doer-agent 0.3.4 → 0.3.6

package/dist/agent.js

@@ -18,6 +18,7 @@ const codexAuthRpcCodec = StringCodec();
 const settingsRpcCodec = StringCodec();
 const gitRpcCodec = StringCodec();
 const skillRpcCodec = StringCodec();
+const runEventsCodec = StringCodec();
 const retainedRuns = new Map();
 const activeSessionWatchers = new Map();
 const sessionLineIndexCache = new Map();
@@ -30,6 +31,9 @@ function sanitizeUserId(userId) {
 function buildAgentRunRpcSubject(userId, agentId) {
     return `doer.agent.run.rpc.${sanitizeUserId(userId)}.${agentId.trim()}`;
 }
+function buildAgentRunEventsSubject(userId, agentId) {
+    return `doer.agent.run.events.${sanitizeUserId(userId)}.${agentId.trim()}`;
+}
 function buildAgentSessionRpcSubject(userId, agentId) {
     return `doer.agent.session.rpc.${sanitizeUserId(userId)}.${agentId.trim()}`;
 }
@@ -514,7 +518,7 @@ async function resolveRunStartLockPath(args) {
     if (typeof args.sessionId === "string" && args.sessionId.trim()) {
         return path.join(dir, `session__${sanitizeRunLockSegment(args.sessionId)}.lock`);
     }
-    return path.join(dir, `run__${sanitizeRunLockSegment(args.runId)}.lock`);
+    return path.join(dir, "pending_new_session.lock");
 }
 async function claimRunStartSlot(args) {
     const lockPath = await resolveRunStartLockPath(args);
@@ -609,7 +613,6 @@ function createDefaultAgentSettingsConfig() {
         codex: {
             model: "gpt-5.4",
             authMode: "api_key",
-            apiKey: null,
         },
         realtime: {
             model: process.env.OPENAI_REALTIME_MODEL?.trim() || "gpt-realtime",
@@ -687,7 +690,6 @@ function normalizeAgentSettingsConfig(value, fallback) {
         codex: {
             model: typeof codex.model === "string" && codex.model.trim() ? codex.model.trim() : base.codex.model,
             authMode: codex.authMode === "oauth" ? "oauth" : codex.authMode === "api_key" ? "api_key" : base.codex.authMode,
-            apiKey: codex.apiKey === null ? null : normalizeNullableString(codex.apiKey) ?? base.codex.apiKey,
         },
         realtime: {
             model: typeof realtime.model === "string" && realtime.model.trim() ? realtime.model.trim() : base.realtime.model,
@@ -768,7 +770,6 @@ function toMaskedSecret(value) {
     return { has: true, masked: maskSecretPreview(value), length: value.length };
 }
 function toAgentSettingsPublic(config) {
-    const codexKey = toMaskedSecret(config.codex.apiKey);
     const realtimeKey = toMaskedSecret(config.realtime.apiKey);
     const gitOauth = toMaskedSecret(config.git.oauthToken);
     const awsSecret = toMaskedSecret(config.aws.secretAccessKey);
@@ -784,9 +785,9 @@ function toAgentSettingsPublic(config) {
         codex: {
             model: config.codex.model,
             authMode: config.codex.authMode,
-            hasApiKey: codexKey.has,
-            apiKeyMasked: codexKey.masked,
-            apiKeyLength: codexKey.length,
+            hasApiKey: false,
+            apiKeyMasked: null,
+            apiKeyLength: null,
         },
         realtime: {
             model: config.realtime.model,
@@ -874,7 +875,6 @@ function normalizeAgentSettingsPatch(value) {
     move("firstTurnPrompt", "general", "firstTurnPrompt");
     move("codexModel", "codex", "model");
     move("codexAuthMode", "codex", "authMode");
-    move("codexApiKey", "codex", "apiKey");
     move("realtimeModel", "realtime", "model");
     move("realtimeVoice", "realtime", "voice");
     move("realtimeWakeName", "realtime", "wakeName");
@@ -915,9 +915,6 @@ async function resolveAgentSettingsConfig(args) {
 }
 function buildAgentSettingsEnvPatch(config) {
     const envPatch = {};
-    if (config.codex.authMode === "api_key" && config.codex.apiKey) {
-        envPatch.OPENAI_API_KEY = config.codex.apiKey;
-    }
     if (config.git.enabled) {
         if (config.git.name)
             envPatch.GIT_AUTHOR_NAME = config.git.name;
@@ -983,34 +980,136 @@ function cloneRunTask(task, _sinceSeq) {
         ...task,
     };
 }
-function extractCodexSessionMetadata(value) {
+function buildImmediateRunChangedEvent(task) {
+    return {
+        type: "run.changed",
+        agentId: task.agentId,
+        sessionId: task.sessionId,
+        filePath: task.sessionFilePath,
