@stigmer/runner 3.0.1

package/dist/runner-manager.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Dynamic per-session runner manager.
+ *
+ * Unlike {@link createStigmerRunner} which creates a single Worker polling
+ * one task queue, the RunnerManager maintains a pool of Workers — one per
+ * session — all sharing a single Temporal connection and a shared set of
+ * activities.
+ *
+ * Used by the desktop app and any multi-session host that needs to
+ * dynamically add/remove sessions without restarting the process.
+ */
+import type { Config } from "./config.js";
+export declare function getShutdownSignalForQueue(taskQueue: string): AbortSignal | undefined;
+export interface RunnerManagerOptions {
+    /**
+     * Temporal server address (e.g. "localhost:7233"). Optional: when omitted, the
+     * runner self-discovers it during boot from the control plane using
+     * {@link stigmerToken} (see bootstrap.ts). Provide it explicitly to bypass
+     * discovery — an explicit value always wins.
+     */
+    readonly temporalAddress?: string;
+    /** Stigmer server endpoint for status updates, artifacts, and blueprints. */
+    readonly stigmerEndpoint: string;
+    /** Temporal namespace. @default "default" */
+    readonly temporalNamespace?: string;
+    /** Auth token for authenticating with the Stigmer server. */
+    readonly stigmerToken?: string;
+    /** Cursor API key for direct mode (not needed in proxy mode). */
+    readonly cursorApiKey?: string;
+    /** Root directory for agent workspaces. Defaults to ~/.stigmer/workspaces/runner. */
+    readonly workspaceRootDir?: string;
+    /** Maximum concurrent activity executions per session Worker. @default 5 */
+    readonly maxConcurrentActivitiesPerSession?: number;
+    /** Stigmer proxy endpoint for cloud mode. */
+    readonly proxyEndpoint?: string;
+    /** Default LLM model identifier. @default "gpt-4.1" */
+    readonly primaryModel?: string;
+    /** Checkpointer type for LangGraph agent state. @default "memory" (or "http" if proxyEndpoint is set) */
+    readonly checkpointerType?: "memory" | "http";
+    /** Checkpointer proxy endpoint. Falls back to proxyEndpoint. */
+    readonly checkpointerProxyEndpoint?: string;
+    /** Enable Cursor cloud mode. @default false */
+    readonly cloudModeEnabled?: boolean;
+    /**
+     * Workspace/filesystem execution location — where the agent actually runs.
+     *
+     * - "local": the agent operates on the host filesystem (local-path workspace
+     *   entries are valid; the desktop app and CLI daemon use this).
+     * - "cloud": the agent runs in a server-provisioned sandbox (git-only).
+     *
+     * This is intentionally distinct from {@link proxyEndpoint}, which controls
+     * credential/artifact *transport*. The desktop runner is the canonical case
+     * where the two diverge: it executes locally while routing Cursor traffic and
+     * artifacts through the proxy. Defaults to "local".
+     *
+     * @default "local"
+     */
+    readonly executionMode?: "local" | "cloud";
+}
+export interface StigmerRunnerManager {
+    /** Add a session — creates a Worker polling session:{sessionId}. Idempotent. */
+    addSession(sessionId: string): Promise<void>;
+    /** Remove a session — gracefully shuts down that session's Worker. */
+    removeSession(sessionId: string): Promise<void>;
+    /** List currently active session IDs. */
+    activeSessions(): string[];
+    /** Add a workflow execution — creates a Worker polling wfexec:{executionId}. Idempotent. */
+    addWorkflowExecution(executionId: string): Promise<void>;
+    /** Remove a workflow execution — gracefully shuts down that execution's Worker. */
+    removeWorkflowExecution(executionId: string): Promise<void>;
+    /** List currently active workflow execution IDs. */
+    activeWorkflowExecutions(): string[];
+    /**
+     * Push a refreshed *control-plane* auth token (the host's durable credential,
+     * e.g. the desktop's Auth0 token) to all activity clients.
+     *
+     * This updates the control-plane credential only. The proxy credential
+     * (x-stigmer-auth) follows it in lockstep UNLESS the runner minted its own
+     * proxy token during bootstrap, in which case the runner owns and refreshes
+     * that token itself and this push must not clobber it. See the two-writer note
+     * on the implementation.
+     */
+    updateToken(token: string | null): void;
+    /** Graceful shutdown of all Workers and the Temporal connection. */
+    shutdown(): Promise<void>;
+}
+/**
+ * Create a runner manager that dynamically manages per-session Workers.
+ *
+ * One shared NativeConnection to Temporal, one shared set of activities.
+ * Each call to `addSession(id)` creates a new Worker polling `session:{id}`.
