withruntime 0.33.1 → 0.33.2

package/dist/ci-cli.d.ts

@@ -5,6 +5,6 @@ type Out = {
     write: (text: string) => void;
     error: (text: string) => void;
 };
-export declare const CI_HELP = "runtime ci <command>\n\n  CI/CD checks each push and pull request of a connected GitHub repository in\n  sandboxes, as the steps its config file names. A fork's pull request waits\n  until a writer re-runs it on GitHub. In a private beta: outside it, each\n  command says how to ask to join.\n\n  import [dir] [--write] [--force]            This folder's GitHub Actions workflows and CircleCI\n                                              config as a runtime.yml: printed, or written with\n                                              --write; what isn't carried over is noted at its top.\n                                              Needs no key and sends nothing\n  connect <owner/name> [--branch main] [--config runtime.yml] [--installation <id>]\n          [--trust <app-slug>[bot]]... [--name <name>]\n                                              Connect a repository; prints its id. Takes a full key.\n                                              --trust runs that App's pushes as its own from the start\n  repos [ls] [--all]                          Connected repositories, with the Apps each trusts;\n                                              --all: disconnected ones too\n  repos trust <repoId | owner/name> <app-slug>[bot]...\n                                              Run that App's pushes as the repository's own code,\n                                              keeping the Apps it trusts already\n  repos untrust <repoId | owner/name> <app-slug>[bot]...\n                                              Stop trusting those Apps, keeping the rest\n  disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled\n  ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]\n     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state\n  get <checkId>                               One check and its jobs in plan order\n  cancel <checkId>                            Cancel a queued or running check: its jobs end,\n                                              its machines are let go, GitHub is told\n  logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes\n  tests <repoId> [--quarantined]              Its test files: time, recent outcomes, quarantine\n  flakes [--repository <repoId>] [--all]      Flaky tests: each quarantined (or still gating), its\n                                              owner and 48-hour deadline; --all: ended ones too\n  flake <flakeId>                             One flaky test: its proof, owner, and recent runs\n  flake prove <flakeId>                       Its 100 proof runs again at main's next commit\n  flake hand <flakeId> <login | org/team>     Hand it to someone else\n  flake delete <flakeId> --reason <why>       Say why its test is deleted; it ends once main\n                                              no longer holds the file\n\n  A failed job's sandbox may be kept paused: `runtime sandboxes wake <id>`, then\n  `runtime sandboxes shell <id>` to look around where it failed.\n\nExamples\n  runtime ci import --write\n  runtime ci connect acme/web --config .runtime/ci.yml\n  runtime ci repos trust acme/web acme-bot[bot]\n  runtime ci ls --commit $(git rev-parse HEAD)\n  runtime ci logs <jobId>\n";
+export declare const CI_HELP = "runtime ci <command>\n\n  CI/CD checks each push and pull request of a connected GitHub repository in\n  sandboxes, as the steps its config file names. A fork's pull request waits\n  until a writer re-runs it on GitHub. In a private beta: outside it, each\n  command says how to ask to join.\n\n  import [dir] [--write] [--force]            This folder's GitHub Actions workflows and CircleCI\n                                              config as a runtime.yml: printed, or written with\n                                              --write; what isn't carried over is noted at its top.\n                                              Needs no key and sends nothing\n  connect <owner/name> [--branch main] [--config runtime.yml] [--installation <id>]\n          [--trust <app-slug>[bot]]... [--name <name>]\n                                              Connect a repository; prints its id. Takes a full key.\n                                              --trust runs that App's pushes as its own from the start\n  repos [ls] [--all]                          Connected repositories, with the Apps each trusts;\n                                              --all: disconnected ones too\n  repos trust <repoId | owner/name> <app-slug>[bot]...\n                                              Run that App's pushes as the repository's own code,\n                                              keeping the Apps it trusts already\n  repos untrust <repoId | owner/name> <app-slug>[bot]...\n                                              Stop trusting those Apps, keeping the rest\n  repos undo <repoId | owner/name> on|off     When main's check fails, find the first commit that\n                                              fails it and open a pull request reverting it, which\n                                              lands once its check passes. Off until turned on;\n                                              takes an owner's or admin's full key\n  disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled\n  ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]\n     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state\n  get <checkId>                               One check and its jobs in plan order\n  cancel <checkId>                            Cancel a queued or running check: its jobs end,\n                                              its machines are let go, GitHub is told\n  logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes\n  tests <repoId> [--quarantined]              Its test files: time, recent outcomes, quarantine\n  flakes [--repository <repoId>] [--all]      Flaky tests: each quarantined (or still gating), its\n                                              owner and 48-hour deadline; --all: ended ones too\n  flake <flakeId>                             One flaky test: its proof, owner, and recent runs\n  flake prove <flakeId>                       Its 100 proof runs again at main's next commit\n  flake hand <flakeId> <login | org/team>     Hand it to someone else\n  flake delete <flakeId> --reason <why>       Say why its test is deleted; it ends once main\n                                              no longer holds the file\n\n  A failed job's sandbox may be kept paused: `runtime sandboxes wake <id>`, then\n  `runtime sandboxes shell <id>` to look around where it failed.\n\nExamples\n  runtime ci import --write\n  runtime ci connect acme/web --config .runtime/ci.yml\n  runtime ci repos trust acme/web acme-bot[bot]\n  runtime ci repos undo acme/web on\n  runtime ci ls --commit $(git rev-parse HEAD)\n  runtime ci logs <jobId>\n";
 export declare function ciCommand(argv: string[], out: Out, client: () => Promise<Runtime>, kit: CliKit): Promise<number>;
 export {};

