@vm0/runner 2.13.1 → 2.13.2

package/index.js

@@ -43,8 +43,9 @@ var runnerConfigSchema = z.object({
     rootfs: z.string().min(1, "Rootfs path is required")
   }),
   proxy: z.object({
-    port: z.number().int().min(1024).max(65535).default(PROXY_DEFAULTS.port)
-  }).default(PROXY_DEFAULTS)
+    port: z.number().int().min(1024).max(65535).default(PROXY_DEFAULTS.port),
+    ca_dir: z.string().min(1, "Proxy CA directory is required")
+  })
 });
 var DEBUG_SERVER_DEFAULTS = {
   url: "http://localhost:3000",
@@ -69,8 +70,9 @@ var debugConfigSchema = z.object({
     rootfs: z.string().min(1, "Rootfs path is required")
   }),
   proxy: z.object({
-    port: z.number().int().min(1024).max(65535).default(PROXY_DEFAULTS.port)
-  }).default(PROXY_DEFAULTS)
+    port: z.number().int().min(1024).max(65535).default(PROXY_DEFAULTS.port),
+    ca_dir: z.string().default("/tmp/vm0-proxy")
+  }).default({ ...PROXY_DEFAULTS, ca_dir: "/tmp/vm0-proxy" })
 });
 function loadDebugConfig(configPath) {
   if (!fs.existsSync(configPath)) {
@@ -7042,9 +7044,43 @@ var scheduleRunsContract = c12.router({
   }
 });
 
-// ../../packages/core/src/contracts/public/common.ts
+// ../../packages/core/src/contracts/realtime.ts
 import { z as z17 } from "zod";
-var publicApiErrorTypeSchema = z17.enum([
+var c13 = initContract();
+var ablyTokenRequestSchema = z17.object({
+  keyName: z17.string(),
+  ttl: z17.number().optional(),
+  timestamp: z17.number(),
+  capability: z17.string(),
+  clientId: z17.string().optional(),
+  nonce: z17.string(),
+  mac: z17.string()
+});
+var realtimeTokenContract = c13.router({
+  /**
+   * POST /api/realtime/token
+   * Get an Ably token to subscribe to a run's events channel
+   */
+  create: {
+    method: "POST",
+    path: "/api/realtime/token",
+    body: z17.object({
+      runId: z17.string().uuid("runId must be a valid UUID")
+    }),
+    responses: {
+      200: ablyTokenRequestSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get Ably token for run event subscription"
+  }
+});
+
+// ../../packages/core/src/contracts/public/common.ts
+import { z as z18 } from "zod";
+var publicApiErrorTypeSchema = z18.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -7056,55 +7092,55 @@ var publicApiErrorTypeSchema = z17.enum([
   "conflict_error"
   // Resource conflict (409)
 ]);
-var publicApiErrorSchema = z17.object({
-  error: z17.object({
+var publicApiErrorSchema = z18.object({
+  error: z18.object({
     type: publicApiErrorTypeSchema,
-    code: z17.string(),
-    message: z17.string(),
-    param: z17.string().optional(),
-    doc_url: z17.string().url().optional()
+    code: z18.string(),
+    message: z18.string(),
+    param: z18.string().optional(),
+    doc_url: z18.string().url().optional()
   })
 });
-var paginationSchema = z17.object({
-  has_more: z17.boolean(),
-  next_cursor: z17.string().nullable()
+var paginationSchema = z18.object({
+  has_more: z18.boolean(),
+  next_cursor: z18.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z17.object({
-    data: z17.array(dataSchema),
+  return z18.object({
+    data: z18.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z17.object({
-  cursor: z17.string().optional(),
-  limit: z17.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z18.object({
+  cursor: z18.string().optional(),
+  limit: z18.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z17.string().uuid();
-var timestampSchema = z17.string().datetime();
+var requestIdSchema = z18.string().uuid();
+var timestampSchema = z18.string().datetime();
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z18 } from "zod";
-var c13 = initContract();
-var publicAgentSchema = z18.object({
-  id: z18.string(),
-  name: z18.string(),
-  current_version_id: z18.string().nullable(),
+import { z as z19 } from "zod";
+var c14 = initContract();
+var publicAgentSchema = z19.object({
+  id: z19.string(),
+  name: z19.string(),
+  current_version_id: z19.string().nullable(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var agentVersionSchema = z18.object({
-  id: z18.string(),
-  agent_id: z18.string(),
-  version_number: z18.number(),
+var agentVersionSchema = z19.object({
+  id: z19.string(),
+  agent_id: z19.string(),
+  version_number: z19.number(),
   created_at: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z18.string().optional()
+  name: z19.string().optional()
 });
-var publicAgentsListContract = c13.router({
+var publicAgentsListContract = c14.router({
   list: {
     method: "GET",
     path: "/v1/agents",
@@ -7118,12 +7154,12 @@ var publicAgentsListContract = c13.router({
     description: "List all agents in the current scope with pagination. Use the `name` query parameter to filter by agent name."
