withruntime 0.33.1 → 0.33.3

package/dist/ci-cli.d.ts

@@ -5,6 +5,6 @@ type Out = {
     write: (text: string) => void;
     error: (text: string) => void;
 };
-export declare const CI_HELP = "runtime ci <command>\n\n  CI/CD checks each push and pull request of a connected GitHub repository in\n  sandboxes, as the steps its config file names. A fork's pull request waits\n  until a writer re-runs it on GitHub. In a private beta: outside it, each\n  command says how to ask to join.\n\n  import [dir] [--write] [--force]            This folder's GitHub Actions workflows and CircleCI\n                                              config as a runtime.yml: printed, or written with\n                                              --write; what isn't carried over is noted at its top.\n                                              Needs no key and sends nothing\n  connect <owner/name> [--branch main] [--config runtime.yml] [--installation <id>]\n          [--trust <app-slug>[bot]]... [--name <name>]\n                                              Connect a repository; prints its id. Takes a full key.\n                                              --trust runs that App's pushes as its own from the start\n  repos [ls] [--all]                          Connected repositories, with the Apps each trusts;\n                                              --all: disconnected ones too\n  repos trust <repoId | owner/name> <app-slug>[bot]...\n                                              Run that App's pushes as the repository's own code,\n                                              keeping the Apps it trusts already\n  repos untrust <repoId | owner/name> <app-slug>[bot]...\n                                              Stop trusting those Apps, keeping the rest\n  disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled\n  ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]\n     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state\n  get <checkId>                               One check and its jobs in plan order\n  cancel <checkId>                            Cancel a queued or running check: its jobs end,\n                                              its machines are let go, GitHub is told\n  logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes\n  tests <repoId> [--quarantined]              Its test files: time, recent outcomes, quarantine\n  flakes [--repository <repoId>] [--all]      Flaky tests: each quarantined (or still gating), its\n                                              owner and 48-hour deadline; --all: ended ones too\n  flake <flakeId>                             One flaky test: its proof, owner, and recent runs\n  flake prove <flakeId>                       Its 100 proof runs again at main's next commit\n  flake hand <flakeId> <login | org/team>     Hand it to someone else\n  flake delete <flakeId> --reason <why>       Say why its test is deleted; it ends once main\n                                              no longer holds the file\n\n  A failed job's sandbox may be kept paused: `runtime sandboxes wake <id>`, then\n  `runtime sandboxes shell <id>` to look around where it failed.\n\nExamples\n  runtime ci import --write\n  runtime ci connect acme/web --config .runtime/ci.yml\n  runtime ci repos trust acme/web acme-bot[bot]\n  runtime ci ls --commit $(git rev-parse HEAD)\n  runtime ci logs <jobId>\n";
