runlayer 0.31.0__tar.gz → 0.31.2__tar.gz

{runlayer-0.31.0 → runlayer-0.31.2}/AGENTS.md

@@ -59,6 +59,8 @@ The AI Watch onedir bundle contains one PyInstaller `aiwatch` exe (`packaging/ai
 
 **Install scope** — `aiwatch setup hooks install` and `aiwatch bootstrap` default to `--mdm` (enterprise config dirs: `/Library/Application Support/Cursor`, `/Library/Application Support/Windsurf`, `/etc/codex/managed_config.toml`, Windows equivalents). Codex's Windows target is the System layer `C:\ProgramData\OpenAI\Codex\{hooks.json,config.toml}` — never SYSTEM's `~/.codex` (systemprofile, read by nobody) and never `managed_config.toml` there (Windows only reads that from `~/.codex`); `_codex_features_toml_file` picks the file, so hooks flag and LLM routing land in the same TOML. Windows MDM also strips Runlayer entries from the console user's legacy `~/.codex/hooks.json` (best-effort, reparse-point preflight). AI Watch scopes wire `"<aiwatch-hook>" hook --client <name>` only when the daemon gate is open and the co-located shim exists; otherwise they wire `"<aiwatch>" hook --client <name>`. On Windows, both install paths emit Claude Code's shell-free exec form (`command` executable + `args`) because shell-form hooks may run under Git Bash or PowerShell. Gemini CLI, VS Code, Windsurf, and Codex get the call-operator form `& "<aiwatch>" hook --client <name>` — a bare quoted string is a PowerShell expression, not an invocation; Copilot CLI's `powershell` field likewise (its `bash` field stays plain). There is no per-client symlink. Windsurf has a real root-owned enterprise dir and Cascade merges system → user → workspace hooks, so MDM scope writes the system `hooks.json` and leaves the user's own file alone. Three clients have no usable enterprise hook dir and instead resolve the console user's home (via `find_console_user_home`): Hermes has no native enterprise dir, Goose hook plugins are user-level (`~/.agents/plugins/runlayer-hooks/hooks/hooks.json`), and Claude Code's enterprise `managed-settings.json` hooks regressed (ENG-3204, hooks don't fire) so MDM-scope writes its user-scope `~/.claude/settings.json` (user hooks still fire) — same as `~/.hermes/config.yaml`. Same auto-install pipeline, just a per-user destination. Revert Claude Code to `managed-settings.json` once the regression is fixed. **Presence gate is scope- and client-dependent** (`hook_install.clients.presence_gates_install`): in MDM scope, enterprise-dir clients (`ENTERPRISE_DIR_CLIENTS`: Cursor, Codex, Copilot CLI, Windsurf, Qwen Code, Gemini CLI) are written and checked unconditionally — the root-owned file is harmless for an absent client, and the executable probe can miss a real install (Cursor.app outside `/Applications`, no `cursor` CLI), which left devices unmonitored (ENG-6643). Console-home clients (`CONSOLE_HOME_CLIENTS`) and every `--user` install still skip when `presence.client_is_installed` fails. Every supported client must be in exactly one of the two sets. Pass `--user` to write per-user `~/.<client>` dirs instead (dev / manual one-shot use). The MDM-scope path is the steady-state contract: macOS bootstrap LaunchDaemon (root) + the Windows `AIWatchHooks` scheduled task (SYSTEM) drive it. **Credential gate** still guards install — `credential_gate.credential_present` must be satisfied before install wires AI clients at the hook. Scan-only removal skips the credential gate so stale hooks can be removed after config changes. A managed `OrgApiKey` satisfies the gate directly (hooks authenticate with the org key; no per-user enroll needed). The legacy enroll-marker path remains for `EnrollmentKey` fleets: in MDM scope the gate also accepts the console user's per-host enrollment marker file `~/.runlayer/.enrolled-<host_key>` (`runlayer_cli/hook_install/console_user.py:has_enrolled_credential_for_host`) — proof the enroll agent ran, even when the actual secret lives in a keychain root can't read. The marker is empty so root can `stat()` it without keychain access.
 
