@tokenfactory/acc-runner 0.43.0 → 0.44.1

package/dist/git-auth/github-token-source.js

@@ -0,0 +1,44 @@
+export const GITHUB_TOKEN_SOURCE_ENV = "ACC_RUNNER_GITHUB_TOKEN_SOURCE";
+/**
+ * Resolve which source GH_TOKEN should come from. Defaults to "env" (today's
+ * behaviour, unchanged) so existing desktop runners and containers with
+ * GH_TOKEN baked into their launch env see no change.
+ */
+export function resolveGithubTokenSource(env = process.env) {
+    const v = (env[GITHUB_TOKEN_SOURCE_ENV] ?? "").trim().toLowerCase();
+    return v === "installation-token" || v === "installation_token" ? "installation-token" : "env";
+}
+/**
+ * The repo(s) an installation-token mint should be scoped to for this
+ * container: the runner's declared served-repo scope (RunnerConfig.repos)
+ * when non-empty, else the single configured target repo — the same
+ * fallback the pre-multi-repo single-repo default already uses everywhere
+ * else in the runner (an undeclared scope means "this one repo", not
+ * "every repo the App can see").
+ */
+export function effectiveInstallationTokenRepos(cfg) {
+    return cfg.repos && cfg.repos.length > 0 ? cfg.repos : [cfg.targetRepo];
+}
+/**
+ * Startup/refresh-time env hydration: when ACC_RUNNER_GITHUB_TOKEN_SOURCE is
+ * "installation-token", mints (or serves the cached) short-lived, repo-scoped
+ * token from `provider` and returns `base` with GH_TOKEN set to it;
+ * otherwise returns `base` unchanged. Unlike hydrateAnthropicApiKey, an
+ * existing GH_TOKEN in `base` is deliberately OVERWRITTEN when opted in — the
+ * whole point is to replace the shared PAT a container's launch env may
+ * already carry, not defer to it. Never mutates `base`.
+ *
+ * Callers invoke this once at startup and again on a refresh timer (the
+ * provider's own cache means a call before the refresh margin is a cheap
+ * no-op mint).
+ */
+export async function hydrateGithubToken(base = process.env, provider) {
+    if (resolveGithubTokenSource(base) !== "installation-token")
+        return base;
+    if (!provider) {
+        throw new Error(`${GITHUB_TOKEN_SOURCE_ENV}=installation-token requires an InstallationTokenProvider at startup`);
+    }
+    const token = await provider.getToken();
+    return { ...base, GH_TOKEN: token };
+}
+//# sourceMappingURL=github-token-source.js.map

package/dist/git-auth/github-token-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-token-source.js","sourceRoot":"","sources":["../../src/git-auth/github-token-source.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,MAAM,uBAAuB,GAAG,gCAAyC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,OAAO,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;AACjG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAG/C;IACC,OAAO,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA0B,OAAO,CAAC,GAAG,EACrC,QAA0C;IAE1C,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,GAAG,uBAAuB,sEAAsE,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC"}

package/dist/git-auth/index.d.ts

@@ -7,6 +7,10 @@
 export { classifyGitFetchError, isGitAuthFailure, GIT_AUTH_FAILURE_PATTERNS, type GitFetchFailureClass, } from "./classify.js";
 export { makeGitAuthProbe, maskGitCredentials, type GitAuthProbe, type GitAuthProbeResult, type DefaultProbeOptions, } from "./probe.js";
 export { GitAuthController, DEFAULT_GIT_AUTH_FAILURE_THRESHOLD, type GitAuthControllerDeps, type GitAuthDegradedInfo, type GitAuthRecoveredInfo, type GitAuthSnapshot, } from "./controller.js";
+/** NS-RUN-3: per-container GitHub App installation tokens (replaces a shared GH_TOKEN PAT). */
+export { InstallationTokenProvider, InstallationTokenScopeError, isWithinRequestedScope, makeHttpInstallationTokenFetcher, type InstallationTokenFetcher, type InstallationTokenProviderOptions, type InstallationTokenResult, } from "./installation-token.js";
+/** NS-RUN-3: where a running container's GH_TOKEN comes from (env vs. minted). */
+export { GITHUB_TOKEN_SOURCE_ENV, resolveGithubTokenSource, effectiveInstallationTokenRepos, hydrateGithubToken, type GithubTokenSource, } from "./github-token-source.js";
 /** Runner-emitted audit verbs. The alerts tick (api/_lib/alerts-git-auth.ts) */
 /** scans these to derive currently-degraded machines and page the operator. */
 export declare const RUNNER_GIT_AUTH_FAILED_VERB = "runner.git_auth_failed";

