runtime-sdk 0.4.37__tar.gz → 0.4.39__tar.gz

{runtime_sdk-0.4.37 → runtime_sdk-0.4.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runtime-sdk
-Version: 0.4.37
+Version: 0.4.39
 Summary: Runtime Python SDK and CLI
 Project-URL: Repository, https://github.com/The-Money-Company-Limited/runtimevm
 Project-URL: Issues, https://github.com/The-Money-Company-Limited/runtimevm/issues
@@ -79,6 +79,8 @@ runtime create myapp --command "python3 app.py" --cwd /home/ubuntu --port 3000
 runtime enter <name-or-id>         # open an interactive shell; accepts slug/name or computer id
 runtime enter <name-or-id> -- claude   # open a real TTY and run an interactive command
 runtime enter <name-or-id> -- python   # use enter for REPLs, agents, prompts, and full-screen apps
+runtime ssh <name-or-id>           # open SSH through Runtime's authenticated tunnel
+runtime ssh <name-or-id> -- uptime # run a command with the local ssh client
 runtime list
 runtime info <id>
 runtime share public <id>
@@ -196,6 +198,10 @@ runtime switch -c feature/search --repo owner/repo --from main
 Rules:
 - GitHub must already be connected with `runtime integrate github`.
 - Run `runtime integrate github` again when you want to add another personal account or org.
+- New GitHub connects require user authorization during installation and
+  `GITHUB_APP_CLIENT_ID` / `GITHUB_APP_CLIENT_SECRET` on the Runtime API.
+  In GitHub App settings, enable user authorization during installation and set
+  the callback URL to `https://api.runruntime.dev/github/callback`.
 - `runtime switch` opens an existing branch workspace, or creates the computer if
   the branch exists but the workspace does not yet.
 - `runtime switch -c` creates a new branch first, then opens that branch's

{runtime_sdk-0.4.37 → runtime_sdk-0.4.39}/README.md

@@ -57,6 +57,8 @@ runtime create myapp --command "python3 app.py" --cwd /home/ubuntu --port 3000
 runtime enter <name-or-id>         # open an interactive shell; accepts slug/name or computer id
 runtime enter <name-or-id> -- claude   # open a real TTY and run an interactive command
 runtime enter <name-or-id> -- python   # use enter for REPLs, agents, prompts, and full-screen apps
+runtime ssh <name-or-id>           # open SSH through Runtime's authenticated tunnel
+runtime ssh <name-or-id> -- uptime # run a command with the local ssh client
 runtime list
 runtime info <id>
 runtime share public <id>
@@ -174,6 +176,10 @@ runtime switch -c feature/search --repo owner/repo --from main
 Rules:
 - GitHub must already be connected with `runtime integrate github`.
 - Run `runtime integrate github` again when you want to add another personal account or org.
+- New GitHub connects require user authorization during installation and
+  `GITHUB_APP_CLIENT_ID` / `GITHUB_APP_CLIENT_SECRET` on the Runtime API.
+  In GitHub App settings, enable user authorization during installation and set
+  the callback URL to `https://api.runruntime.dev/github/callback`.
 - `runtime switch` opens an existing branch workspace, or creates the computer if
   the branch exists but the workspace does not yet.
 - `runtime switch -c` creates a new branch first, then opens that branch's

{runtime_sdk-0.4.37 → runtime_sdk-0.4.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "runtime-sdk"
-version = "0.4.37"
+version = "0.4.39"
 description = "Runtime Python SDK and CLI"
 readme = "README.md"
 requires-python = ">=3.11"

{runtime_sdk-0.4.37 → runtime_sdk-0.4.39}/scripts/runtime_sdk/cli.py

@@ -1,13 +1,16 @@
 from __future__ import annotations
 
 import argparse
+import base64
 import contextlib
 import difflib
 import importlib
 import json
 import os
+import pty
 import re
 import select
+import secrets
 import shlex
 import shutil
 import signal
@@ -197,6 +200,25 @@ def build_parser() -> argparse.ArgumentParser:
     secrets_delete = secrets_subparsers.add_parser("delete", aliases=["rm"], help="Delete a secret set")
     secrets_delete.add_argument("slug", nargs="?", default=None, help="Secret set slug")
 
+    codex_cmd = subparsers.add_parser("codex", help="Log Codex into Runtime computers")
+    codex_subparsers = codex_cmd.add_subparsers(dest="codex_action", required=True)
+    codex_login = codex_subparsers.add_parser("login", help="Open Codex login and save it to Runtime")
+    codex_login.add_argument("--device", action="store_true", help="Use Codex device-code login")
+    codex_subparsers.add_parser("status", help="Show whether Runtime has Codex login")
+    codex_subparsers.add_parser("logout", help="Remove Runtime's saved Codex login")
+
+    claude_cmd = subparsers.add_parser("claude", help="Log Claude Code into Runtime computers")
+    claude_subparsers = claude_cmd.add_subparsers(dest="claude_action", required=True)
+    claude_subparsers.add_parser("login", help="Open Claude login and save it to Runtime")
+    claude_subparsers.add_parser("status", help="Show whether Runtime has Claude login")
+    claude_subparsers.add_parser("logout", help="Remove Runtime's saved Claude login")
+
+    xai_cmd = subparsers.add_parser("xai", help="Log xAI into Runtime computers")
+    xai_subparsers = xai_cmd.add_subparsers(dest="xai_action", required=True)
+    xai_subparsers.add_parser("login", help="Open xAI login and save it to Runtime")
+    xai_subparsers.add_parser("status", help="Show whether Runtime has xAI login")
+    xai_subparsers.add_parser("logout", help="Remove Runtime's saved xAI login")
+
     github_cmd = subparsers.add_parser("github", help="Manage connected GitHub App installations")
     github_subparsers = github_cmd.add_subparsers(dest="github_action", required=True)
     github_subparsers.add_parser("list", aliases=["ls"], help="List connected GitHub installations")
@@ -248,6 +270,14 @@ def build_parser() -> argparse.ArgumentParser:
     enter_cmd.add_argument("id", nargs="?", default=None, help="Computer ID (hostname)")
     enter_cmd.add_argument("enter_command", nargs="*", help="Command to run in the interactive terminal")
 
+    ssh_cmd = subparsers.add_parser(
+        "ssh",
+        help="SSH into a computer through Runtime",
+        epilog="Extra arguments after the computer id are passed to ssh after the destination.",
+    )
+    ssh_cmd.add_argument("id", nargs="?", default=None, help="Computer ID (hostname)")
+    ssh_cmd.add_argument("ssh_args", nargs=argparse.REMAINDER, help="Remote command or ssh arguments")
+
     info_cmd = subparsers.add_parser("info", help="Get computer details")
     info_cmd.add_argument("id", nargs="?", default=None, help="Computer ID (hostname)")
 
@@ -374,6 +404,15 @@ def build_parser() -> argparse.ArgumentParser:
     service_clear = service_subparsers.add_parser("clear", help="Clear the durable published app service")
     service_clear.add_argument("id", nargs="?", default=None, help="Computer ID (hostname)")
 
