@rosthq/cli 0.7.13 → 0.7.14

package/dist/index.js

@@ -44296,7 +44296,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-03.12",
+    version: "2026-07-03.13",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -44755,7 +44755,7 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
 | \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
-| \`{{cli}} runner install-service|start|stop|restart|status|logs|uninstall --name <name>\` | launchd/service manager (macOS today) + \`{{cli}} runner serve\` | Install and manage an always-on local runner service that keeps the runner online across reboots; the service shells out to \`{{cli}} runner serve --execute\` and stores no secret in the service definition, its arguments, or logs. Non-macOS emits an explicit unsupported message. | Tenant (local machine) | \`{{cli}} runner install-service --name mac-mini --execute\`; \`{{cli}} runner logs --name mac-mini\` |
+| \`{{cli}} runner install-service|start|stop|restart|status|logs|uninstall --name <name> [--user-code <code>]\` | launchd/service manager (macOS today) + \`{{cli}} runner serve\` | Install and manage an always-on local runner service that keeps the runner online across reboots. The service runs the runner under the absolute Node binary with an explicit PATH (so it works under nvm/Homebrew) and bootstraps into whichever launchd domain the session supports. Pass \`--user-code\` to pair the service at install; otherwise install prints the exact command to pair it. No secret is stored in the service definition, its arguments, or logs. Non-macOS emits an explicit unsupported message. | Tenant (local machine) | \`{{cli}} runner install-service --name mac-mini --execute --user-code ABCD-EFGH\`; \`{{cli}} runner logs --name mac-mini\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` / credential flow for Baserow REST connect | \`integration.connect_rest\`, \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | Create a vault-backed Baserow REST integration through the credential flow, list connector metadata, read setup-readiness, read one connector's health, and run provider-specific tests without exposing credentials. | Tenant-admin for connect; tenant for reads/tests | \`{{cli}} integration readiness --provider google --json\` |
 | \`{{cli}} system health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | \`{{cli}} system health --json\`; \`{{cli}} system health --seat <id> --json\` |
@@ -51151,6 +51151,7 @@ function runnerServicePaths(homeDir, runnerName) {
 }
 function renderLaunchdPlist(config2) {
   const programArgs = [
+    config2.nodePath,
     config2.binPath,
     "runner",
     "serve",
@@ -51175,9 +51176,13 @@ ${programArgsXml}
   <dict>
     <key>${cliBrand.envPrefix}_APP_URL</key>
     <string>${escapePlist(config2.appUrl)}</string>
+    <key>PATH</key>
+    <string>${escapePlist(config2.servicePath)}</string>
   </dict>
   <key>KeepAlive</key>
   <true/>
+  <key>ThrottleInterval</key>
+  <integer>30</integer>
   <key>RunAtLoad</key>
   <true/>
   <key>StandardOutPath</key>
@@ -51215,6 +51220,8 @@ ${serviceUsage()}
     runnerName: parsed.runnerName,
     appUrl: options.appUrl,
     execute: parsed.execute,
+    userCode: parsed.userCode,
+    nodePath: options.nodePath ?? resolveNodePath(),
     binPath: options.binPath ?? resolveBinPath(),
     homeDir: options.homeDir ?? homedir2(),
     platform: options.platform ?? process.platform,
@@ -51250,12 +51257,20 @@ async function installService(options) {
   await mkdir3(paths.logDir, { recursive: true });
   await mkdir3(path4.dirname(paths.stateFile), { recursive: true });
   await mkdir3(path4.dirname(paths.launchAgentPath), { recursive: true });
+  if (options.userCode !== void 0) {
+    const paired = await pairRunnerOnce(options, safeName, paths.stateFile, options.userCode);
+    if (!paired) {
+      return 1;
+    }
+  }
   const plist = renderLaunchdPlist({
+    nodePath: options.nodePath,
     binPath: options.binPath,
     runnerName: safeName,
     stateFile: paths.stateFile,
     logDir: paths.logDir,
     appUrl: options.appUrl,
+    servicePath: buildServicePath(options.nodePath, options.homeDir),
     execute: options.execute
   });
   await writeFile3(paths.launchAgentPath, plist, { mode: 420 });
@@ -51274,6 +51289,7 @@ async function installService(options) {