+**Config backups.** Every writer that rewrites a third-party client config (`hook_install/clients.py` writers via `_write_config_with_backup`, `llm_routing._apply_prepared_write`, operator `commands/setup.py::_backup_file`) keeps the previous content beside it as `<stem>.backup_<YYYYMMDD_HHMMSS_ffffff><suffix>` and then prunes to the newest `BACKUP_KEEP` (5) recognized copies (`hook_install/config_backup.py`). AI Watch backups are change-gated — an unchanged reconcile writes nothing — but pruning runs on every successful write so piles left by older builds (which also used a second-only stamp) drain on the next reconcile. Pruning matches only the exact backup name shape, skips anything that is not a regular file, unlinks descriptor-relatively under the console-home anchor in MDM scope, and is best-effort (never fails the install). Runlayer-owned files (Cline scripts, Goose `plugin.json`, the routing credential) are never backed up.
+
 **LLM routing credential.** Reconcile writes helper-based Claude Code / Codex configs (`apiKeyHelper` / `[model_providers.runlayer.auth]`, no secret; see `hook_install/llm_routing.py`) plus the console user's `~/.runlayer/aiwatch/llm-routing-credential` (0600, user-owned, symlinks refused, never backed up, deleted on unroute). `aiwatch credential <client>` (`runlayer_cli/aiwatch_credential.py`, stdlib + `mdm_config` only, pre-typer like `hook`) exchanges it at `POST /api/v1/llm-gateway/device-tokens` within 5 s and one retry, prints the token, and exits 1 with one stderr line on failure. It caches the token in `~/.runlayer/aiwatch/llm-routing-token` (0600, temp file + rename, shared by both clients), re-mints below one 240 s client refresh interval, and deletes the cache on unroute. Clients refresh every 4 min and after a 401.
 
 **aiwatch never reads `~/.runlayer/config.yaml`.** The aiwatch binary resolves host from MDM managed config (`mdm_config.read_managed_config`) and per-user secrets from the keychain only. `config.load_config` / `save_config` / `clear_config` gate on `runtime.is_aiwatch_runtime()` (process flag set at the aiwatch/hook entrypoints, plus the frozen-aiwatch bundle idiom): for aiwatch, `load_config` synthesizes a `Config` from the MDM `Host` (one host entry, url only — keeps `get_secret_for_host`'s keychain lookup live) and `save_config`/`clear_config` are no-ops. `save_config` **returns a `bool`** (`True` persisted, `False` aiwatch no-op) so credential-writing callers (`enroll`, `auth.login`, `bootstrap._enroll_step`, hook lazy enrollment) can detect the case where the keychain write *also* failed (`set_host_credentials` → `False`): then the secret only lives in the in-memory `Config` and is lost. Those callers must warn / fail instead of claiming success, and must not drop the enrollment marker (which would falsely satisfy the bootstrap credential gate). The full `runlayer` CLI is unaffected and reads/writes the YAML as before.

{runlayer-0.31.0 → runlayer-0.31.2}/Makefile

@@ -30,7 +30,7 @@ version-bump:
 	fi
 
 test:
-	uv run pytest
+	uv run pytest -n auto
 
 test-e2e:
 	uv run pytest tests/e2e -m e2e -v --tb=short -n auto

{runlayer-0.31.0 → runlayer-0.31.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runlayer
-Version: 0.31.0
+Version: 0.31.2
 Summary: A command-line interface for running MCP servers via HTTP transport
 Project-URL: Homepage, https://runlayer.com
 Project-URL: Documentation, https://docs.runlayer.com/

{runlayer-0.31.0 → runlayer-0.31.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "runlayer"
-version = "0.31.0"
+version = "0.31.2"
 description = "A command-line interface for running MCP servers via HTTP transport"
 readme = "README.md"
 requires-python = ">=3.10"