package/dist/git-auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,8BAA8B,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,+FAA+F;AAC/F,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,gCAAgC,EAChC,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,kFAAkF;AAClF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,kBAAkB,EAClB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,8BAA8B,8BAA8B,CAAC"}

package/dist/git-auth/index.js

@@ -7,6 +7,10 @@
 export { classifyGitFetchError, isGitAuthFailure, GIT_AUTH_FAILURE_PATTERNS, } from "./classify.js";
 export { makeGitAuthProbe, maskGitCredentials, } from "./probe.js";
 export { GitAuthController, DEFAULT_GIT_AUTH_FAILURE_THRESHOLD, } from "./controller.js";
+/** NS-RUN-3: per-container GitHub App installation tokens (replaces a shared GH_TOKEN PAT). */
+export { InstallationTokenProvider, InstallationTokenScopeError, isWithinRequestedScope, makeHttpInstallationTokenFetcher, } from "./installation-token.js";
+/** NS-RUN-3: where a running container's GH_TOKEN comes from (env vs. minted). */
+export { GITHUB_TOKEN_SOURCE_ENV, resolveGithubTokenSource, effectiveInstallationTokenRepos, hydrateGithubToken, } from "./github-token-source.js";
 /** Runner-emitted audit verbs. The alerts tick (api/_lib/alerts-git-auth.ts) */
 /** scans these to derive currently-degraded machines and page the operator. */
 export const RUNNER_GIT_AUTH_FAILED_VERB = "runner.git_auth_failed";

package/dist/git-auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/git-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAInB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kCAAkC,GAKnC,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/git-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAInB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kCAAkC,GAKnC,MAAM,iBAAiB,CAAC;AACzB,+FAA+F;AAC/F,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,gCAAgC,GAIjC,MAAM,yBAAyB,CAAC;AACjC,kFAAkF;AAClF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC"}

