@pulsehub/runner 0.1.1 → 0.1.3

package/.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
       - run: npm test

package/.github/workflows/publish.yml

@@ -20,30 +20,43 @@ jobs:
     outputs:
       version: ${{ steps.bump.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
+          package-manager-cache: false
       - run: npm test
       - run: node src/index.js --help
       - name: Bump patch version and tag the release
         id: bump
         shell: bash
         run: |
-          npm version patch --no-git-tag-version
           version="$(node -p 'require("./package.json").version')"
-          tag="v${version}"
+          published_version="$(npm view @pulsehub/runner version)"
 
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add package.json
-          git commit -m "chore(release): ${tag} [skip ci]"
-          git tag "${tag}"
-          git push origin HEAD:main
-          git push origin "${tag}"
+          if [ "${version}" = "${published_version}" ]; then
+            npm version patch --no-git-tag-version
+            version="$(node -p 'require("./package.json").version')"
+            tag="v${version}"
+
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git add package.json
+            git commit -m "chore(release): ${tag} [skip ci]"
+            git tag "${tag}"
+            git push origin HEAD:main
+            git push origin "${tag}"
+          else
+            tag="v${version}"
+            echo "npm latest is ${published_version}; retrying unpublished repository version ${version}."
+            if ! git rev-parse --verify "refs/tags/${tag}" >/dev/null 2>&1; then
+              git tag "${tag}"
+              git push origin "${tag}"
+            fi
+          fi
 
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
@@ -55,13 +68,16 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: v${{ needs.version.outputs.version }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+      - name: Show Node and npm versions
+        run: node --version && npm --version
       - name: Verify version tag
         run: test "v$(node -p 'require("./package.json").version')" = "v${{ needs.version.outputs.version }}"
       - run: npm publish --access public

package/README.md

@@ -6,6 +6,8 @@ To update an existing installation after a new release, run `npm update -g @puls
 
 Every push to `main` (including a merged pull request) runs the release workflow. It tests the Runner, increments the patch version, commits the version and a matching `vX.Y.Z` tag to `main`, then publishes that version to npm. The npm publisher uses GitHub Actions OIDC; no npm token is stored in GitHub. Development-channel releases can be added separately when a `dev` branch is introduced.
 
+The background service writes sanitized lifecycle and per-repository publication events to `logs/runner.jsonl` under the Runner data directory. On macOS this is `~/Library/Application Support/pulse-runner/logs/runner.jsonl`; `PULSE_RUNNER_HOME` overrides the directory. The file is created with user-only permissions and does not contain agent transcripts or provider sessions.
+
 Initialize the local machine with its workspace and agent identifiers plus the release signing public key, then paste the public key printed by `init` into Pulse Settings. The current release key is [`keys/runner-job-v1-public.pem`](keys/runner-job-v1-public.pem). Pulse returns a one-time device credential; `pair` derives and stores the Runner ID and credential with owner-only permissions. Use `diagnose` before `start`.
 
 After a successful agent run, the Runner itself pushes every changed `pul/*` branch in the job's signed project worktrees and creates (or detects) its pull request through the local GitHub CLI. This avoids relying on an interactive agent approval for publication; `git` and `gh` must be authenticated locally.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsehub/runner",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Local, credential-safe Pulse Runner",
   "repository": {
     "type": "git",
@@ -11,7 +11,7 @@
   },
   "type": "module",
   "bin": {
-    "pulse-runner": "./src/index.js"
+    "pulse-runner": "src/index.js"
   },
   "engines": {
     "node": ">=20"

package/src/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { generateKeyPairSync } from 'node:crypto';
 import { spawn } from 'node:child_process';
-import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { appendFile, chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { platform } from 'node:os';
 import { ensureDataDir, paths, readConfig, readCredential, removeTemporary, writeConfig, writeCredential } from './config.js';
@@ -14,6 +14,21 @@ const value = (flag) => { const i = args.indexOf(flag); return i < 0 ? undefined
 const has = (flag) => args.includes(flag);
 const usage = () => console.log(`pulse-runner <init|pair|start|run|diagnose|repo|service>\n\ninit --workspace WS --agent AGENT --signing-public-key FILE --allow-autonomous [--endpoint URL] [--repo owner/repo]\npair --credential runner.secret\nstart | run --once | diagnose | repo add|remove|list | service install|start|stop|status`);
 
