withruntime 0.3.1 → 0.5.0

package/dist/image-context.js

@@ -0,0 +1,176 @@
+import { lstat, readdir, readFile } from "node:fs/promises";
+import { join, relative, resolve, sep } from "node:path";
+import { gzipSync } from "node:zlib";
+import { tarHeader } from "./tar.js";
+/* A Dockerfile's build context, made from a folder the way `docker build`
+ * makes it: every file the .dockerignore does not exclude, in one gzipped tar
+ * archive, with a list of the files and their SHA-256 for the server to
+ * resolve COPY against. The archive is deterministic (sorted, no times, no
+ * owners), so an unchanged folder gives the same chunks and a rebuild
+ * uploads nothing. Node and Bun only: it reads the file system. */
+export const CONTEXT_LIMITS = {
+    /** The archive, compressed: what is uploaded. */
+    bytes: 100 * 1_048_576,
+    files: 20_000,
+    chunkBytes: 1_048_576,
+};
+/** A .dockerignore as Docker reads it: `#` comments, `!` re-includes, `**`
+ * crosses directories, a pattern naming a directory excludes what is in it,
+ * and the last matching pattern decides. The same rules as the server's
+ * (packages/cloud/src/images/dockerfile.ts `dockerignoreFilter`). */
+export function dockerignoreFilter(text) {
+    if (text === undefined || text.trim() === "")
+        return () => false;
+    const rules = [];
+    for (const raw of text.replace(/\r\n?/g, "\n").split("\n")) {
+        let line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const negate = line.startsWith("!");
+        if (negate)
+            line = line.slice(1).trim();
+        line = normalize(line.replace(/^\/+/, "")).replace(/\/+$/, "");
+        if (!line || line === ".")
+            continue;
+        let source = "";
+        for (let i = 0; i < line.length; i++) {
+            const char = line[i];
+            if (char === "*" && line[i + 1] === "*") {
+                if (line[i + 2] === "/") {
+                    source += "(?:.*/)?";
+                    i += 2;
+                }
+                else {
+                    source += ".*";
+                    i += 1;
+                }
+            }
+            else if (char === "*")
+                source += "[^/]*";
+            else if (char === "?")
+                source += "[^/]";
+            else if (char === "[") {
+                const end = line.indexOf("]", i + 1);
+                if (end < 0)
+                    source += "\\[";
+                else {
+                    source += `[${line
+                        .slice(i + 1, end)
+                        .replace(/^!/, "^")
+                        .replace(/\\/g, "\\\\")}]`;
+                    i = end;
+                }
+            }
+            else if (char === "\\" && i + 1 < line.length) {
+                source += line[++i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            }
+            else
+                source += char.replace(/[.+^${}()|\\]/g, "\\$&");
+        }
+        try {
+            rules.push({ negate, regex: new RegExp(`^${source}$`) });
+        }
+        catch {
+            throw new Error(`.dockerignore: invalid pattern ${JSON.stringify(raw.trim())}`);
+        }
+    }
+    return (path) => {
+        const parts = path.split("/");
+        let excluded = false;
+        for (const rule of rules) {
+            let hit = false;
+            for (let n = parts.length; n >= 1 && !hit; n--)
+                hit = rule.regex.test(parts.slice(0, n).join("/"));
+            if (hit)
+                excluded = !rule.negate;
+        }
+        return excluded;
+    };
+}
+/** posix.normalize, without importing a path module into this function. */
+function normalize(path) {
+    const out = [];
+    for (const part of path.split("/")) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..")
+            out.pop();
+        else
+            out.push(part);
+    }
+    return out.join("/") || ".";
+}
+async function sha256(bytes) {
+    const digest = await crypto.subtle.digest("SHA-256", new Uint8Array(bytes));
+    return Buffer.from(digest).toString("hex");
+}
+/** The context of a folder: its .dockerignore (or `<Dockerfile>.dockerignore`)
+ * applied, `.git` left out when there is none. Symbolic links are left out:
+ * COPY reads files. */
+export async function packContext(folder, options = {}) {
+    const root = resolve(folder);
+    let dockerignore = options.dockerignore;
+    if (dockerignore === undefined)
+        for (const candidate of [
+            ...(options.dockerfile ? [`${resolve(root, options.dockerfile)}.dockerignore`] : []),
+            join(root, ".dockerignore"),
+        ]) {
+            dockerignore = await readFile(candidate, "utf8").catch(() => undefined);
+            if (dockerignore !== undefined)
+                break;
+        }
+    const ignored = dockerignoreFilter(dockerignore ?? ".git\n");
+    const reincludes = /^\s*!/m.test(dockerignore ?? "");
+    const files = [];
+    const parts = [];
+    let total = 0;
+    async function walk(directory) {
+        for (const name of (await readdir(directory)).sort()) {
+            const full = join(directory, name);
+            const path = relative(root, full).split(sep).join("/");
+            const info = await lstat(full);
+            if (info.isDirectory()) {
+                // A directory excluded outright is not walked, unless a later `!`
+                // rule could bring something in it back.
+                if (ignored(path) && !reincludes)
+                    continue;
+                await walk(full);
+            }
+            else if (info.isFile()) {
+                if (ignored(path))
+                    continue;
+                if (files.length >= CONTEXT_LIMITS.files)
+                    throw new Error(`The build context has more than ${CONTEXT_LIMITS.files} files. Leave some out with a .dockerignore.`);
+                const data = new Uint8Array(await readFile(full));
+                total += data.length;
+                const mode = info.mode & 0o777;
+                files.push({ path, sha256: await sha256(data), size: data.length, mode });
+                parts.push(tarHeader(path, data.length, mode, "0", "", 0), data);
+                const pad = (512 - (data.length % 512)) % 512;
+                if (pad)
+                    parts.push(new Uint8Array(pad));
+            }
+        }
+    }
+    await walk(root);
+    parts.push(new Uint8Array(1024));
+    const tar = new Uint8Array(parts.reduce((n, p) => n + p.length, 0) || 1024);
+    let offset = 0;
+    for (const part of parts) {
+        tar.set(part, offset);
+        offset += part.length;
+    }
+    const archive = new Uint8Array(gzipSync(tar, { level: 6 }));
+    if (archive.length > CONTEXT_LIMITS.bytes)
+        throw new Error(`The build context is ${Math.ceil(archive.length / 1_048_576)} MiB compressed (${Math.ceil(total / 1_048_576)} MiB of files); the most is ${CONTEXT_LIMITS.bytes / 1_048_576} MiB. Leave build outputs and dependencies out with a .dockerignore.`);
+    return { archive, files, ...(dockerignore === undefined ? {} : { dockerignore }) };
+}
+/** The archive cut into the 1 MiB chunks the server stores by digest. */
+export async function chunkArchive(archive) {
+    const chunks = [];
+    for (let at = 0; at < archive.length; at += CONTEXT_LIMITS.chunkBytes) {
+        const bytes = archive.subarray(at, Math.min(archive.length, at + CONTEXT_LIMITS.chunkBytes));
+        chunks.push({ sha256: await sha256(bytes), bytes });
+    }
+    return { sha256: await sha256(archive), size: archive.length, chunks };
+}