+ *
+ * @example
+ * ```ts
+ * import { createStigmerRunnerManager } from '@stigmer/runner';
+ *
+ * const manager = await createStigmerRunnerManager({
+ *   temporalAddress: 'localhost:7233',
+ *   stigmerEndpoint: 'http://localhost:7234',
+ * });
+ *
+ * await manager.addSession('ses_abc123');
+ * await manager.addSession('ses_def456');
+ *
+ * // Later:
+ * await manager.removeSession('ses_abc123');
+ * await manager.shutdown();
+ * ```
+ */
+export declare function createStigmerRunnerManager(options: RunnerManagerOptions): Promise<StigmerRunnerManager>;
+export declare function mapManagerOptionsToConfig(options: RunnerManagerOptions, tokenRef?: {
+    current: string | null;
+}): Config;

package/dist/runner-manager.js

@@ -0,0 +1,412 @@
+/**
+ * Dynamic per-session runner manager.
+ *
+ * Unlike {@link createStigmerRunner} which creates a single Worker polling
+ * one task queue, the RunnerManager maintains a pool of Workers — one per
+ * session — all sharing a single Temporal connection and a shared set of
+ * activities.
+ *
+ * Used by the desktop app and any multi-session host that needs to
+ * dynamically add/remove sessions without restarting the process.
+ */
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import { NativeConnection, Worker, bundleWorkflowCode, } from "@temporalio/worker";
+import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
+import { createRunnerTokenCoordinator } from "./runner-token-coordinator.js";
+const SESSION_QUEUE_PREFIX = "session:";
+const WFEXEC_QUEUE_PREFIX = "wfexec:";
+/**
+ * Module-level registry of shutdown signals per task queue.
+ * Activities running in the same process can read this to determine
+ * whether their worker is being shut down (vs orchestrator pause).
+ */
+const _shutdownSignalRegistry = new Map();
+export function getShutdownSignalForQueue(taskQueue) {
+    return _shutdownSignalRegistry.get(taskQueue);
+}
+/**
+ * Create a runner manager that dynamically manages per-session Workers.
+ *
+ * One shared NativeConnection to Temporal, one shared set of activities.
+ * Each call to `addSession(id)` creates a new Worker polling `session:{id}`.
+ *
+ * @example
+ * ```ts
+ * import { createStigmerRunnerManager } from '@stigmer/runner';
+ *
+ * const manager = await createStigmerRunnerManager({
+ *   temporalAddress: 'localhost:7233',
+ *   stigmerEndpoint: 'http://localhost:7234',
+ * });
+ *
+ * await manager.addSession('ses_abc123');
+ * await manager.addSession('ses_def456');
+ *
+ * // Later:
+ * await manager.removeSession('ses_abc123');
+ * await manager.shutdown();
+ * ```
+ */
+export async function createStigmerRunnerManager(options) {
+    validateManagerOptions(options);
+    // `tokenRef` holds the control-plane token (the host's durable credential,
+    // e.g. the desktop's Auth0 token) and is shared with activity clients via
+    // config.stigmerTokenRef. The proxy credential (x-stigmer-auth) is managed
+    // separately by a RunnerTokenCoordinator (created after the interceptors are
+    // installed) — see that module for the two-writer rationale and the staleness
+    // history it guards.
+    const tokenRef = { current: options.stigmerToken ?? null };
+    const baseConfig = mapManagerOptionsToConfig(options, tokenRef);
+    // Install the Cursor SDK interceptors BEFORE resolving Temporal coordinates.
+    // Coordinate discovery dials the control plane via StigmerClient, which loads
+    // @connectrpc/connect-node and snapshots the node:http2 ESM facade on first
+    // import. The HTTP/2 interceptor patches http2.connect and only propagates to
+    // that facade if it runs first, so install MUST precede any connect-node load
+    // (discovery here, and the SDK later). The interceptors depend only on
+    // proxyEndpoint/stigmerToken (already in baseConfig), not resolved coordinates.
+    // Install fetch interceptor before any @cursor/sdk imports
+    const { installFetchInterceptor, updateInterceptorToken, getExecutionContext } = await import("./activities/execute-cursor/fetch-interceptor.js");
+    installFetchInterceptor({
+        proxyEndpoint: baseConfig.proxyEndpoint ?? undefined,
+        stigmerToken: baseConfig.stigmerToken ?? undefined,
+    });
+    // HTTP/2 interceptor for Connect RPC auth + execution ID injection (BiDi billing)
+    const { installHttp2Interceptor, updateHttp2InterceptorToken, assertHttp2ConnectPatched } = await import("./activities/execute-cursor/http2-interceptor.js");
+    installHttp2Interceptor({
+        proxyEndpoint: baseConfig.proxyEndpoint ?? undefined,
+        stigmerToken: baseConfig.stigmerToken ?? undefined,
+    });
+    // Fail loudly at boot if a load-order regression left the node:http2 ESM
+    // facade unpatched (otherwise BiDi streams would silently 401). No-op when
+    // the interceptor is unconfigured (no proxy/token).
