hub-runner 0.2.0 → 0.2.1

package/main.mjs

@@ -12,7 +12,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -449,8 +453,8 @@ var require_graceful_fs = __commonJS({
     var gracefulQueue;
     var previousSymbol;
     if (typeof Symbol === "function" && typeof Symbol.for === "function") {
-      gracefulQueue = Symbol.for("graceful-fs.queue");
-      previousSymbol = Symbol.for("graceful-fs.previous");
+      gracefulQueue = /* @__PURE__ */ Symbol.for("graceful-fs.queue");
+      previousSymbol = /* @__PURE__ */ Symbol.for("graceful-fs.previous");
     } else {
       gracefulQueue = "___graceful-fs.queue";
       previousSymbol = "___graceful-fs.previous";
@@ -1232,7 +1236,7 @@ var require_signal_exit = __commonJS({
 var require_mtime_precision = __commonJS({
   "../../hosted-hub/node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
-    var cacheSymbol = Symbol();
+    var cacheSymbol = /* @__PURE__ */ Symbol();
     function probe(file, fs, callback) {
       const cachedPrecision = fs[cacheSymbol];
       if (cachedPrecision) {
@@ -1612,8 +1616,8 @@ var require_proper_lockfile = __commonJS({
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 import { homedir as homedir4 } from "node:os";
 import { randomUUID } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync10, realpathSync as realpathSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync10, realpathSync as realpathSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join16 } from "node:path";
 
 // ../../lib/clean-env.mjs
 var INHERITED_ENV = /^(EVE_|WORKFLOW_)/;
@@ -4052,7 +4056,7 @@ function needsCopy({ from, to, paths = [] }) {
 }
 
 // ../../workspaces/session-workspaces.mjs
-var ATTACHMENTS = "/attachments/";
+var ATTACHMENTS = ["/attachments/", "/.eve/attachments/"];
 var expand = (p) => resolve3(p === "~" ? homedir() : p.startsWith("~/") ? join11(homedir(), p.slice(2)) : p);
 function createSessionWorkspaces({
   stateDir,
@@ -4120,15 +4124,16 @@ function createSessionWorkspaces({
       const rel = execFileSync2("git", ["-C", c.repo, "rev-parse", "--git-path", "info/exclude"], { encoding: "utf8" }).trim();
       const file = resolve3(c.repo, rel);
       const text = existsSync8(file) ? readFileSync7(file, "utf8") : "";
-      if (!text.split("\n").includes(ATTACHMENTS)) {
+      const missing = ATTACHMENTS.filter((p) => !text.split("\n").includes(p));
+      if (missing.length) {
         mkdirSync6(dirname5(file), { recursive: true });
         appendFileSync(file, `${text && !text.endsWith("\n") ? "\n" : ""}# hub: eve's copies of thread images
-${ATTACHMENTS}
+${missing.join("\n")}
 `);
       }
       excluded.add(c.repo);
     } catch (error) {
-      log2.warn(`[workspaces] couldn't exclude ${ATTACHMENTS} in ${c.repo}: ${error.message}`);
+      log2.warn(`[workspaces] couldn't exclude ${ATTACHMENTS.join(" ")} in ${c.repo}: ${error.message}`);
     }
   }
   async function provision(rec, c) {
@@ -4494,6 +4499,52 @@ function runnerWorktrees(dir2, workspace) {
   };
 }
 