+export declare const CI_HELP = "runtime ci <command>\n\n  CI/CD checks each push and pull request of a connected GitHub repository in\n  sandboxes, as the steps its config file names. A fork's pull request runs\n  nothing; a writer can open it again from a branch of the repository. In a\n  private beta: outside it, each command says how to ask to join.\n\n  import [dir] [--write] [--force]            This folder's GitHub Actions workflows and CircleCI\n                                              config as a runtime.yml: printed, or written with\n                                              --write; what isn't carried over is noted at its top.\n                                              Needs no key and sends nothing\n  connect <owner/name> [--branch main] [--config runtime.yml] [--installation <id>]\n          [--trust <app-slug>[bot]]... [--name <name>]\n                                              Connect a repository; prints its id. Takes a full key.\n                                              --trust runs that App's pushes as its own from the start\n  repos [ls] [--all]                          Connected repositories, with the Apps each trusts;\n                                              --all: disconnected ones too\n  repos trust <repoId | owner/name> <app-slug>[bot]...\n                                              Run that App's pushes as the repository's own code,\n                                              keeping the Apps it trusts already\n  repos untrust <repoId | owner/name> <app-slug>[bot]...\n                                              Stop trusting those Apps, keeping the rest\n  repos undo <repoId | owner/name> on|off     When main's check fails, find the first commit that\n                                              fails it and open a pull request reverting it, which\n                                              lands once its check passes. Off until turned on;\n                                              takes an owner's or admin's full key\n  disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled\n  checks [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]\n     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state (or ls)\n  check <checkId>                             One check and its jobs in plan order (or get)\n  cancel <checkId>                            Cancel a queued or running check: its jobs end,\n                                              its machines are let go, GitHub is told\n  logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes\n  tests <repoId> [--quarantined]              Its test files: time, recent outcomes, quarantine\n  flakes [--repository <repoId>] [--all]      Flaky tests: each quarantined (or still gating), its\n                                              owner and 48-hour deadline; --all: ended ones too\n  flake <flakeId>                             One flaky test: its proof, owner, and recent runs\n  flake prove <flakeId>                       Its 100 proof runs again at main's next commit\n  flake hand <flakeId> <login | org/team>     Hand it to someone else\n  flake delete <flakeId> --reason <why>       Say why its test is deleted; it ends once main\n                                              no longer holds the file\n  releases [--repository <repoId>] [--commit <sha>] [--limit 50]\n                                              A release's steps as they were taken, oldest\n                                              first: migrations, deploys, servers, waits\n\n  A failed job's sandbox may be kept paused: `runtime sandboxes wake <id>`, then\n  `runtime sandboxes shell <id>` to look around where it failed. A key reads the\n  checks of repositories its own agent connected; an account-wide key reads and\n  cancels every check of the account (switch one at withruntime.com/account/keys).\n\nExamples\n  runtime ci import --write\n  runtime ci connect acme/web --config .runtime/ci.yml\n  runtime ci repos trust acme/web acme-bot[bot]\n  runtime ci repos undo acme/web on\n  runtime ci checks --commit $(git rev-parse HEAD)\n  runtime ci cancel <checkId>\n  runtime ci logs <jobId>\n";
 export declare function ciCommand(argv: string[], out: Out, client: () => Promise<Runtime>, kit: CliKit): Promise<number>;
 export {};

