feat(runtime)!: collapse to node/python + fix nsjail invocation on hardened hosts

.github/workflows/ci.yml

@@ -75,7 +75,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "24"
           # No npm cache — every CI run starts from scratch so we
           # never pick up a stale lockfile or dependency tree.
           cache: ""
@@ -117,7 +117,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "24"
           cache: ""
 
       - name: npm ci

.github/workflows/release.yml

@@ -3,7 +3,7 @@ name: Release
 # Triggers on `v*` tag pushes. Produces:
 #   - orva-linux-{amd64,arm64}       (Go binary, static)
 #   - nsjail-linux-{amd64,arm64}     (built from source, stripped)
-#   - rootfs-{node22,node24,python313,python314}-{amd64,arm64}.tar.zst
+#   - rootfs-{node,python}-{amd64,arm64}.tar.zst
 #                                    (extracted from official Docker slim
 #                                    images + adapter pre-installed)
 #   - checksums.txt                  (sha256 of every asset)
@@ -49,7 +49,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "24"
           cache: ""
       - uses: actions/setup-go@v6
         with:
@@ -85,7 +85,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: "24"
           # No npm cache — fresh install on every run.
           cache: ""
 
@@ -283,7 +283,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runtime: [node22, node24, python313, python314]
+        runtime: [node, python]
         goarch: [amd64, arm64]
         include:
           - goarch: amd64
@@ -303,11 +303,11 @@ jobs:
 
           # Pre-install the adapter so install.sh doesn't need the source tree.
           mkdir -p "$GITHUB_WORKSPACE/rootfs/opt/orva"
-          if [ -f "runtimes/${{ matrix.runtime }}/adapter.js" ]; then
-            cp "runtimes/${{ matrix.runtime }}/adapter.js" "$GITHUB_WORKSPACE/rootfs/opt/orva/adapter.js"
+          if [ -f "backend/runtimes/${{ matrix.runtime }}/adapter.js" ]; then
+            cp "backend/runtimes/${{ matrix.runtime }}/adapter.js" "$GITHUB_WORKSPACE/rootfs/opt/orva/adapter.js"
           fi
-          if [ -f "runtimes/${{ matrix.runtime }}/adapter.py" ]; then
-            cp "runtimes/${{ matrix.runtime }}/adapter.py" "$GITHUB_WORKSPACE/rootfs/opt/orva/adapter.py"
+          if [ -f "backend/runtimes/${{ matrix.runtime }}/adapter.py" ]; then
+            cp "backend/runtimes/${{ matrix.runtime }}/adapter.py" "$GITHUB_WORKSPACE/rootfs/opt/orva/adapter.py"
           fi
 
       - name: tar + zstd compress
@@ -411,7 +411,7 @@ jobs:
             | `orva-cli-darwin-{amd64,arm64}` | Slim CLI (macOS Intel + Apple Silicon) |
             | `orva-cli-windows-{amd64,arm64}.exe` | Slim CLI (Windows) — used by `install-cli.ps1` |
             | `nsjail-linux-{amd64,arm64}` | Pre-built nsjail (downloaded by install.sh) |
-            | `rootfs-{node22,node24,python313,python314}-{amd64,arm64}.tar.zst` | Language rootfs |
+            | `rootfs-{node,python}-{amd64,arm64}.tar.zst` | Language rootfs |
             | `install.sh`, `install-cli.sh`, `install-cli.ps1` | One-line installers |
             | `checksums.txt` | sha256 of every asset above |
 

CLAUDE.md

@@ -1,6 +1,6 @@
 # Orva
 
-Self-hosted Function-as-a-Service (FaaS) for homelab and on-premises use. Users write JavaScript (Node 22/24), Python (3.13/3.14), or TypeScript functions; Orva deploys them into nsjail sandboxes and exposes them over HTTP with a built-in dashboard, CLI, MCP server, and an in-product AI chat assistant (the **AI** sidebar section) that operates the instance end-to-end via in-process tool calling (BYO provider keys, embedded Bifrost gateway).
+Self-hosted Function-as-a-Service (FaaS) for homelab and on-premises use. Users write JavaScript (Node.js 24), Python (3.14), or TypeScript functions — two generic runtimes, `node` and `python`, latest-stable only; Orva deploys them into nsjail sandboxes and exposes them over HTTP with a built-in dashboard, CLI, MCP server, and an in-product AI chat assistant (the **AI** sidebar section) that operates the instance end-to-end via in-process tool calling (BYO provider keys, embedded Bifrost gateway).
 