+// ../../hosted-hub/runner/model-credential.ts
+import { renameSync as renameSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join15 } from "node:path";
+var ENV_FILE = ".env.development.local";
+var REFRESH_BEFORE_MS = 50 * 6e4;
+function expiryOf(token) {
+  const exp = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString()).exp;
+  if (typeof exp !== "number") throw new Error("model credential: the hub answered a token with no expiry");
+  return exp * 1e3;
+}
+function modelCredential(o) {
+  const now = o.now ?? Date.now;
+  let expiresAt = 0, timer, fetching, stopped = false;
+  async function refresh() {
+    const url = new URL(`${o.hubUrl}/api/model-credential`);
+    if (o.bypass) url.searchParams.set("x-vercel-protection-bypass", o.bypass);
+    const res = await o.fetch(url, { headers: { authorization: `Bearer ${o.botToken()}` }, signal: AbortSignal.timeout(15e3) });
+    if (!res.ok) throw new Error(`model credential: HTTP ${res.status} ${(await res.text()).slice(0, 200)}`);
+    const { token } = await res.json();
+    if (typeof token !== "string" || !token) throw new Error("model credential: the hub answered no token");
+    const expires = expiryOf(token);
+    if (expires - REFRESH_BEFORE_MS <= now()) throw new Error("model credential: the hub answered a token that is already due");
+    const file = join15(o.dir, ENV_FILE);
+    writeFileSync6(`${file}.tmp`, `VERCEL_OIDC_TOKEN=${token}
+`, { mode: 384 });
+    renameSync5(`${file}.tmp`, file);
+    expiresAt = expires;
+    clearTimeout(timer);
+    if (stopped) return;
+    timer = setTimeout(() => {
+      void ensure().catch((e) => o.log("model credential", e.message));
+    }, expires - REFRESH_BEFORE_MS - now());
+    timer.unref?.();
+  }
+  function ensure() {
+    if (expiresAt - REFRESH_BEFORE_MS > now()) return Promise.resolve();
+    return fetching ??= refresh().finally(() => {
+      fetching = void 0;
+    });
+  }
+  return { ensure, stop: () => {
+    stopped = true;
+    clearTimeout(timer);
+  } };
+}
+
 // ../../hosted-hub/runner/hub-runner.ts
 var realBots = { stage: stageLocal, supervise: createSupervisor };
 var HeldElsewhere = class extends Error {
@@ -4507,9 +4558,7 @@ var RETRY_MS = 2e3;
 var BATCH = 200;
 var ACK_MS = 15e3;
 function botEnv(env, config, bot, token) {
-  const inherited = Object.entries(cleanEnv(env)).filter(([k]) => !/^(HUB_|ROSTER_)/.test(k));
-  const credential = new URL(`${config.hubUrl}/api/model-credential`);
-  if (config.bypass) credential.searchParams.set("x-vercel-protection-bypass", config.bypass);
+  const inherited = Object.entries(cleanEnv(env)).filter(([k]) => !/^(HUB_|ROSTER_)/.test(k) && k !== "VERCEL_OIDC_TOKEN");
   return {
     ...Object.fromEntries(inherited),
     HUB_URL: config.hubUrl,
@@ -4519,9 +4568,7 @@ function botEnv(env, config, bot, token) {
     HUB_WORKSPACE: config.workspace,
     HUB_SANDBOX_SERVICES: "none",
     HUB_SESSION_WORKTREE_DIR: worktreeDir(config.dir),
-    ...config.bypass ? { HUB_PROTECTION_BYPASS: config.bypass } : {},
-    EVE_MODEL_CREDENTIAL_URL: credential.href,
-    EVE_MODEL_CREDENTIAL_TOKEN: token
+    ...config.bypass ? { HUB_PROTECTION_BYPASS: config.bypass } : {}
   };
 }
 var log = (...args) => console.error((/* @__PURE__ */ new Date()).toISOString(), "[hub-runner]", ...args);
@@ -4560,6 +4607,7 @@ async function run3(config, bots = realBots) {
   if (!claim.ok) throw new Error(`claim: HTTP ${claim.status} ${(await claim.text()).slice(0, 200)}`);
   const claimed = await claim.json();
   token = String(claimed.token);
+  const model = modelCredential({ fetch: net, hubUrl: config.hubUrl, bypass: config.bypass, botToken: () => claimed.botToken, dir: config.dir, log });
   let workspace = "", commit = "";
   let told = null, telling = Promise.resolve(), stopping = false, printed = "";
   const tell = (failedCommit) => telling = telling.catch(() => {
@@ -4689,6 +4737,7 @@ async function run3(config, bots = realBots) {
     if (created instanceof CreateRefused) return answered(d, { kind: "refused", error: created.message });
     const eveSessionId = d.eveSessionId ?? (await hubJson(`/api/sessions/${encodeURIComponent(d.sessionId)}/eve`, { method: "POST", body: JSON.stringify({ eveSessionId: created }) })).eveSessionId;
