@wrangled/cli 0.2.0

package/dist/pull.js

@@ -0,0 +1,209 @@
+import { mkdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { api, apiDownload, CliError, exitCodes } from "./api.js";
+import { brand } from "./brand.js";
+import { inRunFolder, writeFileAtomic } from "./files.js";
+/** Kept in the pull folder: whose content it holds, which file each item went to, and where the next pull starts. */
+export const PULL_STATE_FILE = `.${brand.slug}-content.json`;
+export const PULL_MEDIA_DIR = "media";
+const PAGE_SIZE = 200;
+const MAX_STEM = 100;
+// Windows refuses these as a file's name before its first dot, in any case.
+const WINDOWS_RESERVED = /^(con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³])$/i;
+/** A file name safe on macOS, Linux and Windows: no reserved characters or names, no trailing dot or space, at most `max` characters. */
+export function safeFileName(text, max = MAX_STEM) {
+    const cleaned = text
+        .normalize("NFC")
+        .replace(/[<>:"/\\|?*\u0000-\u001f\u007f\s]+/g, "-")
+        .replace(/-{2,}/g, "-");
+    const trimmed = Array.from(cleaned.replace(/^[-. ]+/, ""))
+        .slice(0, max)
+        .join("")
+        .replace(/[-. ]+$/, "");
+    const name = trimmed || "item";
+    return WINDOWS_RESERVED.test(name.split(".")[0]) ? `_${name}` : name;
+}
+/**
+ * Gives each item its file, relative to the pull folder, recording it in `files`: <kind>/<SKU or natural key>.md. Once
+ * given, an item keeps its path. A name another item already has (compared without case, as macOS and Windows do)
+ * gets the item's id added.
+ */
+export function pathAssigner(files) {
+    const taken = new Set(Object.values(files).map((path) => path.toLowerCase()));
+    return (item) => {
+        const known = files[item.id];
+        if (known)
+            return known;
+        const dir = safeFileName(item.kind);
+        const plain = `${dir}/${safeFileName(item.sku ?? item.naturalKey)}.md`;
+        const path = taken.has(plain.toLowerCase()) ? `${dir}/${safeFileName(item.sku ?? item.naturalKey, MAX_STEM - 37)}-${item.id}.md` : plain;
+        files[item.id] = path;
+        taken.add(path.toLowerCase());
+        return path;
+    };
+}
+/** JSON with every object's keys sorted, so the same value always prints the same. */
+function sortedJson(value) {
+    const sort = (v) => Array.isArray(v)
+        ? v.map(sort)
+        : v !== null && typeof v === "object"
+            ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sort(v[k])]))
+            : v;
+    return JSON.stringify(sort(value), null, 2);
+}
+function yamlLines(key, value, indent) {
+    const scalar = (v) => (typeof v === "string" ? JSON.stringify(v) : String(v));
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return [`${indent}${key}: []`];
+        return [
+            `${indent}${key}:`,
+            ...value.flatMap((entry) => {
+                if (entry === null || typeof entry !== "object" || Array.isArray(entry))
+                    return [`${indent}  - ${scalar(entry)}`];
+                const lines = Object.entries(entry).flatMap(([k, v]) => yamlLines(k, v, `${indent}    `));
+                return [`${indent}  - ${lines[0].trimStart()}`, ...lines.slice(1)];
+            }),
+        ];
+    }
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value);
+        if (entries.length === 0)
+            return [`${indent}${key}: {}`];
+        return [`${indent}${key}:`, ...entries.flatMap(([k, v]) => yamlLines(k, v, `${indent}  `))];
+    }
+    return [`${indent}${key}: ${scalar(value)}`];
+}
+/**
+ * An item as a Markdown file: YAML front matter with what it is, its numbers and where its files are, then its words.
+ * Only what the item holds goes in, so the file changes only when the item does.