     );
     return 1;
   }
+  const pairingLine = options.userCode !== void 0 ? `Paired with the supplied user code; the bearer secret is stored locally and never printed.` : `Pair it once so it can claim work: \`${cliBrand.binName} runner serve --once --user-code <code> --name ${safeName} --state-file "${paths.stateFile}"\` (get a code from Settings > Runners), or re-run install-service with --user-code <code>. The bearer secret is stored locally and never printed.`;
   options.io.stdout.write(
     `${[
       `Installed runner service ${label}.`,
@@ -51281,7 +51297,7 @@ async function installService(options) {
       `state file: ${paths.stateFile}`,
       `logs: ${paths.logDir}`,
       `execute: ${options.execute ? "on (claims and runs work orders)" : "off (heartbeat only)"}`,
-      `The runner pairs on first run; its bearer secret is stored locally and never printed.`
+      pairingLine
     ].join("\n")}
 `
   );
@@ -51472,6 +51488,7 @@ async function uninstallService(options) {
 function parseServiceArgs(args) {
   let runnerName;
   let execute2 = false;
+  let userCode;
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
     if (token === "--name") {
@@ -51481,6 +51498,13 @@ function parseServiceArgs(args) {
       }
       runnerName = value;
       index += 1;
+    } else if (token === "--user-code") {
+      const value = args[index + 1];
+      if (value === void 0 || value.startsWith("--")) {
+        throw new Error("--user-code requires a value.");
+      }
+      userCode = value;
+      index += 1;
     } else if (token === "--execute") {
       execute2 = true;
     } else {
@@ -51490,13 +51514,13 @@ function parseServiceArgs(args) {
   if (runnerName === void 0 || runnerName.trim().length === 0) {
     throw new Error("--name <runner-name> is required.");
   }
-  return { runnerName, execute: execute2 };
+  return { runnerName, execute: execute2, ...userCode !== void 0 ? { userCode } : {} };
 }
 function serviceUsage() {
   const bin = cliBrand.binName;
   return [
     `Usage:`,
-    `  ${bin} runner install-service --name <name> [--execute]`,
+    `  ${bin} runner install-service --name <name> [--execute] [--user-code <code>]`,
     `  ${bin} runner start|stop|restart|status|logs|uninstall --name <name>`
   ].join("\n");
 }
@@ -51581,6 +51605,54 @@ function unsupportedPlatform(io, platform2) {
   );
   return 1;
 }
+function resolveNodePath() {
+  return process.execPath;
+}
+function buildServicePath(nodePath, homeDir) {
+  const entries = [
+    path4.dirname(nodePath),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    path4.join(homeDir, ".local", "bin"),
+    path4.join(homeDir, "bin"),
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ];
+  return Array.from(new Set(entries)).join(":");
+}
+async function pairRunnerOnce(options, safeName, stateFile, userCode) {
+  const serveArgs = [
+    options.binPath,
+    "runner",
+    "serve",
+    "--once",
+    "--user-code",
+    userCode,
+    "--name",
+    safeName,
+    "--state-file",
+    stateFile
+  ];
+  try {
+    await options.exec(options.nodePath, serveArgs, {
+      env: { ...process.env, [`${cliBrand.envPrefix}_APP_URL`]: options.appUrl }
+    });
+    options.io.stdout.write(`Paired runner ${safeName}.
+`);
+    return true;
+  } catch (error51) {
+    const raw = error51 instanceof Error ? error51.message : String(error51);
+    const scrubbed = redactForLog(raw.split(userCode).join("<user-code>"));
+    options.io.stderr.write(
+      `Failed to pair the runner with --user-code: ${scrubbed}
+The plist is installed but not loaded. Fix pairing, then run \`${cliBrand.binName} runner start --name ${safeName}\`.
+`
+    );
+    return false;
+  }
+}
 function resolveBinPath() {
   const entry = process.argv[1];
   if (entry === void 0 || entry.length === 0) {
@@ -51615,8 +51687,8 @@ async function readTail(file2, maxBytes) {
 function escapePlist(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-var defaultExec = async (file2, args) => {
-  const result = await execFile4(file2, args);
+var defaultExec = async (file2, args, options) => {
+  const result = await execFile4(file2, args, options?.env ? { env: options.env } : {});
   return { stdout: String(result.stdout), stderr: String(result.stderr) };
 };
 function assertNever2(value) {