+    goal_cmd = subparsers.add_parser("goal", help="Watch email-triggered Codex goal runs")
+    goal_subparsers = goal_cmd.add_subparsers(dest="goal_action", required=True)
+    goal_watch = goal_subparsers.add_parser("watch", help="Stream a goal run from inside a computer")
+    goal_watch.add_argument("id", nargs="?", default=None, help="Computer ID (hostname)")
+    goal_watch.add_argument("--latest", action="store_true", help="Watch the latest known goal run")
+    goal_watch.add_argument("--next", action="store_true", help="Wait for and watch the next goal run")
+    goal_watch.add_argument("--email-id", help="Watch a specific Runtime email id, e.g. eml_...")
+    goal_watch.add_argument("--timeout", type=int, default=0, help="Stop after N seconds (default: no timeout)")
+
     proxy_cmd = subparsers.add_parser("proxy", help="Manage background local port proxies")
     proxy_subparsers = proxy_cmd.add_subparsers(dest="proxy_command", required=True)
     proxy_start = proxy_subparsers.add_parser("start", help="Start one or more background local port proxies")
@@ -416,6 +455,7 @@ _HELP_SECTIONS: tuple[tuple[str, tuple[tuple[str, str], ...]], ...] = (
             ("url [id]", "Show a computer's public URL and live published port"),
             ("start [id]", "Wake a cold computer"),
             ("enter [id] [-- <cmd>]", "Enter a computer's console or interactive TTY command"),
+            ("ssh [id] [-- <cmd>]", "SSH into a computer through Runtime's authenticated tunnel"),
             ("run [id] <cmd>", "Run a one-shot command"),
             ("exec [id] -- <cmd>", "Stream stdout/stderr and optionally pipe stdin"),
             ("publish [id] <port> -- <cmd>", "Run and publish a durable service command"),
@@ -448,6 +488,13 @@ _HELP_SECTIONS: tuple[tuple[str, tuple[tuple[str, str], ...]], ...] = (
             ("service clear [id]", "Clear the durable published app service"),
         ),
     ),
+    (
+        "Goals",
+        (
+            ("goal watch [id] --next", "Stream the next email-triggered Codex goal"),
+            ("goal watch [id] --latest", "Stream the latest email-triggered Codex goal"),
+        ),
+    ),
     (
         "Proxy",
         (
@@ -475,6 +522,9 @@ _HELP_SECTIONS: tuple[tuple[str, tuple[tuple[str, str], ...]], ...] = (
             ("logout", "Revoke API key and remove local config"),
             ("api-keys list/create/revoke", "Manage Runtime API keys"),
             ("secrets list/show/set/import/rm", "Manage account-level secret sets"),
+            ("codex login/status/logout", "Log Codex into Runtime computers"),
+            ("claude login/status/logout", "Log Claude Code into Runtime computers"),
+            ("xai login/status/logout", "Log xAI into Runtime computers"),
         ),
     ),
     (
@@ -492,8 +542,12 @@ _HELP_EXAMPLES: tuple[str, ...] = (
     "runtime ls -w                   # live-updating list",
     "runtime create mybox --command 'npm start' --cwd /app --port 3000",
     "runtime share private mybox     # require owner auth",
+    "runtime ssh mybox               # SSH through Runtime without exposing VM IPs",
     "runtime integrate github         # open GitHub and wait for the install to finish",
     "runtime github list              # show connected GitHub orgs/accounts",
+    "runtime codex login              # open Codex login and save it to Runtime",
+    "runtime claude login             # open Claude login and save it to Runtime",
+    "runtime xai login                # open xAI login through Slicer and save it to Runtime",
     "runtime proxy start mybox 5432  # forward localhost:5432 → mybox:5432",
     "runtime completion zsh > ~/.zsh/completions/_runtime",
 )
@@ -544,8 +598,12 @@ def main(argv: list[str] | None = None) -> int:
         return report_error("runtime-sdk supports macOS and Linux only; Windows is not supported")
 
     try:
-        if args.command == "enter" and args.enter_command and "--" not in raw_argv:
-            return report_error("enter command must be separated from the computer id with --")
+        enter_id: str | None = None
+        enter_command: list[str] | None = None
+        if args.command == "enter":
+            enter_id, enter_command, enter_err = _parse_enter_invocation(raw_argv, args.id, args.enter_command)
+            if enter_err:
+                return report_error(enter_err)
 
         config = load_config()
         if args.base_url:
@@ -597,6 +655,30 @@ def main(argv: list[str] | None = None) -> int:
             if args.secrets_action in ("delete", "rm"):
                 return handle_secrets_delete(config, args.slug)
             return report_error("unknown secrets command")
+        if args.command == "codex":
+            if args.codex_action == "login":
+                return handle_codex_login(config, device=args.device)
+            if args.codex_action == "status":
+                return handle_codex_status(config)
+            if args.codex_action == "logout":
+                return handle_codex_logout(config)
+            return report_error("unknown codex command")
+        if args.command == "claude":
+            if args.claude_action == "login":
+                return handle_claude_login(config)
+            if args.claude_action == "status":
+                return handle_claude_status(config)
+            if args.claude_action == "logout":
+                return handle_claude_logout(config)
+            return report_error("unknown claude command")
+        if args.command == "xai":
+            if args.xai_action == "login":
+                return handle_xai_login(config)
+            if args.xai_action == "status":
+                return handle_xai_status(config)
+            if args.xai_action == "logout":
+                return handle_xai_logout(config)
+            return report_error("unknown xai command")
         if args.command == "github":
             if args.github_action in ("list", "ls"):
                 return handle_github_list(config)
@@ -632,7 +714,9 @@ def main(argv: list[str] | None = None) -> int:
         if args.command == "start":
             return handle_start(config, args.id)
         if args.command == "enter":
-            return handle_enter(config, args.id, args.enter_command)
+            return handle_enter(config, enter_id, enter_command)
+        if args.command == "ssh":
+            return handle_ssh(config, args.id, args.ssh_args)
         if args.command in ("delete", "rm"):
             return handle_delete(config, args.id, force=getattr(args, "force", False))
         if args.command == "run":
@@ -667,6 +751,10 @@ def main(argv: list[str] | None = None) -> int:
             if args.service_action == "clear":
                 return handle_service_clear(config, args.id)
             return report_error("unknown service command")
+        if args.command == "goal":
+            if args.goal_action == "watch":
+                return handle_goal_watch(config, args.id, latest=args.latest, next_goal=args.next, email_id=args.email_id, timeout=args.timeout)
+            return report_error("unknown goal command")
         if args.command == "proxy":
             if args.proxy_command == "start":
                 return handle_proxy_start(config, args.id, args.ports)
@@ -709,6 +797,22 @@ def main(argv: list[str] | None = None) -> int:
 # --------------------------------------------------------------------------- #
 
