@tokenfactory/acc-runner 0.43.0 → 0.44.1

package/dist/watch.d.ts

@@ -253,6 +253,11 @@ export interface WatchOptions {
      * 60s. Tests set a large value so only the `gitAuthProbeOnce()` hook drives it.
      */
     gitAuthProbeIntervalMs?: number;
+    /**
+     * NS RUN-3: cadence (ms) of the GH_TOKEN refresh check (only armed when
+     * ACC_RUNNER_GITHUB_TOKEN_SOURCE=installation-token). Defaults to 60s.
+     */
+    githubTokenRefreshIntervalMs?: number;
     /**
      * GIT-AUTH-ALERT: consecutive auth-class probe failures before the runner
      * trips the degraded `git_auth_failed` state. Defaults to 2 (the spec bar).
@@ -412,6 +417,14 @@ interface WatchState {
     gitAuthProbeIntervalMs: number;
     gitAuthChecking: boolean;
     gitAuthFailed: boolean;
+    /**
+     * NS RUN-3: refresh timer for the minted GitHub App installation token
+     * (null when ACC_RUNNER_GITHUB_TOKEN_SOURCE is not "installation-token" —
+     * the default, unchanged-behaviour path). Keeps process.env.GH_TOKEN fresh
+     * for the life of a long-running container; unref'd so it never holds the
+     * process open on its own.
+     */
+    githubTokenRefreshTimer: NodeJS.Timeout | null;
     /**
      * v0.68 (T-68-1): realtime channel-health recovery. The `.subscribe`
      * status callback previously handled ONLY `SUBSCRIBED`; a `CHANNEL_ERROR`

package/dist/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAGlB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAW9E,OAAO,EAAE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,EAIjB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAK9F,OAAO,EAAE,qBAAqB,EAAmB,MAAM,4BAA4B,CAAC;AAGpF,OAAO,EACL,yBAAyB,EAE1B,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,YAAY,EAQZ,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EAEtB,oBAAoB,EAEpB,KAAK,kBAAkB,EACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,iBAAiB,EAKlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAyGF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,OAAO,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,CAChB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;QAAE,QAAQ,EAAE,oBAAoB,CAAA;KAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAWf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,wEAAwE;IACxE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,KAAK,eAAe,GAAG,CACrB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;IAAE,QAAQ,EAAE,oBAAoB,CAAA;CAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,UAAU,UAAU;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;IAC1B,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;IAChC,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC5C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0BAA0B,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1D;;;;;;;OAOG;IACH,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;;OAOG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sFAAsF;IACtF,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,uBAAuB,EAAE,MAAM,CAAC,OAAO,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,gEAAgE;IAChE,WAAW,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,0DAA0D;IAC1D,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;;;;OAOG;IACH,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpF,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC1C;AA+MD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAMD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5E;AA6bD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,GACZ,sBAAsB,GAAG,IAAI,CAS/B;AAsCD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAsDf;AAuUD,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CA0xBnF;AA0VD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf;AAmSD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,IAAI,CACL,oBAAoB,EACpB,gBAAgB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO,CACjF,CA6GA"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAGlB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAW9E,OAAO,EAAE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,EAIjB,KAAK,YAAY,EAOlB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAK9F,OAAO,EAAE,qBAAqB,EAAmB,MAAM,4BAA4B,CAAC;AAGpF,OAAO,EACL,yBAAyB,EAE1B,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,YAAY,EAQZ,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAqBhD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EAEtB,oBAAoB,EAEpB,KAAK,kBAAkB,EACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,iBAAiB,EAKlB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAgHF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,OAAO,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,CAChB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;QAAE,QAAQ,EAAE,oBAAoB,CAAA;KAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAWf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,wEAAwE;IACxE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC;;;;OAIG;IACH,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,KAAK,eAAe,GAAG,CACrB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;IAAE,QAAQ,EAAE,oBAAoB,CAAA;CAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,UAAU,UAAU;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;IAC1B,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;IAChC,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC5C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0BAA0B,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1D;;;;;;;OAOG;IACH,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,uBAAuB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/C;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;;OAOG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sFAAsF;IACtF,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,uBAAuB,EAAE,MAAM,CAAC,OAAO,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,gEAAgE;IAChE,WAAW,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,0DAA0D;IAC1D,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;;;;OAOG;IACH,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpF,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACtD;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC1C;AA+MD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAMD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5E;AA6bD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,GACZ,sBAAsB,GAAG,IAAI,CAS/B;AAsCD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAsDf;AAuUD,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAo4BnF;AA0VD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf;AAmSD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,IAAI,CACL,oBAAoB,EACpB,gBAAgB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO,CACjF,CA6GA"}

package/dist/watch.js

@@ -47,7 +47,12 @@ import { acquireSingletonLock, singletonRunnerId, SingletonLockHeldError, } from
 import { getClaudeVersion, recordTaskClaudeVersion, } from "./runtime/version-drift.js";
 import { autoUpgradeDisabled, maybeSelfUpgrade, maybeSelfUpdateOn426, } from "./runtime/self-upgrade.js";
 import { postRunnerStateMessage } from "./messaging.js";
-import { GitAuthController, makeGitAuthProbe, RUNNER_GIT_AUTH_FAILED_VERB, RUNNER_GIT_AUTH_RECOVERED_VERB, } from "./git-auth/index.js";
+import { GitAuthController, makeGitAuthProbe, RUNNER_GIT_AUTH_FAILED_VERB, RUNNER_GIT_AUTH_RECOVERED_VERB, 
+// NS RUN-3: per-container GitHub App installation tokens.
