgentField(hub?.hostTargetLeaseId, 128);
+    const hostInstanceId = safeRemoteAgentField(hub?.hostTargetHostInstanceId || hub?.hostInstanceId, 128);
+    const nodeId = safeRemoteAgentField(hub?.hostTargetNodeId, 128);
+    const activatedAt = safeRemoteAgentField(hub?.hostTargetActivatedAt, 80) || new Date().toISOString();
+    const expiresAt = safeRemoteAgentField(hub?.hostTargetExpiresAt, 80) || new Date(Date.now() + REMOTE_HOST_TARGET_LEASE_MS).toISOString();
+
+    if (!pairToken || !leaseId || !hostInstanceId || !nodeId) {
+        return {
+            ok: false,
+            reason: 'missing-fields',
+            endpoint: '',
+            endpointCandidates: []
+        };
+    }
+
+    if (endpointCandidates.length === 0) {
+        const reason = rawEndpointCandidates.length === 0
+            ? safeRemoteAgentField(hub?.agentEndpointRouteReason || 'missing-endpoint-candidates', 160)
+            : getRemoteHostTargetEndpointReason(rawEndpointCandidates[0]);
+        return {
+            ok: false,
+            reason,
+            endpoint: rawEndpointCandidates[0] || '',
+            endpointCandidates: rawEndpointCandidates
+        };
+    }
+
+    return {
+        ok: true,
+        endpoint,
+        endpointCandidates,
+        leaseId,
+        hostInstanceId,
+        nodeId,
+        expiresAt,
+        payload: {
+            p_node_id: nodeId,
+            p_lease_id: leaseId,
+            p_host_instance_id: hostInstanceId,
+            p_endpoint: endpoint,
+            p_pair_token: pairToken,
+            p_manager_package: safeRemoteAgentField(hub?.managerPackage || '@mindexec/cli', 160),
+            p_manager_version: safeRemoteAgentField(hub?.managerVersion || '', 80),
+            p_agent_package: safeRemoteAgentField(hub?.agentPackage || '@mindexec/remote', 160),
+            p_activated_at: activatedAt,
+            p_expires_at: expiresAt,
+            p_endpoint_candidates: endpointCandidates
+        }
+    };
+}
+
+function logRemoteHostTargetRenew(status, reason, endpoint = '') {
+    const key = [status, reason, endpoint].join('|');
+    const now = Date.now();
+    if (key === remoteHostTargetRenewLogKey
+        && now - remoteHostTargetRenewLogAt < REMOTE_HOST_TARGET_RENEW_LOG_REPEAT_MS) {
+        return;
+    }
+
+    remoteHostTargetRenewLogKey = key;
+    remoteHostTargetRenewLogAt = now;
+    logEvent(
+        'remote',
+        `host target renew ${status} ${formatKeyValue('reason', reason || '-')} ${formatKeyValue('endpoint', endpoint || '-')}`,
+        status === 'ok' ? 'remote' : 'warn');
+}
+
+function isRemoteHostTargetRenewSoftSkipReason(reason) {
+    return /^(registry-not-authenticated|session-expired|supabase-config-missing|missing-endpoint-candidates|loopback-endpoint|wildcard-endpoint|link-local-endpoint)$/i
+        .test(String(reason || '').trim());
+}
+
+async function publishLocalRemoteHostTargetToRegistry(hub, { takeover = false } = {}) {
+    const registryPayload = buildRemoteHostTargetRegistryPayload(hub);
+    if (!registryPayload.ok) {
+        return {
+            ok: false,
+            active: false,
+            reason: registryPayload.reason,
+            endpoint: registryPayload.endpoint,
+            endpointCandidates: registryPayload.endpointCandidates,
+            stale: false
+        };
+    }
+
+    const context = await readRemoteRegistryContext();
+    if (!context.ok) {
+        return {
+            ok: false,
+            active: false,
+            reason: context.reason,
+            endpoint: registryPayload.endpoint,
+            endpointCandidates: registryPayload.endpointCandidates,
+            stale: false
+        };
+    }
+
+    const row = await callRemoteRegistryRpc(
+        context.config,
+        context.session,
+        'set_remote_host_target',
+        {
+            ...registryPayload.payload,
+            p_takeover: takeover === true
+        });
+    const reason = row.reason || (row.ok ? 'ok' : 'registry-publish-failed');
+    return {
+        ok: row.ok,
+        active: row.ok,
