@pulsehub/runner 0.1.13 → 0.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsehub/runner",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Local, credential-safe Pulse Runner",
   "repository": {
     "type": "git",

package/src/github-app.js

@@ -17,6 +17,13 @@ export function bindingFor(config, projectId, repo) {
   if (bindings.length !== 1) throw new Error(`Configure one local GitHub App for project ${projectId}, repo ${repo}.`);
   return validateBinding(bindings[0]);
 }
+export function parseAppKeyOutput(output, allowHex = false) {
+  let key = output.trim();
+  // macOS security renders passwords containing newlines as hexadecimal.
+  if (allowHex && /^(?:[0-9a-fA-F]{2})+$/.test(key)) key = Buffer.from(key, 'hex').toString('utf8').trim();
+  if (!/-----BEGIN (?:RSA )?PRIVATE KEY-----/.test(key)) throw new Error('Local GitHub App key is unavailable in the OS credential store.');
+  return key;
+}
 export async function readAppKey(binding) {
   const service = `pulse-runner.github-app.${binding.appId}.${binding.keyId}`;
   try {
@@ -27,8 +34,8 @@ export async function readAppKey(binding) {
       : platform() === 'linux'
         ? await exec('secret-tool', ['lookup', 'service', service], { timeout: 10_000, maxBuffer: 32_768 })
         : null;
-    if (!result || !/-----BEGIN (?:RSA )?PRIVATE KEY-----/.test(result.stdout)) throw new Error();
-    return result.stdout.trim();
+    if (!result) throw new Error();
+    return parseAppKeyOutput(result.stdout, platform() === 'darwin');
   } catch { throw new Error('Local GitHub App key is unavailable in the OS credential store.'); }
 }
 export function appJwt(appId, privateKey, now = Date.now()) {

package/src/runtime.js

@@ -139,11 +139,12 @@ export async function runOnce(config, options = {}) {
   let job;
   let jobPhase = 'poll';
   let completionReported = false;
+  let agentActive = false;
   const journal = join(paths().root, 'active-job.json');
   const checkActive = async () => {
     controller.signal.throwIfAborted();
     if (Date.parse(job.expiresAt) <= Date.now()) controller.abort();
-    const response = await remote(config, 'pulseRunnerHeartbeat', { status: 'busy', jobId: job.id });
+    const response = await remote(config, 'pulseRunnerHeartbeat', { status: 'busy', jobId: job.id, agentActive });
     if (response.cancelRequested) controller.abort();
     controller.signal.throwIfAborted();
   };
@@ -204,7 +205,15 @@ export async function runOnce(config, options = {}) {
         controller.signal.throwIfAborted();
         jobPhase = 'run-agent';
         await logEvent('agent.started', { jobId: job.id, repo: primary.repo, mode: job.mode });
-        const result = await runAgent(agent.kind, job, primary.worktree, checkouts.filter((entry) => entry !== primary), config, delivery.mcpCredential, temp, { signal: controller.signal, profile, onDiagnostic: ({ event, ...details }) => logEvent(event, { jobId: job.id, ...details }) });
+        agentActive = true;
+        let result;
+        try {
+          await checkActive();
+          result = await runAgent(agent.kind, job, primary.worktree, checkouts.filter((entry) => entry !== primary), config, delivery.mcpCredential, temp, { signal: controller.signal, profile, onDiagnostic: ({ event, ...details }) => logEvent(event, { jobId: job.id, ...details }) });
+        } finally {
+          agentActive = false;
+          await remote(config, 'pulseRunnerHeartbeat', { status: 'busy', jobId: job.id, agentActive: false }).catch(() => {});
+        }
         controller.signal.throwIfAborted();
         await checkActive();
         await logEvent(result.code === 0 ? 'agent.completed' : 'agent.failed', { jobId: job.id, exitCode: result.code, ...(result.code === 0 ? {} : { error: failureDetail(result.output) }) });

package/test/github-app.test.js

@@ -1,11 +1,25 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { generateKeyPairSync, verify } from 'node:crypto';
-import { appJwt, authorizeRepo, appGit, bindingFor, githubReadiness, githubApi } from '../src/github-app.js';
+import { appJwt, authorizeRepo, appGit, bindingFor, githubReadiness, githubApi, parseAppKeyOutput } from '../src/github-app.js';
 const {privateKey, publicKey}=generateKeyPairSync('rsa',{modulusLength:2048});
 const pem=privateKey.export({type:'pkcs8',format:'pem'}).toString();
 const binding={projectId:'project-1',repo:'owner/repo',appId:'1',installationId:'2',slug:'local-app',keyId:'local-key'};
 const config={githubApps:[binding]};
+test('macOS Keychain hexadecimal multiline output produces a verifiable RSA signature',()=>{
+  for (const type of ['pkcs1', 'pkcs8']) {
+    const original=privateKey.export({type,format:'pem'}).toString();
+    assert.equal(parseAppKeyOutput(original,true),original.trim());
+    const decoded=parseAppKeyOutput(`${Buffer.from(original).toString('hex')}\n`,true);
+    assert.equal(decoded,original.trim());
+    const [header,payload,signature]=appJwt('1',decoded).split('.');
+    assert(verify('RSA-SHA256',Buffer.from(`${header}.${payload}`),publicKey,Buffer.from(signature,'base64url')));
+    assert.throws(()=>parseAppKeyOutput(Buffer.from(original).toString('hex')));
+  }
+  for (const invalid of ['sentinel-secret','abc','00ff',Buffer.from('sentinel-secret').toString('hex')]) {
+    assert.throws(()=>parseAppKeyOutput(invalid,true),error=>!error.message.includes('sentinel'));
+  }
+});
 function apiFixture(overrides={}) {
   const calls=[];
   const api=async(path,token,options)=>{

package/test/integration.test.js

@@ -138,6 +138,10 @@ for (const kind of ['claude','codex']) {
     assert.equal(await exists(join(paths().root,'tmp',f.job.id)),false);
     const completion = f.calls.find(c=>c.path==='/pulseRunnerComplete').body;
     assert.equal(completion.outcome,'completed');
+    const heartbeats = f.calls.filter(c => c.path === '/pulseRunnerHeartbeat' && c.body.jobId);
+    assert.equal(heartbeats[0].body.agentActive, false);
+    assert(heartbeats.some(c => c.body.agentActive === true));
+    assert.equal(heartbeats.at(-1).body.agentActive, false);
     assert.ok(!JSON.stringify(f.calls).includes('pulse_sk_fixture'));
   }));
   test(`integration: ${kind} missing native session rejects before creating worktrees`, () => fixture(kind, async f => {
@@ -388,6 +392,7 @@ test('integration: publication failure retains commits and retry does not run th
   f.job.publicationTargets=[...f.job.publicationTargets.map(t=>({...t,sha:entry.sha}))];f.signJob();
   await f.run();
   assert.equal(await readFile(f.trace,'utf8'),previousTrace);
+  assert(f.calls.filter(c => c.path === '/pulseRunnerHeartbeat' && c.body.jobId).every(c => c.body.agentActive === false));
   const retry=f.calls.find(c=>c.path==='/pulseRunnerComplete').body;
   assert.equal(retry.outcome,'completed');assert.equal(retry.publication.repositories[0].sha,entry.sha);
   assert.equal(retry.publication.repositories[0].stage,'linked');assert.equal(publishCalls,1);