T-12: relay-runner init — cloud mode extension#65
Merged
kirich1409 merged 2 commits intomainfrom Apr 13, 2026
Merged
Conversation
Implement three new CLI commands for cloud-ready initialization: - init --cloud: Generate cloud-ready configuration with bearer token, data directory structure (projects/, workspaces/, sessions/), and SQLite database initialization with WAL mode - add-profile: Add container session profile templates to config.toml - rotate-token: Generate new bearer token and update config hash Backward compatible: init without --cloud works as before. Acceptance criteria met: 1. relay-runner init --cloud generates valid config.toml with [docker], [git], [[profiles]] sections and top-level rest_port/data_dir 2. data_dir created with correct structure (projects, workspaces, sessions) 3. relay.db initialized with sqlx migrations, WAL mode enabled 4. relay-runner add-profile adds profiles without errors 5. relay-runner init (no --cloud) works as before (backward compat) 6. relay-runner rotate-token generates new token and updates config hash
There was a problem hiding this comment.
Pull request overview
Adds “cloud mode” initialization and related CLI management commands to relay-runner, aiming to bootstrap a cloud-ready config, data directory layout, and SQLite DB setup while keeping existing init behavior unchanged.
Changes:
- Extend
initwith--cloudto generate a cloud-orientedconfig.toml, createdata_dirsubdirectories, and initializerelay.dbwith migrations + WAL. - Add
add-profileto append[[profiles]]entries toconfig.toml. - Add
rotate-tokento generate a new bearer token and updateauth.token_hashinconfig.toml.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- generate_secure_token: use File::open + read_exact instead of fs::read on /dev/urandom (unbounded stream would hang or OOM) - rotate-token: fix line_end double-counting token_hash_line_pos offset - add-profile: validate name/image against TOML injection characters - init --cloud: only print bearer token when config.toml was actually written (avoids showing a token that doesn't match the stored hash) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implement three new CLI commands for cloud-ready initialization:
Backward compatible:
initwithout--cloudworks as before.Acceptance Criteria
relay-runner init --cloudgenerates validconfig.tomlwith [docker], [git], [[profiles]] sections and top-level rest_port/data_dirrelay-runner add-profileadds profiles without errorsrelay-runner init(no --cloud) works as before (backward compat)relay-runner rotate-tokengenerates new token and updates config hashTesting
All checks pass.
Closes #23