cli-v0.10.1

Runx CLI 0.10.1

Runx 0.10.1 fixes what a first run of 0.10.0 met. GitHub refused every
runx/github request because the runtime sent no User-Agent. A graph's
registry steps could not be fetched. On Linux, a JavaScript tool that
instantiates WebAssembly ran out of memory under the process limits. Several
commands also exited 0 after failing. The registry commands now use the
hosted catalog when no registry is named, a connector's credential is bound
to the variable that already holds it, and the README and getting-started
examples run as written.

Highlights

• runx connector use <connector> binds a credential to the variable its
  connector declares, such as EXA_API_KEY, when that is set in the
  environment or the workspace .env. The key is never copied: each call
  reads the variable. With the variable unset, it asks for the key without
  echo.
• runx connector use runx/github --session binds, and runx/github
  operations reach GitHub: runtime requests name runx/<version> as their
  User-Agent.
• runx skill fetches every registry skill a graph step or context names
  before the run, through the same fetch as the skill itself.
• Process tools on Linux run under a 16 GiB data limit instead of an
  address-space limit, so a JavaScript tool can instantiate WebAssembly
  inside the limits.
• runx registry search|install|publish reach the hosted catalog when no
  registry is named.
• runx connector use <connector> --hosted opens a Connect grant for the
  exact connector the CLI loaded, so a connector from any publisher can hold
  a hosted grant, not only runx's own.

Added

• A connector instance can hold its credential in the variable the
  connector declares for it (authority kind environment). The instance
  records the variable's name, never its value; every call reads the
  variable, so a rotated key needs no new binding, and a run where it is not
  set is refused before any call. runx connector list shows
  local environment from <VARIABLE>.
• runx skill and runx mcp fetch each registry: step and registry
  context skill the project does not hold into its skills/ directory,
  repeating for the skills those name, before the run starts. The run itself
  resolves installed skills first and stays offline.
• A failure caused by an authority refusal reports code authority_denied
  with the step, the verb and the reason.
• An operation step's idempotency_key may read $run.id, the run's own id,
  so a write happens once per run, as a paid run that must not act twice for
  one purchase needs. No other field reads it.
• A connector's declared request can send the paid invocation a hosted call
  runs under, {"$runx": "invocation"}, so a vendor that sells through runx
  can confirm the sale. runx Connect supplies it from the run its gateway
  session authenticates; the kernel never holds it, so a local call that
  binds it fails closed, and a manifest that binds it anywhere but a hosted
  operation's declared requests is refused. The kernel checks such a request
  before it leaves with a stand-in it discards; Connect renders the real
  value.

Changed

• runx connector use <connector> with nothing named binds a credential
  whose variable is set, and asks for the credential of a connector that
  takes only one. It refused and named --credential <name>. A connector
  with several credentials, or several ways to bind, still refuses with the
  exact form of each, now naming the variable each reads. A signed-in
  session counts as a way to bind only when its command answers with a
  token.
• A secret typed at a terminal for runx connector use is read without
  echo. It was read from stdin with no prompt, and echoed. A piped secret is
  read as before.
• runx connector use --credential <name> binds the credential's variable
  when that is set, rather than reading stdin, and --profile is refused
  then: a profile stores a secret only when its variable is unset.
• With nothing named, runx registry search, install and publish use the
  hosted catalog at https://api.runx.ai, or the API base in
  RUNX_PUBLIC_API_BASE_URL. --registry <dir> or RUNX_REGISTRY_DIR names
  a local registry.
• Runtime HTTP requests send User-Agent: runx/<version> unless the request
  declares its own.
• On Linux, the process resource limits bound each process's data at 16 GiB
  (ulimit -d: its heap and the private memory it maps for writing) instead
  of its address space (ulimit -v). V8 reserves address space for
  WebAssembly memories that it never commits, so the address-space limit
  refused memory a tool would not use. Like every process limit it applies to
  each process on its own: a host that must cap a tool's whole footprint,
  child processes included, sets that limit with a container or cgroup.
  Other platforms are unchanged.
• runx verify labels a receipt signed by a key this runx home does not
  trust as UNTRUSTED, says how to configure the key, and still fails. It
  previously printed INVALID, which reads as tampering.
• runx connector inspect no longer repeats the setup hint on every
  operation line when the connector has no instance.