+        reason,
+        endpoint: registryPayload.endpoint,
+        endpointCandidates: registryPayload.endpointCandidates,
+        leaseId: registryPayload.leaseId,
+        nodeId: registryPayload.nodeId,
+        hostInstanceId: registryPayload.hostInstanceId,
+        expiresAt: registryPayload.expiresAt,
+        stale: reason === 'host-target-taken'
+    };
+}
+
+function scheduleRemoteHostTargetRenew(delayMs = REMOTE_HOST_TARGET_RENEW_MS, reason = 'timer') {
+    if (!REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED || isShuttingDown) {
+        return;
+    }
+
+    if (remoteHostTargetRenewTimer) {
+        clearTimeout(remoteHostTargetRenewTimer);
+        remoteHostTargetRenewTimer = null;
+    }
+
+    remoteHostTargetRenewTimer = setTimeout(() => {
+        remoteHostTargetRenewTimer = null;
+        runRemoteHostTargetRenewOnce(reason).catch(error => {
+            const message = error?.message || String(error || '');
+            updateRemoteHostTargetRenewState({
+                status: 'error',
+                reason: 'renew-error',
+                lastAttemptAt: new Date().toISOString(),
+                lastError: message
+            });
+            logRemoteHostTargetRenew('failed', message);
+            scheduleRemoteHostTargetRenew(REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS, 'error-retry');
+        });
+    }, Math.max(0, Number(delayMs) || 0));
+    remoteHostTargetRenewTimer?.unref?.();
+}
+
+function stopRemoteHostTargetRenew(reason = 'stopped') {
+    if (remoteHostTargetRenewTimer) {
+        clearTimeout(remoteHostTargetRenewTimer);
+        remoteHostTargetRenewTimer = null;
+    }
+    updateRemoteHostTargetRenewState({
+        status: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED ? 'idle' : 'disabled',
+        reason,
+        nodeId: '',
+        leaseId: '',
+        hostInstanceId: '',
+        endpoint: '',
+        endpointCandidates: [],
+        expiresAt: '',
+        lastError: ''
+    });
+}
+
+async function runRemoteHostTargetRenewOnce(trigger = 'timer', options = {}) {
+    if (!REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED || remoteHostTargetRenewInFlight) {
+        return serializeRemoteHostTargetRenewState();
+    }
+
+    remoteHostTargetRenewInFlight = true;
+    const attemptedAt = new Date().toISOString();
+    try {
+        const currentHub = remoteHub.getStatus({ includeSecrets: true });
+        if (currentHub?.hostTargetActive !== true || !currentHub.hostTargetNodeId) {
+            stopRemoteHostTargetRenew('no-local-host-target');
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        const renewed = remoteHub.setHostTarget({
+            enabled: true,
+            nodeId: currentHub.hostTargetNodeId,
+            leaseMs: REMOTE_HOST_TARGET_LEASE_MS
+        });
+        if (renewed?.ok !== true || renewed?.active !== true) {
+            updateRemoteHostTargetRenewState({
+                status: 'error',
+                reason: renewed?.error || 'local-host-renew-failed',
+                nodeId: currentHub.hostTargetNodeId,
+                lastAttemptAt: attemptedAt,
+                lastError: renewed?.error || 'local-host-renew-failed'
+            });
+            scheduleRemoteHostTargetRenew(REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS, 'local-renew-failed');
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        const hub = remoteHub.getStatus({ includeSecrets: true });
+        const registry = await publishLocalRemoteHostTargetToRegistry(hub, {
+            takeover: options.takeover === true
+        });
+        const status = registry.ok ? 'active' : registry.stale ? 'superseded' : 'skipped';
+        updateRemoteHostTargetRenewState({
+            status,
+            reason: registry.reason || (registry.ok ? 'ok' : 'registry-skipped'),
+            nodeId: hub.hostTargetNodeId,
+            leaseId: hub.hostTargetLeaseId,
+            hostInstanceId: hub.hostTargetHostInstanceId || hub.hostInstanceId,
+            endpoint: registry.endpoint || hub.hostTargetEndpoint,