package/dist/git-auth/installation-token.d.ts

@@ -0,0 +1,95 @@
+/** One minted installation token plus the metadata needed to cache/refresh it. */
+export interface InstallationTokenResult {
+    token: string;
+    /** ISO-8601 expiry timestamp (GitHub installation tokens live ~1h). */
+    expiresAt: string;
+    /** The repos this token is ACTUALLY scoped to, as returned by the mint. */
+    repos: string[];
+}
+/** Injectable seam. Production wires this via `makeHttpInstallationTokenFetcher`; tests pass a stub. */
+export type InstallationTokenFetcher = (repos: string[], runnerId: string) => Promise<InstallationTokenResult>;
+/**
+ * Thrown when a mint hands back a token scoped to repos beyond what the
+ * runner requested. This is the client-side half of "token scope limited to
+ * the repos the runner serves" (AC3): even a server that returns an
+ * over-broad grant cannot make this runner USE the excess scope, because the
+ * provider refuses the token outright rather than caching/serving it.
+ */
+export declare class InstallationTokenScopeError extends Error {
+    readonly requested: string[];
+    readonly granted: string[];
+    constructor(requested: string[], granted: string[]);
+}
+/**
+ * True when `granted` is a NON-EMPTY set and every entry is present in
+ * `requested` (case-insensitive).
+ *
+ * AC5: an empty grant is NOT treated as in-scope. A mint that hands back zero
+ * repos proves nothing about what it actually scoped the token to — vacuously
+ * satisfying a subset check would let a malformed or field-less response
+ * through as if it were a valid (if narrow) grant. Fail closed instead: no
+ * verifiable scope means the token is rejected, same as an over-broad one.
+ */
+export declare function isWithinRequestedScope(requested: string[], granted: string[]): boolean;
+export interface InstallationTokenProviderOptions {
+    /**
+     * The repo(s) ("owner/name") this container is configured to serve.
+     * Required and non-empty — a provider with no configured repos can never
+     * mint a token, closing off the "one credential, every repo" shape a
+     * shared PAT had.
+     */
+    repos: string[];
+    fetcher: InstallationTokenFetcher;
+    runnerId: string;
+    /** Refresh this many ms before the cached token's stated expiry. Default 5 min. */
+    refreshMarginMs?: number;
+}
+/**
+ * Runner-side cache/refresh for a single installation token, scoped to the
+ * repo(s) this container serves. In-memory only — like `EnvTokenProvider`
+ * (token-provider.ts), an ephemeral container must never write a credential
+ * to its writable layer.
+ */
+export declare class InstallationTokenProvider {
+    private readonly repos;
+    private readonly fetcher;
+    private readonly runnerId;
+    private readonly refreshMarginMs;
+    private cached;
+    private inflight;
+    constructor(opts: InstallationTokenProviderOptions);
+    /** Repos this provider is configured to serve (defensive copy). */
+    reposServed(): string[];
+    /** True when the cached token is still fresh past the refresh margin. */
+    private fresh;
+    /**
+     * Return a valid installation token, minting or refreshing as needed.
+     * Concurrent callers share one in-flight mint (mirrors the server-side
+     * single-flight in `api/_lib/github-app.ts`) so a burst of git operations
+     * at container boot doesn't fire N redundant mints. A rejected mint clears
+     * the in-flight slot so the NEXT call retries rather than replaying the
+     * same rejection forever.
+     */
+    getToken(): Promise<string>;
+    private mint;
+    /** Diagnostics-safe snapshot — NEVER includes the token itself. */
+    snapshot(): {
+        hasToken: boolean;
+        expiresAt: string | null;
+        repos: string[];
+    };
+}
+/**
+ * Build an HTTP-backed `InstallationTokenFetcher` against the (not-yet-shipped)
+ * `/api/runner/github-installation-token` endpoint. Mirrors
+ * `secrets/inject.ts`'s `makeHttpSecretFetcher`: the runner authenticates
+ * with its own bearer JWT, the server does the privileged GitHub App
+ * JWT-sign + installation-token exchange (`api/_lib/github-app.ts`), and only
+ * the resulting short-lived, repo-scoped token crosses the wire back.
+ */
+export declare function makeHttpInstallationTokenFetcher(opts: {
+    publicUrl: string;
+    jwt: string;
+    fetchImpl?: typeof fetch;
+}): InstallationTokenFetcher;
+//# sourceMappingURL=installation-token.d.ts.map

package/dist/git-auth/installation-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-token.d.ts","sourceRoot":"","sources":["../../src/git-auth/installation-token.ts"],"names":[],"mappings":"AAqCA,kFAAkF;AAClF,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,wGAAwG;AACxG,MAAM,MAAM,wBAAwB,GAAG,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEtC;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAEf,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;CAUnD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAItF;AAKD,MAAM,WAAW,gCAAgC;IAC/C;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,wBAAwB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,QAAQ,CAAiD;gBAErD,IAAI,EAAE,gCAAgC;IAclD,mEAAmE;IACnE,WAAW,IAAI,MAAM,EAAE;IAIvB,yEAAyE;IACzE,OAAO,CAAC,KAAK;IAKb;;;;;;;OAOG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAWnB,IAAI;IASlB,mEAAmE;IACnE,QAAQ,IAAI;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE;CAO7E;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,wBAAwB,CA4C3B"}