Fixed

• runx connector, runx tool, runx doctor, runx new and runx policy
  exit nonzero when they fail. They wrote the error and exited 0.
• A process tool whose program is missing fails with <program> is not installed or not on PATH and exit 127. The message named the internal
  resource-limit wrapper.
• A failed step seals one step receipt. It sealed a second attempt beside the
  first, which runx verify then reported as an orphan tree.
• runx mcp <skill-ref> resolves a ref the way runx skill does: a path, an
  installed skill, a bundled skill or a registry skill. It read every ref as
  a filesystem path.
• runx registry publish runs a skill's harness on the package as the
  registry will hold it, and its cases now reach the connectors that package
  carries, its composed skills' included. A skill whose cases grant a plugin
  connector was refused with "… is in no plugin".
• A run stopped by an authority refusal or a block says why: the harness and
  the run's failure name the step and the reason, as in
  authority Create denied graph step 'provision': a mutation needs an idempotency_key. They said only that the graph did not succeed.
• runx connector use <connector> --hosted asks Connect for the loaded
  connector's exact binding: its reference and its manifest and connector
  digests. It sent
  only the connector's id, which cannot tell one publisher's connector from
  another's, so no connector outside runx could get a hosted grant.
• runx history -j turns on JSON output. It was read as a search query
  (#496).
• A credential profile name bound to one connector's secret is refused for
  another connector or credential. Binding it silently replaced the first
  connector's secret, and that connector's operations then failed (#497).
  Rotating the same credential still works.
• Local registry records are written whole beside their path and then
  renamed or hard-linked into place, so a reader never sees a torn record
  (#499).
• A WebAssembly instantiation inside a JavaScript tool on Linux no longer
  fails with "Out of memory" (#487).
• runx export <target> --project writes runx as the command its
  allowed-tools entry runs, not the absolute path of the binary that ran the
  export, so a committed export works on another machine and after an
  upgrade.
• runx config usage states that unset clears endpoint-url only, and
  its refusal names the CLI key.
• A ~/.runx/config.json of the wrong shape is reported as not a runx
  config, with the field at fault. It was reported as "not valid JSON".
• The README's first example says it needs Node, the deep-research example
  passes its required local files, and the issue-triage example binds
  GitHub before it reads an open issue.
• Getting started verifies the quickstart receipt and shows the verdict to
  expect (#486, #490, #491).

Removed

• Nothing. This release removes no command or flag.

Security

• A runner that declares a variable a connector in its reach holds a
  credential in, such as EXA_API_KEY, is refused before it starts, so a
  skill's declared environment never carries a connector's key.
• A credential profile can no longer be rebound across connectors by name,
  so one connector's secret cannot silently replace another's binding.
• Local registry writes are atomic, so a concurrent reader cannot act on a
  partial record.

Breaking changes

• With no registry named, runx registry search|install|publish reach the
  hosted catalog instead of the local registry cache. Name a local registry
  with --registry <dir> or RUNX_REGISTRY_DIR to keep one.
• Opening a hosted grant needs runx 0.10.1. Connect opens a grant only for
  the exact connector the CLI loaded, and refuses the request runx 0.10.0
  sends with "upgrade runx to 0.10.1". Grants that already exist keep
  working.

Upgrade guidance

• Install with npm install --global @runxhq/cli@0.10.1, Homebrew, Scoop,
  winget or the matching release archive, then confirm runx --version
  reports 0.10.1.
• Keys you already export, such as EXA_API_KEY, bind with
  runx connector use <connector>; runx connector inspect <connector>
  names the variable each credential reads.
• A graph whose steps name registry skills no longer needs a local registry:
  runx skill fetches them into the project before the run.
• If you bound runx/github with --session on 0.10.0 and it failed, run it
  again on 0.10.1.
• Upgrade the CLI before you open a hosted grant with
  runx connector use <connector> --hosted.

Contributors

Thanks to AH64-dll, danielarif26, DivyamTalwar and jonah791 for the issues
this release closes.

Full changelog:
cli-v0.10.0...cli-v0.10.1