+        runId: task.id,
+        updatedAt: task.updatedAt,
+        status: task.status,
+        cancelRequested: task.cancelRequested,
+        resultExitCode: task.resultExitCode,
+        resultSignal: task.resultSignal,
+        error: task.error,
+        finishedAt: task.finishedAt,
+    };
+}
+function publishImmediateRunChangedEvent(args) {
+    args.nc.publish(buildAgentRunEventsSubject(args.userId, args.task.agentId), runEventsCodec.encode(JSON.stringify(buildImmediateRunChangedEvent(args.task))));
+}
+async function findSessionFilePathBySessionId(sessionId) {
+    const targetSessionId = sessionId.trim();
+    if (!targetSessionId) {
+        return null;
+    }
+    let sessionsRootStat;
     try {
-        const parsed = JSON.parse(value);
-        const lineType = typeof parsed.type === "string" ? parsed.type : "";
-        if (!parsed.payload || typeof parsed.payload !== "object" || Array.isArray(parsed.payload)) {
-            return { sessionId: null, sessionFilePath: null };
-        }
-        const payload = parsed.payload;
-        const sessionIdCandidate = typeof payload.sessionId === "string" && payload.sessionId.trim()
-            ? payload.sessionId.trim()
-            : typeof payload.session_id === "string" && payload.session_id.trim()
-                ? payload.session_id.trim()
-                : typeof payload.id === "string" && payload.id.trim() && (lineType === "session_meta" || lineType === "session.started")
-                    ? payload.id.trim()
-                    : null;
-        const filePathCandidate = typeof payload.rollout_path === "string" && payload.rollout_path.trim()
-            ? payload.rollout_path.trim()
-            : typeof payload.filePath === "string" && payload.filePath.trim()
-                ? payload.filePath.trim()
-                : null;
-        return {
-            sessionId: sessionIdCandidate,
-            sessionFilePath: filePathCandidate,
-        };
+        sessionsRootStat = await stat(getSessionsRootPath());
     }
     catch {
-        return { sessionId: null, sessionFilePath: null };
+        return null;
+    }
+    if (!sessionsRootStat.isDirectory()) {
+        return null;
+    }
+    const files = await collectSessionJsonlFiles(getSessionsRootPath());
+    files.sort((a, b) => b.mtimeMs - a.mtimeMs || a.filePath.localeCompare(b.filePath));
+    for (const file of files) {
+        let fileHandle = null;
+        try {
+            fileHandle = await open(file.filePath, "r");
+            const entryStat = await fileHandle.stat();
+            const firstLine = await readFirstLine(fileHandle, entryStat.size);
+            if (!firstLine) {
+                continue;
+            }
+            const parsed = JSON.parse(firstLine);
+            const candidateMeta = parsed && parsed.type === "session_meta" && isObjectRecord(parsed.payload)
+                ? parsed.payload
+                : isObjectRecord(parsed.session_meta)
+                    ? parsed.session_meta
+                    : isObjectRecord(parsed.sessionMeta)
+                        ? parsed.sessionMeta
+                        : isObjectRecord(parsed.meta)
+                            ? parsed.meta
+                            : isObjectRecord(parsed.payload)
+                                ? parsed.payload
+                                : parsed;
+            const candidateId = pickSessionString(candidateMeta.sessionId, candidateMeta.session_id, candidateMeta.id);
+            if (candidateId === targetSessionId) {
+                return file.filePath;
+            }
+        }
+        catch {
+            // ignore malformed session files
+        }
+        finally {
+            await fileHandle?.close().catch(() => undefined);
+        }
     }
+    return null;
+}
+async function readSessionIdFromSessionFile(filePath) {
+    let fileHandle = null;
+    try {
+        fileHandle = await open(filePath, "r");
+        const entryStat = await fileHandle.stat();
+        const firstLine = await readFirstLine(fileHandle, entryStat.size);
+        if (!firstLine) {
+            return null;
+        }
+        const parsed = JSON.parse(firstLine);
+        const candidateMeta = parsed && parsed.type === "session_meta" && isObjectRecord(parsed.payload)