 ## Quick Start
 
@@ -36,7 +36,7 @@ go.mod, go.sum    Single Go module rooted at the repo (covers backend/ + cli/ +
 backend/          Go server (see backend/CLAUDE.md)
   cmd/orva/       Server entry: registers commands.NewRoot() + serve/setup/init
   internal/       Server packages (config, database, pool, proxy, mcp, …)
-  runtimes/       Runtime adapter source: node22, node24, python313, python314
+  runtimes/       Runtime adapter source: node, python
 cli/              Slim standalone CLI codebase (see cli/CLAUDE.md)
   cmd/orva/       Slim CLI entry point (no server packages — ~12 MB binary)
   commands/       Cobra subcommand library — single source of truth for

Dockerfile

@@ -6,7 +6,7 @@ ARG VERSION=dev
 ARG COMMIT=unknown
 ARG BUILD_TIME=unknown
 
-FROM node:22-alpine AS ui
+FROM node:24-alpine AS ui
 WORKDIR /ui
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci --no-audit --no-fund
@@ -42,39 +42,24 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN git clone --depth 1 https://github.com/google/nsjail.git /nsjail \
     && cd /nsjail && make -j"$(nproc)" && strip nsjail
 
-FROM node:22-slim AS rootfs-node22
+# Orva offers two runtimes, latest-stable only: node (Node.js 24) and
+# python (Python 3.14). Bump the base image here to track a newer stable.
+FROM node:24-slim AS rootfs-node
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man /usr/share/locale \
     && mkdir -p /opt/orva /opt/orva/node_modules/orva /code
-COPY backend/runtimes/node22/adapter.js /opt/orva/adapter.js
-COPY backend/runtimes/node22/orva.js    /opt/orva/node_modules/orva/index.js
+COPY backend/runtimes/node/adapter.js /opt/orva/adapter.js
+COPY backend/runtimes/node/orva.js    /opt/orva/node_modules/orva/index.js
 RUN echo '{"name":"orva","version":"0.2.0","main":"index.js"}' > /opt/orva/node_modules/orva/package.json
 
-FROM node:24-slim AS rootfs-node24
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man /usr/share/locale \
-    && mkdir -p /opt/orva /opt/orva/node_modules/orva /code
-COPY backend/runtimes/node24/adapter.js /opt/orva/adapter.js
-COPY backend/runtimes/node24/orva.js    /opt/orva/node_modules/orva/index.js
-RUN echo '{"name":"orva","version":"0.2.0","main":"index.js"}' > /opt/orva/node_modules/orva/package.json
-
-FROM python:3.13-slim AS rootfs-python313
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
-    && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man /usr/share/locale \
-    && find /usr/local/lib/python3.13 -depth -type d -name __pycache__ -exec rm -rf {} + \
-    && find /usr/local/lib/python3.13 -depth -type d -name tests -exec rm -rf {} + \
-    && mkdir -p /opt/orva /code
-COPY backend/runtimes/python313/adapter.py /opt/orva/adapter.py
-COPY backend/runtimes/python313/orva.py    /opt/orva/orva.py
-
-FROM python:3.14-slim AS rootfs-python314
+FROM python:3.14-slim AS rootfs-python
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/* /usr/share/doc /usr/share/man /usr/share/locale \
     && find /usr/local/lib/python3.14 -depth -type d -name __pycache__ -exec rm -rf {} + \
     && find /usr/local/lib/python3.14 -depth -type d -name tests -exec rm -rf {} + \
     && mkdir -p /opt/orva /code
-COPY backend/runtimes/python314/adapter.py /opt/orva/adapter.py
-COPY backend/runtimes/python314/orva.py    /opt/orva/orva.py
+COPY backend/runtimes/python/adapter.py /opt/orva/adapter.py
+COPY backend/runtimes/python/orva.py    /opt/orva/orva.py
 
 FROM debian:bookworm-slim
 ARG VERSION
@@ -102,10 +87,8 @@ COPY --from=nsjail /nsjail/nsjail /usr/local/bin/nsjail
 # uses the same binary; the entrypoint pre-writes ~/.orva/config.yaml so
 # common commands work without re-passing --endpoint / --api-key.
 COPY --from=go /out/orva /usr/local/bin/orva
-COPY --from=rootfs-node22    / /opt/orva/rootfs/node22/
-COPY --from=rootfs-node24    / /opt/orva/rootfs/node24/
-COPY --from=rootfs-python313 / /opt/orva/rootfs/python313/
-COPY --from=rootfs-python314 / /opt/orva/rootfs/python314/
+COPY --from=rootfs-node   / /opt/orva/rootfs/node/
+COPY --from=rootfs-python / /opt/orva/rootfs/python/
 COPY scripts/entrypoint.sh /usr/local/bin/orva-entrypoint
 RUN chmod +x /usr/local/bin/orva-entrypoint
 