package/dist/git-auth/installation-token.js

@@ -0,0 +1,192 @@
+/**
+ * NS-RUN-3: per-container GitHub App installation tokens.
+ *
+ * Headless/container runners have historically shared one long-lived GH_TOKEN
+ * PAT across every node in the fleet (see docs/acc/RUNNER_AUTOSCALE.md §2,
+ * `ACC_AUTOSCALE_RUNNER_ENV_JSON`) — a single credential whose blast radius is
+ * the whole fleet's repo access, that never expires until an operator rotates
+ * it by hand, and that cannot be scoped tighter than whatever repos the PAT
+ * itself carries.
+ *
+ * This module is the RUNNER-SIDE client for replacing that PAT with
+ * short-lived (~1h) GitHub App installation tokens, scoped to only the
+ * repo(s) a given container is configured to serve. The privileged half of
+ * the mint — signing a JWT with the GitHub App's private key and exchanging
+ * it for an installation access token — already exists server-side in
+ * `api/_lib/github-app.ts` (`getInstallationTokenForRepo`); this module never
+ * holds that private key, only the short-lived bearer it fetches over HTTPS
+ * using the runner's OWN control-plane JWT — the same "runner authenticates,
+ * server does the privileged work" shape `secrets/inject.ts`'s
+ * `{{secret:NAME}}` broker already uses for tool-call secrets.
+ *
+ * Scope enforcement is defense-in-depth on BOTH sides: the request always
+ * names the exact repos this runner serves (never "all installs"), and this
+ * client additionally REFUSES to use a minted token whose granted repos
+ * exceed what it asked for (`InstallationTokenScopeError`) — a
+ * misconfigured or compromised server response cannot hand this container a
+ * broader credential than it was provisioned for.
+ *
+ * Wiring note (tracked as a follow-up, out of this module's file scope): the
+ * HTTP endpoint this fetcher targets (`/api/runner/github-installation-token`)
+ * does not exist yet, and neither `packages/acc-runner/docker/entrypoint.sh`
+ * nor `api/scheduled/runner-autoscale.ts` have been pointed at this provider
+ * in place of a shared `GH_TOKEN`. This module is the tested client primitive
+ * that follow-up work wires in.
+ */
+import { maskGitCredentials } from "./probe.js";
+/**
+ * Thrown when a mint hands back a token scoped to repos beyond what the
+ * runner requested. This is the client-side half of "token scope limited to
+ * the repos the runner serves" (AC3): even a server that returns an
+ * over-broad grant cannot make this runner USE the excess scope, because the
+ * provider refuses the token outright rather than caching/serving it.
+ */
+export class InstallationTokenScopeError extends Error {
+    requested;
+    granted;
+    constructor(requested, granted) {
+        super(`installation token scope exceeds request: requested [${requested.join(", ")}], granted [${granted.join(", ")}]`);
+        this.name = "InstallationTokenScopeError";
+        this.requested = requested;
+        this.granted = granted;
+    }
+}
+function normaliseRepo(repo) {
+    return repo.trim().toLowerCase();
+}
+/**
+ * True when `granted` is a NON-EMPTY set and every entry is present in
+ * `requested` (case-insensitive).
+ *
+ * AC5: an empty grant is NOT treated as in-scope. A mint that hands back zero
+ * repos proves nothing about what it actually scoped the token to — vacuously
+ * satisfying a subset check would let a malformed or field-less response
+ * through as if it were a valid (if narrow) grant. Fail closed instead: no
+ * verifiable scope means the token is rejected, same as an over-broad one.
+ */
+export function isWithinRequestedScope(requested, granted) {
+    if (granted.length === 0)
+        return false;
+    const allowed = new Set(requested.map(normaliseRepo));
+    return granted.every((r) => allowed.has(normaliseRepo(r)));
+}
+/** Default refresh margin: mint a new token once the cached one is this close to expiry. Mirrors api/_lib/github-app.ts's server-side cache. */
+const DEFAULT_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+/**
+ * Runner-side cache/refresh for a single installation token, scoped to the
+ * repo(s) this container serves. In-memory only — like `EnvTokenProvider`
+ * (token-provider.ts), an ephemeral container must never write a credential
+ * to its writable layer.
+ */
+export class InstallationTokenProvider {
+    repos;
+    fetcher;
+    runnerId;
+    refreshMarginMs;
+    cached = null;
+    inflight = null;
+    constructor(opts) {
+        const repos = (opts.repos ?? []).map((r) => r.trim()).filter(Boolean);
+        if (repos.length === 0) {
+            throw new Error("InstallationTokenProvider requires at least one repo — a container must be " +