+            ? parsed.payload
+            : isObjectRecord(parsed.session_meta)
+                ? parsed.session_meta
+                : isObjectRecord(parsed.sessionMeta)
+                    ? parsed.sessionMeta
+                    : isObjectRecord(parsed.meta)
+                        ? parsed.meta
+                        : isObjectRecord(parsed.payload)
+                            ? parsed.payload
+                            : parsed;
+        return pickSessionString(candidateMeta.sessionId, candidateMeta.session_id, candidateMeta.id);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        await fileHandle?.close().catch(() => undefined);
+    }
+}
+async function detectPendingRunSession(knownFilePaths) {
+    const sessionsRoot = getSessionsRootPath();
+    let sessionsRootStat;
+    try {
+        sessionsRootStat = await stat(sessionsRoot);
+    }
+    catch {
+        return null;
+    }
+    if (!sessionsRootStat.isDirectory()) {
+        return null;
+    }
+    const files = await collectSessionJsonlFiles(sessionsRoot);
+    files.sort((a, b) => a.mtimeMs - b.mtimeMs || a.filePath.localeCompare(b.filePath));
+    for (const file of files) {
+        if (knownFilePaths.has(file.filePath)) {
+            continue;
+        }
+        const sessionId = await readSessionIdFromSessionFile(file.filePath);
+        if (!sessionId) {
+            continue;
+        }
+        knownFilePaths.add(file.filePath);
+        return {
+            sessionId,
+            sessionFilePath: file.filePath,
+        };
+    }
+    return null;
 }
 async function updateRunSessionMetadata(task, metadata) {
     let changed = false;
@@ -1023,11 +1122,25 @@ async function updateRunSessionMetadata(task, metadata) {
         task.sessionFilePath = metadata.sessionFilePath.trim();
         changed = true;
     }
+    if (!task.sessionFilePath && task.sessionId) {
+        const resolvedSessionFilePath = await findSessionFilePathBySessionId(task.sessionId).catch(() => null);
+        if (resolvedSessionFilePath) {
+            task.sessionFilePath = resolvedSessionFilePath;
+            changed = true;
+        }
+    }
     if (!changed) {
         return;
     }
     task.updatedAt = formatLocalTimestamp();
     await persistRunTask(task).catch(() => undefined);
+    if (metadata.nc) {
+        publishImmediateRunChangedEvent({
+            nc: metadata.nc,
+            userId: task.userId,
+            task,
+        });
+    }
     if (!previousSessionId && task.sessionId) {
         await updateRunStartSlotSession({
             runId: task.id,
@@ -1113,6 +1226,7 @@ async function startManagedRun(args) {
         userId: args.userId,
         taskId: args.runId,
         codexAuthBundle: args.codexAuthBundle,
+        runtimeEnvPatch: args.runtimeEnvPatch,
     });
     const child = spawnManagedCodexCommand({
         codexArgs: args.codexArgs,
@@ -1138,46 +1252,60 @@ async function startManagedRun(args) {
         startedAt: now,
         finishedAt: null,
     };
-    let stdoutBuffer = "";
-    const recordChunk = (stream, chunk) => {
-        writeRunStream(task.id, stream, chunk);
-        if (stream !== "stdout" || (task.sessionId && task.sessionFilePath)) {
+    let pendingSessionPollClosed = false;
+    let pendingSessionPollTimer = null;
+    const knownPendingSessionFiles = new Set();
+    const stopPendingSessionPoll = () => {
+        pendingSessionPollClosed = true;
+        if (pendingSessionPollTimer) {
+            clearInterval(pendingSessionPollTimer);
+            pendingSessionPollTimer = null;
+        }
+    };
+    const pollPendingSession = async () => {
+        if (pendingSessionPollClosed || task.sessionId) {
+            stopPendingSessionPoll();
             return;
         }
-        stdoutBuffer += chunk;
-        const lines = stdoutBuffer.split(/\r?\n/);
-        stdoutBuffer = lines.pop() ?? "";
-        for (const line of lines) {
-            const trimmed = line.trim();
-            if (!trimmed) {
-                continue;
-            }
-            const metadata = extractCodexSessionMetadata(trimmed);
-            if (metadata.sessionId || metadata.sessionFilePath) {
-                void updateRunSessionMetadata(task, metadata);