+    await assertHttp2ConnectPatched();
+    // The token coordinator owns the proxy credential (x-stigmer-auth) and its
+    // refresh lifecycle. It writes ONLY the interceptors and re-mints using the
+    // always-fresh control-plane token in `tokenRef` — never the (possibly
+    // expired) minted token itself, so a slept-past-TTL runner recovers without a
+    // restart.
+    const tokenCoordinator = createRunnerTokenCoordinator({
+        applyProxyToken: (token) => {
+            updateInterceptorToken(token);
+            updateHttp2InterceptorToken(token);
+        },
+        reMint: () => refreshRunnerAccessToken({
+            token: tokenRef.current,
+            stigmerEndpoint: baseConfig.stigmerBackendEndpoint,
+        }),
+    });
+    // Resolve the runner bootstrap after the http2 patch is in place (discovery
+    // dials the control plane through connect-node). An explicit address wins;
+    // otherwise a token triggers control-plane discovery; otherwise localhost.
+    // Must happen before createAllActivities so runtime activities that dial
+    // Temporal (e.g. emit-event) see the resolved address too.
+    const bootstrap = await resolveRunnerBootstrap({
+        explicitAddress: options.temporalAddress,
+        explicitNamespace: options.temporalNamespace,
+        token: options.stigmerToken,
+        stigmerEndpoint: baseConfig.stigmerBackendEndpoint,
+    });
+    const config = {
+        ...baseConfig,
+        temporalAddress: bootstrap.temporalAddress,
+        temporalNamespace: bootstrap.temporalNamespace,
+    };
+    // Adopt the minted proxy token (cloud): it diverges from the control-plane
+    // token from here on, and the coordinator refreshes it before expiry.
+    if (bootstrap.runnerAccessToken) {
+        tokenCoordinator.adoptMintedToken(bootstrap.runnerAccessToken, bootstrap.runnerAccessTokenExpiresInSeconds);
+        console.log("[runner-manager] Adopted minted proxy token from bootstrap");
+    }
+    else if (baseConfig.proxyEndpoint && tokenRef.current) {
+        // Proxy is configured but no token was minted (OSS, signing key unset, or an
+        // explicit Temporal address pinned so bootstrap discovery was skipped). The
+        // runner keeps using the control-plane token for proxy traffic; warn so a
+        // resulting 401 is diagnosable rather than silent.
+        console.warn("[runner-manager] Proxy endpoint configured but no runner token was minted; " +
+            "falling back to the control-plane token for x-stigmer-auth");
+    }
+    const { setExecutionContextRef } = await import("./activities/execute-cursor/rejection-capture.js");
+    setExecutionContextRef(getExecutionContext());
+    const activities = await createAllActivities(config);
+    const payloadCodec = await createPayloadCodec(config);
+    const connection = await NativeConnection.connect({
+        address: config.temporalAddress,
+    });
+    const interceptorConfig = await buildInterceptorConfig();
+    const workflowsPath = fileURLToPath(new URL("./workflows/index.js", import.meta.url));
+    console.log("[runner-manager] Pre-bundling workflow code...");
+    const workflowBundle = await bundleWorkflowCode({ workflowsPath });
+    console.log("[runner-manager] Workflow code bundled successfully");
+    const sessions = new Map();
+    const workflowExecutions = new Map();
+    const shutdownSignals = new Map();
+    let shuttingDown = false;
+    async function createWorkerOnQueue(taskQueue) {
+        const shutdownController = new AbortController();
+        shutdownSignals.set(taskQueue, shutdownController);
+        _shutdownSignalRegistry.set(taskQueue, shutdownController.signal);
+        const worker = await Worker.create({
+            connection,
+            namespace: config.temporalNamespace,
+            taskQueue,
+            activities,
+            workflowBundle,
+            maxConcurrentActivityTaskExecutions: config.maxConcurrentActivities,
+            dataConverter: payloadCodec
+                ? { payloadCodecs: [payloadCodec] }
+                : undefined,
+            sinks: interceptorConfig.sinks,
+            interceptors: interceptorConfig.interceptors,
+        });
+        const runPromise = worker.run().catch((err) => {
+            console.error(`[runner-manager] Worker for queue ${taskQueue} exited with error:`, err);
+        });
+        return { worker, runPromise, shutdownController };
+    }
+    return {
+        async addSession(sessionId) {
+            if (shuttingDown) {
+                throw new Error("RunnerManager is shutting down");
+            }
+            if (sessions.has(sessionId)) {
+                return;
+            }
+            const taskQueue = SESSION_QUEUE_PREFIX + sessionId;
+            const managed = await createWorkerOnQueue(taskQueue);
+            sessions.set(sessionId, managed);
+            console.log(`[runner-manager] Added session ${sessionId} (queue=${taskQueue}, active=${sessions.size})`);
+        },
+        async removeSession(sessionId) {
+            const session = sessions.get(sessionId);
+            if (!session) {