+ */
+export function renderItem(item) {
+    const front = {
+        id: item.id,
+        sku: item.sku,
+        natural_key: item.naturalKey,
+        kind: item.kind,
+        platform: item.platform,
+        origin: item.origin,
+        name: item.name,
+        status: item.status,
+        platform_status: item.platformStatus,
+        version: item.version,
+        captured_at: item.capturedAt,
+        removed_at: item.removedAt,
+        links: item.links.map((l) => ({ platform: l.platform, object_type: l.objectType, external_id: l.externalId })),
+        html: item.htmlPath,
+        media: item.media.map((m) => ({ path: m.path, role: m.role, content_type: m.contentType, bytes: m.bytes, sha256: m.sha256 })),
+        scorecards: [...item.scorecards]
+            .sort((a, b) => byText(a.currency ?? "", b.currency ?? ""))
+            .map((s) => ({ currency: s.currency, numbers: Object.fromEntries(Object.entries(s.numbers).sort(([a], [b]) => byText(a, b))) })),
+    };
+    const sections = [
+        ["Subject", item.subject],
+        ["Preview text", item.previewText],
+        ["Headline", item.headline],
+        ["Body", item.body || null],
+        ["Fields", Object.keys(item.fields).length === 0 ? null : `\`\`\`json\n${sortedJson(item.fields)}\n\`\`\``],
+        ...item.transcripts.map((t) => [`Transcript (file ${t.mediaPosition})`, t.text]),
+    ];
+    const body = sections.flatMap(([title, text]) => (text === null ? [] : [`## ${title}\n\n${text.trimEnd()}\n`]));
+    return ["---", ...Object.entries(front).flatMap(([k, v]) => yamlLines(k, v, "")), "---", "", ...body.join("\n").split("\n")].join("\n").trimEnd() + "\n";
+}
+const byText = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+async function readState(path) {
+    const text = await readText(path);
+    if (text === null)
+        return null;
+    try {
+        const state = JSON.parse(text);
+        return typeof state.apiOrigin === "string" && typeof state.workspaceId === "string" && typeof state.files === "object" && state.files !== null
+            ? { ...state, last: state.last ?? null }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readText(path) {
+    return readFile(path, "utf8").catch((error) => {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    });
+}
+const exists = (path) => stat(path).then(() => true, (error) => {
+    if (error.code === "ENOENT")
+        return false;
+    throw error;
+});
+const sameFilters = (a, b) => a.kind === b.kind && a.platform === b.platform && a.origin === b.origin;
+/**
+ * Copies the content library into `dir`, one Markdown file per item, fetching only what changed since the last pull
+ * into the same folder with the same filters (or everything, with `full`, or when `media` is asked for and the last
+ * pull saved none). A file is written only when its text changes. With `media`, each item's files and HTML are saved
+ * under media/ by their storage name, once. A folder holding another workspace's content is refused.
+ */
+export async function pullContent(connection, dir, filters, options) {
+    await inRunFolder(dir);
+    await mkdir(dir, { recursive: true });
+    const statePath = join(dir, PULL_STATE_FILE);
+    const state = await readState(statePath);
+    const apiOrigin = new URL(connection.apiUrl).origin;
+    const { workspace } = await api(connection, "/api/v1/me");
+    if (state && (state.apiOrigin !== apiOrigin || state.workspaceId !== workspace.id)) {
+        throw new CliError(`${dir} holds content pulled from another workspace (${state.workspaceId} at ${state.apiOrigin}), not ${workspace.slug} (${workspace.id} at ${apiOrigin}). Pull into another folder.`, exitCodes.error);