 
+def _parse_enter_invocation(raw_argv: list[str], parsed_id: str | None, parsed_command: list[str]) -> tuple[str | None, list[str], str | None]:
+    enter_index = raw_argv.index("enter")
+    enter_args = raw_argv[enter_index + 1:]
+    if "--" not in enter_args:
+        if parsed_command:
+            return None, [], "enter command must be separated from the computer id with --"
+        return parsed_id, parsed_command, None
+
+    separator_index = enter_args.index("--")
+    before_separator = enter_args[:separator_index]
+    if len(before_separator) > 1:
+        return None, [], "enter accepts at most one computer id before --"
+    computer_id = before_separator[0] if before_separator else None
+    return computer_id, enter_args[separator_index + 1:], None
+
+
 def write_json(payload: dict[str, Any], *, error: bool = False) -> int:
     stream = sys.stderr if error else sys.stdout
     stream.write(json.dumps(payload) + "\n")
@@ -1614,6 +1718,17 @@ def _render_secret_set_panel(payload: dict[str, Any]) -> None:
     _UI.console().print(Panel(body, title="secret set", border_style="cyan", expand=False))
 
 
+def _render_provider_login_status(payload: dict[str, Any]) -> None:
+    provider = payload.get("provider") or "provider"
+    if payload.get("logged_in"):
+        credential = payload.get("provider_credential") or {}
+        updated = _relative_time_label(credential.get("updated_at")) if isinstance(credential, dict) else None
+        suffix = f" [dim]updated {updated}[/dim]" if updated else ""
+        _UI.console().print(f"[green]✓[/green] {provider} login is saved in Runtime{suffix}")
+        return
+    _UI.console().print(f"[yellow]{provider} is not logged into Runtime[/yellow]")
+
+
 # --------------------------------------------------------------------------- #
 # Command handlers                                                            #
 # --------------------------------------------------------------------------- #
@@ -2032,6 +2147,305 @@ def handle_secrets_delete(config: RuntimeConfig, slug: str | None) -> int:
     )
 