+async function logEvent(event, details = {}) {
+  try {
+    const p = await ensureDataDir();
+    const safeDetails = Object.fromEntries(Object.entries(details).map(([key, value]) => [
+      key,
+      typeof value === 'string' ? sanitize(value) : value,
+    ]));
+    const file = join(p.logs, 'runner.jsonl');
+    await appendFile(file, `${JSON.stringify({ timestamp: new Date().toISOString(), event, ...safeDetails })}\n`, { mode: 0o600 });
+    await chmod(file, 0o600);
+  } catch {
+    // Logging must not turn a successfully completed job into a failed one.
+  }
+}
+
 async function request(config, path, body) {
   const credential = await readCredential();
   if (!credential) throw new Error('Runner is not paired. Run pulse-runner pair first.');
@@ -23,6 +38,24 @@ async function request(config, path, body) {
 }
 
 function repoPath(repo) { return repo.replace('/', '__'); }
+function failureDetail(output) {
+  return sanitize(output).split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(-3).join(' | ').slice(-240);
+}
+function completionSummary(result, publication) {
+  const entries = [{
+    label: result.code === 0 ? 'Agent completed' : `Agent failed (exit ${result.code})`,
+    detail: result.code === 0 ? '' : failureDetail(result.output),
+  }];
+  for (const published of publication.succeeded) entries.push({ label: 'Publication succeeded', detail: published });
+  for (const failed of publication.failed) entries.push({
+    label: `Publication failed for ${failed.repo} during ${failed.phase}`,
+    detail: failureDetail(failed.error),
+  });
+  const detailCount = entries.filter((entry) => entry.detail).length;
+  const prefixSize = entries.reduce((sum, entry) => sum + entry.label.length + (entry.detail ? 2 : 0), 0) + entries.length - 1;
+  const detailBudget = detailCount ? Math.max(0, Math.floor((480 - prefixSize) / detailCount)) : 0;
+  return entries.map(({ label, detail }) => detail && detailBudget ? `${label}: ${detail.slice(-detailBudget)}` : label).join('\n').slice(-500);
+}
 async function checkoutRepo(repo, worktree) {
   const p = paths(); const mirror = join(p.repos, `${repoPath(repo)}.git`);
   const existing = await command('git', ['--git-dir', mirror, 'rev-parse', '--git-dir']).catch(() => ({ code: 1, output: '' }));
@@ -56,47 +89,97 @@ async function cleanup(checkouts) {
     await removeTemporary(worktree);
   }));
 }
-async function publishCheckout(checkout) {
+async function publishCheckout(checkout, jobId) {
   const branchResult = await command('git', ['-C', checkout.worktree, 'branch', '--show-current']);
   const branch = branchResult.output.trim();
-  if (!branch || !branch.startsWith('pul/')) return '';
+  if (!branch || !branch.startsWith('pul/')) {
+    await logEvent('publication.skipped', { jobId, repo: checkout.repo, reason: 'branch-not-pulse' });
+    return '';
+  }
+  let phase = 'validate-commit';
   const status = await command('git', ['-C', checkout.worktree, 'status', '--porcelain']);
   const uncommitted = status.output.split('\n').filter((line) => line && !line.endsWith('.pulse-runner-job'));
-  if (uncommitted.length > 0) throw new Error(`Uncommitted changes remain in ${checkout.repo}; the agent must commit every changed worktree.`);
+  if (uncommitted.length > 0) throw Object.assign(new Error(`Uncommitted changes remain in ${checkout.repo}; the agent must commit every changed worktree.`), { phase });
+  phase = 'inspect-commit';
   const head = await command('git', ['-C', checkout.worktree, 'rev-parse', 'HEAD']);
-  if (head.code || head.output.trim() === checkout.baseCommit) return '';
+  if (head.code) throw Object.assign(new Error(sanitize(head.output)), { phase });
+  if (head.output.trim() === checkout.baseCommit) {
+    await logEvent('publication.skipped', { jobId, repo: checkout.repo, branch, reason: 'no-commits' });
+    return '';
+  }
   // Sólo se publica una rama de trabajo Pulse de un worktree firmado como
   // contexto de este job. El Runner no elige repos ni destinos externos.
+  phase = 'push';
+  await logEvent('publication.started', { jobId, repo: checkout.repo, branch, phase });