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/aiwatch.py

@@ -339,7 +339,7 @@ def _relay_daemon_response(response: "HookResult") -> NoReturn:
 
 def _run_hook_daemon_first() -> None:
     """Use daemon IPC when gated on; preserve consumed stdin for inline fallback."""
-    from runlayer_cli.hook import daemon_client  # noqa: PLC0415 - stdlib-only
+    from runlayer_cli.hook import daemon_client, hook_io  # noqa: PLC0415 - stdlib-only
 
     client_start_ms = _client_start_ms()
     stdin_text: str | None = None
@@ -351,7 +351,7 @@ def _run_hook_daemon_first() -> None:
         daemon_enabled = False
     if daemon_enabled:
         try:
-            stdin_text = sys.stdin.read()
+            stdin_text = hook_io.read_process_stdin()
         except Exception as exc:
             stdin_error = exc
         else:
@@ -365,7 +365,6 @@ def _run_hook_daemon_first() -> None:
         _relay_daemon_response(response)
 
     _inject_truststore()
-    from runlayer_cli.hook import hook_io  # noqa: PLC0415
     from runlayer_cli.hook.dispatch import run_hook  # noqa: PLC0415
 
     if stdin_text is None and stdin_error is None:

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/aiwatch_checkin.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import sys
 import time
 from collections.abc import Callable, Mapping
+from typing import Any, Protocol
 
 import httpx
 import structlog
@@ -39,6 +40,65 @@ _SYNC_DETAIL_MAX_ITEM_LEN = 200
 _CHECKIN_RETRY_DELAYS_SECONDS = (0.1, 0.2)
 _CHECKIN_REJECTED_RESPONSE_BODY_MAX_LEN = 500
 
+# Single-form payload keys that describe the device rather than one feature.
+# The batch body carries them once at the top level; everything else in a
+# single-form payload is that feature's entry. Mirrored by the backend's
+# ``AIWatchCheckInDeviceFields`` (contract test on the backend side).
+BATCH_CHECKIN_DEVICE_KEYS: frozenset[str] = frozenset(
+    {
+        "device_id",
+        "hostname",
+        "os",
+        "os_version",
+        "username",
+        "org_device_id",
+        "serial_number",
+        "windows_user_sid",
+        "tools",
+    }
+)
+
+# Failure log event per scan-tick feature. The builders and the batch
+# fallback replay both read from here, so the replay cannot log a different
+# event than the direct single-form path would have.
+_SCAN_LOG_EVENTS: dict[str, str] = {
+    "protect": "aiwatch_protect_checkin_failed",
+    "enforce": "aiwatch_enforce_checkin_failed",
+    "sessions": "aiwatch_sessions_checkin_failed",
+    "daemon": "aiwatch_daemon_checkin_failed",
+    "detect": "aiwatch_detect_checkin_failed",
+}
+
+
+class CheckInSubmitter(Protocol):
+    """The slice of ``RunlayerClient`` the check-in builders depend on."""
+
+    @property
+    def base_url(self) -> str: ...
+
+    def submit_aiwatch_checkin(self, payload: dict[str, Any]) -> dict[str, Any]: ...
+
+
+class _CheckInCollector:
+    """Stand-in submitter that captures single-form payloads instead of sending.
+
+    Lets the scan path reuse every existing check-in builder unchanged and ship
+    the captured payloads in one batch request afterwards.
+    """
+
+    def __init__(self, client: RunlayerClient) -> None:
+        self._client = client
+        self.payloads: list[dict[str, object]] = []
+
+    @property
+    def base_url(self) -> str:
+        return self._client.base_url
+
+    def submit_aiwatch_checkin(self, payload: dict[str, Any]) -> dict[str, Any]:
+        self.payloads.append(payload)
+        return {}
+
+
 _PRIVILEGED_USERNAMES = frozenset(
     {
         "system",
@@ -123,7 +183,7 @@ def _base_payload(
 
 
 def _submit_payload_for_response(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     payload: dict[str, object],
     *,
     log_event: str,
@@ -157,7 +217,7 @@ def _submit_payload_for_response(
 
 
 def _submit_payload(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     payload: dict[str, object],
     *,
     log_event: str,
@@ -206,7 +266,7 @@ def submit_llm_routing_checkin(
 
 
 def _submit_simple_checkin(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     *,
     feature: str,
     status: str,
@@ -233,7 +293,7 @@ def _submit_simple_checkin(
     _submit_payload(client, payload, log_event=log_event)
 