package/dist/index.d.ts

@@ -7,12 +7,16 @@
 import type { Runtime } from "./client.js";
 import { type RuntimeOptions } from "./client.js";
 import { Sandbox as SandboxClass } from "./sandbox.js";
-import type { CreateSandbox } from "./types.js";
+import type { CreateSandbox, KeepAliveOptions } from "./types.js";
 import type { RequestOptions } from "./transport.js";
 export { Runtime, Sandboxes, FeedbackApi, SupportApi, type RuntimeOptions, type SupportReply, } from "./client.js";
 export { Files, Process, Processes, Terminal } from "./sandbox.js";
+export { Tunnel, TunnelStream, type PortForward } from "./tunnel.js";
 export { Page } from "./page.js";
 export type { KeyLimits } from "./products/limits.js";
+export type { AuditEvent, AuditPage } from "./products/audit.js";
+export type { Secret, SetSecret } from "./products/secrets.js";
+export { verifyWebhook, WebhookVerificationError, type MetricPoint, type MetricRange, type OtelExport, type RuntimeEvent, type SandboxMetrics, type Webhook, type WebhookDelivery, type WebhookEventType, } from "./products/observability.js";
 export { Snapshots, type Snapshot, type SnapshotOptions } from "./snapshots.js";
 export { Transport, VERSION, apiOrigin, type RequestOptions, type Call } from "./transport.js";
 export * from "./errors.js";
@@ -20,9 +24,22 @@ export type * from "./types.js";
 /** A sandbox. `Sandbox.create()` uses RUNTIME_API_KEY; `runtime.sandboxes`
  * does the same with an explicit client. */
 export declare class Sandbox extends SandboxClass {
-    /** Creates a sandbox (every field optional) and waits until it is running. */
+    /** Creates a sandbox (every field optional) and waits until it is running.
+     * `keepAlive: true` (or its options) extends its lease in the background
+     * until you stop it; see `sandbox.keepAlive()`. */
     static create(input?: CreateSandbox & {
         wait?: boolean;
+        keepAlive?: boolean | KeepAliveOptions;
+    }, options?: RequestOptions & {
+        client?: Runtime;
+    }): Promise<SandboxClass>;
+    /** The sandbox named `name` in this account, ready to use: running as it
+     * is, woken if it is paused, restarted if it is stopped and persistent, or
+     * created with `input` when no sandbox has the name. `sandbox.info.reused`
+     * says which. The other fields apply only when it is created. */
+    static getOrCreate(name: string, input?: Omit<CreateSandbox, "name" | "getOrCreate"> & {
+        wait?: boolean;
+        keepAlive?: boolean | KeepAliveOptions;
     }, options?: RequestOptions & {
         client?: Runtime;
     }): Promise<SandboxClass>;

package/dist/index.js

@@ -2,17 +2,32 @@ import { defaultClient } from "./client.js";
 import { Sandbox as SandboxClass } from "./sandbox.js";
 export { Runtime, Sandboxes, FeedbackApi, SupportApi, } from "./client.js";
 export { Files, Process, Processes, Terminal } from "./sandbox.js";
+export { Tunnel, TunnelStream } from "./tunnel.js";
 export { Page } from "./page.js";
+export { verifyWebhook, WebhookVerificationError, } from "./products/observability.js";
 export { Snapshots } from "./snapshots.js";
 export { Transport, VERSION, apiOrigin } from "./transport.js";
 export * from "./errors.js";
 /** A sandbox. `Sandbox.create()` uses RUNTIME_API_KEY; `runtime.sandboxes`
  * does the same with an explicit client. */
 export class Sandbox extends SandboxClass {
-    /** Creates a sandbox (every field optional) and waits until it is running. */
+    /** Creates a sandbox (every field optional) and waits until it is running.
+     * `keepAlive: true` (or its options) extends its lease in the background
+     * until you stop it; see `sandbox.keepAlive()`. */
     static async create(input = {}, options = {}) {
         const { client, ...rest } = options;
-        return (client ?? defaultClient()).sandboxes.create(input, rest);
+        const { keepAlive, ...body } = input;
+        const sandbox = await (client ?? defaultClient()).sandboxes.create(body, rest);
+        if (keepAlive)
+            sandbox.keepAlive(keepAlive === true ? {} : keepAlive);
+        return sandbox;
+    }
+    /** The sandbox named `name` in this account, ready to use: running as it
+     * is, woken if it is paused, restarted if it is stopped and persistent, or
+     * created with `input` when no sandbox has the name. `sandbox.info.reused`
+     * says which. The other fields apply only when it is created. */
+    static async getOrCreate(name, input = {}, options = {}) {
+        return Sandbox.create({ ...input, name, getOrCreate: true }, options);
     }
     /** Reconnects to an existing sandbox by id. */
     static async connect(id, options = {}) {