 
+def _read_provider_auth_file(path: str | Path) -> str:
+    try:
+        return Path(path).read_text(encoding="utf-8")
+    except OSError as exc:
+        raise RuntimeConfigError(f"failed to read auth file: {exc}") from exc
+
+
+def _codex_auth_path(codex_home: Path) -> Path:
+    return codex_home / "auth.json"
+
+
+def _claude_auth_env(home: Path) -> dict[str, str]:
+    env = os.environ.copy()
+    env["HOME"] = str(home)
+    env["XDG_CONFIG_HOME"] = str(home / ".config")
+    env.pop("ANTHROPIC_API_KEY", None)
+    env.pop("ANTHROPIC_AUTH_TOKEN", None)
+    env.pop("CLAUDE_CODE_OAUTH_TOKEN", None)
+    return env
+
+
+def _run_codex_login(codex_bin: str, codex_home: Path, *, device: bool) -> int:
+    cmd = [
+        codex_bin,
+        "login",
+        "-c",
+        'cli_auth_credentials_store="file"',
+    ]
+    if device:
+        cmd.append("--device-auth")
+    env = os.environ.copy()
+    env["CODEX_HOME"] = str(codex_home)
+    return subprocess.run(cmd, env=env).returncode
+
+
+def _run_claude_setup_token(claude_bin: str, home: Path, *, timeout_seconds: int = 300) -> str:
+    sys.stderr.write("Creating Claude Runtime proxy token. Complete the browser flow if prompted.\n")
+    sys.stderr.flush()
+    master_fd, slave_fd = pty.openpty()
+    proc = subprocess.Popen(
+        [claude_bin, "setup-token"],
+        stdin=slave_fd,
+        stdout=slave_fd,
+        stderr=slave_fd,
+        env=_claude_auth_env(home),
+        close_fds=True,
+    )
+    os.close(slave_fd)
+    chunks: list[bytes] = []
+    displayed = 0
+    token_output_hidden = False
+    deadline = time.monotonic() + timeout_seconds
+    try:
+        while proc.poll() is None:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                proc.terminate()
+                try:
+                    proc.wait(timeout=5)
+                except subprocess.TimeoutExpired:
+                    proc.kill()
+                    proc.wait()
+                raise RuntimeConfigError("claude setup-token timed out")
+            readers = [master_fd]
+            if _interactive():
+                readers.append(sys.stdin.fileno())
+            readable, _, _ = select.select(readers, [], [], min(0.2, remaining))
+            for fd in readable:
+                if fd == master_fd:
+                    try:
+                        data = os.read(master_fd, 4096)
+                    except OSError:
+                        data = b""
+                    if data:
+                        chunks.append(data)
+                        displayed, token_output_hidden = _write_claude_setup_output(
+                            b"".join(chunks).decode("utf-8", errors="ignore"),
+                            displayed,
+                            token_output_hidden,
+                        )
+                else:
+                    data = os.read(fd, 1024)
+                    if data:
+                        os.write(master_fd, data)
+        while True:
+            try:
+                data = os.read(master_fd, 4096)
+            except OSError:
+                break
+            if not data:
+                break
+            chunks.append(data)
+            displayed, token_output_hidden = _write_claude_setup_output(
+                b"".join(chunks).decode("utf-8", errors="ignore"),
+                displayed,
+                token_output_hidden,
+            )
+    finally:
+        with contextlib.suppress(OSError):
+            os.close(master_fd)
+    status = proc.wait()
+    if status != 0:
+        raise RuntimeConfigError(f"claude setup-token failed with exit code {status}")
+    token = _extract_claude_oauth_token(b"".join(chunks).decode("utf-8", errors="ignore"))
+    if not token:
+        raise RuntimeConfigError("claude setup-token completed but did not print an OAuth token")
+    return token
+
+
+def _write_claude_setup_output(output: str, displayed: int, token_output_hidden: bool) -> tuple[int, bool]:
+    marker = re.search(r"Your OAuth token", output, flags=re.I)
+    if marker:
+        if marker.start() > displayed:
+            sys.stderr.write(output[displayed:marker.start()])
+            sys.stderr.flush()
+        if not token_output_hidden:
+            sys.stderr.write("\nClaude OAuth token captured and hidden.\n")
+            sys.stderr.flush()
+        return len(output), True
+    if len(output) > displayed:
+        chunk = re.sub(r"sk-ant-[A-Za-z0-9_-]{12,}", "[hidden]", output[displayed:])
+        sys.stderr.write(chunk)
+        sys.stderr.flush()
+    return len(output), token_output_hidden
+
+
+def _extract_claude_oauth_token(output: str) -> str:
+    output = re.sub(r"\x1b\].*?(?:\x07|\x1b\\)", "", output, flags=re.S)
+    output = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", output)
+    section = output
+    marker = re.search(r"Your OAuth token.*?:", output, flags=re.I | re.S)
+    if marker:
+        section = output[marker.end():]
+    section = re.split(r"Store this token", section, maxsplit=1, flags=re.I)[0]
+    compact = re.sub(r"\s+", "", section)
+    match = re.search(r"sk-ant-[A-Za-z0-9_-]{20,}", compact)
+    return match.group(0) if match else ""
+
+
+def _claude_oauth_token_json(token: str) -> str:
+    return json.dumps({"type": "claude-code-oauth-token", "token": token}, separators=(",", ":"))
+
+
+def _run_xai_oauth(slicer_bin: str) -> str:
+    sys.stderr.write("Opening xAI OAuth flow through Slicer. Complete the browser flow if prompted.\n")
+    sys.stderr.flush()
+    proc = subprocess.run([slicer_bin, "proxy", "oauth", "xai"], stdout=subprocess.PIPE, text=True)
+    if proc.returncode != 0:
+        raise RuntimeConfigError(f"slicer xAI OAuth failed with exit code {proc.returncode}")
+    auth_json = proc.stdout.strip()
+    if not auth_json:
+        raise RuntimeConfigError("slicer xAI OAuth completed but did not emit auth JSON")
+    try:
+        decoded = json.loads(auth_json)
+    except json.JSONDecodeError as exc:
+        raise RuntimeConfigError("slicer xAI OAuth emitted invalid JSON") from exc
+    if not isinstance(decoded, dict):
+        raise RuntimeConfigError("slicer xAI OAuth emitted non-object JSON")
+    return auth_json
+
+
+def _require_xai_oauth_helper(slicer_bin: str) -> None:
+    proc = subprocess.run(
+        [slicer_bin, "proxy", "oauth", "xai", "--help"],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+    if proc.returncode == 0:
+        return
+    detail = (proc.stderr or proc.stdout or "").strip()
+    if detail:
+        detail = ": " + detail.splitlines()[-1]
+    raise RuntimeConfigError("slicer CLI does not support `slicer proxy oauth xai`; update Slicer" + detail)
+
+
+def _find_provider(credentials: dict[str, Any], provider: str) -> dict[str, Any] | None:
+    for credential in credentials.get("provider_credentials") or []:
+        if credential.get("provider") == provider:
+            return credential
+    return None
+
+
+def _provider_label(provider: str) -> str:
+    return {"claude": "Claude", "codex": "Codex", "xai": "xAI"}.get(provider, provider)
+
+
+def handle_provider_status(config: RuntimeConfig, provider: str) -> int:
+    if (err := _require_api_key(config)) is not None:
+        return err
+    client = RuntimeClient(base_url=config.base_url, api_key=config.api_key)
+    credential = _find_provider(client.list_provider_credentials(), provider)
+    return report_success(
+        {"provider": provider, "logged_in": credential is not None, "provider_credential": credential},
+        _render_provider_login_status,
+    )
+
+
+def handle_provider_logout(config: RuntimeConfig, provider: str) -> int:
+    if (err := _require_api_key(config)) is not None:
+        return err
+    client = RuntimeClient(base_url=config.base_url, api_key=config.api_key)
+    try:
+        client.delete_provider_credential(provider)
+    except RuntimeAPIError as exc:
+        if exc.status_code != 404:
+            raise
+    label = _provider_label(provider)
+    return report_success(
+        {"provider": provider, "logged_in": False},
+        lambda payload: _UI.console().print(f"[green]✓[/green] {label} login removed from Runtime"),
+    )
+
+
+def handle_codex_status(config: RuntimeConfig) -> int:
+    return handle_provider_status(config, "codex")
+
+
+def handle_codex_login(config: RuntimeConfig, *, device: bool = False) -> int:
+    if (err := _require_api_key(config)) is not None:
+        return err
+    codex_bin = shutil.which("codex")
+    if not codex_bin:
+        return report_error("codex CLI is not installed")
+
+    with tempfile.TemporaryDirectory(prefix="runtime-codex-") as codex_home:
+        home = Path(codex_home)
+        status = _run_codex_login(codex_bin, home, device=device)
+        if status != 0:
+            return report_error(f"codex login failed with exit code {status}")
+        auth_path = _codex_auth_path(home)
+        if not auth_path.exists():
+            return report_error("codex login completed but did not write auth.json")
+        auth_json = _read_provider_auth_file(auth_path)
+
+    client = RuntimeClient(base_url=config.base_url, api_key=config.api_key)
+    credential = client.put_provider_credential("codex", auth_json)
+    return report_success(
+        {"provider": "codex", "logged_in": True, "provider_credential": credential},
+        lambda payload: _UI.console().print("[green]✓[/green] Codex login saved to Runtime"),
+    )
+
+
+def handle_codex_logout(config: RuntimeConfig) -> int:
+    return handle_provider_logout(config, "codex")
+
+
+def handle_claude_status(config: RuntimeConfig) -> int:
+    return handle_provider_status(config, "claude")
+
+
+def handle_claude_login(config: RuntimeConfig) -> int:
+    if (err := _require_api_key(config)) is not None:
+        return err
+    claude_bin = shutil.which("claude")
+    if not claude_bin:
+        return report_error("claude CLI is not installed")
+
+    with tempfile.TemporaryDirectory(prefix="runtime-claude-") as claude_home:
+        home = Path(claude_home)
+        token = _run_claude_setup_token(claude_bin, home)
+        auth_json = _claude_oauth_token_json(token)
+
+    client = RuntimeClient(base_url=config.base_url, api_key=config.api_key)
+    credential = client.put_provider_credential("claude", auth_json)
+    return report_success(
+        {"provider": "claude", "logged_in": True, "provider_credential": credential},
+        lambda payload: _UI.console().print("[green]✓[/green] Claude login saved to Runtime"),
+    )
+
+
+def handle_claude_logout(config: RuntimeConfig) -> int:
+    return handle_provider_logout(config, "claude")
+
+
+def handle_xai_status(config: RuntimeConfig) -> int:
+    return handle_provider_status(config, "xai")
+
+
+def handle_xai_login(config: RuntimeConfig) -> int:
+    if (err := _require_api_key(config)) is not None:
+        return err
+    slicer_bin = shutil.which("slicer")
+    if not slicer_bin:
+        return report_error("slicer CLI is not installed")
+
+    _require_xai_oauth_helper(slicer_bin)
+    auth_json = _run_xai_oauth(slicer_bin)
+    client = RuntimeClient(base_url=config.base_url, api_key=config.api_key)
+    credential = client.put_provider_credential("xai", auth_json)
+    return report_success(
+        {"provider": "xai", "logged_in": True, "provider_credential": credential},
+        lambda payload: _UI.console().print("[green]✓[/green] xAI login saved to Runtime"),
+    )
+
+
+def handle_xai_logout(config: RuntimeConfig) -> int:
+    return handle_provider_logout(config, "xai")
+
 
 def handle_github_list(config: RuntimeConfig) -> int:
     if (err := _require_api_key(config)) is not None:
@@ -2554,6 +2968,300 @@ def handle_service_logs(config: RuntimeConfig, computer_id: str | None, follow:
     return 0
 