+    }
+    const last = options.full ? null : state?.last;
+    const changedSince = last && sameFilters(last.filters, filters) && (last.media || !options.media) ? last.watermark : undefined;
+    const files = { ...state?.files };
+    const assignPath = pathAssigner(files);
+    const saveState = (next) => writeFileAtomic(statePath, `${JSON.stringify({ apiOrigin, workspaceId: workspace.id, files, last: next }, null, 2)}\n`, 0o644);
+    const report = { dir, items: 0, written: [], unchanged: 0, removed: 0, media: 0, watermark: "" };
+    let cursor = null;
+    do {
+        const query = new URLSearchParams(Object.entries({ ...filters, changedSince, cursor: cursor ?? undefined, limit: String(PAGE_SIZE) }).filter((e) => e[1] !== undefined));
+        const page = await api(connection, `/api/v1/content/all?${query}`);
+        for (const item of page.items) {
+            const relative = assignPath(item);
+            const path = join(dir, relative);
+            const text = renderItem(item);
+            report.items++;
+            if (item.removedAt)
+                report.removed++;
+            if ((await readText(path)) === text)
+                report.unchanged++;
+            else {
+                await mkdir(join(dir, relative, ".."), { recursive: true });
+                await writeFileAtomic(path, text, 0o644);
+                report.written.push(relative);
+            }
+            if (options.media)
+                report.media += await saveMedia(connection, dir, item);
+        }
+        report.watermark = page.watermark;
+        cursor = page.nextCursor;
+        if (cursor)
+            await saveState(state?.last ?? null);
+    } while (cursor);
+    await saveState({ watermark: report.watermark, filters, media: options.media });
+    return report;
+}
+/** Where --media saves a stored file, relative to the pull folder: media/ and its storage path after the workspace id. */
+export function mediaPath(assetPath) {
+    return [PULL_MEDIA_DIR, ...assetPath.split("/").slice(1).map((segment) => safeFileName(segment, 200))].join("/");
+}
+async function saveMedia(connection, dir, item) {
+    let saved = 0;
+    for (const assetPath of [...(item.htmlPath ? [item.htmlPath] : []), ...item.media.map((m) => m.path)]) {
+        const segments = assetPath.split("/");
+        const target = join(dir, mediaPath(assetPath));
+        if (await exists(target))
+            continue;
+        const { bytes } = await apiDownload(connection, `/api/v1/assets/${segments.map(encodeURIComponent).join("/")}`);
+        await mkdir(join(target, ".."), { recursive: true });
+        await writeFileAtomic(target, bytes, 0o644);
+        saved++;
+    }
+    return saved;
+}

package/dist/runner/claim.js

@@ -0,0 +1,42 @@
+import { CliError, exitCodes } from "../api.js";
+import { SKILL_NAME_PATTERN } from "../skill-zip.js";
+export const harnessNames = ["claude", "codex"];
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The claim response as the runner uses it. Never echoes the body: it holds the run key. */
+export function parseClaim(body) {
+    const bad = (field) => new CliError(`The server's claim has no valid ${field}.`, exitCodes.error);
+    if (!isObject(body))
+        throw bad("body");
+    const { run, skill, caps } = body;
+    if (!isObject(run) || typeof run.id !== "string")
+        throw bad("run.id");
+    if (typeof body.runKey !== "string" || body.runKey.length === 0)
+        throw bad("runKey");
+    if (!isObject(skill) || typeof skill.name !== "string" || !SKILL_NAME_PATTERN.test(skill.name) || typeof skill.version !== "number" || typeof skill.sha256 !== "string" || typeof skill.url !== "string") {
