cli-v0.10.2

Runx CLI 0.10.2

Runx 0.10.2 lets a host's agent work a project through runx. One governed turn
reads, searches, edits and runs commands inside the workspace, asks the person
when it needs to, and leaves every change journaled and undoable. A paid
registry skill is bought on the buyer's decision and paid from a runx balance
or a payment grant. Every resume answer is bound to the request it answers.
Connectors have one name each, credentials can come from a secrets manager by
reference, and the catalog moves to its current skill names.

Highlights

• Agent sessions. The bundled agent-session skill is one turn of a host's
  agent. Its read runner reads and searches the workspace and the catalog,
  loads the skills and connectors its catalog rules admit, reads pages and asks
  the person. Its develop runner also edits files and runs commands. The
  bundled revert skill undoes a run's edits together, refusing a file changed
  since.
• The approval floor. In a run whose authority sets agent_bounds, every
  step that changes the workspace or runs a process waits on an approval that
  shows what it executes: an edit's unified diff, a command's argv. Standing
  approvals let a person confirm edits under paths, commands by argv prefix, or
  every local effect in advance.
• Paid skills. A call that reaches a runner the registry sells is bought,
  never run locally. The kernel takes runx's quote, waits on one purchase
  request the person answers with a payment method (runx:balance or a payment
  grant), reserves the exact amount and sends one keyed purchase. What the
  purchase provisions stays in runx custody.
• Bound resume answers. The resume document is runx.resume.v1. Each answer
  and approval carries the request_digest of the request it answers, and a
  document that answers a request the run does not wait on, or one that
  changed, is refused whole.
• Secrets managers. runx connector use <connector> --from <reference>
  binds a credential that 1Password, AWS Secrets Manager, AWS Systems Manager
  Parameter Store, Vault, the system keychain or a file keeps. runx reads it
  through that manager's own CLI before every call and never stores the value.
• One connector name. A connector has one name, such as github or
  google/calendar, resolved by runtime capability, then the skill's plugin,
  then a pinned install. A plugin no longer needs plugin.json.

Added

• fs.edit replaces exact text in one file, bound to the content it read, and
  returns the digests before and after. fs.write and fs.apply_bundle take
  the expected_digest of each file they replace.
• Every workspace change is journaled before it is applied. A bundle a crash
  left half-applied is rolled back by the run's next driver or by its close.
• fs.list, fs.search, git.log, git.show and git.diff.
• process.start, process.read, process.write, process.resize,
  process.stop and process.list run dev servers, watchers and interactive
  programs under runx supervision, and those processes outlive the turn that
  started them. runx process list|read|stop and the client's processes
  follow them. A command.execute writes its output to a process log as it
  runs.
• ask_human asks one to three questions, each with up to four options, and
  the person answers in their lane.
• registry.search and registry.inspect give an agent the catalog as tools.
  runx.skill.inspect.v1 is a typed contract that runx skill inspect and
  registry.inspect both report.
• A turn session runs its admitted calls in parallel: reads share the session,
  and effects never overlap.
• A completed turn call returns its packet outputs as artifact references,
  which a later call may pass in place of the content.
• A host pins its own call_id on a turn call, and runx.turn_call.v1 carries
  the digest of the call's input.
• runx history <run-id> --json reads one run as runx.run_read.v1: its
  summary, every request it waits on with its digest, and its events after a
  per-stream cursor.
• An agent act carries its run's act and the project's instructions: each
  AGENTS.md and CLAUDE.md from the repository root down to the workspace.
• runx list skills items carry their catalog visibility and description.
• An operation may declare its provider's charge. runx skill --max-cost, or a
  run authority's max_cost_micro, bounds what a run and its children spend; a
  call past it is refused as cost_limit_exceeded.
• A paid skill's offer states its price as data (fixed, one amount per
  combination of enum inputs, or a base and unit amount over a committed
  artifact's bytes) and may name a claim endpoint where the buyer collects what
  runx never holds. verifyPurchaseClaim in @runxhq/contracts lets a seller
  check a purchaser's claim offline against runx's published trust root.
• pay is the one buyer job for an x402 requirement, paid from the payer's own
  wallet/evm. charge and refund settle through coinbase/cdp.
• data.validate validates up to 128 values against one bounded JSON Schema
  2020-12 schema. Results carry exact schema and value digests and error paths
  without copying private values.
• runx registry package --json includes registry.content_digest, the same
  complete-package identity as publication.
• A harness case's process_calls replays exact local connector-tool results
  without starting host processes, and a case can act on what earlier purchases
  hold for its principal.
• The optional sql connector runs operator-declared parameterized queries
  through installed SQLAlchemy dialects and database drivers.
• runx connector use --hosted --from <reference> seeds a Connect grant from a
  secrets manager, and runx config set api-key --from <reference> reads the
  model key the same way.
• The client gains skills.list, artifacts.read, runs.read and
  processes.