+                "scoped to the repo(s) it serves, never minted a token for every install");
+        }
+        this.repos = repos;
+        this.fetcher = opts.fetcher;
+        this.runnerId = opts.runnerId;
+        this.refreshMarginMs = Math.max(0, opts.refreshMarginMs ?? DEFAULT_REFRESH_MARGIN_MS);
+    }
+    /** Repos this provider is configured to serve (defensive copy). */
+    reposServed() {
+        return [...this.repos];
+    }
+    /** True when the cached token is still fresh past the refresh margin. */
+    fresh() {
+        if (!this.cached)
+            return false;
+        return new Date(this.cached.expiresAt).getTime() - Date.now() > this.refreshMarginMs;
+    }
+    /**
+     * Return a valid installation token, minting or refreshing as needed.
+     * Concurrent callers share one in-flight mint (mirrors the server-side
+     * single-flight in `api/_lib/github-app.ts`) so a burst of git operations
+     * at container boot doesn't fire N redundant mints. A rejected mint clears
+     * the in-flight slot so the NEXT call retries rather than replaying the
+     * same rejection forever.
+     */
+    async getToken() {
+        if (this.fresh())
+            return this.cached.token;
+        if (this.inflight)
+            return (await this.inflight).token;
+        const mint = this.mint().finally(() => {
+            this.inflight = null;
+        });
+        this.inflight = mint;
+        return (await mint).token;
+    }
+    async mint() {
+        const result = await this.fetcher(this.repos, this.runnerId);
+        if (!isWithinRequestedScope(this.repos, result.repos)) {
+            throw new InstallationTokenScopeError(this.repos, result.repos);
+        }
+        this.cached = result;
+        return result;
+    }
+    /** Diagnostics-safe snapshot — NEVER includes the token itself. */
+    snapshot() {
+        return {
+            hasToken: this.cached !== null,
+            expiresAt: this.cached?.expiresAt ?? null,
+            repos: this.repos,
+        };
+    }
+}
+/**
+ * Build an HTTP-backed `InstallationTokenFetcher` against the (not-yet-shipped)
+ * `/api/runner/github-installation-token` endpoint. Mirrors
+ * `secrets/inject.ts`'s `makeHttpSecretFetcher`: the runner authenticates
+ * with its own bearer JWT, the server does the privileged GitHub App
+ * JWT-sign + installation-token exchange (`api/_lib/github-app.ts`), and only
+ * the resulting short-lived, repo-scoped token crosses the wire back.
+ */
+export function makeHttpInstallationTokenFetcher(opts) {
+    const f = opts.fetchImpl ?? fetch;
+    const endpoint = `${opts.publicUrl.replace(/\/$/, "")}/api/runner/github-installation-token`;
+    return async (repos, runnerId) => {
+        const res = await f(endpoint, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${opts.jwt}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ repos, runner_id: runnerId }),
+        });
+        if (!res.ok) {
+            // Masked defensively: the endpoint contract is that the body never
+            // carries token material, but a broken/aliased endpoint could echo
+            // request state back — never trust an error body unmasked.
+            const text = await res.text().catch(() => "");
+            throw new Error(`github-installation-token HTTP ${res.status}: ${maskGitCredentials(text || res.statusText)}`);
+        }
+        const data = (await res.json());
+        if (typeof data.token !== "string" || typeof data.expires_at !== "string") {
+            throw new Error("github-installation-token response missing token/expires_at");
+        }
+        // AC5: a field-less or empty `repos` is rejected here, not silently
+        // trusted back to whatever we asked for — an over-broad or malformed
+        // server response must never be papered over by re-stating the request
+        // as if it were the grant. isWithinRequestedScope() in the caller
+        // additionally refuses an empty grant, so this is defense-in-depth: the
+        // fetcher itself never fabricates a scope the server didn't state.
+        if (!Array.isArray(data.repos) || data.repos.length === 0) {
+            throw new Error("github-installation-token response missing/empty repos (no fallback to the requested repos)");
+        }
+        const grantedRepos = data.repos.filter((r) => typeof r === "string");
+        if (grantedRepos.length !== data.repos.length) {
+            throw new Error("github-installation-token response repos contains a non-string entry");
+        }
+        return { token: data.token, expiresAt: data.expires_at, repos: grantedRepos };
+    };
+}
+//# sourceMappingURL=installation-token.js.map