 
+GOAL_WATCH_DIR = "/home/ubuntu/.runtime/email-goals"
+
+
+def _goal_emit(tag: str, message: Any) -> None:
+    text = str(message or "").rstrip()
+    if not text:
+        return
+    lines = text.splitlines() or [text]
+    for index, line in enumerate(lines):
+        prefix = f"[{tag}] " if index == 0 else " " * (len(tag) + 3)
+        print(prefix + line, flush=True)
+
+
+def _goal_parse_time(value: Any) -> float:
+    if not value:
+        return 0.0
+    text = str(value)
+    match = re.match(r"^(.*T\d\d:\d\d:\d\d)(?:\.(\d+))?(Z|[+-]\d\d:\d\d)?$", text)
+    if match:
+        fraction = match.group(2) or ""
+        suffix = match.group(3) or ""
+        text = match.group(1)
+        if fraction:
+            text += "." + fraction[:6].ljust(6, "0")
+        text += suffix
+    try:
+        return datetime.fromisoformat(text.replace("Z", "+00:00")).timestamp()
+    except ValueError:
+        return 0.0
+
+
+def _goal_read_text(client: RuntimeClient, computer_id: str, path: str) -> str | None:
+    try:
+        return client.read_file(computer_id, path).decode("utf-8", errors="replace")
+    except RuntimeAPIError as exc:
+        if exc.status_code == 404:
+            return None
+        raise
+
+
+def _goal_read_json(client: RuntimeClient, computer_id: str, path: str) -> dict[str, Any] | None:
+    text = _goal_read_text(client, computer_id, path)
+    if not text:
+        return None
+    try:
+        payload = json.loads(text)
+    except ValueError:
+        return None
+    return payload if isinstance(payload, dict) else None
+
+
+def _goal_list_logs(client: RuntimeClient, computer_id: str) -> list[dict[str, Any]]:
+    try:
+        payload = client.list_files(computer_id, GOAL_WATCH_DIR)
+    except RuntimeAPIError as exc:
+        if exc.status_code == 404:
+            return []
+        raise
+    entries = payload.get("entries") or []
+    logs = [
+        entry for entry in entries
+        if isinstance(entry, dict) and str(entry.get("name") or "").endswith(".log")
+    ]
+    return sorted(logs, key=lambda entry: _goal_parse_time(entry.get("mtime")))
+
+
+def _goal_run_json(client: RuntimeClient, computer_id: str, command: str) -> dict[str, Any] | None:
+    try:
+        result = client.run_command(computer_id, command, uid=1000, gid=1000, cwd="/home/ubuntu", shell="/bin/bash")
+    except RuntimeAPIError:
+        return None
+    if int(result.get("exit_code") or 0) != 0:
+        return None
+    try:
+        payload = json.loads(result.get("stdout") or "{}")
+    except ValueError:
+        return None
+    return payload if isinstance(payload, dict) else None
+
+
+def _goal_run_text(client: RuntimeClient, computer_id: str, command: str) -> str:
+    try:
+        result = client.run_command(computer_id, command, uid=1000, gid=1000, cwd="/home/ubuntu", shell="/bin/bash")
+    except RuntimeAPIError:
+        return ""
+    if int(result.get("exit_code") or 0) != 0:
+        return ""
+    return str(result.get("stdout") or "").strip()
+
+
+def _goal_current_email_ids(client: RuntimeClient, computer_id: str) -> set[str]:
+    payload = _goal_run_json(client, computer_id, "runtime-env email inbox --json")
+    emails = payload.get("emails") if isinstance(payload, dict) else []
+    return {str(item.get("id") or "") for item in emails or [] if isinstance(item, dict) and item.get("id")}
+
+
+def _goal_render_log_line(line: str, state: dict[str, Any]) -> None:
+    text = str(line or "").strip()
+    if not text:
+        return
+    mappings = (
+        ("assistant final_answer: ", "agent-final"),
+        ("assistant commentary: ", "agent"),
+        ("assistant analysis: ", "agent"),
+        ("assistant message: ", "agent"),
+        ("assistant delta: ", "agent"),
+        ("started command: ", "cmd"),
+        ("command: ", "cmd"),
+        ("command output delta: ", "out"),
+        ("command output: ", "out"),
+        ("file change: ", "file"),
+        ("mcp tool: ", "mcp"),
+        ("token usage: ", "usage"),
+        ("codex turn started", "codex"),
+        ("codex turn completed: ", "codex"),
+    )
+    for prefix, tag in mappings:
+        if text.startswith(prefix):
+            state["native_codex_stream_seen"] = True
+            value = text[len(prefix):] if text != prefix.strip() else text
+            if tag == "cmd" and value.startswith("command: "):
+                value = value[len("command: "):]
+            _goal_emit(tag, value)
+            return
+    _goal_emit("goal", text)
+
+
+def _goal_wait_for_target(
+    client: RuntimeClient,
+    computer_id: str,
+    *,
+    mode: str,
+    email_id: str | None,
+    baseline: set[str],
+    deadline: float | None,
+) -> str:
+    if email_id:
+        _goal_emit("watch", f"waiting for {email_id}")
+        while True:
+            logs = _goal_list_logs(client, computer_id)
+            if any(entry.get("name") == f"{email_id}.log" for entry in logs):
+                return email_id
+            _goal_check_timeout(deadline)
+            time.sleep(0.75)
+
+    _goal_emit("watch", "waiting for next email goal" if mode == "next" else "waiting for latest email goal")
+    while True:
+        logs = _goal_list_logs(client, computer_id)
+        if mode == "next":
+            logs = [entry for entry in logs if str(entry.get("name") or "") not in baseline]
+        if logs:
+            return str(logs[-1].get("name") or "").removesuffix(".log")
+        _goal_check_timeout(deadline)
+        time.sleep(0.75)
+
+
+def _goal_check_timeout(deadline: float | None) -> None:
+    if deadline is not None and time.time() >= deadline:
+        _goal_emit("watch", "timeout reached")
+        raise TimeoutError
+
+
+def _goal_poll_mail(client: RuntimeClient, computer_id: str, seen: set[str], target_email_id: str, started_at: float) -> None:
+    payload = _goal_run_json(client, computer_id, "runtime-env email inbox --json")
+    emails = payload.get("emails") if isinstance(payload, dict) else []
+    for item in sorted((email for email in emails or [] if isinstance(email, dict)), key=lambda email: _goal_parse_time(email.get("created_at"))):
+        item_id = str(item.get("id") or "")
+        if not item_id or item_id in seen:
+            continue
+        created = _goal_parse_time(item.get("created_at"))
+        if item_id != target_email_id and created and created < started_at - 5:
+            seen.add(item_id)
+            continue
+        seen.add(item_id)
+        direction = item.get("direction") or "email"
+        status = item.get("status") or ""
+        subject = item.get("subject") or ""
+        _goal_emit("mail", f"{direction} {status} {item_id}: {subject}".strip())
+
+
+def _goal_poll_service(client: RuntimeClient, computer_id: str, last_status: str) -> str:
+    status = _goal_run_text(client, computer_id, "runtime-env service status")
+    if status and status != last_status:
+        _goal_emit("service", status)
+        return status
+    return last_status
+
+
+def _goal_describe(client: RuntimeClient, computer_id: str, email_id: str) -> None:
+    metadata = _goal_read_json(client, computer_id, f"{GOAL_WATCH_DIR}/{email_id}.json")
+    if not metadata:
+        return
+    sender = metadata.get("from") or ""
+    to = ", ".join(metadata.get("to") or [])
+    subject = metadata.get("subject") or ""
+    _goal_emit("mail", f"received {email_id} from {sender} to {to}: {subject}")
+
+
+def _goal_watch_polling(client: RuntimeClient, computer_id: str, *, mode: str, email_id: str | None, timeout: int) -> int:
+    started_at = time.time()
+    deadline = started_at + timeout if timeout > 0 else None
+    baseline_logs = {str(entry.get("name") or "") for entry in _goal_list_logs(client, computer_id)} if mode == "next" else set()
+    seen_emails = _goal_current_email_ids(client, computer_id) if mode == "next" else set()
+    state: dict[str, Any] = {"native_codex_stream_seen": False}
+
+    try:
+        target_email_id = _goal_wait_for_target(
+            client,
+            computer_id,
+            mode=mode,
+            email_id=email_id,
+            baseline=baseline_logs,
+            deadline=deadline,
+        )
+    except TimeoutError:
+        return 124
+
+    target_log = f"{GOAL_WATCH_DIR}/{target_email_id}.log"
+    target_response = f"{GOAL_WATCH_DIR}/{target_email_id}.response.md"
+    target_started_at = time.time()
+    offset = 0
+    response_printed = False
+    done_seen_at: float | None = None
+    last_mail_poll = 0.0
+    last_service_poll = 0.0
+    last_service_status = ""
+
+    _goal_emit("goal", f"watching {target_email_id}")
+    _goal_describe(client, computer_id, target_email_id)
+
+    while True:
+        try:
+            _goal_check_timeout(deadline)
+        except TimeoutError:
+            return 124
+        now = time.time()
+
+        text = _goal_read_text(client, computer_id, target_log) or ""
+        if len(text) < offset:
+            offset = 0
+        if len(text) > offset:
+            chunk = text[offset:]
+            offset = len(text)
+            for line in chunk.splitlines():
+                _goal_render_log_line(line, state)
+
+        if now - last_mail_poll >= 2:
+            _goal_poll_mail(client, computer_id, seen_emails, target_email_id, target_started_at)
+            last_mail_poll = now
+
+        if now - last_service_poll >= 2:
+            last_service_status = _goal_poll_service(client, computer_id, last_service_status)
+            last_service_poll = now
+
+        if not response_printed:
+            response = (_goal_read_text(client, computer_id, target_response) or "").strip()
+            if response:
+                _goal_emit("done", response)
+                response_printed = True
+                done_seen_at = now
+
+        if done_seen_at is not None and now - done_seen_at >= 3:
+            return 0
+
+        time.sleep(0.75)
+
+
+def handle_goal_watch(
+    config: RuntimeConfig,
+    computer_id: str | None,
+    *,
+    latest: bool,
+    next_goal: bool,
+    email_id: str | None,
+    timeout: int,
+) -> int:
+    if (err := _require_api_key(config)) is not None:
+        return err
+    if not computer_id:
+        return report_error("computer id is required")
+    if latest and next_goal:
+        return report_error("--latest and --next cannot be used together")
+    if email_id and next_goal:
+        return report_error("--email-id and --next cannot be used together")
+    if timeout < 0:
+        return report_error("--timeout must be non-negative")
+
+    mode = "email" if email_id else "next" if next_goal else "latest"
+
+    client = RuntimeClient(base_url=config.base_url, api_key=config.api_key)
+    computer_id = _resolve_computer_ref(client, computer_id)
+    return _goal_watch_polling(client, computer_id, mode=mode, email_id=email_id, timeout=timeout)
+
+
 def handle_service_restart(config: RuntimeConfig, computer_id: str | None) -> int:
     if (err := _require_api_key(config)) is not None:
         return err
@@ -2653,6 +3361,213 @@ def handle_enter(config: RuntimeConfig, computer_id: str | None, command_parts:
     return _enter_computer(config, str(computer_id))
 