   }
 });
-var publicAgentByIdContract = c13.router({
+var publicAgentByIdContract = c14.router({
   get: {
     method: "GET",
     path: "/v1/agents/:id",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Agent ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -7135,12 +7171,12 @@ var publicAgentByIdContract = c13.router({
     description: "Get agent details by ID"
   }
 });
-var publicAgentVersionsContract = c13.router({
+var publicAgentVersionsContract = c14.router({
   list: {
     method: "GET",
     path: "/v1/agents/:id/versions",
-    pathParams: z18.object({
-      id: z18.string().min(1, "Agent ID is required")
+    pathParams: z19.object({
+      id: z19.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -7155,9 +7191,9 @@ var publicAgentVersionsContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z19 } from "zod";
-var c14 = initContract();
-var publicRunStatusSchema = z19.enum([
+import { z as z20 } from "zod";
+var c15 = initContract();
+var publicRunStatusSchema = z20.enum([
   "pending",
   "running",
   "completed",
@@ -7165,56 +7201,56 @@ var publicRunStatusSchema = z19.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z19.object({
-  id: z19.string(),
-  agent_id: z19.string(),
-  agent_name: z19.string(),
+var publicRunSchema = z20.object({
+  id: z20.string(),
+  agent_id: z20.string(),
+  agent_name: z20.string(),
   status: publicRunStatusSchema,
-  prompt: z19.string(),
+  prompt: z20.string(),
   created_at: timestampSchema,
   started_at: timestampSchema.nullable(),
   completed_at: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z19.string().nullable(),
-  execution_time_ms: z19.number().nullable(),
-  checkpoint_id: z19.string().nullable(),
-  session_id: z19.string().nullable(),
-  artifact_name: z19.string().nullable(),
-  artifact_version: z19.string().nullable(),
-  volumes: z19.record(z19.string(), z19.string()).optional()
+  error: z20.string().nullable(),
+  execution_time_ms: z20.number().nullable(),
+  checkpoint_id: z20.string().nullable(),
+  session_id: z20.string().nullable(),
+  artifact_name: z20.string().nullable(),
+  artifact_version: z20.string().nullable(),
+  volumes: z20.record(z20.string(), z20.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z19.object({
+var createRunRequestSchema = z20.object({
   // Agent identification (one of: agent, agent_id, session_id, checkpoint_id)
-  agent: z19.string().optional(),
+  agent: z20.string().optional(),
   // Agent name
-  agent_id: z19.string().optional(),
+  agent_id: z20.string().optional(),
   // Agent ID
-  agent_version: z19.string().optional(),
+  agent_version: z20.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  session_id: z19.string().optional(),
+  session_id: z20.string().optional(),
   // Resume from checkpoint
-  checkpoint_id: z19.string().optional(),
+  checkpoint_id: z20.string().optional(),
   // Required
-  prompt: z19.string().min(1, "Prompt is required"),
+  prompt: z20.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z19.record(z19.string(), z19.string()).optional(),
-  secrets: z19.record(z19.string(), z19.string()).optional(),
-  artifact_name: z19.string().optional(),
+  variables: z20.record(z20.string(), z20.string()).optional(),
+  secrets: z20.record(z20.string(), z20.string()).optional(),
+  artifact_name: z20.string().optional(),
   // Artifact name to mount
-  artifact_version: z19.string().optional(),
+  artifact_version: z20.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z19.record(z19.string(), z19.string()).optional()
+  volumes: z20.record(z20.string(), z20.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
-  agent_id: z19.string().optional(),
+  agent_id: z20.string().optional(),
   status: publicRunStatusSchema.optional(),
   since: timestampSchema.optional()
 });
-var publicRunsListContract = c14.router({
+var publicRunsListContract = c15.router({
   list: {
     method: "GET",
     path: "/v1/runs",
@@ -7243,12 +7279,12 @@ var publicRunsListContract = c14.router({