package/dist/ci-cli.js

@@ -6,9 +6,9 @@ import { ci, } from "./products/ci.js";
 export const CI_HELP = `runtime ci <command>
 
   CI/CD checks each push and pull request of a connected GitHub repository in
-  sandboxes, as the steps its config file names. A fork's pull request waits
-  until a writer re-runs it on GitHub. In a private beta: outside it, each
-  command says how to ask to join.
+  sandboxes, as the steps its config file names. A fork's pull request runs
+  nothing; a writer can open it again from a branch of the repository. In a
+  private beta: outside it, each command says how to ask to join.
 
   import [dir] [--write] [--force]            This folder's GitHub Actions workflows and CircleCI
                                               config as a runtime.yml: printed, or written with
@@ -25,10 +25,14 @@ export const CI_HELP = `runtime ci <command>
                                               keeping the Apps it trusts already
   repos untrust <repoId | owner/name> <app-slug>[bot]...
                                               Stop trusting those Apps, keeping the rest
+  repos undo <repoId | owner/name> on|off     When main's check fails, find the first commit that
+                                              fails it and open a pull request reverting it, which
+                                              lands once its check passes. Off until turned on;
+                                              takes an owner's or admin's full key
   disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled
-  ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]
-     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state
-  get <checkId>                               One check and its jobs in plan order
+  checks [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]
+     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state (or ls)
+  check <checkId>                             One check and its jobs in plan order (or get)
   cancel <checkId>                            Cancel a queued or running check: its jobs end,
                                               its machines are let go, GitHub is told
   logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes
@@ -40,15 +44,22 @@ export const CI_HELP = `runtime ci <command>
   flake hand <flakeId> <login | org/team>     Hand it to someone else
   flake delete <flakeId> --reason <why>       Say why its test is deleted; it ends once main
                                               no longer holds the file
+  releases [--repository <repoId>] [--commit <sha>] [--limit 50]
+                                              A release's steps as they were taken, oldest
+                                              first: migrations, deploys, servers, waits
 
   A failed job's sandbox may be kept paused: \`runtime sandboxes wake <id>\`, then
-  \`runtime sandboxes shell <id>\` to look around where it failed.
+  \`runtime sandboxes shell <id>\` to look around where it failed. A key reads the
+  checks of repositories its own agent connected; an account-wide key reads and
+  cancels every check of the account (switch one at withruntime.com/account/keys).
 