package/dist/keys.d.ts

@@ -0,0 +1,43 @@
+export type KeyAccess = "full" | "read";
+export type KeyRequest = {
+    /** The key's name, and its agent's. */
+    name: string;
+    access: KeyAccess;
+    /** The most its agent may spend in any 24 hours, or null for none. */
+    dailyLimitMicros: number | null;
+};
+export type CreatedKey = KeyRequest & {
+    key: string;
+    keyId: string;
+    agentId: string;
+    orgId: string;
+    /** Always until revoked, as on the keys page. */
+    expires: null;
+};
+export type KeyRequestOptions = {
+    fetch?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    /** Where the link, the code and progress go: standard error, never stdout. */
+    notify?: (message: string) => void;
+    openBrowser?: (url: string) => Promise<void>;
+    /** Whether a person is at this terminal, so a browser is worth opening. */
+    interactive?: boolean;
+    /** What this computer calls itself, shown to the owner beside the code. */
+    machine?: string;
+    /** Runs `cancel` if the command is interrupted before the key arrives;
+     * returns a function that stops listening. */
+    onInterrupt?: (cancel: () => Promise<void>) => () => void;
+};
+/** Whole microdollars from a daily limit typed in dollars ("25", "7.5",
+ * "$1,000.10"), read as digits rather than through a float, from $0.01 to
+ * $1,000,000: the keys page's own rule (apps/cloud-web/src/app/account/keys/limit.ts). */
+export declare function dailyLimitMicros(typed: string): number;
+/**
+ * Asks for a key, waits for an owner to approve it in the browser, and hands
+ * it back with `confirm`, which tells the website it arrived. Call `confirm`
+ * after the key is shown: it clears the sealed copy the website held for
+ * delivery and turns the owner's page to "Key created".
+ */
+export declare function createKey(request: KeyRequest, env: NodeJS.ProcessEnv, options?: KeyRequestOptions): Promise<CreatedKey & {
+    confirm: () => Promise<void>;
+}>;