Makefile

@@ -44,24 +44,16 @@ docs-embed:
 # Also copies the v0.2 orva SDK module (kv / invoke / jobs).
 adapters-embed:
 	@rm -rf backend/cmd/orva/adapters
-	@mkdir -p backend/cmd/orva/adapters/node22 backend/cmd/orva/adapters/node24 \
-	          backend/cmd/orva/adapters/python313 backend/cmd/orva/adapters/python314
-	@cp backend/runtimes/node22/adapter.js    backend/cmd/orva/adapters/node22/adapter.js
-	@cp backend/runtimes/node24/adapter.js    backend/cmd/orva/adapters/node24/adapter.js
-	@cp backend/runtimes/python313/adapter.py backend/cmd/orva/adapters/python313/adapter.py
-	@cp backend/runtimes/python314/adapter.py backend/cmd/orva/adapters/python314/adapter.py
-	@cp backend/runtimes/node22/orva.js       backend/cmd/orva/adapters/node22/orva.js
-	@cp backend/runtimes/node24/orva.js       backend/cmd/orva/adapters/node24/orva.js
-	@cp backend/runtimes/python313/orva.py    backend/cmd/orva/adapters/python313/orva.py
-	@cp backend/runtimes/python314/orva.py    backend/cmd/orva/adapters/python314/orva.py
+	@mkdir -p backend/cmd/orva/adapters/node backend/cmd/orva/adapters/python
+	@cp backend/runtimes/node/adapter.js     backend/cmd/orva/adapters/node/adapter.js
+	@cp backend/runtimes/python/adapter.py   backend/cmd/orva/adapters/python/adapter.py
+	@cp backend/runtimes/node/orva.js        backend/cmd/orva/adapters/node/orva.js
+	@cp backend/runtimes/python/orva.py      backend/cmd/orva/adapters/python/orva.py
 	@# v0.6 SDK: ship .d.ts + package.json so TS handlers get types;
 	@# py.typed marks the Python module as fully typed for static checkers.
-	@cp backend/runtimes/node22/orva.d.ts     backend/cmd/orva/adapters/node22/orva.d.ts
-	@cp backend/runtimes/node22/package.json  backend/cmd/orva/adapters/node22/package.json
-	@cp backend/runtimes/node24/orva.d.ts     backend/cmd/orva/adapters/node24/orva.d.ts
-	@cp backend/runtimes/node24/package.json  backend/cmd/orva/adapters/node24/package.json
-	@cp backend/runtimes/python313/py.typed   backend/cmd/orva/adapters/python313/py.typed
-	@cp backend/runtimes/python314/py.typed   backend/cmd/orva/adapters/python314/py.typed
+	@cp backend/runtimes/node/orva.d.ts      backend/cmd/orva/adapters/node/orva.d.ts
+	@cp backend/runtimes/node/package.json   backend/cmd/orva/adapters/node/package.json
+	@cp backend/runtimes/python/py.typed     backend/cmd/orva/adapters/python/py.typed
 
 build: adapters-embed docs-embed
 	@mkdir -p $(BUILD)

README.md

@@ -143,7 +143,7 @@ The Build info card at the top of Settings shows the running release's version,
 
 | Feature | Detail |
 |---|---|
-| **Runtimes** | Node.js 22, Node.js 24, Python 3.13, Python 3.14, TypeScript (via Node) |
+| **Runtimes** | `node` (Node.js 24, also runs TypeScript) and `python` (Python 3.14) — two runtimes, latest-stable only |
 | **Isolation** | Every invocation runs in a fresh nsjail sandbox — user namespace, chroot, cgroup v2, seccomp filter |
 | **Warm pools** | One pool per function; idle workers stay resident between calls so repeated invocations skip the spawn cost entirely. Pool size is configurable per function. |
 | **KV store** | Per-function key-value storage backed by SQLite. Use it as a cache, a counter, a session store, or lightweight persistent state. `kv.put / kv.get / kv.delete / kv.list` with optional TTL. Browsable and editable from the dashboard. |
@@ -322,7 +322,7 @@ curl -fsSL https://github.com/Harsh-2002/Orva/releases/latest/download/orva-cli-
 
 orva login --endpoint https://orva.example.com --api-key <key>
 orva functions list
-orva deploy ./src --name my-fn --runtime node24
+orva deploy ./src --name my-fn --runtime node
 orva invoke my-fn --body '{"name":"world"}'
 orva logs my-fn --follow
 ```

backend/cmd/orva/adapters/node24/adapter.js → backend/cmd/orva/adapters/node/adapter.js

@@ -484,7 +484,7 @@ async function readFrame() {
     if (_depth) process.env.ORVA_CALL_DEPTH = _depth;
     else delete process.env.ORVA_CALL_DEPTH;
 
-    // v0.5 trace context — see node22 adapter for the rationale.
+    // v0.5 trace context — propagate the inbound trace/span ids to F2F calls.
     const _tID = _hdrs['x-orva-trace-id'] || _hdrs['X-Orva-Trace-Id'] || '';
     const _sID = _hdrs['x-orva-span-id']  || _hdrs['X-Orva-Span-Id']  || '';
     if (_tID) process.env.ORVA_TRACE_ID = _tID; else delete process.env.ORVA_TRACE_ID;