 
-def submit_detect_checkin(client: RunlayerClient, result: ScanResult) -> None:
+def submit_detect_checkin(client: CheckInSubmitter, result: ScanResult) -> None:
     """Record that a scan ran, even when no findings were submitted."""
     payload = _base_payload(
         device_context_dict(result),
@@ -255,10 +315,10 @@ def submit_detect_checkin(client: RunlayerClient, result: ScanResult) -> None:
     # full-CLI hook host deviation: ``None`` (no fresh marker) clears the
     # tenant-side record, so a fixed ``default_host`` self-heals within a scan.
     payload["hook_host_detail"] = _hook_host_detail(client)
-    _submit_payload(client, payload, log_event="aiwatch_detect_checkin_failed")
+    _submit_payload(client, payload, log_event=_SCAN_LOG_EVENTS["detect"])
 
 
-def _hook_host_detail(client: RunlayerClient) -> host_override.HostOverride | None:
+def _hook_host_detail(client: CheckInSubmitter) -> host_override.HostOverride | None:
     """Fresh ``hook_host_override`` marker for the user this scan reports on.
 
     Hooks write it under the user's ``~/.runlayer/state``, and every scan path
@@ -276,16 +336,13 @@ def _hook_host_detail(client: RunlayerClient) -> host_override.HostOverride | No
     marker = host_override.read_marker()
     if marker is None:
         return None
-    destination = getattr(client, "base_url", None)
-    if not isinstance(destination, str):
-        return None
-    if destination.rstrip("/") != marker["managed_host"].rstrip("/"):
+    if client.base_url.rstrip("/") != marker["managed_host"].rstrip("/"):
         return None
     return marker
 
 
 def _submit_hook_validation_checkin(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     *,
     feature: str,
     include_pipeline: bool,
@@ -351,7 +408,7 @@ def submit_detect_error_checkin(
 
 
 def submit_enforce_validation_checkin(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     *,
     ctx: DeviceContext,
     tools: list[InstalledTool],
@@ -373,12 +430,11 @@ def submit_enforce_validation_checkin(
                 status="disabled",
                 ctx=ctx,
                 tools=tools,
-                log_event=f"aiwatch_{feature}_checkin_failed",
+                log_event=_SCAN_LOG_EVENTS[feature],
             )
         return
 
     feature = "enforce"
-    log_event = "aiwatch_enforce_checkin_failed"
     if mode is AIWatchMode.PROTECT:
         # Clear any formerly-active Enforce state before reporting Protect.
         _submit_simple_checkin(
@@ -387,10 +443,9 @@ def submit_enforce_validation_checkin(
             status="disabled",
             ctx=ctx,
             tools=tools,
-            log_event="aiwatch_enforce_checkin_failed",
+            log_event=_SCAN_LOG_EVENTS["enforce"],
         )
         feature = "protect"
-        log_event = "aiwatch_protect_checkin_failed"
     else:
         # Enforce and Protect are mutually exclusive endpoint modes. Clear a
         # formerly-active Protect row before reporting current Enforce health.
@@ -400,7 +455,7 @@ def submit_enforce_validation_checkin(
             status="disabled",
             ctx=ctx,
             tools=tools,
-            log_event="aiwatch_protect_checkin_failed",
+            log_event=_SCAN_LOG_EVENTS["protect"],
         )
 
     _submit_hook_validation_checkin(
@@ -409,12 +464,12 @@ def submit_enforce_validation_checkin(
         include_pipeline=resolve_include_pipeline(False, managed),
         ctx=ctx,
         tools=tools,
-        log_event=log_event,
+        log_event=_SCAN_LOG_EVENTS[feature],
     )
 
 
 def submit_sessions_validation_checkin(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     *,
     ctx: DeviceContext,
     tools: list[InstalledTool],
@@ -430,7 +485,7 @@ def submit_sessions_validation_checkin(
             status="disabled",
             ctx=ctx,
             tools=tools,
-            log_event="aiwatch_sessions_checkin_failed",
+            log_event=_SCAN_LOG_EVENTS["sessions"],
         )
         return
     _submit_hook_validation_checkin(
@@ -439,7 +494,7 @@ def submit_sessions_validation_checkin(
         include_pipeline=True,
         ctx=ctx,
         tools=tools,
-        log_event="aiwatch_sessions_checkin_failed",
+        log_event=_SCAN_LOG_EVENTS["sessions"],
     )
 