package/dist/keys.js

@@ -0,0 +1,196 @@
+import { execFile } from "node:child_process";
+import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { hostname } from "node:os";
+import { promisify } from "node:util";
+import { connectionOrigins } from "./credentials.js";
+import { RuntimeError } from "./errors.js";
+import { named } from "./login.js";
+import { describeRoute, envFetch } from "./proxy.js";
+const KEY = /^rtcloud_([a-f0-9-]{36})_[A-Za-z0-9_-]{43}$/;
+/** How often to ask whether the owner has answered. The website answers
+ * "pending" to anything faster than every 4.5 seconds. */
+const POLL_MS = 5000;
+/** Whole microdollars from a daily limit typed in dollars ("25", "7.5",
+ * "$1,000.10"), read as digits rather than through a float, from $0.01 to
+ * $1,000,000: the keys page's own rule (apps/cloud-web/src/app/account/keys/limit.ts). */
+export function dailyLimitMicros(typed) {
+    const text = typed.trim().replace(/^\$/, "").replace(/,/g, "");
+    const parts = text.match(/^(\d{1,7})(?:\.(\d{1,2}))?$/);
+    const cents = parts ? Number(parts[1]) * 100 + Number((parts[2] ?? "").padEnd(2, "0")) : 0;
+    if (cents < 1 || cents > 100_000_000)
+        throw new RuntimeError({
+            code: "usage",
+            status: 0,
+            message: "--daily-limit is an amount in US dollars from 0.01 to 1000000, such as 25.",
+        });
+    return cents * 10_000;
+}
+function failure(code, message, status = 0, hint) {
+    return new RuntimeError({ code, status, message, ...(hint ? { hint } : {}) });
+}
+async function browser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+    const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+    await promisify(execFile)(command, args, { timeout: 10_000 });
+}
+function interrupted(cancel) {
+    const handler = () => {
+        process.stderr.write("\nCanceling the key request.\n");
+        void cancel()
+            .catch(() => undefined)
+            .finally(() => process.exit(130));
+    };
+    process.once("SIGINT", handler);
+    return () => void process.off("SIGINT", handler);
+}
+/**
+ * Asks for a key, waits for an owner to approve it in the browser, and hands
+ * it back with `confirm`, which tells the website it arrived. Call `confirm`
+ * after the key is shown: it clears the sealed copy the website held for
+ * delivery and turns the owner's page to "Key created".
+ */
+export async function createKey(request, env, options = {}) {
+    const name = request.name.trim();
+    if (!name ||
+        request.name.length > 80 ||
+        [...request.name].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+        throw failure("usage", "Give the key a name of up to 80 characters.");
+    if (request.access === "read" && request.dailyLimitMicros !== null)
+        throw failure("usage", "A read-only key cannot spend, so it takes no --daily-limit.");
+    const origins = connectionOrigins(env);
+    const fetcher = options.fetch ?? envFetch;
+    const notify = options.notify ?? ((message) => process.stderr.write(`${message}\n`));
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    // A key asked for here is approved on the page this address serves: only
+    // Runtime's own website, or one on this computer for testing.
+    const local = (origin) => ["localhost", "127.0.0.1", "[::1]"].includes(new URL(origin).hostname);
+    if (!(origins.auth === "https://withruntime.com" || local(origins.auth)))
+        throw failure("usage", "Keys are approved at https://withruntime.com, or at a local test address. Check RUNTIME_AUTH_URL.");
+    async function post(path, body, key) {
+        const address = `${origins.auth}/api/connect/${path}`;
+        let response;
+        try {
+            response = await fetcher(address, {
+                method: "POST",
+                redirect: "error",
+                signal: AbortSignal.timeout(20_000),
+                headers: {
+                    "content-type": "application/json",
+                    ...(key ? { authorization: `Bearer ${key}` } : {}),
+                },
+                body: JSON.stringify(body),
+            });
+        }
+        catch (cause) {
+            const route = options.fetch ? { via: "" } : describeRoute(address, cause, env);
+            throw failure("network_error", `Runtime could not be reached at ${origins.auth}${route.via}.`, 0, route.hint);
+        }
+        const result = (await response.json().catch(() => ({})));
+        if (!response.ok)
+            throw failure(response.status === 429 ? "rate_limited" : "key_request_failed", typeof result.error === "string" ? result.error : "Runtime could not take this request.", response.status);
+        return result;
+    }
+    const pair = await promisify(generateKeyPair)("rsa", {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    });