package/dist/ci-cli.js

@@ -25,6 +25,10 @@ export const CI_HELP = `runtime ci <command>
                                               keeping the Apps it trusts already
   repos untrust <repoId | owner/name> <app-slug>[bot]...
                                               Stop trusting those Apps, keeping the rest
+  repos undo <repoId | owner/name> on|off     When main's check fails, find the first commit that
+                                              fails it and open a pull request reverting it, which
+                                              lands once its check passes. Off until turned on;
+                                              takes an owner's or admin's full key
   disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled
   ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]
      [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state
@@ -48,6 +52,7 @@ Examples
   runtime ci import --write
   runtime ci connect acme/web --config .runtime/ci.yml
   runtime ci repos trust acme/web acme-bot[bot]
+  runtime ci repos undo acme/web on
   runtime ci ls --commit $(git rev-parse HEAD)
   runtime ci logs <jobId>
 `;
@@ -181,6 +186,18 @@ export async function ciCommand(argv, out, client, kit) {
                 print(`${repo.repository} trusts ${trusted(repo)}.`, repo);
                 return 0;
             }
+            if (action === "undo") {
+                const id = need(more[0], "the repository's id or owner/name");
+                const say = need(more[1], "on or off");
+                if (say !== "on" && say !== "off")
+                    throw usage(`${say} is neither on nor off: ${me} ci repos undo ${id} on`);
+                const found = await api.repositories.find(id);
+                const repo = await api.repositories.setUndo(found?.id ?? id, say === "on");
+                print(repo.undoCulprits
+                    ? `${repo.repository}: when ${repo.productionBranch}'s check fails, its culprit is found and a pull request reverting it opens.`
+                    : `${repo.repository}: a failing ${repo.productionBranch} is reported, never undone.`, repo);
+                return 0;
+            }
             if (action === "connect")
                 return ciCommand(["connect", ...more], out, client, kit);
             if (action === "disconnect" || action === "rm")
@@ -192,6 +209,7 @@ export async function ciCommand(argv, out, client, kit) {
                     "connect",
                     "trust",
                     "untrust",
+                    "undo",
                     "disconnect",
                 ]);
             const args = parse(listing, ["all"], []);
@@ -201,13 +219,14 @@ export async function ciCommand(argv, out, client, kit) {
             })).toArray(Infinity);
             print(all.length
                 ? table([
-                    ["ID", "REPOSITORY", "BRANCH", "CONFIG", "TRUSTED APPS", "STATE"],
+                    ["ID", "REPOSITORY", "BRANCH", "CONFIG", "TRUSTED APPS", "UNDO", "STATE"],
                     ...all.map((r) => [
                         r.id,
                         r.repository,
                         r.productionBranch,
                         r.configPath,
                         trusted(r),
+                        r.undoCulprits ? "on" : "off",
                         r.state,
                     ]),
                 ])