   const pushed = await command('git', ['-c', 'remote.origin.mirror=false', '--git-dir', checkout.mirror, 'push', 'origin', `refs/heads/${branch}:refs/heads/${branch}`]);
-  if (pushed.code) throw new Error(sanitize(pushed.output));
+  if (pushed.code) throw Object.assign(new Error(sanitize(pushed.output)), { phase });
+  await logEvent('publication.pushed', { jobId, repo: checkout.repo, branch, phase });
+  phase = 'find-pull-request';
   const existing = await command('gh', ['pr', 'view', branch, '--repo', checkout.repo, '--json', 'url']);
-  if (existing.code === 0) return `Published ${checkout.repo}:${branch}; existing PR detected.`;
+  if (existing.code === 0) {
+    await logEvent('publication.pull-request-exists', { jobId, repo: checkout.repo, branch });
+    return `Published ${checkout.repo}:${branch}; existing PR detected.`;
+  }
+  if (!/no pull requests found/i.test(existing.output)) throw Object.assign(new Error(sanitize(existing.output)), { phase });
+  phase = 'create-pull-request';
   const created = await command('gh', ['pr', 'create', '--repo', checkout.repo, '--base', 'main', '--head', branch, '--fill']);
-  if (created.code) throw new Error(sanitize(created.output));
+  if (created.code) throw Object.assign(new Error(sanitize(created.output)), { phase });
+  await logEvent('publication.pull-request-created', { jobId, repo: checkout.repo, branch, url: created.output.trim() });
   return `Published ${checkout.repo}:${branch}; ${created.output.trim()}`;
 }
-async function publish(checkouts) {
-  const publications = [];
+async function publish(checkouts, jobId) {
+  const publications = { succeeded: [], failed: [] };
   for (const checkout of checkouts) {
-    const published = await publishCheckout(checkout);
-    if (published) publications.push(published);
+    try {
+      const published = await publishCheckout(checkout, jobId);
+      if (published) publications.succeeded.push(published);
+    } catch (error) {
+      const failure = { repo: checkout.repo, phase: error.phase || 'prepare', error: sanitize(error.message) };
+      publications.failed.push(failure);
+      await logEvent('publication.failed', { jobId, ...failure });
+    }
   }
-  return publications.join('\n');
+  return publications;
 }
 async function runOnce(config) {
   await request(config, 'pulseRunnerHeartbeat', { status: 'online' });
   const delivery = await request(config, 'pulseRunnerPoll', {}); if (!delivery.job) return false;
   const job = delivery.job;
+  await logEvent('job.received', { jobId: job.id, issueId: job.issueId, agentId: job.agentId, mode: job.mode, repo: job.repoFullName });
+  let jobPhase = 'validate-job';
   try {
     const agent = delivery.agent || { kind: config.agentKind, role: job.agentId === config.agentId ? 'dev' : null };
-    validateJob(job, config, agent); await request(config, 'pulseRunnerHeartbeat', { status: 'busy' });
+    validateJob(job, config, agent);
+    await logEvent('job.validated', { jobId: job.id, repoCount: (job.contextRepos || [job.repoFullName]).length });
+    jobPhase = 'prepare-worktrees';
+    await request(config, 'pulseRunnerHeartbeat', { status: 'busy' });
     const { primary, checkouts } = await checkout(job); const temp = join(paths().root, 'tmp', job.id);
     try {
+      jobPhase = 'run-agent';
+      await logEvent('agent.started', { jobId: job.id, repo: primary.repo, mode: job.mode });
       const result = await runAgent(agent.kind, job, primary.worktree, checkouts.filter((checkout) => checkout !== primary), config, delivery.mcpCredential, temp);
-      const publication = result.code === 0 && job.mode !== 'review' ? await publish(checkouts) : '';
-      await request(config, 'pulseRunnerComplete', { jobId: job.id, outcome: result.code === 0 ? 'completed' : 'failed', result: sanitize([result.output, publication].filter(Boolean).join('\n')) });
+      const shouldPublish = result.code === 0 && job.mode !== 'review';
+      await logEvent(result.code === 0 ? 'agent.completed' : 'agent.failed', {
+        jobId: job.id,
+        exitCode: result.code,
+        ...(result.code === 0 ? {} : { error: failureDetail(result.output) }),
+      });
+      const publication = shouldPublish ? await publish(checkouts, job.id) : { succeeded: [], failed: [] };