+    const started = await post("start", {
+        purpose: "key",
+        agentName: name,
+        access: request.access,
+        dailyLimitMicros: request.dailyLimitMicros,
+        machine: options.machine ?? hostname(),
+        publicKey: pair.publicKey,
+    });
+    if (typeof started.verificationUri !== "string" ||
+        typeof started.deviceCode !== "string" ||
+        !/^[A-Za-z0-9_-]{43}$/.test(started.deviceCode) ||
+        typeof started.userCode !== "string" ||
+        !/^[A-F0-9]{4}(-[A-F0-9]{4}){2}$/.test(started.userCode) ||
+        typeof started.expiresAt !== "number" ||
+        !Number.isFinite(started.expiresAt))
+        throw failure("key_request_failed", "Runtime returned an invalid key request.");
+    const link = new URL(started.verificationUri);
+    if (link.origin !== origins.auth ||
+        link.pathname !== "/connect" ||
+        link.username ||
+        link.password ||
+        link.hash ||
+        [...link.searchParams.keys()].some((key) => key !== "code") ||
+        link.searchParams.get("code") !== started.userCode)
+        throw failure("key_request_failed", "Runtime returned an unexpected approval address.");
+    const deviceCode = started.deviceCode;
+    const expiresAt = Math.min(started.expiresAt, Date.now() + 15 * 60_000);
+    notify(`Approve this key in your browser: ${link.href}\nCheck that the page shows code ${started.userCode}. An account owner chooses Create key.\nWaiting for the approval, up to 15 minutes. Stopping this cancels the request.`);
+    if (options.interactive ?? Boolean(process.stderr.isTTY))
+        await (options.openBrowser ?? browser)(link.href).catch(() => notify("Open the link in a browser where an account owner is signed in."));
+    const stop = (options.onInterrupt ?? interrupted)(async () => {
+        await post("token", { deviceCode, action: "cancel" });
+    });
+    try {
+        // One poll past the expiry, because an approval given in its last seconds
+        // is still delivered.
+        for (;;) {
+            await sleep(POLL_MS);
+            const last = Date.now() >= expiresAt;
+            let result;
+            try {
+                result = await post("token", { deviceCode });
+            }
+            catch (error) {
+                // A dropped connection or a busy website is not an answer: ask again.
+                if (!last &&
+                    error instanceof RuntimeError &&
+                    (error.code === "network_error" || error.status >= 500))
+                    continue;
+                throw error;
+            }
+            if (result.status === "pending") {
+                if (last)
+                    break;
+                continue;
+            }
+            if (result.status === "denied")
+                throw failure("key_request_declined", "The key request was declined. No key was created.");
+            if (result.status === "canceled")
+                throw failure("key_request_canceled", "The key request was canceled. No key was issued.");
+            if (result.status === "expired")
+                break;
+            if (result.status !== "connected" ||
+                typeof result.encryptedKey !== "string" ||
+                typeof result.agentId !== "string" ||
+                typeof result.orgId !== "string")
+                throw failure("key_request_failed", "Runtime returned an invalid key.");
+            let key;
+            try {
+                key = privateDecrypt({ key: pair.privateKey, oaepHash: "sha256" }, Buffer.from(result.encryptedKey, "base64")).toString("utf8");
+            }
+            catch {
+                throw failure("key_request_failed", "Could not open the key Runtime returned. Start again.");
+            }
+            const match = KEY.exec(key);
+            if (!match)
+                throw failure("key_request_failed", "Runtime returned an invalid key.");
+            // From here the key is this command's: an interruption must not revoke it.
+            stop();
+            return {
+                name,
+                access: request.access,
+                dailyLimitMicros: request.dailyLimitMicros,
+                key,
+                keyId: match[1],
+                agentId: result.agentId,
+                orgId: result.orgId,
+                expires: null,
+                confirm: async () => {
+                    await post("confirm", {}, key).catch(() => notify("The key works, but Runtime did not hear that it arrived. The approval page may still say Approved."));
+                },
+            };
+        }
+    }
+    finally {
+        stop();
+    }
+    throw failure("key_request_expired", named("The key request expired before it was approved. Run `runtime keys create` again."));
+}