 
@@ -581,7 +636,7 @@ def _daemon_degraded_message(detail: Mapping[str, object]) -> str:
 
 
 def submit_daemon_checkin(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     *,
     ctx: DeviceContext,
     tools: list[InstalledTool],
@@ -622,7 +677,7 @@ def submit_daemon_checkin(
         error_message=error_message,
     )
     payload["daemon_detail"] = detail
-    _submit_payload(client, payload, log_event="aiwatch_daemon_checkin_failed")
+    _submit_payload(client, payload, log_event=_SCAN_LOG_EVENTS["daemon"])
 
 
 def _run_isolated(feature: str, run: Callable[[], None]) -> None:
@@ -645,7 +700,7 @@ def _run_isolated(feature: str, run: Callable[[], None]) -> None:
 
 
 def submit_validation_checkins(
-    client: RunlayerClient,
+    client: CheckInSubmitter,
     *,
     ctx: DeviceContext,
     tools: list[InstalledTool],
@@ -666,20 +721,114 @@ def submit_validation_checkins(
     )
 
 
+def build_batch_checkin_payload(
+    ctx: DeviceContext,
+    tools: list[InstalledTool],
+    payloads: list[dict[str, object]],
+) -> dict[str, object]:
+    """Fold single-form payloads into one batch body.
+
+    Every captured payload was built from the same ``ctx`` + ``tools``, so the
+    device half goes out once and each entry keeps only its feature half.
+    """
+    return {
+        **ctx,
+        "tools": tools,
+        "features": [
+            {
+                key: value
+                for key, value in payload.items()
+                if key not in BATCH_CHECKIN_DEVICE_KEYS
+            }
+            for payload in payloads
+        ],
+    }
+
+
+def _submit_batch(client: RunlayerClient, payload: dict[str, object]) -> bool:
+    """Send one batch; True when the single-form path should run instead.
+
+    Falling back covers a backend without the batch route (the client maps
+    that 404 to ``{"unsupported": True}``) and a rejected body (422): one
+    refused feature must not cost the others their liveness, which the
+    sequential path guarantees by construction. Any other failure is final for
+    this tick — replaying five requests against a struggling backend would
+    defeat the batching.
+    """
+    for attempt in range(len(_CHECKIN_RETRY_DELAYS_SECONDS) + 1):
+        try:
+            response = client.submit_aiwatch_checkin_batch(payload)
+        except httpx.HTTPStatusError as exc:
+            status_code = exc.response.status_code
+            logger.warning(
+                "aiwatch_checkin_batch_rejected",
+                status_code=status_code,
+                response_body=exc.response.text[
+                    :_CHECKIN_REJECTED_RESPONSE_BODY_MAX_LEN
+                ],
+            )
+            return status_code == 422
+        except (httpx.TransportError, OSError) as exc:
+            if attempt == len(_CHECKIN_RETRY_DELAYS_SECONDS):
+                logger.warning("aiwatch_checkin_batch_failed", error=str(exc))
+                return False
+            time.sleep(_CHECKIN_RETRY_DELAYS_SECONDS[attempt])
+        except (httpx.HTTPError, ValueError) as exc:
+            logger.warning("aiwatch_checkin_batch_failed", error=str(exc))
+            return False
+        else:
+            if response.get("unsupported"):
+                logger.debug("aiwatch_checkin_batch_unsupported")
+                return True
+            return False
+    return False
+
+
+def _flush_scan_checkins(
+    client: RunlayerClient,
+    *,
+    ctx: DeviceContext,
+    tools: list[InstalledTool],
+    payloads: list[dict[str, object]],
+) -> None:
+    if not payloads:
+        return
+    should_fall_back = _submit_batch(
+        client, build_batch_checkin_payload(ctx, tools, payloads)
+    )
+    if not should_fall_back:
+        return
+    for payload in payloads:
+        _submit_payload(
+            client,
+            payload,
+            log_event=_SCAN_LOG_EVENTS.get(
+                str(payload.get("feature")), "aiwatch_checkin_failed"
+            ),
+        )
+
+
 def submit_all_scan_checkins(client: RunlayerClient, result: ScanResult) -> None:
     """Submit every best-effort AI Watch check-in for a completed scan.
 