Changed

• runx names no default model: a managed agent whose provider has no
  agent.model is refused. OpenAI runs on the Responses API, and Gemini tool
  calls replay their thought signature, so Gemini 3 models complete multi-call
  turns. A provider's refusal reaches the receipt with its status and error.
• One driver per run. Every runx skill, runx resume, runx mcp --run, MCP
  skill call and session is refused while another driver holds the run, in the
  same process or another.
• A run executes the packages it admitted. Worker modules, child runners and
  agent instructions are read from the run's binding, not from disk at each
  step, so a file changed mid-run cannot run under the original digest.
• A person's decisions are recorded before the run goes further, so a decision
  admitted before a crash is used by the next driver.
• runx resume and runx skill stop gracefully on SIGTERM and exit 143.
  runx mcp stops an in-flight turn call on notifications/cancelled.
• A close seals any paused run from its record alone, so a package that changed
  since the run started never traps it open.
• A connector credential's variable that the environment and the workspace
  .env set to different values is refused. A connector's sign-in command runs
  only when --session names it.
• runx connector use --hosted sends only the credential its placement names
  and prints the authorization link before it waits.
• Team delegation returns bounded assignments, and the host owns continuing
  work, scheduling and child invocation.
• Release binaries link with thin LTO over the default codegen units. A release
  build takes 60 seconds instead of 239 and peaks at 3.4 GB instead of 5.7 GB.

Fixed

• MCP clients on protocol revision 2026-07-28 list runx's tools: runx states
  how long each list may be cached and by whom.
• Connector operations an agent turn calls through runx mcp no longer fail
  inside the server's runtime.
• A parent run returns its child's refusal and failure reason. A child that
  stops short is sealed, and its receipts stay in its parent's tree.
• A process step runs only while its package on disk is the one its run
  admitted.
• Full exports no longer rediscover a previously exported package's bundled
  dependencies as separate workspace skills.
• Integers outside JavaScript's safe range are refused before module execution
  instead of being rounded.
• Extraction validates actual values, and schema checking validates actual
  samples.

Removed

• marketplace-invoke and the mediated listing leg of a paid invocation: a
  paid skill is bought directly.
• spend, x402-pay and stripe-pay, replaced by pay. send-as,
  conversation-reply and slack-notify, replaced by message-send.
  github-pr-comment, merged into github. ecosystem-brief, merged into
  research-brief. n8n-handoff and zapier-handoff, merged into
  webhook-handoff. data-store, whose composers call store operations
  directly.
• The vault-unseal, vuln-disclosure and weather-forecast skills, and the
  declared-only mpp, stripe, stripe-spt and vault connectors.
• plugin.json namespace files.
• Current catalog aliases for renamed packages. Immutable historical packages
  and existing receipt bindings keep their original bytes.

Security

• rustls 0.23.46 fixes RUSTSEC-2026-0346 through RUSTSEC-2026-0349.
• Within agent bounds, file, git and command tools stay inside the workspace
  and never read, write, list or show secrets: .env files other than
  templates, private keys, .npmrc, .netrc, .pgpass, and anything under
  .git or .runx. A patch or commit leaves them out and names them as
  omitted.
• A workspace .env may not set HOME or USERPROFILE, and a secrets-manager
  binding carries a proof keyed to the runx home that a project cannot plant.
• Native schema validation cannot retrieve remote schemas and bounds schema,
  value and error sizes.

Breaking changes

• Resume documents are runx.resume.v1 only. Each entry under answers
  ({request_digest, value}) and approvals ({request_digest, approved, reason}) carries the digest of the request it answers. The approvals lane is
  the person's alone: a claimed call's retry is {request_digest, value: {retry: true}}, and the answers lane can no longer answer an approval.
• A run id may not begin with sha256:.
• A managed agent needs agent.model.
• Connectors are named by name, not by publisher-qualified refs. coinbase-cdp
  is coinbase/cdp; google-analytics, google-calendar,
  google-search-console and google-sheets are google/analytics,
  google/calendar, google/search-console and google/sheets; x402 is
  wallet/evm. Installs live at connectors/<name>/<version>/, and a
  requirement outside the skill's plugin pins the connector's
  manifest_digest.
• Current registry names change from agency to team-delegate,
  content-pipeline to content-package, contract-drafter to
  contract-draft, crm-cleanup to crm-update-plan, data-subject-request
  to privacy-request-review, deep-research to research-brief,
  github-sync to github, helpdesk to support-triage, issue-intake to
  code-intake, issue-to-pr to github-issue-to-pr, issue-triage to
  github-issue-triage, list-hygiene-judge to contact-consent-review,
  nws-weather-forecast to nws-weather, open-meteo-weather-forecast to
  open-meteo-weather, ops-desk to operations-review, postmortem-maker
  to postmortem-draft, purchase-approval to purchase-policy-check,
  sbom-maker to sbom-generate, schema-guard to schema-check,
  settle-invoice to invoice-pay, sql-analyst to sql-analysis, and
  work-plan to code-plan. Publisher ownership is unchanged, and the old
  names are not aliases.
• SQL Analysis takes a logical source reference and a question, and its
  default runner performs a declared SQL read.
• Core foundation skills come from the CLI bundle, and their redundant registry
  listings are withdrawn.

Upgrade guidance

• Install @runxhq/cli@0.10.2 or the native release, and check that
  runx --version prints runx-cli 0.10.2 before installing updated catalog
  packages.
• A host that resumes runs reads each waited request's request_digest from
  the paused output's requests, or from runx history <run-id> --json under
  waiting, and sends it with every answer.
• Set agent.model with runx config set agent.model <model> before running a
  managed agent.
• Run runx connector use again for a connector whose name changed, and update
  graph references to the current skill names. Historical receipts need no
  rewriting.
• On Arch Linux, install runx from the AUR; it builds this release from
  source. The runxhq-bin package is retired.
• For SQL, install the optional connector's requirements and your database
  driver, bind an operator-owned read-only source and declare the queries it
  may run.

Contributors

Community package updates keep their original publisher identities and
contributor attribution. Maintained packages remain published by Runx.

Full changelog:
cli-v0.10.1...cli-v0.10.2