     description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
   }
 });
-var publicRunByIdContract = c14.router({
+var publicRunByIdContract = c15.router({
   get: {
     method: "GET",
     path: "/v1/runs/:id",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Run ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -7260,14 +7296,14 @@ var publicRunByIdContract = c14.router({
     description: "Get run details by ID"
   }
 });
-var publicRunCancelContract = c14.router({
+var publicRunCancelContract = c15.router({
   cancel: {
     method: "POST",
     path: "/v1/runs/:id/cancel",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Run ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Run ID is required")
     }),
-    body: z19.undefined(),
+    body: z20.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -7280,26 +7316,26 @@ var publicRunCancelContract = c14.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z19.object({
+var logEntrySchema = z20.object({
   timestamp: timestampSchema,
-  type: z19.enum(["agent", "system", "network"]),
-  level: z19.enum(["debug", "info", "warn", "error"]),
-  message: z19.string(),
-  metadata: z19.record(z19.string(), z19.unknown()).optional()
+  type: z20.enum(["agent", "system", "network"]),
+  level: z20.enum(["debug", "info", "warn", "error"]),
+  message: z20.string(),
+  metadata: z20.record(z20.string(), z20.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z19.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z20.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z19.enum(["asc", "desc"]).default("asc")
+  order: z20.enum(["asc", "desc"]).default("asc")
 });
-var publicRunLogsContract = c14.router({
+var publicRunLogsContract = c15.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Run ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -7312,29 +7348,29 @@ var publicRunLogsContract = c14.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z19.object({
+var metricPointSchema = z20.object({
   timestamp: timestampSchema,
-  cpu_percent: z19.number(),
-  memory_used_mb: z19.number(),
-  memory_total_mb: z19.number(),
-  disk_used_mb: z19.number(),
-  disk_total_mb: z19.number()
-});
-var metricsSummarySchema = z19.object({
-  avg_cpu_percent: z19.number(),
-  max_memory_used_mb: z19.number(),
-  total_duration_ms: z19.number().nullable()
-});
-var metricsResponseSchema2 = z19.object({
-  data: z19.array(metricPointSchema),
+  cpu_percent: z20.number(),
+  memory_used_mb: z20.number(),
+  memory_total_mb: z20.number(),
+  disk_used_mb: z20.number(),
+  disk_total_mb: z20.number()
+});
+var metricsSummarySchema = z20.object({
+  avg_cpu_percent: z20.number(),
+  max_memory_used_mb: z20.number(),
+  total_duration_ms: z20.number().nullable()
+});
+var metricsResponseSchema2 = z20.object({
+  data: z20.array(metricPointSchema),
   summary: metricsSummarySchema
 });
-var publicRunMetricsContract = c14.router({
+var publicRunMetricsContract = c15.router({
   getMetrics: {
     method: "GET",
     path: "/v1/runs/:id/metrics",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Run ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -7346,7 +7382,7 @@ var publicRunMetricsContract = c14.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z19.enum([
+var sseEventTypeSchema = z20.enum([
   "status",
   // Run status change
   "output",
@@ -7358,25 +7394,25 @@ var sseEventTypeSchema = z19.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z19.object({
+var sseEventSchema = z20.object({
   event: sseEventTypeSchema,
-  data: z19.unknown(),
-  id: z19.string().optional()
+  data: z20.unknown(),
+  id: z20.string().optional()
   // For Last-Event-ID reconnection
 });
-var publicRunEventsContract = c14.router({
+var publicRunEventsContract = c15.router({
   streamEvents: {
     method: "GET",
     path: "/v1/runs/:id/events",
-    pathParams: z19.object({
-      id: z19.string().min(1, "Run ID is required")
+    pathParams: z20.object({