+        throw bad("skill");
+    }
+    if (!harnessNames.includes(body.harness))
+        throw bad("harness");
+    if (typeof body.model !== "string" || body.model.length === 0)
+        throw bad("model");
+    if (typeof body.prompt !== "string")
+        throw bad("prompt");
+    if (!isObject(caps) || typeof caps.aiCents !== "number" || caps.aiCents < 0)
+        throw bad("caps.aiCents");
+    const deadline = typeof body.deadline === "string" ? new Date(body.deadline) : new Date(Number.NaN);
+    if (Number.isNaN(deadline.getTime()))
+        throw bad("deadline");
+    if (body.openRouterKey !== undefined && (typeof body.openRouterKey !== "string" || body.openRouterKey.length === 0))
+        throw bad("openRouterKey");
+    return {
+        runId: run.id,
+        runKey: body.runKey,
+        skill: { name: skill.name, version: skill.version, sha256: skill.sha256, url: skill.url },
+        harness: body.harness,
+        model: body.model,
+        prompt: body.prompt,
+        aiCapUsd: caps.aiCents / 100,
+        deadline,
+        billing: typeof body.openRouterKey === "string" ? { kind: "openrouter", key: body.openRouterKey } : { kind: "subscription" },
+    };
+}

package/dist/runner/claude.js

@@ -0,0 +1,87 @@
+import { brand } from "../brand.js";
+import { harnessModel } from "./harness.js";
+const OPENROUTER_ANTHROPIC_URL = "https://openrouter.ai/api";
+/** File tools work inside the run folder only; the home folder (logins, keys) is off limits even if a path escapes. */
+const FILE_TOOLS = ["Read(./**)", "Edit(./**)", "Write(./**)", "Glob", "Grep"];
+const DENIED_FILES = ["Read(~/**)", "Edit(~/**)", "Write(~/**)"];
+/**
+ * The Agent SDK options for a run. Only the run folder's settings load, only the run's skill is on, and the only shell
+ * commands allowed are the CLI's. When OpenRouter pays, every model variable points at the worker's model, so no
+ * background task runs on a cheaper one.
+ */
+export function claudeOptions(ctx) {
+    const model = harnessModel("claude", ctx.model, ctx.billing);
+    const gateway = ctx.billing.kind === "openrouter"
+        ? {
+            ANTHROPIC_BASE_URL: OPENROUTER_ANTHROPIC_URL,
+            ANTHROPIC_AUTH_TOKEN: ctx.billing.key,
+            ANTHROPIC_API_KEY: "",
+            ANTHROPIC_DEFAULT_SONNET_MODEL: model,
+            ANTHROPIC_DEFAULT_OPUS_MODEL: model,
+            ANTHROPIC_DEFAULT_HAIKU_MODEL: model,
+            ANTHROPIC_SMALL_FAST_MODEL: model,
+            CLAUDE_CODE_SUBAGENT_MODEL: model,
+        }
+        : {};
+    return {
+        cwd: ctx.dir,
+        settingSources: ["project"],
+        skills: [ctx.skill],
+        permissionMode: "dontAsk",
+        allowedTools: [...FILE_TOOLS, `Bash(${brand.slug} *)`],
+        disallowedTools: DENIED_FILES,
+        maxTurns: ctx.maxTurns,
+        maxBudgetUsd: ctx.aiCapUsd,
+        model,
+        persistSession: false,
+        env: { ...ctx.env, CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1", ...gateway },
+    };
+}
+/** Token counts across every model the run used, and the SDK's cost estimate. */
+export function claudeTokens(result) {
+    const tokens = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, costUsd: result.total_cost_usd };
+    for (const usage of Object.values(result.modelUsage)) {
+        tokens.input += usage.inputTokens;
+        tokens.output += usage.outputTokens;
+        tokens.cacheRead += usage.cacheReadInputTokens;
+        tokens.cacheWrite += usage.cacheCreationInputTokens;
+    }
+    return tokens;
+}
+export const claudeHarness = async (ctx) => {
+    // Loaded only here, so starting the CLI never loads the SDK.