package/dist/git-auth/installation-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-token.js","sourceRoot":"","sources":["../../src/git-auth/installation-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiBhD;;;;;;GAMG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,SAAS,CAAW;IACpB,OAAO,CAAW;IAE3B,YAAY,SAAmB,EAAE,OAAiB;QAChD,KAAK,CACH,wDAAwD,SAAS,CAAC,IAAI,CACpE,IAAI,CACL,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAmB,EAAE,OAAiB;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,gJAAgJ;AAChJ,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBhD;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,CAAW;IAChB,OAAO,CAA2B;IAClC,QAAQ,CAAS;IACjB,eAAe,CAAS;IACjC,MAAM,GAAmC,IAAI,CAAC;IAC9C,QAAQ,GAA4C,IAAI,CAAC;IAEjE,YAAY,IAAsC;QAChD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAC;IACxF,CAAC;IAED,mEAAmE;IACnE,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,KAAK;QACX,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;IACvF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,QAAQ;QACN,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAIhD;IACC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uCAAuC,CAAC;IAC7F,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,mEAAmE;YACnE,mEAAmE;YACnE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAClF,IAAI,YAAY,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC"}

package/dist/instance.d.ts

@@ -0,0 +1,30 @@
+/**
+ * RUNNER-NAMED-INSTANCES-1: named runner instances. Keychain mode stores ONE
+ * runner session per OS user, and `acc.register_runner` dedups identity on
+ * (bound_user_id, machine) — so a second runner on one Mac silently became a
+ * duplicate of the first (incident 2026-08-27). A name fixes that client-side:
+ * folded into the keychain account, machine string, cache root and singleton
+ * key, the server dedup mints each name its own stable runner id. Unnamed,
+ * every resolver below returns its historic value byte-for-byte (frozen).
+ */
+/** Env var carrying the active name (set by `--instance <name>`). */
+export declare const INSTANCE_ENV = "ACC_RUNNER_INSTANCE";
+/** Keychain account slot for the unnamed instance. FROZEN. */
+export declare const DEFAULT_INSTANCE_ACCOUNT = "default";
+/** Narrow on purpose: the name lands in a path, a keychain account and a
+ * server-side machine string — nothing escapable/quotable is allowed. */
+export declare const INSTANCE_NAME_RE: RegExp;
+export declare function isValidInstanceName(name: string): boolean;
+/** Throws on an invalid name; returns the trimmed name otherwise. */
+export declare function assertInstanceName(name: string): string;
+/** Active name or null. Throws on an invalid env value — a typo must not
+ * fall back to the default slot and re-create the duplicate incident. */
+export declare function resolveInstance(env?: NodeJS.ProcessEnv): string | null;
+/** Publish `--instance <name>` into the env so every resolver (including in
+ * spawned children) agrees. No-op without the flag. */
+export declare function applyInstanceOption(name: string | undefined): string | null;
+/** Keychain account: "default" unnamed, else "instance:<name>". */
+export declare function instanceKeychainAccount(env?: NodeJS.ProcessEnv): string;
+/** Machine-string suffix: "" unnamed, else "#<name>". */
+export declare function instanceMachineSuffix(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=instance.d.ts.map

package/dist/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../src/instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qEAAqE;AACrE,eAAO,MAAM,YAAY,wBAAwB,CAAC;AAElD,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD;yEACyE;AACzE,eAAO,MAAM,gBAAgB,QAA8B,CAAC;AAE5D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;yEACyE;AACzE,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAGnF;AAED;uDACuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,mEAAmE;AACnE,wBAAgB,uBAAuB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAGvE;AAED,yDAAyD;AACzD,wBAAgB,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAGrE"}