+      id: z20.string().min(1, "Run ID is required")
     }),
-    query: z19.object({
-      last_event_id: z19.string().optional()
+    query: z20.object({
+      last_event_id: z20.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z19.any(),
+      200: z20.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -7388,28 +7424,28 @@ var publicRunEventsContract = c14.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z20 } from "zod";
-var c15 = initContract();
-var publicArtifactSchema = z20.object({
-  id: z20.string(),
-  name: z20.string(),
-  current_version_id: z20.string().nullable(),
-  size: z20.number(),
+import { z as z21 } from "zod";
+var c16 = initContract();
+var publicArtifactSchema = z21.object({
+  id: z21.string(),
+  name: z21.string(),
+  current_version_id: z21.string().nullable(),
+  size: z21.number(),
   // Total size in bytes
-  file_count: z20.number(),
+  file_count: z21.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var artifactVersionSchema = z20.object({
-  id: z20.string(),
+var artifactVersionSchema = z21.object({
+  id: z21.string(),
   // SHA-256 content hash
-  artifact_id: z20.string(),
-  size: z20.number(),
+  artifact_id: z21.string(),
+  size: z21.number(),
   // Size in bytes
-  file_count: z20.number(),
-  message: z20.string().nullable(),
+  file_count: z21.number(),
+  message: z21.string().nullable(),
   // Optional commit message
-  created_by: z20.string(),
+  created_by: z21.string(),
   created_at: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -7419,7 +7455,7 @@ var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchem
 var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
   artifactVersionSchema
 );
-var publicArtifactsListContract = c15.router({
+var publicArtifactsListContract = c16.router({
   list: {
     method: "GET",
     path: "/v1/artifacts",
@@ -7433,12 +7469,12 @@ var publicArtifactsListContract = c15.router({
     description: "List all artifacts in the current scope with pagination"
   }
 });
-var publicArtifactByIdContract = c15.router({
+var publicArtifactByIdContract = c16.router({
   get: {
     method: "GET",
     path: "/v1/artifacts/:id",
-    pathParams: z20.object({
-      id: z20.string().min(1, "Artifact ID is required")
+    pathParams: z21.object({
+      id: z21.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -7450,12 +7486,12 @@ var publicArtifactByIdContract = c15.router({
     description: "Get artifact details by ID"
   }
 });
-var publicArtifactVersionsContract = c15.router({
+var publicArtifactVersionsContract = c16.router({
   list: {
     method: "GET",
     path: "/v1/artifacts/:id/versions",
-    pathParams: z20.object({
-      id: z20.string().min(1, "Artifact ID is required")
+    pathParams: z21.object({
+      id: z21.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -7468,19 +7504,19 @@ var publicArtifactVersionsContract = c15.router({
     description: "List all versions of an artifact with pagination"
   }
 });
-var publicArtifactDownloadContract = c15.router({
+var publicArtifactDownloadContract = c16.router({
   download: {
     method: "GET",
     path: "/v1/artifacts/:id/download",
-    pathParams: z20.object({
-      id: z20.string().min(1, "Artifact ID is required")
+    pathParams: z21.object({
+      id: z21.string().min(1, "Artifact ID is required")
     }),
-    query: z20.object({
-      version_id: z20.string().optional()
+    query: z21.object({
+      version_id: z21.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z20.undefined(),
+      302: z21.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -7492,28 +7528,28 @@ var publicArtifactDownloadContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z21 } from "zod";
-var c16 = initContract();
-var publicVolumeSchema = z21.object({
-  id: z21.string(),
-  name: z21.string(),
-  current_version_id: z21.string().nullable(),
-  size: z21.number(),
+import { z as z22 } from "zod";
+var c17 = initContract();
+var publicVolumeSchema = z22.object({