+InstallationTokenProvider, makeHttpInstallationTokenFetcher, resolveGithubTokenSource, effectiveInstallationTokenRepos, hydrateGithubToken, } from "./git-auth/index.js";
+// NS RUN-3: ANTHROPIC_API_KEY sourced from the vault secret store.
+import { hydrateAnthropicApiKey } from "./provider-auth.js";
+import { makeHttpSecretFetcher } from "./secrets/inject.js";
 // AS-3 (RESUME-WIRE): drive the live capacity pause/resume through the
 // ResumeController (pause-until reset OR account-change OR ping) instead of a
 // fixed pause-until-reset setTimeout, and off the AS-2 account-probe cadence.
@@ -67,6 +72,10 @@ import { unknownAccountIdentity } from "./engines/account-identity.js";
 import { checkVersion, compareSemver } from "./version-check.js";
 import { PACKAGE_VERSION } from "./pkg-version.js";
 import { authPrecedenceHint, servingAuthKind, describeServingAuthKind, forwardsAmbientKey, anthropicApiKey, } from "./provider-auth.js";
+// RUNNER-SERVING-AUTH: the org's subscription-vs-BYOK choice, resolved once
+// per boot and expressed through the same ACC_RUNNER_SERVING_AUTH_KIND var the
+// imports above already fold.
+import { fetchServingAuth, installServingAuth, servingAuthKindIsPinned, describeServingAuthResolution, } from "./serving-auth/index.js";
 // AUTH-REFRESH: the refresh + heartbeat-classification
 // primitives now live in a shared module so the companion runner reuses them
 // verbatim. Re-exported below to keep watch.js's existing test-facing surface.
@@ -157,6 +166,12 @@ const DEFAULT_CLAIM_DEADMAN_MAX_REBUILDS = 2;
 // only the `gitAuthProbeOnce()` hook drives it deterministically. Knob:
 // `git_auth_probe_interval_ms`.
 const DEFAULT_GIT_AUTH_PROBE_INTERVAL_MS = 60_000;
+// NS RUN-3: how often a long-running container re-checks its minted GitHub
+// App installation token. InstallationTokenProvider only actually re-mints
+// once within its own refresh margin (5 min) of the cached token's expiry, so
+// a call before then is a cheap cache hit — this cadence just needs to be
+// comfortably shorter than that margin.
+const DEFAULT_GITHUB_TOKEN_REFRESH_INTERVAL_MS = 60_000;
 // v0.56 (T-56-1): capacity-aware pause. When claude reports a session/usage
 // limit (api_error_status 429) the runner pauses claiming tasks AND reviews
 // until the stated reset time. When no reset time is parseable, fall back to
@@ -1377,25 +1392,6 @@ export async function watchCommand(options = {}) {
                     `(auto-upgrade disabled via ACC_RUNNER_NO_AUTO_UPGRADE=1).\n`
                 : `Auto-upgrade will install npm latest when idle.\n`));
     }
-    // Surface how spawned claude sessions will authenticate under subscription-only
-    // serving. All serving rides subscription capacity unless the serving identity
-    // is BYOK api_key — a host ANTHROPIC_API_KEY is forwarded ONLY in that case,
-    // and stripped otherwise so it can never silently bill the API. The serving
-    // auth_kind comes from ACC_RUNNER_SERVING_AUTH_KIND (fail-safe: subscription
-    // when unset).
-    const servingKind = servingAuthKind();
-    console.log(chalk.gray(`Serving auth: ${describeServingAuthKind(servingKind)}`));
-    if (!forwardsAmbientKey() && anthropicApiKey()) {
-        // Reassure the operator that a stray host key is inert, not billed.