     Owns all scan check-in policy: the enforce + sessions hook-validation
     check-ins, the daemon fleet-health check-in, plus the final detect check-in.
     Detect runs last so its current container health wins over MCP ingestion,
-    including when the scan found servers. Each is independently guarded so a transient
-    failure — corrupt MDM config, a network blip — never interrupts the scan.
+    including when the scan found servers. Each is independently guarded so a
+    transient failure — corrupt MDM config, a network blip — never interrupts
+    the scan. The builders write into a collector and the captured payloads go
+    out as one batch request (one request per feature on backends without the
+    batch route), so the per-feature ordering above is preserved either way.
     Callers just hand over the client + scan result.
     """
     ctx = device_context_dict(result)
-    submit_validation_checkins(client, ctx=ctx, tools=result.tools)
+    collector = _CheckInCollector(client)
+    submit_validation_checkins(collector, ctx=ctx, tools=result.tools)
     _run_isolated(
         "daemon",
-        lambda: submit_daemon_checkin(client, ctx=ctx, tools=result.tools),
+        lambda: submit_daemon_checkin(collector, ctx=ctx, tools=result.tools),
+    )
+    _run_isolated("detect", lambda: submit_detect_checkin(collector, result))
+    _flush_scan_checkins(
+        client, ctx=ctx, tools=result.tools, payloads=collector.payloads
     )
-    _run_isolated("detect", lambda: submit_detect_checkin(client, result))

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/api.py

@@ -448,6 +448,22 @@ class RunlayerClient(CatalogClientMixin):
             response.raise_for_status()
             return response.json()
 
+    def submit_aiwatch_checkin_batch(self, payload: dict[str, Any]) -> dict[str, Any]:
+        """Submit several feature check-ins for one device in a single request.
+
+        Returns {"unsupported": True} when the backend predates the batch route
+        so the caller can fall back to one request per feature.
+        """
+        with self._client(timeout=_AIWATCH_CHECKIN_TIMEOUT) as client:
+            response = client.post(
+                f"{self.base_url}/api/v1/ai-watch/check-in/batch",
+                json=payload,
+            )
+            if response.status_code == 404:
+                return {"unsupported": True}
+            response.raise_for_status()
+            return response.json()
+
     def get_aiwatch_config(
         self, *, device_id: str | None = None
     ) -> SyncedAIWatchConfig | None:

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/commands/aiwatch_setup.py

@@ -38,7 +38,11 @@ from runlayer_cli.hook_install.daemon_lifecycle import (
     ensure_daemon_unit,
     ensure_scan_unit,
 )
-from runlayer_cli.hook_install.llm_routing import reconcile_routing, unroute
+from runlayer_cli.hook_install.llm_routing import (
+    probe_gateway,
+    reconcile_routing,
+    unroute,
+)
 from runlayer_cli.install_window import InstallWindowState, install_window_state
 from runlayer_cli.mdm_config import (
     ManagedConfig,
@@ -352,6 +356,7 @@ def _llm_routing_step(
             base_url=_configured_llm_routing_base_url(managed),
             scope=scope,
             fetch_decision=fetch_decision,
+            probe=probe_gateway,
         )
         if outcome is None:
             typer.secho(

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/commands/scan.py

@@ -727,6 +727,16 @@ def _run_scan(
                 fg=typer.colors.YELLOW,
             )
 