 Examples
   runtime ci import --write
   runtime ci connect acme/web --config .runtime/ci.yml
   runtime ci repos trust acme/web acme-bot[bot]
-  runtime ci ls --commit $(git rev-parse HEAD)
+  runtime ci repos undo acme/web on
+  runtime ci checks --commit $(git rev-parse HEAD)
+  runtime ci cancel <checkId>
   runtime ci logs <jobId>
 `;
 const when = (ms) => (ms === null ? "-" : new Date(ms).toISOString());
@@ -181,6 +192,18 @@ export async function ciCommand(argv, out, client, kit) {
                 print(`${repo.repository} trusts ${trusted(repo)}.`, repo);
                 return 0;
             }
+            if (action === "undo") {
+                const id = need(more[0], "the repository's id or owner/name");
+                const say = need(more[1], "on or off");
+                if (say !== "on" && say !== "off")
+                    throw usage(`${say} is neither on nor off: ${me} ci repos undo ${id} on`);
+                const found = await api.repositories.find(id);
+                const repo = await api.repositories.setUndo(found?.id ?? id, say === "on");
+                print(repo.undoCulprits
+                    ? `${repo.repository}: when ${repo.productionBranch}'s check fails, its culprit is found and a pull request reverting it opens.`
+                    : `${repo.repository}: a failing ${repo.productionBranch} is reported, never undone.`, repo);
+                return 0;
+            }
             if (action === "connect")
                 return ciCommand(["connect", ...more], out, client, kit);
             if (action === "disconnect" || action === "rm")
@@ -192,6 +215,7 @@ export async function ciCommand(argv, out, client, kit) {
                     "connect",
                     "trust",
                     "untrust",
+                    "undo",
                     "disconnect",
                 ]);
             const args = parse(listing, ["all"], []);
@@ -201,13 +225,14 @@ export async function ciCommand(argv, out, client, kit) {
             })).toArray(Infinity);
             print(all.length
                 ? table([
-                    ["ID", "REPOSITORY", "BRANCH", "CONFIG", "TRUSTED APPS", "STATE"],
+                    ["ID", "REPOSITORY", "BRANCH", "CONFIG", "TRUSTED APPS", "UNDO", "STATE"],
                     ...all.map((r) => [
                         r.id,
                         r.repository,
                         r.productionBranch,
                         r.configPath,
                         trusted(r),
+                        r.undoCulprits ? "on" : "off",
                         r.state,
                     ]),
                 ])
@@ -217,7 +242,8 @@ export async function ciCommand(argv, out, client, kit) {
         case "disconnect":
             return disconnect(need(rest[0], "the repository's id or owner/name"));
         case "ls":
-        case "list": {
+        case "list":
+        case "checks": {
             const args = parse(rest, [], ["repository", "branch", "commit", "pr", "state", "limit"]);
             const commit = flag(args, "commit");
             if (commit !== undefined && !/^([0-9a-f]{40}|[0-9a-f]{64})$/.test(commit))
@@ -254,7 +280,8 @@ export async function ciCommand(argv, out, client, kit) {
                 : "No checks.", all);
             return 0;
         }
-        case "get": {
+        case "get":
+        case "check": {
             const check = await api.checks.get(need(rest[0], "a check's id"));
             const job = (j) => [
                 j.id,
@@ -275,6 +302,11 @@ export async function ciCommand(argv, out, client, kit) {
         }
         case "cancel": {
             const check = await api.checks.cancel(need(rest[0], "a check's id (runtime ci ls)"));
+            // A key that may cancel the check but not read it is told its state alone.
+            if (!("commit" in check)) {
+                print(`${check.id}: ${check.state}`, check);
+                return 0;
+            }
             print(`${check.repository} ${check.commit.slice(0, 12)} ${where(check)}: ${check.state}${check.reason ? ` (${check.reason})` : ""}`, check);
             return 0;
         }
@@ -351,6 +383,30 @@ export async function ciCommand(argv, out, client, kit) {
             ].join("\n"), f);
             return 0;
         }
+        case "releases": {
+            const args = parse(rest, [], ["repository", "commit", "limit"]);
+            const repositoryId = flag(args, "repository");
+            const commit = flag(args, "commit");
+            const limit = flag(args, "limit");
+            const steps = (await api.releases.list({
+                limit: limit ? whole(limit, "--limit") : 50,
+                ...(repositoryId ? { repositoryId } : {}),
+                ...(commit ? { commit } : {}),
+            })).data.reverse();
+            print(steps.length
+                ? table([
+                    ["AT", "RELEASE", "BY", "SERVER", "STEP"],
+                    ...steps.map((s) => [
+                        when(s.at),
+                        s.commit.slice(0, 9),
+                        s.source,
+                        s.host ?? "-",
+                        s.line,
+                    ]),
+                ])
+                : "No release steps.", steps);
+            return 0;
+        }
         case "tests": {
             const args = parse(rest, ["quarantined"], []);
             const repositoryId = need(args.positional[0], "a repository's id (runtime ci repos)");
@@ -379,6 +435,8 @@ export async function ciCommand(argv, out, client, kit) {
         "connect",
         "repos",
         "disconnect",
+        "checks",
+        "check",
         "ls",
         "get",
         "cancel",
@@ -386,6 +444,7 @@ export async function ciCommand(argv, out, client, kit) {
         "tests",
         "flakes",
         "flake",
+        "releases",
     ]);
 }
 /** A review's verdict in words: each finding with its place and fix, then

