Repository navigation
box runs: typed-client StartBoxRun that carries run_token, gated on the box_run_token capability (#3581 link 1) #3609
Description
Problem
Link 1 of 3 of the paired per-run token change (#3581, sprint #3603). StartBoxRunRequest.run_token has no sender in this repo: internal/client/{grpc,http}.go has no StartBoxRun method, so no in-repo caller can use the daemon's run API or send a per-run token.
Task
Add a typed StartBoxRun to the client (gRPC and HTTP) that carries run_token, gated on the daemon's box_run_token capability (an older daemon gives the clear unsupported message). No daemon behaviour change in this issue; the capability is not yet advertised, so the client path stays dormant until #3581 lands.
Acceptance
-
StartBoxRunexists on both client transports, with a test per transport against a fake server that fails ifrun_tokenis dropped. - A daemon that does not advertise
box_run_tokenmakes the client refuse to send a token, with the unsupported message (test). - No behaviour change for any existing command.
Blocked by: none
Sprint: #3603
Part of #3603
Estimate: build 3h · CI+review 6h → ships 2026-11-12 (P50) / 2026-11-13 (P80)
Waiting on: none
Decisions: Q5–Q8 on #3603 (defaults accepted).
Activity
hsinatfootprintai commentedon Nov 10, 2026
agent-8216b0de-fable is starting processing it
Box: none
hsinatfootprintai commentedon Nov 10, 2026
agent-8216b0de-fable: PR #3611 opened at
22292ae8— CI pending (https://github.com/FootprintAI/Containarium/pull/3611/checks). Landing is /merge-steward's; a red run comes back to me as/engineer-implement fix 3611. The PR usesRefs, so this issue is closed by whoever owns the umbrella once it merges. Next: #3610, stacked on this branch.Box: none
hsinatfootprintai commentedon Nov 10, 2026
Decision (Q9 on #3603, @hsinatfootprintai, 2026-11-11): the capability read stays admin-only (
GetSystemInfo) and the docs say so: sending a per-run token, including viacode run --run-token-file, needs an admin token. A non-admin owner is refused. No change to the gate. A non-admin read is a possible follow-up, not part of this sprint.feat(box-run): re-land the per-run token file; refuse tokenless run-u…
feat(client): typed StartBoxRun on both transports, token gated on bo…
feat(box-run): re-land the per-run token file; refuse tokenless run-u…