run402 4.47.0 → 4.49.0

package/git-remote-run402.mjs

@@ -104,7 +104,7 @@ import { pathToFileURL } from "node:url";
 import { getSdk } from "./lib/sdk.mjs";
 import { resolveWalletCore, enforceWalletExistsCore, WalletSelectionError } from "./lib/wallet-context.mjs";
 import { gitvaultRemoteAddressForm, gitvaultSlugReleasedInfo, parseGitvaultRemoteUrl } from "#sdk";
-import { GITVAULT_R402_REF_NAMESPACE, hardenedGit, resolveGitInvocationRepo } from "#sdk/node";
+import { GITVAULT_R402_REF_NAMESPACE, hardenedGit, resolveGitInvocationRepo, readPinnedGitvaultRepo, pinGitvaultRepo } from "#sdk/node";
 
 const out = (line) => process.stdout.write(`${line}\n`);
 /** Every helper response block is terminated by a blank line. */
@@ -350,6 +350,26 @@ async function main(argv) {
     return resolvedRepo.repo_dir;
   }
 
+  /**
+   * One materialize per push session (gitvault-client-round-trips design
+   * D1). Git guarantees `list` precedes `push` in the same helper process,
+   * so a `list` that resolves an EXISTING vault against a real repository
+   * stashes its vault instance + materialized base here; `runPush` reuses
+   * BOTH — skipping its own `openOrCreateVault` + `materialize()` entirely
+   * — instead of materializing the same state a second and third time.
+   * `null` whenever there is nothing safe to share: `list` never ran, ran
+   * repo-free (a bare `git ls-remote`), or found an UNALLOCATED vault
+   * (first-push-allocates keeps its own unchanged flow — design D7's own
+   * "base-sharing subtlety" risk note). Reuse also requires the SAME
+   * resolved repository AND the same resolved wallet as `push` is about to
+   * use — in ordinary usage (`push` run from inside the repo it targets)
+   * these always match `list`'s own resolution; the check just makes a
+   * mismatch (an unusual `git -C otherdir push`) fail safe into `push`'s
+   * original, unshared flow rather than reuse a snapshot read under a
+   * different identity.
+   */
+  let sharedListSession = null;
+
   /** This repository's own HEAD branch (`refs/heads/<name>`), or `null` when detached, unborn, or unreadable — never a failure by itself. */
   async function localHeadBranchRef(repoDir) {
     try {
@@ -377,15 +397,17 @@ async function main(argv) {
 