package/dist/index.d.ts

@@ -82,4 +82,4 @@ export type { Agent, AgentDefinition, AgentEvent, AgentMemoryEntry, AgentMemoryF
 export { AGENT_TEMPLATES, AGENT_USES } from "./products/agents.js";
 export type { AgentsDeployChange, AgentsDeployOptions, AgentsDeployResult, AgentsFile, AgentsFileAgent, AgentsFileTrigger, AgentsSource, } from "./agents-deploy.js";
 export type { Container, ContainerState, CreateContainer, UpdateContainer, } from "./products/containers.js";
-export type { CiFlake, CiFlakeDetail, CiRepository, CiTestResult, ConnectCiRepository, ListCiFlakes, ListCiRepositories, UpdateCiFlake, } from "./products/ci.js";
+export type { CiFlake, CiFlakeDetail, CiReleaseStep, CiRepository, CiTestResult, ConnectCiRepository, ListCiFlakes, ListCiReleaseSteps, ListCiRepositories, UpdateCiFlake, } from "./products/ci.js";

package/dist/keys.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { privateDecrypt } from "node:crypto";
 import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { connectionOrigins } from "./credentials.js";
@@ -7,6 +7,7 @@ import { RuntimeError } from "./errors.js";
 import { named } from "./cli-name.js";
 import { sandboxIdentityHeaders } from "./identity.js";
 import { describeRoute, envFetch } from "./proxy.js";
+import { sealing } from "./sealing.js";
 const KEY = /^rtcloud_([a-f0-9-]{36})_[A-Za-z0-9_-]{43}$/;
 /** How often to ask whether the owner has answered. The website answers
  * "pending" to anything faster than every 4.5 seconds. */
@@ -79,16 +80,19 @@ export async function createKey(request, env, options = {}) {
     async function post(path, body, key) {
         const address = `${origins.auth}/api/connect/${path}`;
         let response;
+        // The sandbox's identity first: its own lookup has its own deadline, and
+        // the call's 20 s start when the call does.
+        const identity = await sandboxIdentityHeaders();
         try {
             response = await fetcher(address, {
                 method: "POST",
                 redirect: "error",
-                signal: AbortSignal.timeout(20_000),
                 headers: {
                     "content-type": "application/json",
                     ...(key ? { authorization: `Bearer ${key}` } : {}),
-                    ...(await sandboxIdentityHeaders()),
+                    ...identity,
                 },
+                signal: AbortSignal.timeout(20_000),
                 body: JSON.stringify(body),
             });
         }
@@ -101,11 +105,7 @@ export async function createKey(request, env, options = {}) {
             throw failure(response.status === 429 ? "rate_limited" : "key_request_failed", typeof result.error === "string" ? result.error : "Runtime could not take this request.", response.status);
         return result;
     }
-    const pair = await promisify(generateKeyPair)("rsa", {
-        modulusLength: 2048,
-        publicKeyEncoding: { type: "spki", format: "pem" },
-        privateKeyEncoding: { type: "pkcs8", format: "pem" },
-    });
+    const pair = await sealing.pair();
     const started = await post("start", {
         purpose: "key",
         agentName: name,

package/dist/login.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { privateDecrypt } from "node:crypto";
 import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { me, named } from "./cli-name.js";
@@ -7,6 +7,7 @@ import { Runtime } from "./client.js";
 import { checkBrowserOrigins, connectionOrigins, connectionStore } from "./credentials.js";
 import { sandboxIdentityHeaders } from "./identity.js";
 import { describeRoute, envFetch } from "./proxy.js";
+import { sealing } from "./sealing.js";
 class ConnectionError extends Error {
     status;
     constructor(status, message) {
@@ -73,16 +74,19 @@ function connection(env, options) {
     async function request(path, body, key) {
         let response;
         const address = `${origins.auth}/api/connect/${path}`;
+        // The sandbox's identity first: its own lookup has its own deadline, and
+        // the call's 20 s start when the call does.
+        const identity = await sandboxIdentityHeaders();
         try {
             response = await fetcher(address, {
                 method: "POST",
                 redirect: "error",
-                signal: AbortSignal.timeout(20_000),
                 headers: {
                     "content-type": "application/json",
                     ...(key ? { authorization: `Bearer ${key}` } : {}),
-                    ...(await sandboxIdentityHeaders()),
+                    ...identity,
                 },
+                signal: AbortSignal.timeout(20_000),
                 body: JSON.stringify(body ?? {}),
             });
         }
@@ -259,11 +263,7 @@ export async function beginDeviceLogin(env, agentName, options = {}) {
     let pending = await store.readPending();
     const resumed = pending !== null;
     if (!pending) {
-        const pair = await promisify(generateKeyPair)("rsa", {
-            modulusLength: 2048,
-            publicKeyEncoding: { type: "spki", format: "pem" },
-            privateKeyEncoding: { type: "pkcs8", format: "pem" },
-        });
+        const pair = await sealing.pair();
         // The computer's own name goes to the approval page beside the code, so an
         // owner can tell this request from a link somebody else started.
         const started = await request("start", {