+                return;
+            }
+            const taskQueue = SESSION_QUEUE_PREFIX + sessionId;
+            session.shutdownController.abort();
+            session.worker.shutdown();
+            await session.runPromise;
+            sessions.delete(sessionId);
+            shutdownSignals.delete(taskQueue);
+            _shutdownSignalRegistry.delete(taskQueue);
+            console.log(`[runner-manager] Removed session ${sessionId} (active=${sessions.size})`);
+        },
+        activeSessions() {
+            return Array.from(sessions.keys());
+        },
+        async addWorkflowExecution(executionId) {
+            if (shuttingDown) {
+                throw new Error("RunnerManager is shutting down");
+            }
+            if (workflowExecutions.has(executionId)) {
+                return;
+            }
+            const taskQueue = WFEXEC_QUEUE_PREFIX + executionId;
+            const managed = await createWorkerOnQueue(taskQueue);
+            workflowExecutions.set(executionId, managed);
+            console.log(`[runner-manager] Added workflow execution ${executionId} (queue=${taskQueue}, active=${workflowExecutions.size})`);
+        },
+        async removeWorkflowExecution(executionId) {
+            const execution = workflowExecutions.get(executionId);
+            if (!execution) {
+                return;
+            }
+            const taskQueue = WFEXEC_QUEUE_PREFIX + executionId;
+            execution.shutdownController.abort();
+            execution.worker.shutdown();
+            await execution.runPromise;
+            workflowExecutions.delete(executionId);
+            shutdownSignals.delete(taskQueue);
+            _shutdownSignalRegistry.delete(taskQueue);
+            console.log(`[runner-manager] Removed workflow execution ${executionId} (active=${workflowExecutions.size})`);
+        },
+        activeWorkflowExecutions() {
+            return Array.from(workflowExecutions.keys());
+        },
+        updateToken(token) {
+            // Writes the control-plane credential. The coordinator decides whether the
+            // proxy credential follows it: only when no token has been minted (so the
+            // pre-mint lockstep is preserved), never once the runner owns a minted
+            // token. See runner-token-coordinator.ts and the staleness changelogs.
+            tokenRef.current = token;
+            if (token) {
+                process.env.STIGMER_TOKEN = token;
+            }
+            else {
+                delete process.env.STIGMER_TOKEN;
+            }
+            tokenCoordinator.onControlPlaneTokenChanged(token);
+            console.log("[runner-manager] Auth token updated");
+        },
+        async shutdown() {
+            shuttingDown = true;
+            tokenCoordinator.stop();
+            const totalWorkers = sessions.size + workflowExecutions.size;
+            console.log(`[runner-manager] Shutting down ${totalWorkers} workers (${sessions.size} sessions, ${workflowExecutions.size} workflow executions)...`);
+            const shutdownPromises = [
+                ...Array.from(sessions.entries()).map(async ([id, session]) => {
+                    session.worker.shutdown();
+                    await session.runPromise;
+                    console.log(`[runner-manager] Session worker ${id} stopped`);
+                }),
+                ...Array.from(workflowExecutions.entries()).map(async ([id, execution]) => {
+                    execution.worker.shutdown();
+                    await execution.runPromise;
+                    console.log(`[runner-manager] Workflow execution worker ${id} stopped`);
+                }),
+            ];
+            await Promise.all(shutdownPromises);
+            sessions.clear();
+            workflowExecutions.clear();
+            connection.close();
+            console.log("[runner-manager] All workers stopped, connection closed");
+        },
+    };
+}
+function validateManagerOptions(options) {
+    if (!options.stigmerEndpoint) {
+        throw new Error("RunnerManagerOptions.stigmerEndpoint is required — specify the Stigmer server endpoint");
+    }
+    // temporalAddress is intentionally NOT required: when omitted, the runner
+    // discovers it from the control plane (token-only embedding). If neither an
+    // explicit address nor a token is present, discovery falls back to localhost.
+}
+export function mapManagerOptionsToConfig(options, tokenRef) {
+    const proxyActive = !!options.proxyEndpoint;
+    // Execution location is independent of proxy transport. Do NOT derive `mode`
+    // from `proxyActive`: the desktop runner executes LOCALLY (local-path
+    // workspaces must work) while still routing Cursor traffic through the proxy.
+    // Coupling the two here is exactly what previously broke local-path sessions.
+    const mode = options.executionMode ?? "local";
+    return {
+        taskQueue: "manager", // not used for Workers — each Worker gets its own
+        // May be empty here; createStigmerRunnerManager resolves it via
+        // resolveTemporalCoordinates before any Temporal connection is opened.
