@rosthq/cli 0.7.162 → 0.7.163

package/dist/index.js

@@ -29434,6 +29434,19 @@ var runnerPairingStartOutputSchema = external_exports.object({
   expires_at: isoDateTime2,
   expires_in: external_exports.number().int().nonnegative()
 }).strict();
+var runnerPairingClaimInputSchema = external_exports.object({
+  user_code: external_exports.string().min(8).max(12),
+  service_key_public: external_exports.string().trim().min(1).max(1024).optional()
+}).strict();
+var runnerPairingClaimOutputSchema = external_exports.object({
+  runner_id: uuid5,
+  tenant_id: uuid5,
+  runner_secret: external_exports.string().min(1),
+  name: external_exports.string(),
+  platform: external_exports.string(),
+  service_key_generation: external_exports.number().int().nonnegative().optional(),
+  service_key_bound: external_exports.boolean().optional()
+}).strict();
 var runnerRevokeInputSchema = external_exports.object({
   runner_id: uuid5
 }).strict();
@@ -69609,7 +69622,7 @@ async function removeWorkspace(ws) {
 
 // src/runner-serve.ts
 import { execFile as execFileCallback5, spawn } from "node:child_process";
-import { createHash as createHash4, randomUUID } from "node:crypto";
+import { createHash as createHash4, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, randomUUID } from "node:crypto";
 import { constants as fsConstants6 } from "node:fs";
 import { access as access3, chmod as chmod2, lstat as lstat2, mkdir as mkdir8, open as open2, readFile as readFile11, rename as rename2, rm as rm8, statfs, writeFile as writeFile8 } from "node:fs/promises";
 import { cpus, homedir as homedir7, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
@@ -70369,16 +70382,20 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
       `No paired runner state at ${config2.stateFile}. Provide --user-code <code> from Settings > Runners (Add a runner), or run \`${cliBrand.binName} login --device\` once to pair this runner.`
     );
   }
+  const serviceKey = runnerServiceKeyPairForState(priorState);
   const { runnerId, runnerSecret, tenantId: claimedTenantId, name: claimedName } = await claimRunnerPairingCode(
     fetchImpl,
     appUrl2,
-    userCode
+    userCode,
+    serviceKey
   );
   const state = {
     runner_id: runnerId,
     runner_secret: runnerSecret,
     ...typeof claimedTenantId === "string" ? { tenant_id: claimedTenantId } : config2.expectedTenantId ? { tenant_id: config2.expectedTenantId } : {},
-    name: typeof claimedName === "string" ? claimedName : config2.name
+    name: typeof claimedName === "string" ? claimedName : config2.name,
+    service_key_private: serviceKey.privateKey,
+    service_key_public: serviceKey.publicKey
   };
   await saveState(config2.stateFile, state);
   await reapSupersededRunnerHomes(priorState, runnerId, config2.homeDir);
@@ -70462,6 +70479,8 @@ async function loadState(filePath, expectedTenantId) {
         runner_secret: parsed.runner_secret,
         ...typeof parsed.tenant_id === "string" ? { tenant_id: parsed.tenant_id } : {},
         ...typeof parsed.name === "string" ? { name: parsed.name } : {},
+        ...typeof parsed.service_key_private === "string" ? { service_key_private: parsed.service_key_private } : {},
+        ...typeof parsed.service_key_public === "string" ? { service_key_public: parsed.service_key_public } : {},
         ...isRuntimeSessionMap(parsed.runtime_sessions) ? { runtime_sessions: parsed.runtime_sessions } : {},
         ...isInFlightWorkOrderMap(parsed.in_flight_work_orders) ? { in_flight_work_orders: parsed.in_flight_work_orders } : {}
       };
@@ -70496,8 +70515,56 @@ async function saveState(filePath, state) {
     throw error51;
   }
 }
-async function claimRunnerPairingCode(fetchImpl, appUrl2, userCode) {
-  const claim = await post2(fetchImpl, appUrl2, "/api/runner/pairing/claim", { user_code: userCode });
+var RUNNER_SERVICE_KEY_REPAIR_MESSAGE = "The persisted runner service key is invalid. Repair the local service-key state, then re-pair the runner or use explicit service-key rotation.";
+var RunnerServiceKeyError = class extends Error {
+  code = "service_key_invalid";
+  constructor() {
+    super(RUNNER_SERVICE_KEY_REPAIR_MESSAGE);
+    this.name = "RunnerServiceKeyError";
+  }
+};
+function sshWireField(value) {
+  const bytes = Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
+  const length = Buffer.allocUnsafe(4);
+  length.writeUInt32BE(bytes.length, 0);
+  return Buffer.concat([length, bytes]);
+}
+function openSshEd25519PublicKey(publicKey) {
+  const der = publicKey.export({ type: "spki", format: "der" });