+    const { query } = await import("@anthropic-ai/claude-agent-sdk");
+    const abortController = new AbortController();
+    const abort = () => abortController.abort();
+    if (ctx.signal.aborted)
+        abort();
+    ctx.signal.addEventListener("abort", abort, { once: true });
+    let result;
+    try {
+        const messages = query({ prompt: ctx.prompt, options: { ...claudeOptions(ctx), abortController, stderr: ctx.log } });
+        for await (const message of messages) {
+            logMessage(message, ctx.log);
+            if (message.type === "result")
+                result = message;
+        }
+    }
+    finally {
+        ctx.signal.removeEventListener("abort", abort);
+    }
+    if (!result)
+        return { exitCode: 1 };
+    return { exitCode: result.subtype === "success" && !result.is_error ? 0 : 1, tokens: claudeTokens(result) };
+};
+function logMessage(message, log) {
+    if (message.type === "assistant") {
+        for (const block of message.message.content) {
+            if (block.type === "text")
+                log(`${block.text}\n`);
+            else if (block.type === "tool_use")
+                log(`[${block.name}] ${JSON.stringify(block.input)}\n`);
+        }
+    }
+    else if (message.type === "result") {
+        log(`[result ${message.subtype}] ${message.subtype === "success" ? message.result : message.errors.join("; ")}\n`);
+    }
+}

package/dist/runner/codex.js

@@ -0,0 +1,167 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { copyFile, lstat, mkdir, rename, symlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { CliError, exitCodes } from "../api.js";
+import { harnessModel, runProcess } from "./harness.js";
+const OPENROUTER_URL = "https://openrouter.ai/api/v1";
+export const OPENROUTER_KEY_ENV = "OPENROUTER_API_KEY";
+export const PERMISSION_PROFILE = "run";
+/**
+ * The oldest Codex the run config was checked against: its permission profile, `--strict-config` and the feature
+ * names below. An older Codex may read the config differently, so the runner refuses it.
+ */
+export const MIN_CODEX_VERSION = "0.155.0";
+/** Codex tools a run never needs; with these off, `codex exec` offers only its shell and an ask-the-user tool. */
+const FEATURES_OFF = [
+    "view_image",
+    "multi_agent",
+    "goals",
+    "apps",
+    "plugins",
+    "remote_plugin",
+    "browser_use",
+    "browser_use_external",
+    "computer_use",
+    "image_generation",
+    "memories",
+    "in_app_browser",
+    "skill_mcp_dependency_install",
+    "tool_suggest",
+    "hooks",
+];
+const tomlString = (value) => JSON.stringify(value);
+/**
+ * The run's own config.toml. Commands Codex runs may write only in the run folder and read only that, the system's
+ * basics and `readableRoots`, and never `unreadable`, even inside the run folder; the codex process itself still reads
+ * its login. The network stays on, which the CLI's
+ * calls need. Nothing ever waits for an approval. No `sandbox_mode`: it would override the permission profile.
+ */
+export function codexConfig({ model, billing, readableRoots, unreadable, }) {
+    const lines = [
+        `model = ${tomlString(harnessModel("codex", model, billing))}`,
+        `approval_policy = "never"`,
+        `web_search = "disabled"`,
+        `default_permissions = ${tomlString(PERMISSION_PROFILE)}`,
+    ];
+    if (billing.kind === "openrouter")
+        lines.push(`model_provider = "openrouter"`);
+    lines.push("", `[permissions.${PERMISSION_PROFILE}.filesystem]`, `":minimal" = "read"`, `":workspace_roots" = "write"`, ...readableRoots.map((root) => `${tomlString(root)} = "read"`), ...unreadable.map((path) => `${tomlString(path)} = "deny"`), "", `[permissions.${PERMISSION_PROFILE}.network]`, "enabled = true", "", "[features]", ...FEATURES_OFF.map((feature) => `${feature} = false`), "", "[shell_environment_policy]", `exclude = [${tomlString(OPENROUTER_KEY_ENV)}]`);
+    if (billing.kind === "openrouter") {
+        lines.push("", "[model_providers.openrouter]", `name = "OpenRouter"`, `base_url = ${tomlString(OPENROUTER_URL)}`, `env_key = ${tomlString(OPENROUTER_KEY_ENV)}`, `wire_api = "responses"`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * What a run's commands may read besides the run folder and the system's basics: this Node's install, this CLI's
+ * package and every `node_modules` above it that Node would load its dependencies from (the run's `wr` needs all of
+ * them), and on macOS the certificates Node loads. Only those that exist.