-        console.log(chalk.gray("Serving auth: a host ANTHROPIC_API_KEY is set but will be STRIPPED from spawns (subscription-only)."));
-    }
-    if (forwardsAmbientKey()) {
-        // Only meaningful in BYOK api_key mode — surface the key-vs-claude.ai-login
-        // precedence hint so a 429 is diagnosable from the banner.
-        const authHint = authPrecedenceHint();
-        if (authHint)
-            console.log(chalk.gray(`Serving auth: ${authHint}`));
-    }
     // Startup refresh: if the access token expires in less than an hour,
     // grab a fresh one before opening the realtime connection.
     // v0.12.0 (T-52-7): skipped when the provider has no refresh token —
@@ -1488,6 +1484,94 @@ export async function watchCommand(options = {}) {
         await tokenProvider.save(session);
         console.log(chalk.green(`✓ Registered ephemeral runner: ${session.runner_id}`));
     }
+    // RUNNER-SERVING-AUTH: ask the control plane which serving auth this ORG
+    // chose in Settings, before the banner below reads it. This is what turns
+    // "an operator hand-edits ACC_RUNNER_SERVING_AUTH_KIND on the host" into an
+    // admin-gated setting — it writes the SAME env var and changes nothing else.
+    // Never throws: any failure resolves to subscription (today's behaviour),
+    // and an explicit launch-env value always wins, so container fleets that pin
+    // the var are untouched.
+    //
+    // POSITION MATTERS, twice over. It runs AFTER the startup refresh + ephemeral
+    // registration so the JWT it presents is the final one, not a token that was
+    // about to expire. And it runs BEFORE the NS RUN-3 vault hydration below, so
+    // an explicit ACC_RUNNER_ANTHROPIC_KEY_SOURCE=secret-store fleet still wins
+    // the shared key cache — the per-fleet opt-in outranks the org default, same
+    // precedence rule as the env var itself.
+    if (!servingAuthKindIsPinned()) {
+        const servingChoice = await fetchServingAuth({
+            publicUrl: cfg.publicUrl,
+            jwt: session.access_token,
+        });
+        installServingAuth(servingChoice);
+        if (servingChoice.fallbackReason) {
+            console.log(chalk.gray(`Serving auth: ${describeServingAuthResolution(servingChoice)}`));
+        }
+    }
+    // Surface how spawned claude sessions will authenticate under subscription-only
+    // serving. All serving rides subscription capacity unless the serving identity
+    // is BYOK api_key — a host ANTHROPIC_API_KEY is forwarded ONLY in that case,
+    // and stripped otherwise so it can never silently bill the API. The serving
+    // auth_kind comes from ACC_RUNNER_SERVING_AUTH_KIND (fail-safe: subscription
+    // when unset), which the org setting above may have just supplied.
+    const servingKind = servingAuthKind();
+    console.log(chalk.gray(`Serving auth: ${describeServingAuthKind(servingKind)}`));
+    if (!forwardsAmbientKey() && anthropicApiKey()) {
+        // Reassure the operator that a stray host key is inert, not billed.
+        console.log(chalk.gray("Serving auth: a host ANTHROPIC_API_KEY is set but will be STRIPPED from spawns (subscription-only)."));
+    }
+    if (forwardsAmbientKey()) {
+        // Only meaningful in BYOK api_key mode — surface the key-vs-claude.ai-login
+        // precedence hint so a 429 is diagnosable from the banner.
+        const authHint = authPrecedenceHint();
+        if (authHint)
+            console.log(chalk.gray(`Serving auth: ${authHint}`));
+    }
+    // NS RUN-3: hydrate ANTHROPIC_API_KEY from the vault secret store, BEFORE
+    // any claude spawn can read it. Defaults to a no-op (source "env") so
+    // existing fleets are byte-identical until an operator opts in via
+    // ACC_RUNNER_ANTHROPIC_KEY_SOURCE=secret-store. Runs after the runner is
+    // registered (session.runner_id is stable either way — env-token runners
+    // just registered above; keychain runners already have one) so the
+    // attributed agentId is the runner's real identity. The resolved key is
+    // cached inside provider-auth.ts (anthropicApiKey()'s fallback) — the
+    // return value here is intentionally discarded rather than written to
+    // process.env.ANTHROPIC_API_KEY, which the ambient-key guard
+    // (scripts/ci/no-ambient-anthropic-key.mjs) strictly forbids in this tree.
