feat(cloud-connection): runtime-identity bind v2 — environment-less self-hosted binding#1783
Merged
Merged
Conversation
…elf-hosted binding Counterpart of cloud#264 (ADR runtime-identity-binding): - bind/start + bind/poll no longer require an environment id in singleEnvironment mode — the registration is created cloud-side at approval; the old 'create an environment and paste its id' dead-end is gone - bind carries a registration claim: hostname, runtime_version, and the stored runtime_id on re-bind (identity survives token rotation) - the credential store persists the cloud-minted runtime_id; environmentId becomes optional (set only for cloud-hosted binds) - status: reports runtimeId, env-less single-env runtimes read as unbound (200) instead of 404; queries cloud by runtime_id when no env - unbind: env-optional, revokes via the oscc_ bearer (empty body) - org-packages: bearer-only forward when no env (org from connection); installation/installed degrade gracefully for registration-only runtimes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const qs = environmentId | ||
| ? `?environment_id=${encodeURIComponent(environmentId)}` | ||
| : runtimeId ? `?runtime_id=${encodeURIComponent(runtimeId)}` : ''; | ||
| const resp = await fetch(`${cloudUrl}/api/v1/cloud-connection/status${qs}`, { |
Comment on lines
+333
to
+340
| body: JSON.stringify({ | ||
| ...(environmentId ? { environment_id: environmentId } : {}), | ||
| ...(stored?.runtimeId ? { runtime_id: stored.runtimeId } : {}), | ||
| name: (() => { try { return hostname(); } catch { return undefined; } })(), | ||
| runtime_version: (process.env.OS_RUNTIME_VERSION ?? this.version) || undefined, | ||
| token: accessToken, | ||
| scope: deviceScope, | ||
| }), |
| method: 'POST', | ||
| headers: { 'Content-Type': 'application/json', ...authHeaders() }, | ||
| body: JSON.stringify({ environment_id: environmentId }), | ||
| body: JSON.stringify(environmentId ? { environment_id: environmentId } : {}), |
| const qs = environmentId ? `?environment_id=${encodeURIComponent(environmentId)}` : ''; | ||
| const resp = await fetch( | ||
| `${cloudUrl}/api/v1/cloud/org-packages?environment_id=${encodeURIComponent(environmentId)}`, | ||
| `${cloudUrl}/api/v1/cloud/org-packages${qs}`, |
This was referenced Jun 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Framework counterpart of cloud ADR runtime-identity-binding + cloud#264: a self-hosted runtime binds to the control plane like a device binding to an account.
bind/start/bind/pollwork environment-less insingleEnvironmentmode (the registration row is created cloud-side at approval). The Setup-page "create an environment in the cloud console and paste its id" dead-end is gone.hostname+runtime_version(names the device on the approval surface / runtimes list) and the storedruntime_idon re-bind — identity survives token rotation; the claim is verified cloud-side (org match) against squatting.runtime_id;environmentIdoptional (cloud-hosted binds only).runtimeId; an env-less single-env runtime reads as unbound (200) instead of 404.oscc_bearer (it self-identifies) before clearing the local credential.installation/installeddegrade gracefully for registration-only runtimes (local installs are tracked by LocalManifestSource).Tests
Consumed by the cloud repo via SHA pin bump after merge.
🤖 Generated with Claude Code