package/dist/instance.js

@@ -0,0 +1,51 @@
+/**
+ * RUNNER-NAMED-INSTANCES-1: named runner instances. Keychain mode stores ONE
+ * runner session per OS user, and `acc.register_runner` dedups identity on
+ * (bound_user_id, machine) — so a second runner on one Mac silently became a
+ * duplicate of the first (incident 2026-08-27). A name fixes that client-side:
+ * folded into the keychain account, machine string, cache root and singleton
+ * key, the server dedup mints each name its own stable runner id. Unnamed,
+ * every resolver below returns its historic value byte-for-byte (frozen).
+ */
+/** Env var carrying the active name (set by `--instance <name>`). */
+export const INSTANCE_ENV = "ACC_RUNNER_INSTANCE";
+/** Keychain account slot for the unnamed instance. FROZEN. */
+export const DEFAULT_INSTANCE_ACCOUNT = "default";
+/** Narrow on purpose: the name lands in a path, a keychain account and a
+ * server-side machine string — nothing escapable/quotable is allowed. */
+export const INSTANCE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,31}$/;
+export function isValidInstanceName(name) {
+    return INSTANCE_NAME_RE.test(name);
+}
+/** Throws on an invalid name; returns the trimmed name otherwise. */
+export function assertInstanceName(name) {
+    const n = name.trim();
+    if (isValidInstanceName(n))
+        return n;
+    throw new Error(`Invalid --instance name "${name}": must match ${INSTANCE_NAME_RE.source} ` +
+        "(lowercase letters, digits and dashes, starting alphanumeric, max 32 chars).");
+}
+/** Active name or null. Throws on an invalid env value — a typo must not
+ * fall back to the default slot and re-create the duplicate incident. */
+export function resolveInstance(env = process.env) {
+    const raw = env[INSTANCE_ENV]?.trim();
+    return raw ? assertInstanceName(raw) : null;
+}
+/** Publish `--instance <name>` into the env so every resolver (including in
+ * spawned children) agrees. No-op without the flag. */
+export function applyInstanceOption(name) {
+    if (name !== undefined)
+        process.env[INSTANCE_ENV] = assertInstanceName(name);
+    return resolveInstance();
+}
+/** Keychain account: "default" unnamed, else "instance:<name>". */
+export function instanceKeychainAccount(env) {
+    const name = resolveInstance(env);
+    return name ? `instance:${name}` : DEFAULT_INSTANCE_ACCOUNT;
+}
+/** Machine-string suffix: "" unnamed, else "#<name>". */
+export function instanceMachineSuffix(env) {
+    const name = resolveInstance(env);
+    return name ? `#${name}` : "";
+}
+//# sourceMappingURL=instance.js.map

package/dist/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../src/instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAElD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD;yEACyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,mBAAmB,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACrC,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,iBAAiB,gBAAgB,CAAC,MAAM,GAAG;QACzE,8EAA8E,CACjF,CAAC;AACJ,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC;AAC9D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC"}

package/dist/keychain.d.ts

@@ -1,12 +1,8 @@
-/**
- * OS-keychain wrapper around `keytar`. The CLI never persists a JWT to
- * disk in plaintext — keychain is the only writable surface.
- *
- * keytar is a native module; we lazy-import so commands that don't need
- * credentials (`--version`, `--help`) still work on systems where the
- * binding has not built (`linux` headless CI without libsecret, etc).
- */
 import { type StoredSession } from "./types.js";
+/** RUNNER-NAMED-INSTANCES-1: the session slot — frozen "default" unless a
+ * named instance is active. Resolved per call (not at module load) so login /
+ * watch / logout / doctor can never disagree about it. */
+export declare function sessionAccount(): string;
 type KeytarLike = {
     setPassword(service: string, account: string, password: string): Promise<void>;
     getPassword(service: string, account: string): Promise<string | null>;

package/dist/keychain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAIzE,KAAK,UAAU,GAAG;IAChB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE,CAAC;AAYF,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAUjE;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAGrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWpE;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAEzD"}
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AASA,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzE;;0DAE0D;AAC1D,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,KAAK,UAAU,GAAG;IAChB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE,CAAC;AAYF,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAUjE;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAGrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWpE;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAEzD"}