 
+def handle_ssh(config: RuntimeConfig, computer_id: str | None, ssh_args: list[str] | None = None) -> int:
+    if (err := _require_api_key(config)) is not None:
+        return err
+    ssh_bin = shutil.which("ssh")
+    if not ssh_bin:
+        return report_error("ssh is not installed")
+    ssh_keygen_bin = shutil.which("ssh-keygen")
+    if not ssh_keygen_bin:
+        return report_error("ssh-keygen is not installed")
+
+    if computer_id is None:
+        if not _interactive():
+            return report_error("computer id is required")
+        picked = _pick_computer(
+            config,
+            "Pick a computer to ssh",
+            lambda c: _computer_internal_status(c) in ("running", "cold"),
+        )
+        if picked is None:
+            return 0
+        computer_id = picked.get("id") or picked.get("slug")
+        if not computer_id:
+            return report_error("computer is missing an id")
+
+    client = RuntimeClient(base_url=config.base_url, api_key=config.api_key)
+    resolved_id = _resolve_computer_ref(client, str(computer_id))
+    args = _ssh_extra_args(ssh_args or [])
+
+    with tempfile.TemporaryDirectory(prefix="runtime-ssh-") as temp_dir:
+        temp = Path(temp_dir)
+        key_path = temp / "id_ed25519"
+        known_hosts = temp / "known_hosts"
+        marker = "runtimevm-ssh-" + secrets.token_hex(8)
+        if (key_status := _generate_ssh_key(ssh_keygen_bin, key_path)) != 0:
+            return report_error(f"ssh-keygen failed with exit code {key_status}")
+        public_key = key_path.with_suffix(key_path.suffix + ".pub").read_text(encoding="utf-8").strip()
+
+        _with_spinner("preparing computer for ssh…", lambda: client.create_terminal_ticket(resolved_id))
+        cleanup_proxy: Callable[[], None] | None = None
+        try:
+            _install_temporary_ssh_key(client, resolved_id, public_key, marker)
+            local_port, cleanup_proxy = _start_temporary_proxy(config.base_url, str(config.api_key or ""), resolved_id, 22)
+            ssh_cmd = [
+                ssh_bin,
+                "-i",
+                str(key_path),
+                "-p",
+                str(local_port),
+                "-o",
+                "IdentitiesOnly=yes",
+                "-o",
+                f"UserKnownHostsFile={known_hosts}",
+                "-o",
+                "StrictHostKeyChecking=accept-new",
+                "-o",
+                "LogLevel=ERROR",
+                "ubuntu@127.0.0.1",
+            ]
+            ssh_cmd.extend(args)
+            return subprocess.run(ssh_cmd).returncode
+        finally:
+            if cleanup_proxy is not None:
+                cleanup_proxy()
+            _remove_temporary_ssh_key(client, resolved_id, marker)
+
+
+def _ssh_extra_args(args: list[str]) -> list[str]:
+    if args and args[0] == "--":
+        return args[1:]
+    return args
+
+
+def _generate_ssh_key(ssh_keygen_bin: str, key_path: Path) -> int:
+    return subprocess.run([
+        ssh_keygen_bin,
+        "-q",
+        "-t",
+        "ed25519",
+        "-N",
+        "",
+        "-C",
+        "runtimevm-ephemeral",
+        "-f",
+        str(key_path),
+    ]).returncode
+
+
+def _install_temporary_ssh_key(client: RuntimeClient, computer_id: str, public_key: str, marker: str) -> None:
+    encoded_key = base64.b64encode(public_key.encode()).decode()
+    script = f"""set -euo pipefail
+if ! command -v sshd >/dev/null 2>&1 && [ ! -x /usr/sbin/sshd ]; then
+  echo "openssh-server is not installed in this VM image" >&2
+  exit 127
+fi
+mkdir -p /run/sshd
+if command -v systemctl >/dev/null 2>&1; then
+  systemctl start ssh 2>/dev/null || systemctl start sshd 2>/dev/null || /usr/sbin/sshd
+else
+  /usr/sbin/sshd
+fi
+install -d -m 700 -o ubuntu -g ubuntu /home/ubuntu/.ssh
+auth=/home/ubuntu/.ssh/authorized_keys
+touch "$auth"
+chown ubuntu:ubuntu "$auth"
+chmod 600 "$auth"
+tmp="$(mktemp)"
+grep -Fv -- {shlex.quote(marker)} "$auth" > "$tmp" || true
+cat "$tmp" > "$auth"
+rm -f "$tmp"
+key="$(printf %s {shlex.quote(encoded_key)} | base64 -d)"
+printf '%s %s\\n' "$key" {shlex.quote(marker)} >> "$auth"
+chown ubuntu:ubuntu "$auth"
+chmod 600 "$auth"
+"""
+    result = client.run_command(computer_id, script, uid=0, gid=0, cwd="/", shell="/bin/bash")
+    if int(result.get("exit_code") or 0) != 0:
+        stderr = str(result.get("stderr") or "").strip()
+        raise RuntimeConfigError(stderr or "failed to install temporary SSH key")
+
+
+def _remove_temporary_ssh_key(client: RuntimeClient, computer_id: str, marker: str) -> None:
+    script = f"""set -euo pipefail
+auth=/home/ubuntu/.ssh/authorized_keys
+[ -f "$auth" ] || exit 0
+tmp="$(mktemp)"
+grep -Fv -- {shlex.quote(marker)} "$auth" > "$tmp" || true
+cat "$tmp" > "$auth"
+rm -f "$tmp"
+chown ubuntu:ubuntu "$auth"
+chmod 600 "$auth"
+"""
+    try:
+        result = client.run_command(computer_id, script, uid=0, gid=0, cwd="/", shell="/bin/bash")
+    except RuntimeAPIError as exc:
+        print(f"warning: failed to remove temporary SSH key: {exc}", file=sys.stderr)
+        return
+    if int(result.get("exit_code") or 0) != 0:
+        stderr = str(result.get("stderr") or "").strip()
+        print(f"warning: failed to remove temporary SSH key: {stderr or 'cleanup command failed'}", file=sys.stderr)
+
+
+def _start_temporary_proxy(base_url: str, api_key: str, computer_id: str, remote_port: int) -> tuple[int, Callable[[], None]]:
+    if not api_key:
+        raise RuntimeAPIError("proxy agent missing api key")
+
+    _wait_for_proxy_preflight(base_url, api_key, computer_id, remote_port)
+
+    listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    try:
+        listener.bind(("127.0.0.1", 0))
+        listener.listen()
+        listener.settimeout(1.0)
+    except OSError as exc:
+        with contextlib.suppress(OSError):
+            listener.close()
+        raise RuntimeAPIError(f"proxy listen failed: {exc}") from exc
+
+    local_port = int(listener.getsockname()[1])
+    stop = threading.Event()
+
+    def serve() -> None:
+        try:
+            while not stop.is_set():
+                try:
+                    conn, _ = listener.accept()