+ */
+export function readableRoots() {
+    const cliRoot = fileURLToPath(new URL("../../", import.meta.url)).replace(/\/$/, "");
+    const roots = [dirname(dirname(process.execPath)), cliRoot];
+    for (let dir = dirname(cliRoot); dir !== dirname(dir); dir = dirname(dir))
+        roots.push(join(dir, "node_modules"));
+    if (process.platform === "darwin")
+        roots.push("/System/Library/OpenSSL");
+    return [...new Set(roots)].filter((root) => existsSync(root));
+}
+/** Why `codex --version` output is not good enough to run, or undefined when it is. */
+export function codexVersionProblem(versionOutput) {
+    const found = /codex-cli (\d+)\.(\d+)\.(\d+)/.exec(versionOutput);
+    const minimum = MIN_CODEX_VERSION.split(".").map(Number);
+    const update = "Update it with `codex update` or `npm i -g @openai/codex`.";
+    if (!found)
+        return `Could not read the Codex version from \`codex --version\` (${versionOutput.trim()}); the runner needs ${MIN_CODEX_VERSION} or later. ${update}`;
+    const version = found.slice(1).map(Number);
+    const older = version.findIndex((part, i) => part !== minimum[i]);
+    if (older === -1 || version[older] > minimum[older])
+        return undefined;
+    return `Codex ${version.join(".")} is older than ${MIN_CODEX_VERSION}, the oldest the runner's sandbox rules were checked against. ${update}`;
+}
+/** Sums the token counts of every `usage` object in `codex exec --json` output lines. */
+export function codexTokens(lines) {
+    const names = {
+        input_tokens: "input",
+        cached_input_tokens: "cachedInput",
+        output_tokens: "output",
+        reasoning_output_tokens: "reasoningOutput",
+    };
+    const tokens = {};
+    for (const line of lines) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        for (const [field, value] of Object.entries(event?.usage ?? {})) {
+            const name = names[field];
+            if (name && typeof value === "number" && value >= 0)
+                tokens[name] = (tokens[name] ?? 0) + value;
+        }
+    }
+    return Object.keys(tokens).length > 0 ? tokens : undefined;
+}
+/** The runner's own Codex home, where its ChatGPT login lives. */
+const ownCodexHome = () => process.env.CODEX_HOME || join(homedir(), ".codex");
+export const codexHarness = async (ctx) => {
+    const { stdout } = await promisify(execFile)("codex", ["--version"], { env: ctx.env }).catch((error) => {
+        if (error.code === "ENOENT")
+            throw new CliError("Codex is not installed on this machine: no `codex` on PATH. Install it with `npm i -g @openai/codex`.", exitCodes.error);
+        throw error;
+    });
+    const versionProblem = codexVersionProblem(stdout);
+    if (versionProblem)
+        throw new CliError(versionProblem, exitCodes.error);
+    const codexHome = join(ctx.dir, ".codex");
+    await mkdir(codexHome, { recursive: true });
+    const runAuth = join(codexHome, "auth.json");
+    // Denied by path, so a refreshed login Codex writes there as a real file is as unreadable as the link.
+    await writeFile(join(codexHome, "config.toml"), codexConfig({ ...ctx, readableRoots: readableRoots(), unreadable: [runAuth] }), { mode: 0o600 });
+    // The user's own temp folder is outside what commands may read, so the run gets one inside its folder.
+    const tmp = join(ctx.dir, ".tmp");
+    await mkdir(tmp);
+    const env = { ...ctx.env, CODEX_HOME: codexHome, TMPDIR: tmp };
+    const ownAuth = join(ownCodexHome(), "auth.json");
+    if (ctx.billing.kind === "openrouter")
+        env[OPENROUTER_KEY_ENV] = ctx.billing.key;
+    else {
+        // A link, so the login and any refresh of it stay in the runner's own Codex home.