+  id: z22.string(),
+  name: z22.string(),
+  current_version_id: z22.string().nullable(),
+  size: z22.number(),
   // Total size in bytes
-  file_count: z21.number(),
+  file_count: z22.number(),
   created_at: timestampSchema,
   updated_at: timestampSchema
 });
-var volumeVersionSchema = z21.object({
-  id: z21.string(),
+var volumeVersionSchema = z22.object({
+  id: z22.string(),
   // SHA-256 content hash
-  volume_id: z21.string(),
-  size: z21.number(),
+  volume_id: z22.string(),
+  size: z22.number(),
   // Size in bytes
-  file_count: z21.number(),
-  message: z21.string().nullable(),
+  file_count: z22.number(),
+  message: z22.string().nullable(),
   // Optional commit message
-  created_by: z21.string(),
+  created_by: z22.string(),
   created_at: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -7521,7 +7557,7 @@ var publicVolumeDetailSchema = publicVolumeSchema.extend({
 });
 var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
 var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
-var publicVolumesListContract = c16.router({
+var publicVolumesListContract = c17.router({
   list: {
     method: "GET",
     path: "/v1/volumes",
@@ -7535,12 +7571,12 @@ var publicVolumesListContract = c16.router({
     description: "List all volumes in the current scope with pagination"
   }
 });
-var publicVolumeByIdContract = c16.router({
+var publicVolumeByIdContract = c17.router({
   get: {
     method: "GET",
     path: "/v1/volumes/:id",
-    pathParams: z21.object({
-      id: z21.string().min(1, "Volume ID is required")
+    pathParams: z22.object({
+      id: z22.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -7552,12 +7588,12 @@ var publicVolumeByIdContract = c16.router({
     description: "Get volume details by ID"
   }
 });
-var publicVolumeVersionsContract = c16.router({
+var publicVolumeVersionsContract = c17.router({
   list: {
     method: "GET",
     path: "/v1/volumes/:id/versions",
-    pathParams: z21.object({
-      id: z21.string().min(1, "Volume ID is required")
+    pathParams: z22.object({
+      id: z22.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -7570,19 +7606,19 @@ var publicVolumeVersionsContract = c16.router({
     description: "List all versions of a volume with pagination"
   }
 });
-var publicVolumeDownloadContract = c16.router({
+var publicVolumeDownloadContract = c17.router({
   download: {
     method: "GET",
     path: "/v1/volumes/:id/download",
-    pathParams: z21.object({
-      id: z21.string().min(1, "Volume ID is required")
+    pathParams: z22.object({
+      id: z22.string().min(1, "Volume ID is required")
     }),
-    query: z21.object({
-      version_id: z21.string().optional()
+    query: z22.object({
+      version_id: z22.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z21.undefined(),
+      302: z22.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -8216,10 +8252,8 @@ addons = [tls_clienthello, request, response]
 `;
 
 // src/lib/proxy/proxy-manager.ts
-var DEFAULT_PROXY_CONFIG = {
+var DEFAULT_PROXY_OPTIONS = {
   port: 8080,
-  caDir: "/opt/vm0-runner/proxy",
-  addonPath: "/opt/vm0-runner/proxy/mitm_addon.py",
   registryPath: DEFAULT_REGISTRY_PATH,
   apiUrl: process.env.VM0_API_URL || "https://www.vm0.ai"
 };
@@ -8227,8 +8261,13 @@ var ProxyManager = class {
   config;
   process = null;
   isRunning = false;
-  constructor(config = {}) {
-    this.config = { ...DEFAULT_PROXY_CONFIG, ...config };
+  constructor(config) {
+    const addonPath = path4.join(config.caDir, "mitm_addon.py");
+    this.config = {
+      ...DEFAULT_PROXY_OPTIONS,
+      ...config,
+      addonPath
+    };
   }
   /**
    * Check if mitmproxy is available
@@ -8399,7 +8438,9 @@ var ProxyManager = class {
 var globalProxyManager = null;
 function getProxyManager() {
   if (!globalProxyManager) {
-    globalProxyManager = new ProxyManager();
+    throw new Error(
+      "ProxyManager not initialized. Call initProxyManager() first with caDir."