   /**
    * Open the vault lazily — `capabilities` and `option` must never touch the
-   * network. Dispatches on the address form (design D6): id-form is
-   * BYTE-IDENTICAL to before (`gitvault.open` with `{org_id, project_id}`);
-   * slug-form resolves (and, on the first successful resolution, PINS
-   * `repo_id` in local git state — task 4.5) through
-   * `gitvault.resolveOrCreateAddress` with `allow_create: false` — a read
-   * never allocates, same discipline the id-form path already had.
+   * network. Both address forms resolve (and, on the first successful
+   * resolution, PIN `repo_id` in local git state — task 4.5 for slug-form,
+   * gitvault-client-round-trips design D4 widening the same mechanism to
+   * id-form) through `gitvault.resolveOrCreateAddress` with
+   * `allow_create: false` — a read never allocates, and `allow_create` is
+   * meaningless for id-form's own dispatch anyway (it never creates,
+   * pinned or not). A repo-free call (`repoDir` undefined — `list` outside
+   * any checkout) resolves exactly as it always has, just with nothing to
+   * pin.
    */
   const openVault = async (repoDir) => {
-    if (addressForm === "id") return (await getSdk().gitvault.open(repoDir ? { ...target, repo_dir: repoDir } : target)).vault;
     const result = await getSdk().gitvault.resolveOrCreateAddress({ address, allow_create: false, ...(repoDir ? { repo_dir: repoDir } : {}) });
     return result.handle.vault;
   };
@@ -397,15 +419,36 @@ async function main(argv) {
    * `list`/`fetch` stay pure reads and never create anything (see
    * `runList`'s own not-found handling below).
    *
+   * Id-form (gitvault-client-round-trips design D4): a PINNED repo_id means
+   * this checkout has already resolved (or pushed to) this vault before, so
+   * there is nothing left to allocate — the read-only, pin-aware
+   * `resolveOrCreateAddress` path (same one `openVault` uses) is enough,
+   * and cheaper than re-running the allocation-capable flow on every push.
+   * With NO pin yet, this is unchanged: `gitvault.openOrCreate` runs its
+   * six-stage creation journal when the vault does not exist, exactly as
+   * before — and, on success, PINS the resolved id for every later push on
+   * this checkout (this is the "first successful resolution" the pin exists
+   * for; `resolveOrCreateAddress`'s own pin-on-resolve only covers
+   * slug-form, since id-form's OWN allocation path — this one — never
+   * routes through it).
+   *
    * Prints the one-shot recovery receipt and the keystore path to stderr the
    * moment allocation happens, per the client-surface spec: an agent reads
    * stderr, and the receipt is worth exactly as many copies as get kept.
    */
   async function openOrCreateVault(repoDir) {
+    if (addressForm === "id" && repoDir) {
+      const pinned = await readPinnedGitvaultRepo(repoDir);
+      if (pinned) {
+        const result = await getSdk().gitvault.resolveOrCreateAddress({ address, repo_dir: repoDir, allow_create: false });
+        return result.handle.vault;
+      }
+    }
     const result =
       addressForm === "id"
         ? await getSdk().gitvault.openOrCreate({ ...target, repo_dir: repoDir })
         : await getSdk().gitvault.resolveOrCreateAddress({ address, repo_dir: repoDir, allow_create: true });
+    if (addressForm === "id" && repoDir) await pinGitvaultRepo(repoDir, result.handle.repo_id);
     if (!result.found && result.created) {
       note("");
       note(`vault ${result.handle.repo_id} allocated (genesis ${result.created.genesis_sha256}) — one-shot recovery receipt, keep many copies:`);
@@ -424,11 +467,26 @@ async function main(argv) {
   async function runList() {
     // `list` needs no repository (a repository-free `git ls-remote` outside
     // any checkout must keep working) — the binding walk falls back to cwd,
-    // same as `capabilities`/`option`'s repository-free tier.
+    // same as `capabilities`/`option`'s repository-free tier. Wallet
+    // resolution is UNCHANGED (still cwd-based, never repoDir-based) — only
+    // the vault-open call below additionally threads a repository when one
+    // resolves, purely so a later `push` in this same session can reuse the
+    // resulting vault instance (design D1); the repo-free ls-remote case is
+    // unaffected (`repoDir` just stays `null`).
     applyWalletForDir(process.cwd());
+    let repoDir = null;
+    try {
+      repoDir = await requireRepo();
+    } catch {
+      // Not resolvable as a repository (e.g. `git ls-remote` outside any
+      // checkout) — `list` still works, and there is nothing for `push` to
+      // share later in that case.
+    }
+    let vault;
     let state;
     try {
-      state = await (await openVault()).materialize();
+      vault = await openVault(repoDir ?? undefined);
+      state = await vault.materialize();
     } catch (err) {
       // An unallocated vault is not an error here: `list` is the read half of
       // the protocol dance and must never create anything on its own (D2
@@ -436,13 +494,15 @@ async function main(argv) {
       // exactly what a fresh repository looks like to git, and `push` still
       // runs `list` first either way — this is what lets a first push land in
       // one command instead of `list` failing the whole exchange before
-      // `push` ever gets a turn.
+      // `push` ever gets a turn. Nothing to share with `push` either
+      // (design D7): an unallocated vault has no base to reuse.
       if (isVaultNotFound(err)) {
         endBlock();
         return;
       }
       throw err;
     }
+    if (repoDir) sharedListSession = { repoDir, walletName: resolvedWallet?.name ?? null, vault, base: state };
     const refs = state.refs ?? {};
     for (const ref of Object.keys(refs).sort()) out(`${refs[ref]} ${ref}`);
     // A snapshot-only vault holds protocol refs but no branch heads, so a
@@ -569,8 +629,18 @@ async function main(argv) {
         return 0;
       }
 