+        temporalAddress: options.temporalAddress ?? "",
+        temporalNamespace: options.temporalNamespace ?? "default",
+        stigmerBackendEndpoint: normalizeEndpoint(options.stigmerEndpoint),
+        stigmerToken: options.stigmerToken ?? null,
+        stigmerTokenRef: tokenRef,
+        cursorApiKey: proxyActive
+            ? (options.cursorApiKey ?? "proxy-managed")
+            : (options.cursorApiKey ?? ""),
+        workspaceRootDir: options.workspaceRootDir ?? resolveDefaultWorkspaceDir(),
+        mode,
+        proxyEndpoint: options.proxyEndpoint ?? null,
+        maxConcurrentActivities: options.maxConcurrentActivitiesPerSession ?? 5,
+        idleTimeoutSeconds: null,
+        cloudModeEnabled: options.cloudModeEnabled ?? false,
+        checkpointerType: options.checkpointerType ?? (proxyActive ? "http" : "memory"),
+        checkpointerProxyEndpoint: options.checkpointerProxyEndpoint ?? options.proxyEndpoint ?? null,
+        primaryModel: options.primaryModel ?? "gpt-4.1",
+    };
+}
+async function createAllActivities(config) {
+    const [{ createCursorActivities }, { createDeepAgentActivities }, { createEnsureThreadActivities }, { createClassifyToolApprovalsActivities }, { createDiscoverMcpServerActivities }, { createEvaluateExpressionsActivities }, { createCallHttpActivities }, { createCallGrpcActivities }, { createCallFunctionActivities }, { createCallLlmActivities }, { createCallAgentActivities }, { createCallAgentStatusActivities }, { createRunCommandActivities }, { createHydrateWorkflowActivities }, { createWorkflowEventActivities }, { createPromoteTaskOutputActivities },] = await Promise.all([
+        import("./activities/execute-cursor/index.js"),
+        import("./activities/execute-deep-agent/index.js"),
+        import("./activities/ensure-thread.js"),
+        import("./activities/classify-tool-approvals.js"),
+        import("./activities/discover-mcp-server.js"),
+        import("./activities/evaluate-expressions.js"),
+        import("./activities/call-http.js"),
+        import("./activities/call-grpc.js"),
+        import("./activities/call-function.js"),
+        import("./activities/call-llm.js"),
+        import("./activities/call-agent.js"),
+        import("./activities/call-agent-status.js"),
+        import("./activities/run-command.js"),
+        import("./activities/hydrate-workflow-execution.js"),
+        import("./activities/workflow-event-activities.js"),
+        import("./activities/promote-task-output.js"),
+    ]);
+    return {
+        ...createCursorActivities(config),
+        ...createDeepAgentActivities(config),
+        ...createEnsureThreadActivities(),
+        ...createClassifyToolApprovalsActivities(config),
+        ...createDiscoverMcpServerActivities(config),
+        ...createEvaluateExpressionsActivities(),
+        ...createCallHttpActivities(),
+        ...createCallGrpcActivities(),
+        ...createCallFunctionActivities(),
+        ...createCallLlmActivities(),
+        ...createCallAgentActivities(),
+        ...createCallAgentStatusActivities(),
+        ...createRunCommandActivities(),
+        ...createHydrateWorkflowActivities(config),
+        ...createWorkflowEventActivities(),
+        ...createPromoteTaskOutputActivities(),
+    };
+}
+async function createPayloadCodec(config) {
+    const { loadClaimcheckConfig, ClaimcheckPayloadCodec } = await import("./claimcheck/index.js");
+    const claimcheckConfig = loadClaimcheckConfig();
+    if (!claimcheckConfig.enabled) {
+        return undefined;
+    }
+    const { loadArtifactStorageConfig, createArtifactStorage } = await import("./shared/artifact-storage.js");
+    const storageConfig = loadArtifactStorageConfig(config);
+    const storage = createArtifactStorage(storageConfig);
+    return new ClaimcheckPayloadCodec(storage, claimcheckConfig);
+}
+async function buildInterceptorConfig() {
+    const { createWorkflowMetricsSinks } = await import("./interceptors/workflow-metrics-sink.js");
+    const activityInterceptors = [];
+    let sinks = { ...createWorkflowMetricsSinks() };
+    const workflowInterceptorModules = [];
+    if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
+        const { OpenTelemetryActivityInboundInterceptor, makeWorkflowExporter } = await import("@temporalio/interceptors-opentelemetry");
+        const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-grpc");
+        const { resourceFromAttributes } = await import("@opentelemetry/resources");
+        activityInterceptors.push((ctx) => ({
+            inbound: new OpenTelemetryActivityInboundInterceptor(ctx),
+        }));
+        const resource = resourceFromAttributes({
+            "service.name": "stigmer-runner-manager",
+        });