package/dist/products/ci.d.ts

@@ -27,6 +27,9 @@ export type CiRepository = {
     /** The GitHub Apps (`<app-slug>[bot]`, lowercase, sorted) whose pushes run
      * as the code of someone who can write. */
     trustedApps: string[];
+    /** Whether a red production branch's culprit is undone by a pull request
+     * CI/CD opens: off until `setUndo` turns it on. */
+    undoCulprits: boolean;
     state: "connected" | "disconnected";
 };
 export type ConnectCiRepository = {
@@ -62,7 +65,7 @@ export type CiCheck = {
     /** The GitHub login that pushed, opened or re-ran it. */
     actor: string | null;
     /** The repository's writers' code. A fork's pull request is not, and runs
-     * nothing until a writer re-runs it on GitHub. */
+     * nothing; a writer can open it again from a branch of the repository. */
     trusted: boolean;
     /** Queued for a writer's approval: nothing of it runs. */
     waiting: boolean;
@@ -165,6 +168,12 @@ export type CiReview = {
 export type CiCheckDetail = CiCheck & {
     jobs: CiJob[];
 };
+/** A cancel's answer to a key that may cancel the check but not read it:
+ * its id and state, nothing of its jobs or logs. */
+export type CiCancelled = {
+    id: string;
+    state: CiCheckState;
+};
 /** A job with the tail of its output: at most 256 KiB, the oldest dropped first. */
 export type CiJobDetail = CiJob & {
     log: string;
@@ -288,6 +297,30 @@ export type UpdateCiFlake = {
     owner?: string;
     deleteReason?: string;
 };
+/** One step a release took, as it took it: a migration's copy test or
+ * apply, a deploy ref moved, a server's canary or release, the website's
+ * deploy or promote, or a wait with why. */
+export type CiReleaseStep = {
+    id: number;
+    repositoryId: string;
+    /** The commit this step of the release is of. */
+    commit: string;
+    /** Who took it: `mover` (the release on CI/CD's pass) or the deploy
+     * target that walks it (`hostd`, `controller`, `settings`, `follower`). */
+    source: string;
+    /** The server it was on, when it was on one. */
+    host: string | null;
+    line: string;
+    /** Unix milliseconds. */
+    at: number;
+};
+export type ListCiReleaseSteps = {
+    repositoryId?: string;
+    /** Only this commit's release. */
+    commit?: string;
+    limit?: number;
+    cursor?: string;
+};
 export declare function ci(t: Transport): {
     repositories: {
         /** Connect a GitHub repository for checks. Only a full key connects
@@ -302,6 +335,12 @@ export declare function ci(t: Transport): {
         trust: (id: string, apps: string[], options?: RequestOptions) => Promise<CiRepository>;
         /** Takes Apps off those it trusts, keeping the rest. */
         untrust: (id: string, apps: string[], options?: RequestOptions) => Promise<CiRepository>;
+        /** Turn on (or off) the undo of a red production branch's culprit:
+         * when main's check fails, CI/CD finds the first commit that fails it
+         * and opens a pull request reverting it, which lands once its own
+         * check passes. Off until set; only an owner's or admin's full key
+         * sets it. */
+        setUndo: (id: string, on: boolean, options?: RequestOptions) => Promise<CiRepository>;
         /** Disconnect: its checks still going are cancelled; what ended stays. */
         disconnect: (id: string, options?: RequestOptions) => Promise<CiRepository>;
     };
@@ -311,8 +350,9 @@ export declare function ci(t: Transport): {
         /** A check with its jobs in plan order. */
         get: (id: string, options?: RequestOptions) => Promise<CiCheckDetail>;
         /** Cancel a queued or running check: its jobs end and its machines
-         * are let go. A check that has ended is answered as it is. */
-        cancel: (id: string, options?: RequestOptions) => Promise<CiCheckDetail>;
+         * are let go. A check that has ended is answered as it is; to a key
+         * that may cancel it but not read it, with its id and state alone. */
+        cancel: (id: string, options?: RequestOptions) => Promise<CiCheckDetail | CiCancelled>;
     };
     jobs: {
         /** A job with the tail of its log and the sandboxes it ran in. */
@@ -322,6 +362,11 @@ export declare function ci(t: Transport): {
         /** A repository's test files by name, with their quarantine. */
         list: (repositoryId: string, query?: ListCiTests, options?: RequestOptions) => Promise<Page<CiTest>>;
     };
+    releases: {
+        /** The steps releases took, newest first, of one repository or one
+         * commit: only repositories whose releases CI/CD runs have any. */
+        list: (query?: ListCiReleaseSteps, options?: RequestOptions) => Promise<Page<CiReleaseStep>>;
+    };
     flakes: {
         /** Flaky tests, newest first; `state: ["quarantined", "gating"]`
          * lists the open ones. */