+    );
   }
   return globalProxyManager;
 }
@@ -8612,7 +8653,6 @@ async function withSandboxTiming(actionType, fn) {
 
 // src/lib/executor-env.ts
 var ENV_JSON_PATH = "/tmp/vm0-env.json";
-var PROXY_CA_CERT_PATH = "/opt/vm0-runner/proxy/mitmproxy-ca-cert.pem";
 function buildEnvironmentVariables(context, apiUrl) {
   const envVars = {
     VM0_API_URL: apiUrl,
@@ -8786,13 +8826,13 @@ async function restoreSessionHistory(ssh, resumeSession, workingDir, cliAgentTyp
     `[Executor] Session history restored (${sessionHistory.split("\n").length} lines)`
   );
 }
-async function installProxyCA(ssh) {
-  if (!fs8.existsSync(PROXY_CA_CERT_PATH)) {
+async function installProxyCA(ssh, caCertPath) {
+  if (!fs8.existsSync(caCertPath)) {
     throw new Error(
-      `Proxy CA certificate not found at ${PROXY_CA_CERT_PATH}. Run generate-proxy-ca.sh first.`
+      `Proxy CA certificate not found at ${caCertPath}. Run generate-proxy-ca.sh first.`
     );
   }
-  const caCert = fs8.readFileSync(PROXY_CA_CERT_PATH, "utf-8");
+  const caCert = fs8.readFileSync(caCertPath, "utf-8");
   console.log(
     `[Executor] Installing proxy CA certificate (${caCert.length} bytes)`
   );
@@ -8913,7 +8953,11 @@ async function executeJob(context, config, options = {}) {
         sealSecretsEnabled
       });
       if (mitmEnabled) {
-        await installProxyCA(ssh);
+        const caCertPath = path5.join(
+          config.proxy.ca_dir,
+          "mitmproxy-ca-cert.pem"
+        );
+        await installProxyCA(ssh, caCertPath);
       }
     }
     log(`[Executor] Configuring DNS...`);
@@ -9179,7 +9223,8 @@ var startCommand = new Command("start").description("Start the runner").option("
     initVMRegistry();
     const proxyManager = initProxyManager({
       apiUrl: config.server.url,
-      port: config.proxy.port
+      port: config.proxy.port,
+      caDir: config.proxy.ca_dir
     });
     let proxyEnabled = false;
     try {
@@ -9904,7 +9949,7 @@ var benchmarkCommand = new Command4("benchmark").description(
 });
 
 // src/index.ts
-var version = true ? "2.13.1" : "0.1.0";
+var version = true ? "2.13.2" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/runner",
-  "version": "2.13.1",
+  "version": "2.13.2",
   "description": "Self-hosted runner for VM0 agents",
   "repository": {
     "type": "git",