-      const vault = await openOrCreateVault(repoDir);
-      const base = await vault.materialize();
+      // Design D1: reuse `list`'s vault + materialized base for this push's
+      // FIRST admission attempt when it resolved the SAME repository under
+      // the SAME wallet — skips `openOrCreateVault` and `materialize()`
+      // entirely instead of resolving/materializing the vault a second and
+      // third time in one `list → push` exchange. A conflict retry inside
+      // `vault.push` re-materializes from storage exactly as it always has;
+      // only the FIRST attempt's base changes here. Any mismatch (no prior
+      // `list`, an unallocated vault `list` had nothing to share for, or a
+      // different repository/wallet) falls back to the original flow.
+      const shared = sharedListSession && sharedListSession.repoDir === repoDir && sharedListSession.walletName === (resolvedWallet?.name ?? null) ? sharedListSession : null;
+      const vault = shared ? shared.vault : await openOrCreateVault(repoDir);
+      const base = shared ? shared.base : await vault.materialize();
       const updates = [];
       for (const spec of allowed) {
         const expectedOld = base.refs?.[spec.dst] ?? null;
@@ -601,6 +671,7 @@ async function main(argv) {
       // forward unchanged — a healthy HEAD is never moved.
       const published = await vault.push({
         transaction: { updates },
+        base,
         ...(headFix.head_target ? { head_target: headFix.head_target } : {}),
       });
       if (verbosity >= 1) note(`published generation ${published.generation} (${published.form})`);

package/gitvault-surface.json

@@ -1,5 +1,5 @@
 {
-  "surface_version": "4.47.0",
+  "surface_version": "4.49.0",
   "verbs": [
     "repos create",
     "repos list",

package/lib/credentials.mjs

@@ -26,8 +26,10 @@ Usage:
   run402 credentials <subcommand> [args...]
 
 Project credentials (on the gateway — named, revocable, rotatable):
-  issue --kind <anon|service> --name <name> [--project <id>] [--expires <iso8601>]
+  issue --kind <anon|service> --name <name> [--project <id>] [--expires <iso8601>] [--import]
                                 Mint one. The secret is printed ONCE.
+                                --import also writes it into this machine's
+                                local key cache (the cold-restart re-key path).
   list [--project <id>] [--include-revoked]
                                 List credentials (metadata only, never secrets)
   status [--project <id>]       Are you still on the retiring legacy key?
@@ -87,7 +89,7 @@ const SUB_HELP = {
   issue: `run402 credentials issue — mint a named project credential
 
 Usage:
-  run402 credentials issue --kind <anon|service> --name <name> [--project <id>]
+  run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]
                            [--expires <iso8601>]
 
 --kind    "anon" is the tenant-facing key; "service" is the privileged one.
@@ -95,6 +97,11 @@ Usage:
           returns 409 CREDENTIAL_NAME_TAKEN — that collision is the idempotency
           story, so a retried create never mints a second credential by accident.
 --expires Optional; must be in the future and within one year.
+--import  Also write the minted secret into this machine's local key cache
+          (what deploys and data-plane commands read) — the cold-restart
+          re-key path in ONE step instead of issue-then-project-keys-import.
+          A first --kind anon --import on a machine with no cached entry
+          still needs a service key first, same as project-keys import.
 