+        if submission.backend_incomplete and not quiet:
+            detail = ", ".join(
+                f"{category}/{surface} ({reason})"
+                for category, surface, reason in submission.backend_incomplete
+            )
+            typer.secho(
+                f"{WARN} Submitted; server marked surfaces incomplete: {detail}",
+                fg=typer.colors.YELLOW,
+            )
+
         # The WARN lines above already told the user what happened; here we only
         # act on the exit-code policy the orchestrator computed.
         exit_code = submission.exit_code

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/commands/setup.py

@@ -6,7 +6,6 @@ import platform as plat
 import sys
 from collections.abc import MutableMapping
 from dataclasses import dataclass
-from datetime import datetime
 from enum import Enum
 from pathlib import Path
 from typing import Any, Callable, cast
@@ -54,6 +53,7 @@ from runlayer_cli.hook_install.clients import (
 from runlayer_cli.hook_install.clients import (
     uninstall_client as _hook_install_uninstall_client,
 )
+from runlayer_cli.hook_install.config_backup import backup_path_for, prune_backups
 from runlayer_cli.hook_install.console_user import reown_to_console_user
 from runlayer_cli.hook_install.paths import (
     InstallScope,
@@ -323,17 +323,16 @@ def _backup_file(file_path: Path, *, home: Path | None = None) -> Path | None:
     With *home* set the read/write are link-safe (root MDM writes into the
     user-controlled home can't be redirected by a planted symlink, nor leak a
     root-only file into a user-readable backup — ENG-3217); otherwise plain path
-    ops are used. Returns the backup path, or ``None`` when there is no real file
-    to back up.
+    ops are used. Older backups beyond the retention cap are pruned so repeated
+    installs never pile up. Returns the backup path, or ``None`` when there is
+    no real file to back up.
     """
     data = maybe_safe_read_bytes(file_path, home=home)
     if data is None:
         return None
-    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-    backup_path = file_path.with_name(
-        f"{file_path.stem}.backup_{timestamp}{file_path.suffix}"
-    )
+    backup_path = backup_path_for(file_path)
     maybe_safe_write_bytes(backup_path, data, home=home)
+    prune_backups(file_path, home=home)
     return backup_path
 
 

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/hook/clients.py

@@ -123,6 +123,10 @@ def normalize_event_name(event: str) -> str:
 # output can carry sensitive data just like a successful tool's result.
 _POST_TOOL_EVENTS = frozenset({"PostToolUse", "PostToolUseFailure"})
 
+# Session events whose hook output may add model-visible context.
+_CONTEXT_EVENTS = frozenset({"SessionStart", "UserPromptSubmit"})
+_CONTEXT_CLIENTS = frozenset({Client.CLAUDE_CODE, Client.CODEX})
+
 # Cline parses stdout by scanning for lines prefixed ``HOOK_CONTROL\t`` (last one
 # wins). If NO prefixed line exists it instead requires the entire trimmed stdout
 # to be valid JSON, so any incidental logging would corrupt the decision. Always
@@ -489,7 +493,16 @@ def should_noop_for_devin(client: Client, *, tool_name: str = "") -> bool:
         return False
     if tool_name in _CLAUDE_CODE_BUILTIN_TOOLS:
         return False
-    if tool_name not in _DEVIN_BUILTIN_TOOLS and hook_io.getenv("CLAUDECODE"):
+    # ``CLAUDECODE`` is a per-invocation marker Claude Code exports to the
+    # subprocesses it spawns; its absence in the forwarded request env means
+    # "this request did not come from a nested Claude Code host." Read it
+    # forwarded-only so a daemon that inherited ``CLAUDECODE`` into its own
+    # long-lived ``os.environ`` cannot poison every daemon-served request for
+    # its lifetime -- the inline path (no ``HookIO`` or not daemon-served)
+    # still falls through to ``os.environ`` for a real nested host.
+    if tool_name not in _DEVIN_BUILTIN_TOOLS and hook_io.getenv(
+        "CLAUDECODE", forwarded_only=True
+    ):
         return False
     return True
 
@@ -745,6 +758,22 @@ class HookResponse:
             return _cline_control({"overrideInput": tool_input})
         return None
 