+            endpointCandidates: registry.endpointCandidates || hub.hostTargetEndpointCandidates || [],
+            expiresAt: hub.hostTargetExpiresAt,
+            lastAttemptAt: attemptedAt,
+            lastSuccessAt: registry.ok ? new Date().toISOString() : remoteHostTargetRenewState.lastSuccessAt,
+            lastError: registry.ok || /^(registry-not-authenticated|session-expired|supabase-config-missing)$/i.test(registry.reason || '')
+                ? ''
+                : (registry.reason || 'registry-publish-failed')
+        });
+
+        if (registry.stale) {
+            remoteHub.setHostTarget({
+                enabled: false,
+                nodeId: hub.hostTargetNodeId
+            });
+            logRemoteHostTargetRenew('superseded', registry.reason, registry.endpoint);
+            stopRemoteHostTargetRenew('host-target-superseded');
+            wakeRemoteRegistryFollower('host-target-superseded').catch(() => {});
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        logRemoteHostTargetRenew(registry.ok ? 'ok' : 'skipped', registry.reason, registry.endpoint);
+        const retryDelay = registry.ok || isRemoteHostTargetRenewSoftSkipReason(registry.reason)
+            ? REMOTE_HOST_TARGET_RENEW_MS
+            : REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS;
+        scheduleRemoteHostTargetRenew(
+            retryDelay,
+            registry.ok ? 'renewed' : 'renew-skipped');
+        return serializeRemoteHostTargetRenewState();
+    } finally {
+        remoteHostTargetRenewInFlight = false;
+    }
+}
+
 async function reportRemoteRegistryFollowerSync(payload = {}) {
     const report = createRemoteAgentSyncReport(payload);
     rememberRemoteAgentSyncReport(report);
@@ -9921,6 +10287,7 @@ app.get('/api/status', async (req, res) => {
         remoteAgent: serializeRemoteAgentState(),
         remoteRegistryFollower: serializeRemoteRegistryFollowerState(),
         remoteRegistryRealtime: serializeRemoteRegistryRealtimeState(),
+        remoteHostTargetRenew: serializeRemoteHostTargetRenewState(),
         shellJobsPath: '/api/shell/jobs',
         companyCore: {
             baseUrl: companyCoreBaseUrl,
@@ -9997,20 +10364,27 @@ app.post('/api/remote/frames', (req, res) => {
 app.post('/api/remote/host-target', async (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
     try {
+        const requestedLeaseMs = Number(req.body?.leaseMs);
         const result = remoteHub.setHostTarget({
             enabled: req.body?.enabled !== false,
             nodeId: req.body?.nodeId,
-            leaseMs: req.body?.leaseMs
+            leaseMs: Math.max(
+                REMOTE_HOST_TARGET_LEASE_MS,
+                Number.isFinite(requestedLeaseMs) && requestedLeaseMs > 0 ? requestedLeaseMs : 0)
         });
         if (result?.ok === true && result?.active === true && isLocalRemoteHostTargetActive()) {
             if (isRemoteAgentProcessRunning()) {
                 await stopRemoteAgentConnection('local-host-target-active');
                 logEvent('remote', 'managed RemoteAgent held stopped while local host target is active', 'remote');
             }
+            await runRemoteHostTargetRenewOnce('set-host', { takeover: true });
+        } else if (result?.active !== true) {
+            stopRemoteHostTargetRenew('host-target-inactive');
         }
         res.json({
             ...result,
-            agent: serializeRemoteAgentState()
+            agent: serializeRemoteAgentState(),
+            hostTargetRenew: serializeRemoteHostTargetRenewState()
         });
     } catch (err) {
         logError('remote', 'remote host target update failed.', err);
@@ -10018,17 +10392,25 @@ app.post('/api/remote/host-target', async (req, res) => {
             ok: false,
             active: false,
             error: err?.message || String(err),
-            agent: serializeRemoteAgentState()
+            agent: serializeRemoteAgentState(),
+            hostTargetRenew: serializeRemoteHostTargetRenewState()
         });
     }
 });
 