+                except socket.timeout:
+                    continue
+                except OSError:
+                    if stop.is_set():
+                        break
+                    continue
+                thread = threading.Thread(
+                    target=_handle_proxy_client,
+                    args=(base_url, api_key, computer_id, remote_port, conn),
+                    daemon=True,
+                )
+                thread.start()
+        finally:
+            with contextlib.suppress(OSError):
+                listener.close()
+
+    thread = threading.Thread(target=serve, daemon=True)
+    thread.start()
+
+    def cleanup() -> None:
+        stop.set()
+        with contextlib.suppress(OSError):
+            listener.close()
+        thread.join(timeout=2)
+
+    return local_port, cleanup
+
+
+def _wait_for_proxy_preflight(base_url: str, api_key: str, computer_id: str, remote_port: int) -> None:
+    deadline = time.monotonic() + 20
+    last_error: Exception | None = None
+    while time.monotonic() < deadline:
+        try:
+            _proxy_preflight(base_url, api_key, computer_id, remote_port)
+            return
+        except Exception as exc:
+            last_error = exc
+            time.sleep(0.5)
+    raise RuntimeAPIError(f"proxy preflight failed for {computer_id}:{remote_port}: {last_error}")
+
+
 def handle_delete(config: RuntimeConfig, computer_id: str | None, *, force: bool = False) -> int:
     if (err := _require_api_key(config)) is not None:
         return err
@@ -3741,11 +4656,17 @@ def _vm_startup_submenu(client: RuntimeClient, vm_id: str, slug: str) -> None:
 _HELP_TOPICS: dict[str, tuple[str, ...]] = {
     "computer": ("Computers",),
     "computers": ("Computers",),
+    "ssh": ("Computers",),
     "share": ("Sharing",),
     "sharing": ("Sharing",),
     "service": ("Startup & service",),
+    "goal": ("Goals",),
+    "goals": ("Goals",),
     "proxy": ("Proxy",),
     "github": ("GitHub",),
+    "codex": ("Account",),
+    "claude": ("Account",),
+    "xai": ("Account",),
     "account": ("Account",),
     "shell": ("Shell",),
     "all": tuple(title for title, _ in _HELP_SECTIONS),
@@ -3784,12 +4705,12 @@ _runtime_complete() {
   COMPREPLY=()
   cur="${COMP_WORDS[COMP_CWORD]}"
   if [[ ${COMP_CWORD} -eq 1 ]]; then
-    COMPREPLY=( $(compgen -W "create list ls info url start enter run publish delete rm share service proxy switch checkout github integrate secrets api-keys signup verify login whoami logout completion help" -- "$cur") )
+    COMPREPLY=( $(compgen -W "create list ls info url start enter ssh run publish delete rm share service proxy switch checkout github integrate secrets codex claude xai api-keys signup verify login whoami logout completion help" -- "$cur") )
     return
   fi
   sub="${COMP_WORDS[1]}"
   case "$sub" in
-    info|url|start|enter|run|publish|delete|rm|startup|service)
+    info|url|start|enter|ssh|run|publish|delete|rm|startup|service)
       local ids
       ids=$(runtime _slugs 2>/dev/null)
       COMPREPLY=( $(compgen -W "$ids" -- "$cur") )
@@ -3797,6 +4718,15 @@ _runtime_complete() {
     completion)
       COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
       ;;
+    codex)
+      COMPREPLY=( $(compgen -W "login status logout" -- "$cur") )
+      ;;
+    claude)
+      COMPREPLY=( $(compgen -W "login status logout" -- "$cur") )
+      ;;
+    xai)
+      COMPREPLY=( $(compgen -W "login status logout" -- "$cur") )
+      ;;
     share)
       if [[ ${COMP_CWORD} -eq 2 ]]; then
         COMPREPLY=( $(compgen -W "public private" -- "$cur") )
@@ -3823,6 +4753,7 @@ _runtime() {
     'url:Show public URL'
     'start:Wake a cold computer'
     'enter:Enter console'
+    'ssh:SSH through Runtime'
     'run:Run a command'
     'publish:Publish a port'
     'delete:Delete a computer'
@@ -3835,6 +4766,9 @@ _runtime() {
     'github:GitHub connections'
     'integrate:Connect GitHub'
     'secrets:Secret sets'
+    'codex:Codex login'
+    'claude:Claude login'
+    'xai:xAI login'
     'api-keys:API keys'
     'signup:Send verification code'
     'verify:Verify code'
@@ -3852,7 +4786,7 @@ _runtime() {
       ;;
     args)
       case ${words[1]} in
-        info|url|start|enter|run|publish|delete|rm|startup|service)
+        info|url|start|enter|ssh|run|publish|delete|rm|startup|service)
           local -a ids
           ids=(${(f)"$(runtime _slugs 2>/dev/null)"})
           _describe -t slugs 'computer' ids
@@ -3869,6 +4803,15 @@ _runtime() {
         completion)
           _values 'shell' bash zsh fish
           ;;
+        codex)
+          _values 'codex action' login status logout
+          ;;
+        claude)
+          _values 'claude action' login status logout
+          ;;
+        xai)
+          _values 'xai action' login status logout
+          ;;
       esac
       ;;
   esac
@@ -3890,6 +4833,7 @@ complete -c runtime -n '__fish_use_subcommand' -a info -d 'Show details'
 complete -c runtime -n '__fish_use_subcommand' -a url -d 'Show URL'
 complete -c runtime -n '__fish_use_subcommand' -a start -d 'Wake'
 complete -c runtime -n '__fish_use_subcommand' -a enter -d 'Console'
+complete -c runtime -n '__fish_use_subcommand' -a ssh -d 'SSH'
 complete -c runtime -n '__fish_use_subcommand' -a run -d 'Run command'
 complete -c runtime -n '__fish_use_subcommand' -a publish -d 'Publish port'
 complete -c runtime -n '__fish_use_subcommand' -a delete -d 'Delete'
@@ -3899,12 +4843,18 @@ complete -c runtime -n '__fish_use_subcommand' -a service -d 'Service config'
 complete -c runtime -n '__fish_use_subcommand' -a proxy -d 'Port proxies'
 complete -c runtime -n '__fish_use_subcommand' -a github -d 'GitHub connections'
 complete -c runtime -n '__fish_use_subcommand' -a integrate -d 'Connect GitHub'
+complete -c runtime -n '__fish_use_subcommand' -a codex -d 'Codex login'
+complete -c runtime -n '__fish_use_subcommand' -a claude -d 'Claude login'
+complete -c runtime -n '__fish_use_subcommand' -a xai -d 'xAI login'
 complete -c runtime -n '__fish_use_subcommand' -a help -d 'Extended help'
 complete -c runtime -n '__fish_use_subcommand' -a completion -d 'Completion'
 