package/dist/keys.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { privateDecrypt } from "node:crypto";
 import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { connectionOrigins } from "./credentials.js";
@@ -7,6 +7,7 @@ import { RuntimeError } from "./errors.js";
 import { named } from "./cli-name.js";
 import { sandboxIdentityHeaders } from "./identity.js";
 import { describeRoute, envFetch } from "./proxy.js";
+import { sealing } from "./sealing.js";
 const KEY = /^rtcloud_([a-f0-9-]{36})_[A-Za-z0-9_-]{43}$/;
 /** How often to ask whether the owner has answered. The website answers
  * "pending" to anything faster than every 4.5 seconds. */
@@ -79,16 +80,19 @@ export async function createKey(request, env, options = {}) {
     async function post(path, body, key) {
         const address = `${origins.auth}/api/connect/${path}`;
         let response;
+        // The sandbox's identity first: its own lookup has its own deadline, and
+        // the call's 20 s start when the call does.
+        const identity = await sandboxIdentityHeaders();
         try {
             response = await fetcher(address, {
                 method: "POST",
                 redirect: "error",
-                signal: AbortSignal.timeout(20_000),
                 headers: {
                     "content-type": "application/json",
                     ...(key ? { authorization: `Bearer ${key}` } : {}),
-                    ...(await sandboxIdentityHeaders()),
+                    ...identity,
                 },
+                signal: AbortSignal.timeout(20_000),
                 body: JSON.stringify(body),
             });
         }
@@ -101,11 +105,7 @@ export async function createKey(request, env, options = {}) {
             throw failure(response.status === 429 ? "rate_limited" : "key_request_failed", typeof result.error === "string" ? result.error : "Runtime could not take this request.", response.status);
         return result;
     }
-    const pair = await promisify(generateKeyPair)("rsa", {
-        modulusLength: 2048,
-        publicKeyEncoding: { type: "spki", format: "pem" },
-        privateKeyEncoding: { type: "pkcs8", format: "pem" },
-    });
+    const pair = await sealing.pair();
     const started = await post("start", {
         purpose: "key",
         agentName: name,

package/dist/login.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { privateDecrypt } from "node:crypto";
 import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { me, named } from "./cli-name.js";
@@ -7,6 +7,7 @@ import { Runtime } from "./client.js";
 import { checkBrowserOrigins, connectionOrigins, connectionStore } from "./credentials.js";
 import { sandboxIdentityHeaders } from "./identity.js";
 import { describeRoute, envFetch } from "./proxy.js";
+import { sealing } from "./sealing.js";
 class ConnectionError extends Error {
     status;
     constructor(status, message) {
@@ -73,16 +74,19 @@ function connection(env, options) {
     async function request(path, body, key) {
         let response;
         const address = `${origins.auth}/api/connect/${path}`;
+        // The sandbox's identity first: its own lookup has its own deadline, and
+        // the call's 20 s start when the call does.
+        const identity = await sandboxIdentityHeaders();
         try {
             response = await fetcher(address, {
                 method: "POST",
                 redirect: "error",
-                signal: AbortSignal.timeout(20_000),
                 headers: {
                     "content-type": "application/json",
                     ...(key ? { authorization: `Bearer ${key}` } : {}),
-                    ...(await sandboxIdentityHeaders()),
+                    ...identity,
                 },
+                signal: AbortSignal.timeout(20_000),
                 body: JSON.stringify(body ?? {}),
             });
         }
@@ -259,11 +263,7 @@ export async function beginDeviceLogin(env, agentName, options = {}) {
     let pending = await store.readPending();
     const resumed = pending !== null;
     if (!pending) {
-        const pair = await promisify(generateKeyPair)("rsa", {
-            modulusLength: 2048,
-            publicKeyEncoding: { type: "spki", format: "pem" },
-            privateKeyEncoding: { type: "pkcs8", format: "pem" },
-        });
+        const pair = await sealing.pair();
         // The computer's own name goes to the approval page beside the code, so an
         // owner can tell this request from a link somebody else started.
         const started = await request("start", {