+        const exporter = new OTLPTraceExporter({
+            url: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
+        });
+        const otelSinks = makeWorkflowExporter(exporter, resource);
+        sinks = { ...sinks, ...otelSinks };
+        const esmRequire = createRequire(import.meta.url);
+        workflowInterceptorModules.push(esmRequire.resolve("@temporalio/interceptors-opentelemetry/lib/workflow-interceptors"));
+    }
+    return {
+        sinks,
+        interceptors: {
+            ...(activityInterceptors.length > 0
+                ? { activity: activityInterceptors }
+                : {}),
+            ...(workflowInterceptorModules.length > 0
+                ? { workflowModules: workflowInterceptorModules }
+                : {}),
+        },
+    };
+}
+function resolveDefaultWorkspaceDir() {
+    try {
+        const dir = join(homedir(), ".stigmer", "workspaces", "runner");
+        mkdirSync(dir, { recursive: true });
+        return dir;
+    }
+    catch {
+        const dir = join(tmpdir(), "stigmer-runner-workspace");
+        mkdirSync(dir, { recursive: true });
+        return dir;
+    }
+}
+function normalizeEndpoint(endpoint) {
+    if (endpoint.startsWith("http://") || endpoint.startsWith("https://")) {
+        return endpoint;
+    }
+    if (endpoint.endsWith(":443")) {
+        return `https://${endpoint}`;
+    }
+    return `http://${endpoint}`;
+}
+//# sourceMappingURL=runner-manager.js.map

package/dist/runner-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-manager.js","sourceRoot":"","sources":["../src/runner-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,MAAM,EACN,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAE7E,MAAM,oBAAoB,GAAG,UAAU,CAAC;AACxC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE/D,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAsGD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAA6B;IAE7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhC,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,qBAAqB;IACrB,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;IAC3D,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,gFAAgF;IAEhF,2DAA2D;IAC3D,MAAM,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAC3F,kDAAkD,CACnD,CAAC;IACF,uBAAuB,CAAC;QACtB,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,SAAS;QACpD,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,SAAS;KACnD,CAAC,CAAC;IAEH,kFAAkF;IAClF,MAAM,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CACtG,kDAAkD,CACnD,CAAC;IACF,uBAAuB,CAAC;QACtB,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,SAAS;QACpD,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,SAAS;KACnD,CAAC,CAAC;IACH,yEAAyE;IACzE,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,yBAAyB,EAAE,CAAC;IAElC,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,8EAA8E;IAC9E,WAAW;IACX,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;QACpD,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CACX,wBAAwB,CAAC;YACvB,KAAK,EAAE,QAAQ,CAAC,OAAO;YACvB,eAAe,EAAE,UAAU,CAAC,sBAAsB;SACnD,CAAC;KACL,CAAC,CAAC;IAEH,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;QAC7C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,KAAK,EAAE,OAAO,CAAC,YAAY;QAC3B,eAAe,EAAE,UAAU,CAAC,sBAAsB;KACnD,CAAC,CAAC;IACH,MAAM,MAAM,GAAW;QACrB,GAAG,UAAU;QACb,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;KAC/C,CAAC;IAEF,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAChC,gBAAgB,CAAC,gBAAgB,CAC/B,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,iCAAiC,CAC5C,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;SAAM,IAAI,UAAU,CAAC,aAAa,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,mDAAmD;QACnD,OAAO,CAAC,IAAI,CACV,6EAA6E;YAC3E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAC7C,kDAAkD,CACnD,CAAC;IACF,sBAAsB,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC,eAAe;KAChC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACzD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACjD,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3D,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,UAAU,mBAAmB,CAAC,SAAiB;QAClD,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAC;QACjD,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACnD,uBAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YACjC,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,iBAAiB;YACnC,SAAS;YACT,UAAU;YACV,cAAc;YACd,mCAAmC,EAAE,MAAM,CAAC,uBAAuB;YACnE,aAAa,EAAE,YAAY;gBACzB,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE;gBACnC,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,iBAAiB,CAAC,KAAK;YAC9B,YAAY,EAAE,iBAAiB,CAAC,YAAY;SAC7C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,OAAO,CAAC,KAAK,CACX,qCAAqC,SAAS,qBAAqB,EACnE,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACpD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,SAAiB;YAChC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CACT,kCAAkC,SAAS,WAAW,SAAS,YAAY,QAAQ,CAAC,IAAI,GAAG,CAC5F,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,SAAiB;YACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAAC;YACnD,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC,UAAU,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CACT,oCAAoC,SAAS,YAAY,QAAQ,CAAC,IAAI,GAAG,CAC1E,CAAC;QACJ,CAAC;QAED,cAAc;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB;YAC5C,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,mBAAmB,GAAG,WAAW,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;YACrD,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CACT,6CAA6C,WAAW,WAAW,SAAS,YAAY,kBAAkB,CAAC,IAAI,GAAG,CACnH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,WAAmB;YAC/C,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,mBAAmB,GAAG,WAAW,CAAC;YACpD,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACrC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC,UAAU,CAAC;YAC3B,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CACT,+CAA+C,WAAW,YAAY,kBAAkB,CAAC,IAAI,GAAG,CACjG,CAAC;QACJ,CAAC;QAED,wBAAwB;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,WAAW,CAAC,KAAoB;YAC9B,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,uEAAuE;YACvE,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;YACzB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YACnC,CAAC;YACD,gBAAgB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,YAAY,GAAG,IAAI,CAAC;YACpB,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC;YAC7D,OAAO,CAAC,GAAG,CACT,kCAAkC,YAAY,aAAa,QAAQ,CAAC,IAAI,cAAc,kBAAkB,CAAC,IAAI,0BAA0B,CACxI,CAAC;YAEF,MAAM,gBAAgB,GAAG;gBACvB,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACnC,KAAK,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;oBACtB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC1B,MAAM,OAAO,CAAC,UAAU,CAAC;oBACzB,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;gBAC/D,CAAC,CACF;gBACD,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC7C,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE;oBACxB,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC5B,MAAM,SAAS,CAAC,UAAU,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,8CAA8C,EAAE,UAAU,CAAC,CAAC;gBAC1E,CAAC,CACF;aACF,CAAC;YAEF,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACpC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA6B;IAC3D,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;AAChF,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAA6B,EAC7B,QAAqC;IAErC,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAE5C,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAK,OAAiB,CAAC;IAEzD,OAAO;QACL,SAAS,EAAE,SAAS,EAAE,kDAAkD;QACxE,gEAAgE;QAChE,uEAAuE;QACvE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,SAAS;QACzD,sBAAsB,EAAE,iBAAiB,CAAC,OAAO,CAAC,eAAe,CAAC;QAClE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,eAAe,EAAE,QAAQ;QACzB,YAAY,EAAE,WAAW;YACvB,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,eAAe,CAAC;YAC3C,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,EAAE;QAC1E,IAAI;QACJ,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;QAC5C,uBAAuB,EAAE,OAAO,CAAC,iCAAiC,IAAI,CAAC;QACvE,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QACnD,gBAAgB,EACd,OAAO,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,yBAAyB,EACvB,OAAO,CAAC,yBAAyB,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI;QACpE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc;IAC/C,MAAM,CACJ,EAAE,sBAAsB,EAAE,EAC1B,EAAE,yBAAyB,EAAE,EAC7B,EAAE,4BAA4B,EAAE,EAChC,EAAE,qCAAqC,EAAE,EACzC,EAAE,iCAAiC,EAAE,EACrC,EAAE,mCAAmC,EAAE,EACvC,EAAE,wBAAwB,EAAE,EAC5B,EAAE,wBAAwB,EAAE,EAC5B,EAAE,4BAA4B,EAAE,EAChC,EAAE,uBAAuB,EAAE,EAC3B,EAAE,yBAAyB,EAAE,EAC7B,EAAE,+BAA+B,EAAE,EACnC,EAAE,0BAA0B,EAAE,EAC9B,EAAE,+BAA+B,EAAE,EACnC,EAAE,6BAA6B,EAAE,EACjC,EAAE,iCAAiC,EAAE,EACtC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,sCAAsC,CAAC;QAC9C,MAAM,CAAC,0CAA0C,CAAC;QAClD,MAAM,CAAC,+BAA+B,CAAC;QACvC,MAAM,CAAC,yCAAyC,CAAC;QACjD,MAAM,CAAC,qCAAqC,CAAC;QAC7C,MAAM,CAAC,sCAAsC,CAAC;QAC9C,MAAM,CAAC,2BAA2B,CAAC;QACnC,MAAM,CAAC,2BAA2B,CAAC;QACnC,MAAM,CAAC,+BAA+B,CAAC;QACvC,MAAM,CAAC,0BAA0B,CAAC;QAClC,MAAM,CAAC,4BAA4B,CAAC;QACpC,MAAM,CAAC,mCAAmC,CAAC;QAC3C,MAAM,CAAC,6BAA6B,CAAC;QACrC,MAAM,CAAC,4CAA4C,CAAC;QACpD,MAAM,CAAC,2CAA2C,CAAC;QACnD,MAAM,CAAC,qCAAqC,CAAC;KAC9C,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,sBAAsB,CAAC,MAAM,CAAC;QACjC,GAAG,yBAAyB,CAAC,MAAM,CAAC;QACpC,GAAG,4BAA4B,EAAE;QACjC,GAAG,qCAAqC,CAAC,MAAM,CAAC;QAChD,GAAG,iCAAiC,CAAC,MAAM,CAAC;QAC5C,GAAG,mCAAmC,EAAE;QACxC,GAAG,wBAAwB,EAAE;QAC7B,GAAG,wBAAwB,EAAE;QAC7B,GAAG,4BAA4B,EAAE;QACjC,GAAG,uBAAuB,EAAE;QAC5B,GAAG,yBAAyB,EAAE;QAC9B,GAAG,+BAA+B,EAAE;QACpC,GAAG,0BAA0B,EAAE;QAC/B,GAAG,+BAA+B,CAAC,MAAM,CAAC;QAC1C,GAAG,6BAA6B,EAAE;QAClC,GAAG,iCAAiC,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAc;IAEd,MAAM,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CACnE,uBAAuB,CACxB,CAAC;IACF,MAAM,gBAAgB,GAAG,oBAAoB,EAAE,CAAC;IAChD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CACvE,8BAA8B,CAC/B,CAAC;IACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACrD,OAAO,IAAI,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC/D,CAAC;AAOD,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CACjD,yCAAyC,CAC1C,CAAC;IAEF,MAAM,oBAAoB,GAAkC,EAAE,CAAC;IAC/D,IAAI,KAAK,GAAuB,EAAE,GAAG,0BAA0B,EAAE,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAC5C,MAAM,EAAE,uCAAuC,EAAE,oBAAoB,EAAE,GACrE,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACzD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CACxC,yCAAyC,CAC1C,CAAC;QACF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAC7C,0BAA0B,CAC3B,CAAC;QAEF,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,IAAI,uCAAuC,CAAC,GAAG,CAAC;SAC1D,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,cAAc,EAAE,wBAAwB;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;SAC7C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,oBAAoB,CACpC,QAAe,EACf,QAAe,CACiB,CAAC;QACnC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,0BAA0B,CAAC,IAAI,CAC7B,UAAU,CAAC,OAAO,CAChB,kEAAkE,CACnE,CACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE;gBACpC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC;gBACvC,CAAC,CAAC,EAAE,eAAe,EAAE,0BAA0B,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAChE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,UAAU,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/runner-token-coordinator.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Owns the runner's two-writer token model.
+ *
+ * The runner authenticates two surfaces with two credentials that may diverge:
+ *
+ *   - the control-plane token (the host's durable credential, e.g. the desktop's
+ *     Auth0 token), used for Authorization on control-plane gRPC; and
+ *   - the proxy token (x-stigmer-auth), used for Cursor-proxy traffic.
+ *
+ * On most hosts these are the same token. On cloud the control plane mints a
+ * dedicated iss=stigmer proxy token during bootstrap; from that point the proxy
+ * token is a *separate* credential with its own TTL, owned and refreshed here.
+ *
+ * This coordinator exists because the proxy token's freshness was the subject of
+ * two production fixes (stigmer-cloud _changelog 2026-05-26 and 2026-06-01):
+ * before them, the proxy token froze at startup and silently 401'd after the
+ * host's token refreshed. The lockstep those fixes established — "every token
+ * refresh updates the proxy sink too" — is preserved here for hosts that do not
+ * mint (see {@link RunnerTokenCoordinator.onControlPlaneTokenChanged}). Once a
+ * token is minted, freshness is instead guaranteed by {@link reMint} on a timer,
+ * and a control-plane refresh must NOT overwrite the minted token. Keeping that
+ * gate in one tested place is the whole point of this module.
+ */
+import type { RefreshedRunnerToken } from "./bootstrap.js";
+export interface RunnerTokenCoordinatorOptions {
+    /** Writes the proxy credential to the x-stigmer-auth interceptors. */
+    readonly applyProxyToken: (token: string) => void;
+    /**
+     * Re-mints the proxy token using the current (always-fresh) control-plane
+     * token. Returns undefined on any failure or when no token is minted; the
+     * coordinator retries rather than crashing the runner.
+     */
+    readonly reMint: () => Promise<RefreshedRunnerToken | undefined>;
+    /** Optional structured logger; defaults to console. */
+    readonly log?: Pick<typeof console, "log" | "warn">;
+}
+export interface RunnerTokenCoordinator {
+    /**
+     * Adopt a server-minted proxy token. Applies it immediately and schedules a
+     * refresh before expiry. After this, control-plane updates no longer touch the
+     * proxy token.
+     */
+    adoptMintedToken(token: string, expiresInSeconds: number | undefined): void;
+    /**
+     * Notify the coordinator that the control-plane token changed. While no token
+     * has been minted, the proxy token follows it in lockstep (preserving the
+     * pre-mint staleness fix); once a token is minted, this is a no-op for the
+     * proxy credential.
+     */
+    onControlPlaneTokenChanged(token: string | null): void;
+    /** Whether a server-minted proxy token is currently in effect. */
+    isProxyTokenMinted(): boolean;
+    /** Stop the refresh timer. Idempotent. */
+    stop(): void;
+}
+export declare function createRunnerTokenCoordinator(options: RunnerTokenCoordinatorOptions): RunnerTokenCoordinator;