-complete -c runtime -n '__fish_seen_subcommand_from info url start enter run publish delete rm service' -a '(__runtime_slugs)'
+complete -c runtime -n '__fish_seen_subcommand_from info url start enter ssh run publish delete rm service' -a '(__runtime_slugs)'
 complete -c runtime -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish'
 complete -c runtime -n '__fish_seen_subcommand_from share' -a 'public private'
+complete -c runtime -n '__fish_seen_subcommand_from codex' -a 'login status logout'
+complete -c runtime -n '__fish_seen_subcommand_from claude' -a 'login status logout'
+complete -c runtime -n '__fish_seen_subcommand_from xai' -a 'login status logout'
 """
 
 

{runtime_sdk-0.4.37 → runtime_sdk-0.4.39}/scripts/runtime_sdk/client.py

@@ -84,6 +84,15 @@ class RuntimeClient:
     def delete_secret_set(self, slug: str) -> dict[str, Any]:
         return self._request("DELETE", f"/api/secrets/{slug}", auth_required=True)
 
+    def list_provider_credentials(self) -> dict[str, Any]:
+        return self._request("GET", "/api/provider-credentials", auth_required=True)
+
+    def put_provider_credential(self, provider: str, auth_json: str) -> dict[str, Any]:
+        return self._request("PUT", f"/api/provider-credentials/{provider}", json={"auth_json": auth_json}, auth_required=True)
+
+    def delete_provider_credential(self, provider: str) -> dict[str, Any]:
+        return self._request("DELETE", f"/api/provider-credentials/{provider}", auth_required=True)
+
     # --- Computers ---
 
     def switch_workspace(

{runtime_sdk-0.4.37 → runtime_sdk-0.4.39}/scripts/runtime_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runtime-sdk
-Version: 0.4.37
+Version: 0.4.39
 Summary: Runtime Python SDK and CLI
 Project-URL: Repository, https://github.com/The-Money-Company-Limited/runtimevm
 Project-URL: Issues, https://github.com/The-Money-Company-Limited/runtimevm/issues
@@ -79,6 +79,8 @@ runtime create myapp --command "python3 app.py" --cwd /home/ubuntu --port 3000
 runtime enter <name-or-id>         # open an interactive shell; accepts slug/name or computer id
 runtime enter <name-or-id> -- claude   # open a real TTY and run an interactive command
 runtime enter <name-or-id> -- python   # use enter for REPLs, agents, prompts, and full-screen apps
+runtime ssh <name-or-id>           # open SSH through Runtime's authenticated tunnel
+runtime ssh <name-or-id> -- uptime # run a command with the local ssh client
 runtime list
 runtime info <id>
 runtime share public <id>
@@ -196,6 +198,10 @@ runtime switch -c feature/search --repo owner/repo --from main
 Rules:
 - GitHub must already be connected with `runtime integrate github`.
 - Run `runtime integrate github` again when you want to add another personal account or org.
+- New GitHub connects require user authorization during installation and
+  `GITHUB_APP_CLIENT_ID` / `GITHUB_APP_CLIENT_SECRET` on the Runtime API.
+  In GitHub App settings, enable user authorization during installation and set
+  the callback URL to `https://api.runruntime.dev/github/callback`.
 - `runtime switch` opens an existing branch workspace, or creates the computer if
   the branch exists but the workspace does not yet.
 - `runtime switch -c` creates a new branch first, then opens that branch's