package/dist/products/ci.d.ts

@@ -27,6 +27,9 @@ export type CiRepository = {
     /** The GitHub Apps (`<app-slug>[bot]`, lowercase, sorted) whose pushes run
      * as the code of someone who can write. */
     trustedApps: string[];
+    /** Whether a red production branch's culprit is undone by a pull request
+     * CI/CD opens: off until `setUndo` turns it on. */
+    undoCulprits: boolean;
     state: "connected" | "disconnected";
 };
 export type ConnectCiRepository = {
@@ -302,6 +305,12 @@ export declare function ci(t: Transport): {
         trust: (id: string, apps: string[], options?: RequestOptions) => Promise<CiRepository>;
         /** Takes Apps off those it trusts, keeping the rest. */
         untrust: (id: string, apps: string[], options?: RequestOptions) => Promise<CiRepository>;
+        /** Turn on (or off) the undo of a red production branch's culprit:
+         * when main's check fails, CI/CD finds the first commit that fails it
+         * and opens a pull request reverting it, which lands once its own
+         * check passes. Off until set; only an owner's or admin's full key
+         * sets it. */
+        setUndo: (id: string, on: boolean, options?: RequestOptions) => Promise<CiRepository>;
         /** Disconnect: its checks still going are cancelled; what ended stays. */
         disconnect: (id: string, options?: RequestOptions) => Promise<CiRepository>;
     };

package/dist/products/ci.js

@@ -61,6 +61,17 @@ export function ci(t) {
                 const drop = new Set(apps.map((a) => a.toLowerCase()));
                 return setTrustedApps(repo.id, repo.trustedApps.filter((a) => !drop.has(a)), options);
             },
+            /** Turn on (or off) the undo of a red production branch's culprit:
+             * when main's check fails, CI/CD finds the first commit that fails it
+             * and opens a pull request reverting it, which lands once its own
+             * check passes. Off until set; only an owner's or admin's full key
+             * sets it. */
+            setUndo: (id, on, options) => t.json({
+                method: "POST",
+                path: `${at("/v1/ci/repositories", id)}:update`,
+                body: { undoCulprits: on },
+                ...options,
+            }),
             /** Disconnect: its checks still going are cancelled; what ended stays. */
             disconnect: (id, options) => t.json({
                 method: "DELETE",

package/dist/sealing.d.ts

@@ -0,0 +1,6 @@
+export declare const sealing: {
+    pair: () => Promise<{
+        publicKey: string;
+        privateKey: string;
+    }>;
+};

package/dist/sealing.js

@@ -0,0 +1,14 @@
+import { generateKeyPair } from "node:crypto";
+import { promisify } from "node:util";
+/* The key pair a browser approval seals its answer to (RSA-OAEP, SHA-256):
+   a login's credential, or a key asked for with `keys create`. Made fresh
+   for each request, so only this process can open what the page sends. An
+   object, so a test file can make one pair and reuse it: each takes 80 ms of
+   CPU to make, most of the login and key tests' time (24 October 2026). */
+export const sealing = {
+    pair: () => promisify(generateKeyPair)("rsa", {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    }),
+};

package/dist/transport.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeError } from "./errors.js";
-export declare const VERSION = "0.33.1";
+export declare const VERSION = "0.33.2";
 export declare const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { ConnectionError, DELIBERATE, errorFor, NOTHING_RAN, RuntimeError, WAITS_FOR_ROOM, } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket, untrustedCertificate } from "./proxy.js";
 import { warningText } from "./product-renames.js";
-export const VERSION = "0.33.1";
+export const VERSION = "0.33.2";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",