+    try {
+        await hydrateAnthropicApiKey(process.env, {
+            fetcher: makeHttpSecretFetcher({ publicUrl: cfg.publicUrl, jwt: session.access_token }),
+            agentId: session.runner_id,
+        });
+    }
+    catch (err) {
+        process.stderr.write(`[acc-runner] ANTHROPIC_API_KEY secret-store hydration failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    }
+    // NS RUN-3: mint a short-lived, repo-scoped GitHub App installation token in
+    // place of a shared GH_TOKEN PAT, when opted in via
+    // ACC_RUNNER_GITHUB_TOKEN_SOURCE=installation-token. Defaults to a no-op
+    // ("env" — today's shared-PAT behaviour, unchanged). The provider is kept
+    // alive for the process's lifetime so the periodic refresh below (armed
+    // once `state` exists) can keep process.env.GH_TOKEN current past the
+    // token's ~1h expiry.
+    let installationTokenProvider = null;
+    if (resolveGithubTokenSource(process.env) === "installation-token") {
+        installationTokenProvider = new InstallationTokenProvider({
+            repos: effectiveInstallationTokenRepos(cfg),
+            runnerId: session.runner_id,
+            fetcher: makeHttpInstallationTokenFetcher({ publicUrl: cfg.publicUrl, jwt: session.access_token }),
+        });
+        try {
+            const hydratedGithub = await hydrateGithubToken(process.env, installationTokenProvider);
+            if (hydratedGithub.GH_TOKEN)
+                process.env.GH_TOKEN = hydratedGithub.GH_TOKEN;
+        }
+        catch (err) {
+            process.stderr.write(`[acc-runner] GitHub installation-token mint failed: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    }
     const taskRunnerFactory = options.taskRunnerFactory ?? runTask;
     const heartbeatMs = options.heartbeatMs ?? 4_000;
     const pollMs = options.pollMs ?? POLL_INTERVAL_MS;
@@ -1556,6 +1640,9 @@ export async function watchCommand(options = {}) {
         gitAuthProbeIntervalMs: options.gitAuthProbeIntervalMs ?? DEFAULT_GIT_AUTH_PROBE_INTERVAL_MS,
         gitAuthChecking: false,
         gitAuthFailed: false,
+        // NS RUN-3: armed below, alongside the installation-token provider setup,
+        // only when opted in.
+        githubTokenRefreshTimer: null,
         // v0.68 (T-68-1): realtime channel-health recovery state.
         resubscribing: false,
         resubscribeAttempts: 0,
@@ -1633,6 +1720,25 @@ export async function watchCommand(options = {}) {
     // base clone is resolvable). The probe timer is armed in the timer-setup
     // block below alongside the claim/review scans.
     wireGitAuthController(state, options);
+    // NS RUN-3: keep process.env.GH_TOKEN fresh for the rest of this process's
+    // life. No-op (timer never armed) unless installation-token sourcing was
+    // opted into above. Unref'd so it never holds the process open on its own;
+    // a mint failure logs and retries next tick rather than crashing a running
+    // container mid-task.
+    if (installationTokenProvider) {
+        const provider = installationTokenProvider;
+        state.githubTokenRefreshTimer = setInterval(() => {
+            hydrateGithubToken(process.env, provider)
+                .then((hydrated) => {
+                if (hydrated.GH_TOKEN)
+                    process.env.GH_TOKEN = hydrated.GH_TOKEN;
+            })
+                .catch((err) => {
+                process.stderr.write(`[acc-runner] GitHub installation-token refresh failed (continuing): ${err instanceof Error ? err.message : String(err)}\n`);
+            });
+        }, options.githubTokenRefreshIntervalMs ?? DEFAULT_GITHUB_TOKEN_REFRESH_INTERVAL_MS);
+        state.githubTokenRefreshTimer.unref?.();
+    }
     subscribeChannel(state, taskRunnerFactory);
     // v0.34-B / v0.62 (T-62-1): one-shot startup claim scan. The 5-minute
     // pollSince watermark (v0.30-B) can miss a task dispatched (runner_id set)
@@ -1835,6 +1941,8 @@ export async function watchCommand(options = {}) {
         stopDeadmanFallback(state); // CLAIM-DEADMAN
         if (state.gitAuthTimer)
             clearInterval(state.gitAuthTimer); // GIT-AUTH-ALERT
+        if (state.githubTokenRefreshTimer)
+            clearInterval(state.githubTokenRefreshTimer); // NS RUN-3
         if (state.resubscribeTimer)
             clearTimeout(state.resubscribeTimer); // v0.68 (T-68-1)
         if (state.idleTimer)