package/dist/keychain.js

@@ -6,8 +6,14 @@
  * credentials (`--version`, `--help`) still work on systems where the
  * binding has not built (`linux` headless CI without libsecret, etc).
  */
+import { instanceKeychainAccount } from "./instance.js";
 import { RUNNER_KEYCHAIN_SERVICE } from "./types.js";
-const ACCOUNT = "default";
+/** RUNNER-NAMED-INSTANCES-1: the session slot — frozen "default" unless a
+ * named instance is active. Resolved per call (not at module load) so login /
+ * watch / logout / doctor can never disagree about it. */
+export function sessionAccount() {
+    return instanceKeychainAccount();
+}
 let cached = null;
 async function getKeytar() {
     if (cached)
@@ -19,11 +25,11 @@ async function getKeytar() {
 }
 export async function saveSession(session) {
     const k = await getKeytar();
-    await k.setPassword(RUNNER_KEYCHAIN_SERVICE, ACCOUNT, JSON.stringify(session));
+    await k.setPassword(RUNNER_KEYCHAIN_SERVICE, sessionAccount(), JSON.stringify(session));
 }
 export async function loadSession() {
     const k = await getKeytar();
-    const raw = await k.getPassword(RUNNER_KEYCHAIN_SERVICE, ACCOUNT);
+    const raw = await k.getPassword(RUNNER_KEYCHAIN_SERVICE, sessionAccount());
     if (!raw)
         return null;
     try {
@@ -36,7 +42,7 @@ export async function loadSession() {
 }
 export async function clearSession() {
     const k = await getKeytar();
-    return k.deletePassword(RUNNER_KEYCHAIN_SERVICE, ACCOUNT);
+    return k.deletePassword(RUNNER_KEYCHAIN_SERVICE, sessionAccount());
 }
 /**
  * AX-G1: a SECOND entry in the same keychain service, under a different account.

package/dist/keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAsB,MAAM,YAAY,CAAC;AAEzE,MAAM,OAAO,GAAG,SAAkB,CAAC;AAQnC,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAqD,CAAC;IACzF,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAe,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAc;IAC5D,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,qBAAqB;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAsB,MAAM,YAAY,CAAC;AAEzE;;0DAE0D;AAC1D,MAAM,UAAU,cAAc;IAC5B,OAAO,uBAAuB,EAAE,CAAC;AACnC,CAAC;AAQD,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAqD,CAAC;IACzF,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAe,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,cAAc,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,cAAc,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,KAAc;IAC5D,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,qBAAqB;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,cAAc,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/local-repo/command.d.ts

@@ -0,0 +1,28 @@
+import { type LocalRepoProbe } from "./index.js";
+export interface AddLocalRepoOptions {
+    /** Override the repo name (defaults to the directory name). */
+    name?: string;
+    /** Attach the repo to this project slug as part of the registration. */
+    project?: string;
+    /** Test seam. */
+    out?: (line: string) => void;
+}
+/**
+ * Probe a candidate directory. Every question is answered from the filesystem or
+ * a single read-only `git` call, and a failing `git` is an answer ("no origin"),
+ * never an exception — planLocalRepoRegistration decides what is fatal.
+ */
+export declare function probeLocalRepo(rawPath: string, nameOverride?: string | null): LocalRepoProbe;
+export declare function addLocalRepoCommand(repoPath: string, opts?: AddLocalRepoOptions): Promise<void>;
+export interface ListLocalReposOptions {
+    json?: boolean;
+    out?: (line: string) => void;
+}
+/**
+ * What this machine believes it serves locally, and whether the server agrees.
+ * The two can disagree in both directions — a config entry whose grant was
+ * revoked, or a grant registered from another machine — and an operator
+ * debugging "why is my task not running" needs to see which side is missing.
+ */
+export declare function listLocalReposCommand(opts?: ListLocalReposOptions): Promise<void>;
+//# sourceMappingURL=command.d.ts.map

package/dist/local-repo/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/local-repo/command.ts"],"names":[],"mappings":"AAoCA,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAUD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CA0B5F;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAyDf;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CA2Df"}