+      const outcome = result.code === 0 && publication.failed.length === 0 ? 'completed' : 'failed';
+      const summary = completionSummary(result, publication);
+      jobPhase = 'report-completion';
+      await request(config, 'pulseRunnerComplete', { jobId: job.id, outcome, result: sanitize(summary) });
+      await logEvent('job.completed', { jobId: job.id, outcome, publicationFailures: publication.failed.length });
     } finally { await removeTemporary(temp); await cleanup(checkouts); await removeTemporary(join(paths().worktrees, job.id)); }
-  } catch (error) { await request(config, 'pulseRunnerComplete', { jobId: job.id, outcome: 'failed', result: sanitize(error.message) }).catch(() => {}); throw error; }
+  } catch (error) {
+    const phase = error.phase || jobPhase;
+    const message = error?.message || String(error);
+    await logEvent('job.failed', { jobId: job.id, issueId: job.issueId, repo: job.repoFullName, phase, error: message });
+    await request(config, 'pulseRunnerComplete', { jobId: job.id, outcome: 'failed', result: sanitize(`${phase}: ${message}`) }).catch((completionError) => {
+      logEvent('job.completion-report-failed', { jobId: job.id, error: completionError?.message || String(completionError) });
+    });
+    throw error;
+  }
   finally { await request(config, 'pulseRunnerHeartbeat', { status: 'online' }).catch(() => {}); }
   return true;
 }
@@ -125,5 +208,5 @@ try {
   if (!args.length || has('--help')) usage();
   else if (args[0] === 'init') await init();
   else if (args[0] === 'pair') { const credential = value('--credential'); const match = credential?.match(/^(runner-[A-Za-z0-9_-]{12})\.[A-Za-z0-9_-]{32,}$/); if (!match) throw new Error('Invalid Runner credential.'); const config = await readConfig(); if (!config) throw new Error('Run pulse-runner init before pairing.'); const paired = { ...config, runnerId: match[1] }; await writeCredential(credential); await writeConfig(paired); await syncRepos(paired); console.log(`Runner ${paired.runnerId} paired.`); }
-  else { const config = await readConfig(); if (!config) throw new Error('Runner is not initialized.'); if (args[0] === 'repo') await repo(config); else if (args[0] === 'diagnose') await diagnose(config); else if (args[0] === 'service') await service(config); else if (args[0] === 'run') await runOnce(config); else if (args[0] === 'start') { let backoff = 5_000; for (;;) { try { const ranJob = await runOnce(config); backoff = ranJob ? 1_000 : 5_000; } catch (error) { console.error(sanitize(error.message)); backoff = Math.min(backoff * 2, 60_000); } await new Promise((resolve) => setTimeout(resolve, backoff)); } } else usage(); }
+  else { const config = await readConfig(); if (!config) throw new Error('Runner is not initialized.'); if (args[0] === 'repo') await repo(config); else if (args[0] === 'diagnose') await diagnose(config); else if (args[0] === 'service') await service(config); else if (args[0] === 'run') await runOnce(config); else if (args[0] === 'start') { let backoff = 5_000; for (;;) { try { const ranJob = await runOnce(config); backoff = ranJob ? 1_000 : 5_000; } catch (error) { await logEvent('service.loop-failed', { error: error.message }); console.error(sanitize(error.message)); backoff = Math.min(backoff * 2, 60_000); } await new Promise((resolve) => setTimeout(resolve, backoff)); } } else usage(); }
 } catch (error) { console.error(`pulse-runner: ${sanitize(error.message)}`); process.exitCode = 1; }

package/src/job.js

@@ -25,5 +25,9 @@ export function validateJob(job, config, agentOrNow = null, suppliedNow = Date.n
 }
 
 export function sanitize(value) {
-  return String(value || '').slice(-500).replace(/\b(?:sk-ant-|sk-proj-|sk-|pulse_sk_|ghp_|github_pat_)[A-Za-z0-9_-]+/gi, '[redacted]').replace(/\bBearer\s+[A-Za-z0-9._-]+/gi, 'Bearer [redacted]');
+  return String(value || '')
+    .replace(/\b(runner-[A-Za-z0-9_-]{12}\.)[A-Za-z0-9._-]{32,}/gi, '$1[redacted]')
+    .replace(/\b(?:sk-ant-|sk-proj-|pulse_sk_|ghp_|gho_|ghu_|ghs_|github_pat_|sk-)[A-Za-z0-9_-]+/gi, '[redacted]')
+    .replace(/\bBearer\s+[A-Za-z0-9._-]+/gi, 'Bearer [redacted]')
+    .slice(-500);
 }