 The secret is printed ONCE, on stdout, inside the JSON. Pipe it:
   run402 credentials issue --kind service --name ci | jq -r .secret
@@ -407,7 +414,8 @@ const ISSUE_VALUE_FLAGS = ["--project", "--kind", "--name", "--expires"];
 
 async function issue(args) {
   const a = normalizeArgv(args);
-  assertKnownFlags(a, [...ISSUE_VALUE_FLAGS, "--help", "-h"], ISSUE_VALUE_FLAGS);
+  assertKnownFlags(a, [...ISSUE_VALUE_FLAGS, "--import", "--help", "-h"], ISSUE_VALUE_FLAGS);
+  const importToCache = a.includes("--import");
   const kind = flagValue(a, "--kind");
   const name = flagValue(a, "--name");
   const expiresAt = flagValue(a, "--expires");
@@ -415,7 +423,7 @@ async function issue(args) {
   requirePositionalCount(rest, ISSUE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <id>]",
+    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]",
     missing: "",
   });
   if (kind !== "anon" && kind !== "service") {
@@ -432,8 +440,39 @@ async function issue(args) {
       hint: "The name identifies this credential in 'list' and is how you rotate it later, e.g. --name ci-deploy",
     });
   }
+  // Validate the --import precondition BEFORE minting: refusing after the
+  // mint would burn a show-once secret on a usage error.
+  const existing = importToCache ? getProject(projectId) : undefined;
+  if (importToCache && kind === "anon" && !existing?.service_key) {
+    fail({
+      code: "BAD_USAGE",
+      message: `--import for an anon key writes the whole cache entry, and no service key is cached for ${projectId} yet.`,
+      hint: "Run 'run402 credentials issue --kind service --name <name> --import' first (same rule as project-keys import).",
+      details: { project_id: projectId },
+    });
+  }
   try {
-    emitIssued(await getSdk().credentials.issue(projectId, { kind, name, expiresAt: expiresAt || undefined }));
+    const res = await getSdk().credentials.issue(projectId, { kind, name, expiresAt: expiresAt || undefined });
+    if (importToCache && res?.secret) {
+      // The cold-restart re-key path (gitvault-deploy-lane 6.5a): the minted
+      // secret goes straight into the local cache the deploy and data-plane
+      // commands read, so a fresh machine re-keys in one command per kind
+      // instead of the four-command issue-then-project-keys-import dance.
+      // The secret never rides argv; it came back on the mint response.
+      saveProject(projectId, {
+        anon_key: kind === "anon" ? res.secret : existing?.anon_key ?? "",
+        service_key: kind === "service" ? res.secret : existing?.service_key ?? "",
+        site_url: existing?.site_url,
+        deployed_at: existing?.deployed_at,
+        last_deployment_id: existing?.last_deployment_id,
+        org_id: existing?.org_id,
+        source: "credentials_issue_import",
+        cached_at: new Date().toISOString(),
+      });
+      emitIssued({ ...res, imported_to_local_cache: true });
+      return;
+    }
+    emitIssued(res);
   } catch (err) {
     reportSdkError(err);
   }

package/lib/repos.mjs

@@ -1558,6 +1558,14 @@ async function gc(args) {
     fail({ code: "BAD_USAGE", message: "--intent-core / --verifier-receipt only apply with --submit.", hint: "Add --submit, or drop the flags to plan." });
   }
   const target = await vaultTarget(a);
+  // gitvault-client-round-trips design D3 (task 4.2): re-apply the local
+  // object cache's eviction window as a periodic backstop. Best-effort —
+  // a sweep failure must never block the actual gc plan/submit.
+  try {
+    await sdk.gitvault.sweepObjectCache(target);
+  } catch {
+    // never let cache housekeeping fail a real gc operation
+  }
 
   try {
     if (submitting) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.47.0",
+  "version": "4.49.0",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/deploy.js