+        await lstat(ownAuth).catch(() => {
+            throw new CliError(`Codex is not logged in on this machine: no ${ownAuth}. Run \`codex login\`.`, exitCodes.auth);
+        });
+        await symlink(ownAuth, runAuth);
+    }
+    const lines = [];
+    let partial = "";
+    const exitCode = await runProcess("codex", ["exec", "--json", "--strict-config", "--skip-git-repo-check", "-C", ctx.dir, "-"], {
+        cwd: ctx.dir,
+        env,
+        stdin: ctx.prompt,
+        signal: ctx.signal,
+        log: ctx.log,
+        onStdout(text) {
+            ctx.log(text);
+            const split = (partial + text).split("\n");
+            partial = split.pop();
+            lines.push(...split);
+        },
+    });
+    if (ctx.billing.kind === "subscription")
+        await keepRefreshedLogin(runAuth, ownAuth);
+    return { exitCode, tokens: codexTokens([...lines, partial]) };
+};
+/** If Codex replaced the link with a refreshed login, the refresh goes back to the runner's own home, not away with the run folder. */
+async function keepRefreshedLogin(runAuth, ownAuth) {
+    const info = await lstat(runAuth).catch(() => null);
+    if (!info || info.isSymbolicLink())
+        return;
+    const staged = `${ownAuth}.${process.pid}.tmp`;
+    await copyFile(runAuth, staged);
+    await rename(staged, ownAuth);
+}

package/dist/runner/harness.js

@@ -0,0 +1,65 @@
+import { spawn } from "node:child_process";
+import { constants } from "node:os";
+export const MAX_TURNS = 150;
+const KILL_GRACE_MS = 5_000;
+/**
+ * The id the harness's own login knows the model by. The Claude subscription takes `claude-sonnet-5-5` for
+ * `anthropic/claude-sonnet-5.5`; Codex takes `gpt-5.5` for `openai/gpt-5.5`.
+ */
+export function nativeModel(harness, model) {
+    if (harness === "claude")
+        return model.replace(/^anthropic\//, "").replaceAll(".", "-");
+    return model.replace(/^openai\//, "");
+}
+/** The model id the harness is started with: OpenRouter's own id when OpenRouter pays, else the native one. */
+export function harnessModel(harness, model, billing) {
+    return billing.kind === "openrouter" ? model : nativeModel(harness, model);
+}
+/**
+ * Runs a program in its own process group with `stdin` as its input and stdout and stderr into `log`. On abort the
+ * whole group gets SIGTERM, then SIGKILL; once the program exits, anything it left running in its group is killed too.
+ */
+export function runProcess(command, args, options) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { cwd: options.cwd, env: options.env, detached: true });
+        const killGroup = (signal) => {
+            try {
+                process.kill(-child.pid, signal);
+            }
+            catch {
+                // The group is already gone.
+            }
+        };
+        let killTimer;
+        const onAbort = () => {
+            killGroup("SIGTERM");
+            killTimer = setTimeout(() => killGroup("SIGKILL"), KILL_GRACE_MS);
+        };
+        let exitCode = 1;
+        child.on("error", (error) => {
+            options.signal.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+        child.on("spawn", () => {
+            if (options.signal.aborted)
+                onAbort();
+            else
+                options.signal.addEventListener("abort", onAbort, { once: true });
+        });
+        child.stdout.setEncoding("utf8").on("data", (text) => (options.onStdout ?? options.log)(text));
+        child.stderr.setEncoding("utf8").on("data", options.log);
+        child.stdin.on("error", () => {
+            // A program that never reads its input closes the pipe; that is not a failure of the run.