-            }
+        const detected = await detectPendingRunSession(knownPendingSessionFiles).catch(() => null);
+        if (!detected) {
+            return;
+        }
+        await updateRunSessionMetadata(task, {
+            sessionId: detected.sessionId,
+            sessionFilePath: detected.sessionFilePath,
+            nc: args.nc,
+        }).catch(() => undefined);
+        if (task.sessionId) {
+            stopPendingSessionPoll();
         }
     };
-    child.stdout.on("data", (chunk) => recordChunk("stdout", chunk));
-    child.stderr.on("data", (chunk) => recordChunk("stderr", chunk));
+    if (!task.sessionId) {
+        const existingFiles = await collectSessionJsonlFiles(getSessionsRootPath()).catch(() => []);
+        for (const file of existingFiles) {
+            knownPendingSessionFiles.add(file.filePath);
+        }
+        pendingSessionPollTimer = setInterval(() => {
+            void pollPendingSession();
+        }, 1000);
+    }
+    child.stdout.on("data", (chunk) => writeRunStream(task.id, "stdout", chunk));
+    child.stderr.on("data", (chunk) => writeRunStream(task.id, "stderr", chunk));
     child.once("error", (error) => {
+        stopPendingSessionPoll();
         const message = error instanceof Error ? error.message : String(error);
         task.status = "failed";
         task.error = message;
         task.finishedAt = formatLocalTimestamp();
         persistRetainedRun(task);
+        publishImmediateRunChangedEvent({ nc: args.nc, userId: task.userId, task });
         void removeRunTask(task.id).catch(() => undefined);
         void releaseRunStartSlot({ runId: task.id, sessionId: task.sessionId }).catch(() => undefined);
         void prepared.codexAuthCleanup().catch(() => undefined);
         writeRunStatus(task.id, `failed error=${message}`);
     });
     child.once("close", async (code, signal) => {
-        if (stdoutBuffer.trim() && (!task.sessionId || !task.sessionFilePath)) {
-            const metadata = extractCodexSessionMetadata(stdoutBuffer.trim());
-            if (metadata.sessionId || metadata.sessionFilePath) {
-                void updateRunSessionMetadata(task, metadata);
-            }
-        }
+        stopPendingSessionPoll();
         const latest = await getStoredRun(task.id).catch(() => null);
         if (latest?.cancelRequested) {
             task.cancelRequested = true;
@@ -1188,6 +1316,7 @@ async function startManagedRun(args) {
         task.status = task.cancelRequested ? "canceled" : (task.resultExitCode ?? 1) === 0 ? "completed" : "failed";
         task.error = task.status === "failed" ? `Command exited with code ${task.resultExitCode ?? "null"}` : null;
         persistRetainedRun(task);
+        publishImmediateRunChangedEvent({ nc: args.nc, userId: task.userId, task });
         void removeRunTask(task.id).catch(() => undefined);
         void releaseRunStartSlot({ runId: task.id, sessionId: task.sessionId }).catch(() => undefined);
         void prepared.codexAuthCleanup().catch(() => undefined);
@@ -1195,7 +1324,11 @@ async function startManagedRun(args) {
     });
     persistRetainedRun(task);
     void persistRunTask(task).catch(() => undefined);
+    publishImmediateRunChangedEvent({ nc: args.nc, userId: task.userId, task });
     writeRunStatus(task.id, `started requestId=${args.requestId} cwd=${prepared.taskWorkspace}`);
+    if (!task.sessionId) {
+        void pollPendingSession();
+    }
     return cloneRunTask(task);
 }
 function shellSingleQuote(value) {
@@ -1312,6 +1445,62 @@ async function runLocalCodexCli(args, timeoutMs, envPatch) {
         });
     });
 }
+async function runLocalCodexCliWithInput(args, input, timeoutMs, envPatch) {
+    const command = buildLocalCodexCliCommand(args);
+    const workspaceRoot = workspaceRootOverride ?? (process.env.WORKSPACE?.trim() || process.cwd());
+    const env = {
+        ...process.env,
+        ...(envPatch ?? {}),
+        WORKSPACE: workspaceRoot,
+        CODEX_HOME: resolveCodexHomePath(),
+    };
+    return await new Promise((resolve, reject) => {
+        const child = spawn(command, {
+            cwd: workspaceRoot,
+            shell: resolveShellPath(),
+            env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let done = false;