 app.delete('/api/remote/host-target', (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
-    res.json(remoteHub.setHostTarget({
+    const result = remoteHub.setHostTarget({
         enabled: false,
         nodeId: req.body?.nodeId
-    }));
+    });
+    if (result?.ok === true) {
+        stopRemoteHostTargetRenew('host-target-cleared');
+    }
+    res.json({
+        ...result,
+        hostTargetRenew: serializeRemoteHostTargetRenewState()
+    });
 });
 
 app.get('/api/remote/agent/status', (req, res) => {
@@ -11751,6 +12133,12 @@ async function shutdownBridge(signal) {
         // Ignore registry follower shutdown errors
     }
 
+    try {
+        stopRemoteHostTargetRenew('bridge-shutdown');
+    } catch {
+        // Ignore host-target renew shutdown errors
+    }
+
     try {
         closeRemoteRegistryRealtime('bridge-shutdown');
     } catch {

package/wwwroot/_content/MindExecution.Shared/js/mind-map-core.js

@@ -5,7 +5,7 @@
     const DEBUG = false;
     const FPS_DEBUG = false;
     const FRAME_PERF_DEBUG = false;
-const MINDMAP_CORE_BUILD_ID = '20260616-remote-ws-control-frames-v573';
+const MINDMAP_CORE_BUILD_ID = '20260617-flow-run-hitfix-v586';
     const CanvasPhase = Object.freeze({
         Booting: 'booting',
         BoardFileLoading: 'board-file-loading',

package/wwwroot/_content/MindExecution.Shared/js/mind-map-css3d-manager.js

@@ -8524,6 +8524,7 @@
     const AUTOMATION_RESULT_PIN_HELP_TEXT = 'Drag to connect this result to an input pin. Click to view the result.';
     const BUSINESS_AUTOMATION_PIN_HIT_PADDING = 8;
     const BUSINESS_AUTOMATION_PIN_DROP_PADDING = 24;
+    const BUSINESS_AUTOMATION_RESULT_PIN_EDGE_PADDING = 18;
 
     function getAutomationPinTheme(type) {
         const normalized = String(type || '').trim().toLowerCase();
@@ -8580,7 +8581,7 @@
             width: ${compact ? '24px' : 'auto'};
             height: ${compact ? '24px' : '22px'};
             max-width: ${compact ? '24px' : '124px'};
-            pointer-events: ${side === 'result' ? 'none' : 'auto'};
+            pointer-events: ${resultTooltipPin ? 'auto' : (side === 'result' ? 'none' : 'auto')};
             user-select: none;
             -webkit-user-select: none;
             white-space: nowrap;
@@ -8667,13 +8668,14 @@
         }
 
         const placement = String(options.placement || '').trim().toLowerCase();
+        const hasInteractiveResultPin = pins.some(pin => isAutomationResultTooltipPinDefinition(pin, side));
         const group = document.createElement('div');
         group.className = `map-node-memo__automation-pins is-${side}${placement ? ` is-placement-${placement}` : ''}`;
         group.style.cssText = `
             position: absolute;
             display: flex;
             gap: ${options.compact === true ? '0' : (side === 'result' ? '8px' : '7px')};
-            pointer-events: ${side === 'result' ? 'none' : 'auto'};
+            pointer-events: ${hasInteractiveResultPin ? 'auto' : (side === 'result' ? 'none' : 'auto')};
             z-index: 7;
             ${getAutomationPinGroupPlacementStyle(side, placement)}
         `;
@@ -9137,11 +9139,14 @@
     }
 
     function handleBusinessAutomationDocumentPointerDown(event) {
+        const resultPin = findBusinessAutomationResultPinAtEvent(event, {
+            geometryPadding: BUSINESS_AUTOMATION_RESULT_PIN_EDGE_PADDING
+        })?.pin || null;
         const targetPin = event.target?.closest?.('.map-node-memo__automation-pin') || null;
         const stackedPin = findBusinessAutomationPinAtEvent(event, '.map-node-memo__automation-pin', {
             geometryPadding: BUSINESS_AUTOMATION_PIN_HIT_PADDING
         })?.pin || null;
-        const pin = targetPin || stackedPin;
+        const pin = resultPin || targetPin || stackedPin;
         const edge = event.target?.closest?.('.mind-map-business-automation-edge-hit, .mind-map-business-automation-edge-path') || null;
 
         if (!pin && !edge) {
@@ -10140,7 +10145,17 @@
             return;
         }
 
-        const pinHit = findBusinessAutomationPinAtEvent(event, '.map-node-memo__automation-pin');
+        const resultPinHit = findBusinessAutomationResultPinAtEvent(event, {
+            geometryPadding: BUSINESS_AUTOMATION_RESULT_PIN_EDGE_PADDING
+        });
+        if (resultPinHit?.pin) {
+            handleBusinessAutomationPinPointerDown(event, resultPinHit.pin);
+            return;
+        }
+
+        const pinHit = findBusinessAutomationPinAtEvent(event, '.map-node-memo__automation-pin', {
+            geometryPadding: BUSINESS_AUTOMATION_PIN_HIT_PADDING
+        });
         if (pinHit?.pin) {
             handleBusinessAutomationPinPointerDown(event, pinHit.pin);
             return;
@@ -10202,6 +10217,19 @@
             return;
         }
 