package/dist/login.js

@@ -1,8 +1,10 @@
 import { execFile } from "node:child_process";
 import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { Runtime } from "./index.js";
 import { connectionOrigins, connectionStore } from "./credentials.js";
+import { describeRoute, envFetch } from "./proxy.js";
 class ConnectionError extends Error {
     status;
     constructor(status, message) {
@@ -71,11 +73,12 @@ async function browser(url) {
 function connection(env, options) {
     const origins = connectionOrigins(env);
     const store = connectionStore(env);
-    const fetcher = options.fetch ?? fetch;
+    const fetcher = options.fetch ?? envFetch;
     async function request(path, body, key) {
         let response;
+        const address = `${origins.auth}/api/connect/${path}`;
         try {
-            response = await fetcher(`${origins.auth}/api/connect/${path}`, {
+            response = await fetcher(address, {
                 method: "POST",
                 redirect: "error",
                 signal: AbortSignal.timeout(20_000),
@@ -86,8 +89,15 @@ function connection(env, options) {
                 body: JSON.stringify(body ?? {}),
             });
         }
-        catch {
-            throw new ConnectionError(503, "Runtime could not be reached. Retry the connection.");
+        catch (cause) {
+            const route = options.fetch ? { via: "" } : describeRoute(address, cause, env);
+            throw new ConnectionError(503, route.hint
+                ? `Runtime could not be reached at ${origins.auth}${route.via}. ${route.hint}`
+                : "Runtime could not be reached. Retry the connection.");
+        }
+        if (response.status === 407 && !options.fetch) {
+            const route = describeRoute(address, 407, env);
+            throw new ConnectionError(503, `Runtime could not be reached at ${origins.auth}${route.via}. ${route.hint ?? ""}`.trim());
         }
         if (!response.ok)
             throw new ConnectionError(response.status, response.status === 401
@@ -154,9 +164,14 @@ export async function authenticationCommand(args, env, options = {}) {
     let noBrowser = false;
     let withKey = false;
     let wait;
+    // `runtime account add`: connect another account even though this machine
+    // is connected already; the one in use is kept among the saved accounts.
+    let another = false;
     for (let i = 0; i < rest.length; i++) {
         if (rest[i] === "--no-browser")
             noBrowser = true;
+        else if (rest[i] === "--another-account")
+            another = true;
         else if (rest[i] === "--with-key")
             withKey = true;
         else if (rest[i] === "--wait")
@@ -203,7 +218,7 @@ export async function authenticationCommand(args, env, options = {}) {
         }).usage();
         return { connected: true, source: "environment" };
     }
-    const saved = await store.read();
+    const saved = another ? null : await store.read();
     if (saved) {
         try {
             await request("confirm", undefined, saved.key);
@@ -268,7 +283,13 @@ export async function beginDeviceLogin(env, agentName, options = {}) {
             publicKeyEncoding: { type: "spki", format: "pem" },
             privateKeyEncoding: { type: "pkcs8", format: "pem" },
         });
-        const started = await request("start", { agentName, publicKey: pair.publicKey });
+        // The computer's own name goes to the approval page beside the code, so an
+        // owner can tell this request from a link somebody else started.
+        const started = await request("start", {
+            agentName,
+            publicKey: pair.publicKey,
+            machine: hostname(),
+        });
         if (typeof started.verificationUri !== "string" ||
             typeof started.deviceCode !== "string" ||
             !/^[A-Za-z0-9_-]{43}$/.test(started.deviceCode) ||