+        let timedOut = false;
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        child.stdin?.write(input);
+        if (!input.endsWith("\n")) {
+            child.stdin?.write("\n");
+        }
+        child.stdin?.end();
+        const timer = setTimeout(() => {
+            timedOut = true;
+            sendSignalToTaskProcess(child, "SIGTERM");
+            setTimeout(() => sendSignalToTaskProcess(child, "SIGKILL"), 1000);
+        }, Math.max(500, timeoutMs));
+        child.once("error", (error) => {
+            if (done) {
+                return;
+            }
+            done = true;
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.once("exit", (code) => {
+            if (done) {
+                return;
+            }
+            done = true;
+            clearTimeout(timer);
+            resolve({ code, stdout, stderr, timedOut });
+        });
+    });
+}
 function buildSkillGeneratorPrompt(userPrompt) {
     return [
         "Create a Codex skill from the user's description.",
@@ -1663,6 +1852,20 @@ async function startLocalCodexLogin() {
     }
     throw new Error(normalized || `Codex login failed with code ${result.code ?? "null"}`);
 }
+async function loginLocalCodexWithApiKey(apiKey) {
+    const result = await runLocalCodexCliWithInput(["login", "--with-api-key"], apiKey, 15000);
+    const normalized = stripAnsi([result.stdout, result.stderr].filter(Boolean).join("\n")).trim();
+    if ((result.code ?? 1) !== 0) {
+        throw new Error(normalized || `Codex API key login failed with code ${result.code ?? "null"}`);
+    }
+    const status = await getLocalCodexLoginStatus().catch(() => null);
+    return {
+        loggedIn: status?.loggedIn === true,
+        output: status?.output || normalized || "Logged in",
+        verificationUri: null,
+        userCode: null,
+    };
+}
 async function logoutLocalCodexAuth() {
     if (pendingCodexDeviceAuth && pendingCodexDeviceAuth.child.exitCode === null) {
         sendSignalToTaskProcess(pendingCodexDeviceAuth.child, "SIGTERM");
@@ -1694,11 +1897,15 @@ function normalizeCodexAuthRpcRequest(args) {
     const responseSubject = typeof args.request.responseSubject === "string" ? args.request.responseSubject.trim() : "";
     const requestAgentId = typeof args.request.agentId === "string" ? args.request.agentId.trim() : "";
     const actionRaw = typeof args.request.action === "string" ? args.request.action.trim() : "";
-    const action = actionRaw === "start" || actionRaw === "logout" ? actionRaw : "status";
+    const action = actionRaw === "start" || actionRaw === "logout" || actionRaw === "login_api_key" ? actionRaw : "status";
+    const apiKey = typeof args.request.apiKey === "string" && args.request.apiKey.trim() ? args.request.apiKey.trim() : null;
     if (!requestId || !responseSubject || !requestAgentId || requestAgentId !== args.agentId) {
         throw new Error("invalid codex auth rpc request");
     }
-    return { requestId, responseSubject, action };
+    if (action === "login_api_key" && !apiKey) {
+        throw new Error("api key is required");
+    }
+    return { requestId, responseSubject, action, apiKey };
 }
 function publishCodexAuthRpcResponse(args) {
     args.nc.publish(args.responseSubject, codexAuthRpcCodec.encode(JSON.stringify(args.payload)));
@@ -1712,7 +1919,10 @@ async function handleCodexAuthRpcMessage(args) {
         requestId = request.requestId;
         responseSubject = request.responseSubject;
         let result = null;
-        if (request.action === "start") {
+        if (request.action === "login_api_key") {
+            result = await loginLocalCodexWithApiKey(request.apiKey ?? "");
+        }
+        else if (request.action === "start") {
             const status = await getLocalCodexLoginStatus();
             if (status.loggedIn) {
                 result = { loggedIn: true, output: status.output };
@@ -2133,6 +2343,7 @@ async function handleRunRpcMessage(args) {
                     serverBaseUrl: args.serverBaseUrl,
                     userId: args.userId,
                     agentId: args.agentId,
+                    nc: args.jetstream.nc,
                     sessionId: request.sessionId,
                     codexArgs: buildManagedCodexArgs({