package/dist/products/ci.js

@@ -61,6 +61,17 @@ export function ci(t) {
                 const drop = new Set(apps.map((a) => a.toLowerCase()));
                 return setTrustedApps(repo.id, repo.trustedApps.filter((a) => !drop.has(a)), options);
             },
+            /** Turn on (or off) the undo of a red production branch's culprit:
+             * when main's check fails, CI/CD finds the first commit that fails it
+             * and opens a pull request reverting it, which lands once its own
+             * check passes. Off until set; only an owner's or admin's full key
+             * sets it. */
+            setUndo: (id, on, options) => t.json({
+                method: "POST",
+                path: `${at("/v1/ci/repositories", id)}:update`,
+                body: { undoCulprits: on },
+                ...options,
+            }),
             /** Disconnect: its checks still going are cancelled; what ended stays. */
             disconnect: (id, options) => t.json({
                 method: "DELETE",
@@ -74,7 +85,8 @@ export function ci(t) {
             /** A check with its jobs in plan order. */
             get: (id, options) => t.json({ method: "GET", path: at("/v1/ci/checks", id), ...options }),
             /** Cancel a queued or running check: its jobs end and its machines
-             * are let go. A check that has ended is answered as it is. */
+             * are let go. A check that has ended is answered as it is; to a key
+             * that may cancel it but not read it, with its id and state alone. */
             cancel: (id, options) => t.json({
                 method: "POST",
                 path: `${at("/v1/ci/checks", id)}:cancel`,
@@ -89,6 +101,11 @@ export function ci(t) {
             /** A repository's test files by name, with their quarantine. */
             list: (repositoryId, query = {}, options) => paged("/v1/ci/tests", { ...query, repositoryId }, options),
         },
+        releases: {
+            /** The steps releases took, newest first, of one repository or one
+             * commit: only repositories whose releases CI/CD runs have any. */
+            list: (query = {}, options) => paged("/v1/ci/releases", query, options),
+        },
         flakes: {
             /** Flaky tests, newest first; `state: ["quarantined", "gating"]`
              * lists the open ones. */

package/dist/sealing.d.ts

@@ -0,0 +1,6 @@
+export declare const sealing: {
+    pair: () => Promise<{
+        publicKey: string;
+        privateKey: string;
+    }>;
+};

package/dist/sealing.js

@@ -0,0 +1,14 @@
+import { generateKeyPair } from "node:crypto";
+import { promisify } from "node:util";
+/* The key pair a browser approval seals its answer to (RSA-OAEP, SHA-256):
+   a login's credential, or a key asked for with `keys create`. Made fresh
+   for each request, so only this process can open what the page sends. An
+   object, so a test file can make one pair and reuse it: each takes 80 ms of
+   CPU to make, most of the login and key tests' time (24 October 2026). */
+export const sealing = {
+    pair: () => promisify(generateKeyPair)("rsa", {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    }),
+};

package/dist/transport.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeError } from "./errors.js";
-export declare const VERSION = "0.33.1";
+export declare const VERSION = "0.33.3";
 export declare const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { ConnectionError, DELIBERATE, errorFor, NOTHING_RAN, RuntimeError, WAITS_FOR_ROOM, } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket, untrustedCertificate } from "./proxy.js";
 import { warningText } from "./product-renames.js";
-export const VERSION = "0.33.1";
+export const VERSION = "0.33.3";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.33.1",
+  "version": "0.33.3",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",
@@ -258,7 +258,7 @@
     "llm"
   ],
   "dependencies": {
-    "undici": "^7.29.1",
+    "undici": "^7.30.1",
     "yaml": "^2.8.1"
   },
   "peerDependencies": {