package/dist/mcp.d.ts

@@ -1,8 +1,8 @@
 /** Bridges an MCP client that speaks stdio to Runtime's hosted MCP endpoint.
  * Newline-delimited JSON-RPC in, the same out; every message is forwarded as
  * it is, so the server's tools, schemas and `instructions` reach the client
- * unchanged, and nothing here keeps a second catalogue. No dependencies:
- * starting it costs a process and one TLS connection.
+ * unchanged, and nothing here keeps a second catalogue. Starting it costs a
+ * process and one TLS connection (undici loads only behind a proxy).
  *
  * With no key on this machine it does not fail: it serves one tool,
  * runtime_connect, that walks the agent and its person through the browser

package/dist/mcp.js

@@ -2,6 +2,7 @@ import process from "node:process";
 import { resolveCredential } from "./credentials.js";
 import { RuntimeError } from "./errors.js";
 import { beginDeviceLogin } from "./login.js";
+import { envFetch } from "./proxy.js";
 import { apiOrigin, VERSION } from "./transport.js";
 const CONNECT_INSTRUCTIONS = "Runtime is not connected on this machine yet. Call runtime_connect: it gives you a link and a code for the person you work for to approve in their browser (no key to copy). Once they have, call runtime_connect again; Runtime's tools then appear (sandboxes, commands, files and the rest).";
 const connectTool = {
@@ -13,8 +14,8 @@ const connectTool = {
 /** Bridges an MCP client that speaks stdio to Runtime's hosted MCP endpoint.
  * Newline-delimited JSON-RPC in, the same out; every message is forwarded as
  * it is, so the server's tools, schemas and `instructions` reach the client
- * unchanged, and nothing here keeps a second catalogue. No dependencies:
- * starting it costs a process and one TLS connection.
+ * unchanged, and nothing here keeps a second catalogue. Starting it costs a
+ * process and one TLS connection (undici loads only behind a proxy).
  *
  * With no key on this machine it does not fail: it serves one tool,
  * runtime_connect, that walks the agent and its person through the browser
@@ -22,7 +23,7 @@ const connectTool = {
  * So `claude mcp add runtime -- npx -y withruntime mcp` is the whole
  * setup. */
 export async function serveMcp(env = process.env, options = {}) {
-    const fetcher = options.fetch ?? fetch;
+    const fetcher = options.fetch ?? envFetch;
     let key;
     try {
         key = await resolveCredential(env);