     await worktrees.ensure({ ...d, sessionId: eveSessionId });
+    await model.ensure();
     const { answer } = await sendToBot(net, eve(d.bot, work.human), { ...d, status: d.status ?? null, eveSessionId }, d.workspace, loadImage);
     if (answer.kind === "ended") {
       await upload({ sessionId: d.sessionId, eveSessionId }, d.bot, work.human, 0, { toTail: true });
@@ -4802,6 +4851,7 @@ async function run3(config, bots = realBots) {
   async function compactOne({ sessionId, eveSessionId, bot, requestedAt }, human) {
     if (compacted.get(sessionId)?.requestedAt !== requestedAt) {
       const agent = running.get(bot);
+      if (agent) await model.ensure();
       const answer = agent ? await compactSession(net, eve(bot, human), eveSessionId).then((r) => ({ status: r.status, body: typeof r.body === "string" ? r.body : JSON.stringify(r.body) })) : { status: 503, body: "the bot is not running on this Mac" };
       compacted.set(sessionId, { requestedAt, answer, reported: false });
     }
@@ -4909,6 +4959,7 @@ async function run3(config, bots = realBots) {
     stopping = true;
     if (clear) await tell(null).catch((e) => log("setup report", e.message));
     shutdown.abort();
+    model.stop();
     clearTimeout(retry);
     await supervisor.stopAll();
     await Promise.allSettled([feed, syncing]);
@@ -4925,22 +4976,22 @@ async function run3(config, bots = realBots) {
 var need = (name) => process.env[name] || (() => {
   throw new Error(`${name} is required`);
 })();
-var configured = process.env.HUB_RUNNER_DIR || join15(homedir4(), ".hub", "local");
+var configured = process.env.HUB_RUNNER_DIR || join16(homedir4(), ".hub", "local");
 mkdirSync7(configured, { recursive: true });
 var dir = realpathSync4(configured);
-mkdirSync7(join15(dir, "status"), { recursive: true });
-statusFile(join15(dir, "status", `${process.pid}.json`), { pid: process.pid, state: "starting", build: process.env.HUB_RUNNER_BUILD ?? "" });
+mkdirSync7(join16(dir, "status"), { recursive: true });
+statusFile(join16(dir, "status", `${process.pid}.json`), { pid: process.pid, state: "starting", build: process.env.HUB_RUNNER_BUILD ?? "" });
 process.on("exit", exitStatus);
 var drainAsked = new Promise((resolve6) => process.on("SIGUSR2", () => resolve6()));
-var release = await import_proper_lockfile.default.lock(dir, { lockfilePath: join15(dir, "runner.lock"), stale: 1e4, realpath: false }).catch((error) => {
+var release = await import_proper_lockfile.default.lock(dir, { lockfilePath: join16(dir, "runner.lock"), stale: 1e4, realpath: false }).catch((error) => {
   if (error.code !== "ELOCKED") throw error;
   status("busy-here");
   process.exit(5);
 });
-var deviceFile = join15(dir, "device-id");
-if (!existsSync11(deviceFile)) writeFileSync6(deviceFile, randomUUID());
+var deviceFile = join16(dir, "device-id");
+if (!existsSync11(deviceFile)) writeFileSync7(deviceFile, randomUUID());
 var device = readFileSync10(deviceFile, "utf8").trim();
-var credentials = process.env.HUB_URL || process.env.HUB_SESSION ? { hubUrl: need("HUB_URL"), session: need("HUB_SESSION"), bypass: process.env.HUB_PROTECTION_BYPASS || void 0 } : JSON.parse(readFileSync10(join15(dir, "credentials.json"), "utf8"));
+var credentials = process.env.HUB_URL || process.env.HUB_SESSION ? { hubUrl: need("HUB_URL"), session: need("HUB_SESSION"), bypass: process.env.HUB_PROTECTION_BYPASS || void 0 } : JSON.parse(readFileSync10(join16(dir, "credentials.json"), "utf8"));
 var deviceName = process.env.HUB_DEVICE_NAME || device;
 var started = await run3({
   hubUrl: credentials.hubUrl.replace(/\/$/, ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hub-runner",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "license": "Apache-2.0",
   "description": "Runs a hub workspace's Mac bots on this Mac under launchd, with no app needed.",
   "type": "module",
@@ -15,11 +15,12 @@
   "engines": {
     "node": ">=24"
   },
-  "publishConfig": {
-    "access": "public"
-  },
   "scripts": {
     "build": "node scripts/build.mjs",
+    "prepack": "node scripts/build.mjs",
     "test": "node --test --test-timeout=60000 --test-force-exit test/*.test.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
   }
-}
+}