fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(work): close walking-skeleton story 04 (runner clone/install)

Browse Source
This commit is contained in:
Danijel Martinek
2026-07-12 22:55:17 +02:00
parent ec7bf948af
commit 882c47b014
2 changed files with 17 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/work/epics/walking-skeleton/04-runner-app-protocol-clone-install/_story.md
View File

@@ -3,11 +3,12 @@ id: 04-runner-app-protocol-clone-install
epic: walking-skeleton
title: runner app — protocol server, clone stage, install stage
type: technical-story
status: todo
status: done
feature: runner
depends-on: [01-vite-kitchen-fixture, 02-core-runner-protocol]
blocks: [05-runner-scan-and-preview-adapter, 06-runner-provisioner-port]
created: 2026-07-12T10:24:14Z
updated: 2026-07-12T20:55:19.369Z
---
## Goal
@@ -44,6 +45,8 @@ The runner ↔ repo-toolchain seam is one of the three risks this epic exists to
## Tasks
- [ ] Scaffold `apps/runner`: WS server speaking `@repo/core-runner-protocol` (every message zod-parsed), hello/ready handshake gated on the workspace-scoped auth token, status/error event emission; integration test spawns the real runner and completes the handshake over real WS.
- [ ] Add the clone stage: git clone of the requested repo with the PAT delivered via an ephemeral credential helper (spec §6 verbatim — never in URLs, argv, logs, or `.git/config`), staged progress events; integration test clones the `git daemon`-served `vite-kitchen`, asserts credential-leak absence (grep argv/logs/`.git/config`), and asserts named failure events for bad URL / bad token.
- [ ] Add the install stage: package-manager detection + install with staged progress events; integration test asserts install completes on the fixture and a named failure event is emitted on install error.
- [x] Scaffold `apps/runner`: WS server speaking `@repo/core-runner-protocol` (every message zod-parsed), hello/ready handshake gated on the workspace-scoped auth token, status/error event emission; integration test spawns the real runner and completes the handshake over real WS.
- [x] Add the clone stage: git clone of the requested repo with the PAT delivered via an ephemeral credential helper (spec §6 verbatim — never in URLs, argv, logs, or `.git/config`), staged progress events; integration test clones the `git daemon`-served `vite-kitchen`, asserts credential-leak absence (grep argv/logs/`.git/config`), and asserts named failure events for bad URL / bad token.
- [x] Add the install stage: package-manager detection + install with staged progress events; integration test asserts install completes on the fixture and a named failure event is emitted on install error.
_Landed: b090e26 + 750ab44 + ec7bf94 (cherry-picks), two independent adversarial reviews approved — credential-leak surface airtight (blank-then-veect helper, PAT via child env only, proven by unit builder + integration grep of logs/.git/config/.git surface + spawn-suite whole-child-output grep). Auth proven via a Basic-auth dumb-HTTP git fixture (real 401→helper→retry, asserts exact x-access-token:PAT). 98 tests, 96.6% coverage. Honest boundary: real smart-HTTP/GitHub deferred to later PRDs (documented in apps/runner/AGENTS.md)._