+        });
+        child.stdin.end(options.stdin);
+        child.on("exit", (code, signal) => {
+            exitCode = code ?? 128 + (signal ? constants.signals[signal] : 0);
+            killGroup("SIGKILL");
+        });
+        child.on("close", () => {
+            clearTimeout(killTimer);
+            options.signal.removeEventListener("abort", onAbort);
+            resolve(exitCode);
+        });
+    });
+}

package/dist/runner/harnesses.js

@@ -0,0 +1,10 @@
+import { claudeHarness } from "./claude.js";
+import { codexHarness } from "./codex.js";
+import { runProcess } from "./harness.js";
+export const harnesses = { claude: claudeHarness, codex: codexHarness };
+/** Runs `command` in place of the coding agent: the prompt on stdin, its output into the log. Tests use it as a fake. */
+export function commandHarness(command) {
+    return async (ctx) => ({
+        exitCode: await runProcess(command, [], { cwd: ctx.dir, env: ctx.env, stdin: ctx.prompt, signal: ctx.signal, log: ctx.log }),
+    });
+}

package/dist/runner/redact.js

@@ -0,0 +1,56 @@
+import { brand } from "../brand.js";
+// Mirrors the server's redactRunOutput (src/lib/workers/runner-protocol.ts), so nothing secret leaves the runner even
+// before the server redacts again. src/lib/cli-consistency.test.ts checks the two agree.
+export const REDACTED = "[redacted]";
+export const LOG_TAIL_MAX_BYTES = 20 * 1024;
+export const RUN_ERROR_MAX_BYTES = 4 * 1024;
+const MIN_SECRET_LENGTH = 8;
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const KEY_LIKE = new RegExp(`(?<![A-Za-z0-9])(?:${[brand.apiKeyPrefix, ...brand.legacyApiKeyPrefixes, brand.runnerTokenPrefix].map(escapeRegExp).join("|")})[A-Za-z0-9_-]{16,}`, "g");
+const SECRET_PARAM = /\b(access_token|token|api_key|apikey|key|secret|signature|sig|password)=[^&\s"']+/gi;
+const BEARER = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+const PROVIDER_KEY = /(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{16,}/g;
+const CREDENTIAL_ASSIGNMENT = /(["']?)([A-Za-z0-9_.-]*(?:key|token|secret|password|passwd|authorization|credential)[A-Za-z0-9_.-]*)\1(\s*[:=]\s*)(["']?)([^\s"'&,;}]{8,})/gi;
+/** Known secrets, credential parameters, key-shaped strings, bearer tokens and credential-named values replaced. */
+export function redact(text, secrets) {
+    let out = text;
+    for (const secret of secrets) {
+        if (secret.length >= MIN_SECRET_LENGTH)
+            out = out.replaceAll(secret, REDACTED);
+    }
+    return out
+        .replace(SECRET_PARAM, `$1=${REDACTED}`)
+        .replace(KEY_LIKE, REDACTED)
+        .replace(PROVIDER_KEY, REDACTED)
+        .replace(BEARER, `$1${REDACTED}`)
+        .replace(CREDENTIAL_ASSIGNMENT, (match, quote, name, separator, valueQuote, value) => /^\d+$/.test(value) ? match : `${quote}${name}${quote}${separator}${valueQuote}${REDACTED}`);
+}
+/** The end of `text` that fits in `maxBytes` of UTF-8, never starting mid-character. */
+export function tailBytes(text, maxBytes) {
+    const bytes = Buffer.from(text, "utf8");
+    if (bytes.length <= maxBytes)
+        return text;
+    let start = bytes.length - maxBytes;
+    while (start < bytes.length && (bytes[start] & 0xc0) === 0x80)
+        start++;
+    return bytes.subarray(start).toString("utf8");
+}
+/**
+ * The last output of a run. It keeps more than it reports, so a secret cut in half at the start of what it keeps is
+ * outside the reported tail, which is redacted as a whole.
+ */
+export class LogTail {
+    maxBytes;
+    #text = "";
+    constructor(maxBytes = LOG_TAIL_MAX_BYTES) {
+        this.maxBytes = maxBytes;
+    }
+    append(chunk) {
+        this.#text += chunk;
+        if (this.#text.length > 4 * this.maxBytes)
+            this.#text = tailBytes(this.#text, 2 * this.maxBytes);
+    }
+    report(secrets) {
+        return tailBytes(redact(this.#text, secrets), this.maxBytes);
+    }
+}