+  if (!Buffer.isBuffer(der) || der.length < 32) {
+    throw new Error("Unable to encode the runner service key.");
+  }
+  const rawKey = der.subarray(der.length - 32);
+  const wire = Buffer.concat([sshWireField("ssh-ed25519"), sshWireField(rawKey)]);
+  return `ssh-ed25519 ${wire.toString("base64")}`;
+}
+function generateRunnerServiceKeyPair() {
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const privatePem = privateKey.export({ type: "pkcs8", format: "pem" });
+  if (typeof privatePem !== "string") {
+    throw new Error("Unable to persist the runner service key.");
+  }
+  return { privateKey: privatePem, publicKey: openSshEd25519PublicKey(publicKey) };
+}
+function runnerServiceKeyPairFromPrivate(privatePem) {
+  const privateKey = createPrivateKey(privatePem);
+  return { privateKey: privatePem, publicKey: openSshEd25519PublicKey(createPublicKey2(privateKey)) };
+}
+function runnerServiceKeyPairForState(state) {
+  if (state?.service_key_private === void 0) {
+    return generateRunnerServiceKeyPair();
+  }
+  try {
+    return runnerServiceKeyPairFromPrivate(state.service_key_private);
+  } catch {
+    throw new RunnerServiceKeyError();
+  }
+}
+async function claimRunnerPairingCode(fetchImpl, appUrl2, userCode, serviceKey) {
+  const claim = await post2(fetchImpl, appUrl2, "/api/runner/pairing/claim", {
+    user_code: userCode,
+    ...serviceKey ? { service_key_public: serviceKey.publicKey } : {}
+  });
   const runnerSecret = claim.json.runner_secret;
   const runnerId = claim.json.runner_id;
   const tenantId = claim.json.tenant_id;
@@ -70508,7 +70575,10 @@ async function claimRunnerPairingCode(fetchImpl, appUrl2, userCode) {
     runnerId,
     runnerSecret,
     tenantId: typeof tenantId === "string" ? tenantId : null,
-    name: typeof claim.json.name === "string" ? claim.json.name : null
+    name: typeof claim.json.name === "string" ? claim.json.name : null,
+    ...serviceKey ? { serviceKeyPrivate: serviceKey.privateKey, serviceKeyPublic: serviceKey.publicKey } : {},
+    ...typeof claim.json.service_key_generation === "number" ? { serviceKeyGeneration: claim.json.service_key_generation } : {},
+    ...typeof claim.json.service_key_bound === "boolean" ? { serviceKeyBound: claim.json.service_key_bound } : {}
   };
 }
 async function startPairing(client, config2) {
@@ -73974,7 +74044,14 @@ async function runPairingStage(sidecar, userCode, agent, fetchImpl, appUrl2, hom
   }
   if (userCode !== void 0) {
     const priorState = await loadState(sidecar.state_file, expectedTenantId);
-    const claimResult = await claimRunnerPairingCodeSafe(fetchImpl, appUrl2, userCode);
+    let serviceKey;
+    try {
+      serviceKey = runnerServiceKeyPairForState(priorState);
+    } catch (error51) {
+      const message = error51 instanceof RunnerServiceKeyError ? error51.message : RUNNER_SERVICE_KEY_REPAIR_MESSAGE;
+      return { kind: "claim_failed", exitCode: 1, message: redactForLog(message) };
+    }
+    const claimResult = await claimRunnerPairingCodeSafe(fetchImpl, appUrl2, userCode, serviceKey);
     if (!claimResult.ok) {
       return { kind: "claim_failed", exitCode: claimResult.exitCode, message: claimResult.message };
     }
@@ -73996,7 +74073,9 @@ async function runPairingStage(sidecar, userCode, agent, fetchImpl, appUrl2, hom
       runner_id: claimResult.runnerId,
       runner_secret: claimResult.runnerSecret,
       ...claimResult.tenantId !== null ? { tenant_id: claimResult.tenantId } : {},
-      ...claimResult.name !== null ? { name: claimResult.name } : {}
+      ...claimResult.name !== null ? { name: claimResult.name } : {},
+      ...claimResult.serviceKeyPrivate !== void 0 ? { service_key_private: claimResult.serviceKeyPrivate } : {},
+      ...claimResult.serviceKeyPublic !== void 0 ? { service_key_public: claimResult.serviceKeyPublic } : {}
     };
     await saveState(sidecar.state_file, newState);
     await reapSupersededRunnerHomes(priorState, newState.runner_id, homeDir);
@@ -74021,9 +74100,9 @@ async function runPairingStage(sidecar, userCode, agent, fetchImpl, appUrl2, hom
   }
   return { kind: "needs_user_code" };
 }
-async function claimRunnerPairingCodeSafe(fetchImpl, appUrl2, userCode) {
+async function claimRunnerPairingCodeSafe(fetchImpl, appUrl2, userCode, serviceKey) {
   try {
-    const claim = await claimRunnerPairingCode(fetchImpl, appUrl2, userCode);
+    const claim = await claimRunnerPairingCode(fetchImpl, appUrl2, userCode, serviceKey);
     return { ok: true, ...claim };
   } catch (error51) {
     const message = error51 instanceof Error ? error51.message : String(error51);