@@ -3873,10 +3873,21 @@ async function uploadInlineCas(client, projectId, bytes, contentType) {
  * `/apply/v1/plans*` use SIWX, which the kernel's getAuth provides
  * automatically — only the apikey-gated paths need this helper.
  *
- * Returns an empty object when the credentials provider doesn't know the
- * project (the request will then go out without an apikey and the gateway
- * will reject with 401 — matches the failure mode for unconfigured
- * projects in any of today's other apikey-auth tools).
+ * COLD-RESTART RECOVERY (gitvault-deploy-lane 6.5a, the #624 class one layer
+ * in): when the local credential cache has no entry for the project — the
+ * returning-agent case, where the wallet survives but the once-issued project
+ * keys did not — this helper mints a SHORT-LIVED anon token via
+ * `POST /projects/v1/:project_id/tokens` (the route the platform built as
+ * exactly this recovery path; the gateway's own 401 envelope names it as the
+ * `mint_token` next_action) and uses it as the apikey, memoized in-process
+ * until shortly before it expires. A wallet-holding agent on a fresh machine
+ * deploys with zero extra commands; nothing durable is written anywhere.
+ *
+ * The mint is attempted only on a cache miss and never retried within a
+ * process on failure; a client that cannot mint (no signer, no authority)
+ * falls through to the pre-existing behavior — the request goes out without
+ * an apikey and the gateway rejects with 401, whose envelope names the
+ * recovery.
  */
 async function apikeyHeaders(client, projectId) {
     // A CI session and a delegate both already authorize these routes via
@@ -3886,9 +3897,55 @@ async function apikeyHeaders(client, projectId) {
     if (isCiClient(client) || isDelegateClient(client))
         return {};
     const project = await client.getProject(projectId);
-    if (!project)
-        return {};
-    return { apikey: project.anon_key };
+    if (project?.anon_key)
+        return { apikey: project.anon_key };
+    const minted = await mintedAnonToken(client, projectId);
+    return minted ? { apikey: minted } : {};
+}
+/**
+ * Per-client, per-project memo of short-lived minted anon tokens (plus a
+ * one-shot "minting failed, don't hammer" marker). Held only in process
+ * memory — a short-lived token must never land in a durable cache.
+ */
+const mintedTokenMemo = new WeakMap();
+/** Refresh margin: stop using a minted token this long before it expires. */
+const MINTED_TOKEN_REFRESH_MARGIN_MS = 30_000;
+async function mintedAnonToken(client, projectId) {
+    let perProject = mintedTokenMemo.get(client);
+    if (!perProject) {
+        perProject = new Map();
+        mintedTokenMemo.set(client, perProject);
+    }
+    const memo = perProject.get(projectId);
+    if (memo) {
+        if ("failed" in memo)
+            return null;
+        if (Date.now() < memo.expiresAtMs - MINTED_TOKEN_REFRESH_MARGIN_MS)
+            return memo.token;
+    }
+    try {
+        const issued = await client.request(`/projects/v1/${encodeURIComponent(projectId)}/tokens`, {
+            method: "POST",
+            // Least authority: the apikey-gated deploy legs need exactly what the
+            // anon key carries, never the service key's power.
+            body: { kind: "anon" },
+            context: "minting a short-lived anon token for deploy (local project keys not cached)",
+        });
+        if (!issued?.secret) {
+            perProject.set(projectId, { failed: true });
+            return null;
+        }
+        const ttlMs = (typeof issued.expires_in === "number" && issued.expires_in > 0 ? issued.expires_in : 300) * 1000;
+        perProject.set(projectId, { token: issued.secret, expiresAtMs: Date.now() + ttlMs });
+        return issued.secret;
+    }
+    catch {
+        // No signer, no authority, or the route is unavailable: fall through to
+        // the pre-existing no-apikey behavior. Marked so one deploy's many
+        // apikey-gated legs don't each re-attempt a doomed mint.
+        perProject.set(projectId, { failed: true });
+        return null;
+    }
 }
 function isCiClient(client) {
     return isCiSessionCredentials(client.credentials);