+    def allow_with_context(self, context: str) -> str | None:
+        """Allow a session event and add model-visible context.
+
+        Claude Code and Codex share the ``hookSpecificOutput.additionalContext``
+        contract on session start and prompt submit.
+        """
+        if self._client in _CONTEXT_CLIENTS and self._event in _CONTEXT_EVENTS:
+            return json.dumps(
+                {
+                    "hookSpecificOutput": {
+                        "hookEventName": self._event,
+                        "additionalContext": context,
+                    }
+                }
+            )
+
     def allow_with_notice(self, notice: str) -> str | None:
         """Allow carrying a user-visible one-liner, or ``None`` when this client
         has no such channel (Claude Code documents ``systemMessage`` as a common

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/hook/daemon_protocol.py

@@ -60,6 +60,9 @@ HOOK_ENV_ALLOWLIST = frozenset(
         # Retry kill switch: read at send time in relay._post; must ride the
         # request env or daemon-served hooks silently keep the default retries.
         "RUNLAYER_HOOK_RETRIES",
+        # Plugin routing-context kill switch (hook/plugin_context.py): same
+        # reason as the gzip switch above.
+        "RUNLAYER_PLUGIN_CONTEXT",
         "USERPROFILE",
     }
 )

{runlayer-0.31.0 → runlayer-0.31.2}/runlayer_cli/hook/dispatch.py

@@ -66,6 +66,7 @@ from runlayer_cli.hook.relay import (
     uses_managed_credential,
 )
 from runlayer_cli.hook.windsurf_payload import adapt_windsurf_payload
+from runlayer_cli.hook.plugin_context import build_plugin_context
 from runlayer_cli.mdm_config import (
     AIWatchMode,
     resolve_install_hooks,
@@ -1144,6 +1145,34 @@ def _handle_permission_request(ctx: _DispatchCtx) -> None:
     _write(ctx.resp.allow())
 
 
+_PLUGIN_CONTEXT_CLIENTS = frozenset({Client.CLAUDE_CODE, Client.CODEX})
+
+
+def _plugin_context_output(ctx: _DispatchCtx) -> str | None:
+    """Session/prompt output carrying Runlayer Plugin routing rules.
+
+    None when the client or event has no context slot, or the built-in plugin
+    is not configured for this session, so callers fall back to plain allow.
+    """
+    if ctx.client not in _PLUGIN_CONTEXT_CLIENTS or ctx.hook_type not in (
+        "SessionStart",
+        "UserPromptSubmit",
+    ):
+        return None
+    cwd = ctx.input_data.get("cwd", "") or hook_io.getcwd()
+    context = build_plugin_context(ctx.client, cwd)
+    if context is None:
+        return None
+    return ctx.resp.allow_with_context(context)
+
+
+def _handle_session_start(ctx: _DispatchCtx) -> None:
+    forward_event(
+        ctx.client.value, ctx.original_hook_type, ctx.input_data, debug=ctx.debug
+    )
+    _write(_plugin_context_output(ctx) or ctx.resp.observational())
+
+
 def _handle_session_event(ctx: _DispatchCtx) -> None:
     if ctx.hook_type == "UserPromptSubmit" and ctx.client in (
         Client.CLAUDE_CODE,
@@ -1153,7 +1182,7 @@ def _handle_session_event(ctx: _DispatchCtx) -> None:
     forward_event(
         ctx.client.value, ctx.original_hook_type, ctx.input_data, debug=ctx.debug
     )
-    _write(ctx.resp.allow())
+    _write(_plugin_context_output(ctx) or ctx.resp.allow())
 
 
 def _handle_post_tool_use(ctx: _DispatchCtx) -> None:
@@ -1359,6 +1388,7 @@ _DISPATCH_TABLE: dict[str, Callable[[_DispatchCtx], None]] = {
     "beforeShellExecution": _handle_shell_execution,
     "BeforeShellExecution": _handle_shell_execution,
     "PermissionRequest": _handle_permission_request,
+    "SessionStart": _handle_session_start,
     "SubagentStart": _handle_session_event,
     "UserPromptSubmit": _handle_session_event,
     "PostToolUse": _handle_post_tool_use,