                         prompt: request.prompt ?? "",
@@ -2182,6 +2393,7 @@ async function handleRunRpcMessage(args) {
             target.cancelRequested = true;
             target.updatedAt = formatLocalTimestamp();
             await persistRunTask(target);
+            publishImmediateRunChangedEvent({ nc: args.jetstream.nc, userId: target.userId, task: target });
             writeRunStatus(target.id, `cancel requested pid=${target.processPid}`);
             sendSignalToPid(target.processPid, "SIGINT");
             const task = cloneRunTask(target);
@@ -3560,16 +3772,18 @@ function normalizeShellRpcCodexAuthBundle(value) {
     }
     const row = value;
     const authJson = typeof row.authJson === "string" ? row.authJson : null;
-    if (!authJson) {
+    const authMode = row.authMode === "oauth" ? "oauth" : row.authMode === "api_key" ? "api_key" : undefined;
+    const apiKey = typeof row.apiKey === "string" || row.apiKey === null ? row.apiKey : undefined;
+    if (!authJson && authMode !== "api_key" && apiKey === undefined) {
         return null;
     }
     return {
         taskId: typeof row.taskId === "string" ? row.taskId : undefined,
-        authMode: row.authMode === "oauth" ? "oauth" : row.authMode === "api_key" ? "api_key" : undefined,
+        authMode,
         issuedAt: typeof row.issuedAt === "string" ? row.issuedAt : undefined,
         expiresAt: typeof row.expiresAt === "string" ? row.expiresAt : undefined,
-        authJson,
-        apiKey: typeof row.apiKey === "string" || row.apiKey === null ? row.apiKey : undefined,
+        authJson: authJson ?? undefined,
+        apiKey,
     };
 }
 async function postJson(url, body) {
@@ -3734,27 +3948,49 @@ async function checkCancelRequested(args) {
     const response = await getJson(`${args.serverBaseUrl}/api/agent/tasks/${encodeURIComponent(args.taskId)}/events?${query.toString()}`);
     return Boolean(response.task?.cancelRequested);
 }
-async function prepareTaskCodexAuth(args) {
-    void args;
+async function syncCodexAuthState(args) {
+    const envPatch = {};
+    const synced = false;
+    if (args.authMode === "api_key") {
+        if (args.apiKey) {
+            envPatch.OPENAI_API_KEY = args.apiKey;
+        }
+    }
     return {
-        envPatch: {},
+        envPatch,
         cleanup: async () => { },
         meta: {
-            codexAuthSource: "agent_local",
-            codexAuthSynced: false,
+            codexAuthSource: args.source,
+            codexAuthMode: args.authMode ?? null,
+            codexAuthHasApiKey: Boolean(args.apiKey),
+            codexAuthHasAuthJson: Boolean(args.authJson),
+            codexAuthIssuedAt: args.issuedAt ?? null,
+            codexAuthExpiresAt: args.expiresAt ?? null,
+            codexAuthSynced: synced,
         },
     };
 }
+async function prepareTaskCodexAuth(args) {
+    void args;
+    return await syncCodexAuthState({
+        source: "agent_local",
+        authJson: null,
+        issuedAt: null,
+        expiresAt: null,
+    });
+}
 async function prepareCodexAuthBundle(bundle) {
-    void bundle;
-    return {
-        envPatch: {},
-        cleanup: async () => { },
-        meta: {
-            codexAuthSource: "agent_local",
-            codexAuthSynced: false,
-        },
-    };
+    if (!bundle) {
+        return null;
+    }
+    return await syncCodexAuthState({
+        source: "server_bundle",
+        authMode: bundle.authMode,
+        apiKey: bundle.apiKey,
+        authJson: bundle.authJson ?? null,
+        issuedAt: bundle.issuedAt ?? null,
+        expiresAt: bundle.expiresAt ?? null,
+    });
 }
 async function prepareCommandExecution(args) {
     const shellPath = resolveShellPath();
@@ -3768,6 +4004,7 @@ async function prepareCommandExecution(args) {
         DOER_USER_ID: args.userId,
         DOER_AGENT_TASK_ID: args.taskId,
         ...buildAgentSettingsEnvPatch(localAgentSettings),
+        ...args.runtimeEnvPatch,
         ...(codexAuth?.envPatch ?? {}),
         WORKSPACE: taskWorkspace,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doer-agent",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Reverse-polling agent runtime for doer",
   "type": "module",
   "main": "dist/agent.js",