+        const resultPinHit = findBusinessAutomationResultPinAtEvent(event, {
+            geometryPadding: BUSINESS_AUTOMATION_RESULT_PIN_EDGE_PADDING
+        });
+        const resultPin = resultPinHit?.pin || null;
+        const container = resultPin?.closest?.('.map-node-automation') || null;
+        if (resultPin && container && !isBusinessAutomationTooltipDragClick(event, container)) {
+            event.preventDefault();
+            event.stopPropagation();
+            event.stopImmediatePropagation?.();
+            openBusinessAutomationTooltipFromResultPin(resultPin, event);
+            return;
+        }
+
         event.preventDefault();
         event.stopPropagation();
         event.stopImmediatePropagation?.();

package/wwwroot/index.html

@@ -7,8 +7,8 @@
     <title>MindExec | Run your ideas as AI task graphs</title>
     <meta name="description" content="MindExec is an AI execution canvas for solo builders, researchers, developers, and creators. Start with free browser tools, then move serious work into saved MindCanvas projects." />
     <base href="/" />
-    <link rel="stylesheet" href="_content/MindExecution.Shared/css/app.css?v=20260617-mdm-tile-scale-v585" />
-    <link rel="stylesheet" href="_content/MindExecution.Shared/css/mind-map-overrides.css?v=20260617-mdm-tile-scale-v585" />
+    <link rel="stylesheet" href="_content/MindExecution.Shared/css/app.css?v=20260617-flow-run-hitfix-v586" />
+    <link rel="stylesheet" href="_content/MindExecution.Shared/css/mind-map-overrides.css?v=20260617-flow-run-hitfix-v586" />
     <!-- ?쇄뼹??Font Awesome (local) ?쇄뼹??-->
     <link rel="stylesheet" href="_content/MindExecution.Shared/lib/font-awesome/css/all.min.css" />
     <!-- ?꿎뼯??-->
@@ -579,7 +579,7 @@
             }
 
             const base = '_content/MindExecution.Shared/js/';
-        const scriptVersion = '20260617-mdm-tile-scale-v585';
+        const scriptVersion = '20260617-flow-run-hitfix-v586';
             const scriptUrl = (script) => `${base}${script}?v=${scriptVersion}`;
             console.log(`[Script Loader] Shared JS version: ${scriptVersion}`);
             const criticalScripts = [

package/wwwroot/service-worker-assets.js

@@ -1,5 +1,5 @@
 self.assetsManifest = {
-    "version":  "ZfLSWK2O",
+    "version":  "20SB8UIp",
     "assets":  [
                    {
                        "hash":  "sha256-+CSYMcqLNTsq3VnH11jgYyOCCdxvHzL74CBmo4sCmMU=",
@@ -78,7 +78,7 @@
                        "url":  "_content/MindExecution.Shared/js/marked.min.js"
                    },
                    {
-                       "hash":  "sha256-oDfBxq3aqmSU1z5MGGpE9ZeTdsBtrykHEBnygOVFJtE=",
+                       "hash":  "sha256-y/ehxOpFseX3lMFu+VGjbL4lTMmQ0kEmj5QIRldR2S4=",
                        "url":  "_content/MindExecution.Shared/js/mind-map-core.js"
                    },
                    {
@@ -86,7 +86,7 @@
                        "url":  "_content/MindExecution.Shared/js/mind-map-core.js.backup"
                    },
                    {
-                       "hash":  "sha256-Ma2j27vONNBesOrw65Auhtvwr3a5NFSp7sDag7VUo38=",
+                       "hash":  "sha256-CXwos9ge49EzJij/kELHzhWSDGBSR3fbqqW7hBxARCI=",
                        "url":  "_content/MindExecution.Shared/js/mind-map-css3d-manager.js"
                    },
                    {
@@ -834,7 +834,7 @@
                        "url":  "image-manifest.json"
                    },
                    {
-                       "hash":  "sha256-uZsIbGZb6Q24FUaQCppHT2DCnj7ae7QpkaKq6YnmLIY=",
+                       "hash":  "sha256-428jP5ecE6zg8KQQ90OJuzhM+BUgcq4ko9pBmv1rm7Q=",
                        "url":  "index.html"
                    },
                    {

package/wwwroot/service-worker.js

@@ -1,4 +1,4 @@
-/* Manifest version: ZfLSWK2O */
+/* Manifest version: 20SB8UIp */
 // Hosted deployments should prefer the network over stale offline caches.
 // This service worker immediately clears old Blazor offline caches and unregisters itself.