@runuai/host 0.2.6 → 0.3.0

package/src/protocol.ts

@@ -68,6 +68,10 @@ export interface HostCapabilities {
     kind: string;
     availableVersions: string[];
   }>;
+  // ADR-033: cloud user ids that currently have a GitHub token ON THIS HOST —
+  // the per-host gh-connected state shown on the host detail page. Re-advertised
+  // whenever a token is added/removed. Optional: older hosts omit it.
+  githubUsers?: string[];
 }
 
 export interface TaskUpResult {
@@ -111,6 +115,14 @@ export interface TaskCommandTask {
   globalContext?: string;
   reviewerOrder?: string[];
   agents: TaskAgent[];
+  /**
+   * Cloud-computed PUBLIC preview URLs to inject into the container env at
+   * task-up, keyed by the operator-chosen var name (e.g.
+   * `EXPO_PACKAGER_PROXY_URL`). Non-secret — written literally into the task's
+   * compose file. Only present on task-up commands, when a preview port set
+   * `urlEnv` and the cloud has a preview base domain configured.
+   */
+  previewEnv?: Record<string, string>;
 }
 
 /**
@@ -295,6 +307,11 @@ export type CloudToHost =
       target: TunnelTarget;
       taskId: string;
       name?: string;
+      // The in-container port to reach for a preview (ADR-036). The cloud
+      // resolves it from the task's declared + ad-hoc preview ports; the host
+      // proxies to <container-ip>:<containerPort> over the Docker network.
+      // Absent for the editor target (which uses the published codeServerPort).
+      containerPort?: number;
       reqLine: TunnelReqLine;
       upgrade: boolean;
     }
@@ -305,18 +322,25 @@ export type CloudToHost =
   // never responds, so the cloud never sends an ack. (HTTP tunnels only.)
   | { kind: "tunnel.requestEnd"; tunnelId: string }
   | { kind: "tunnel.close"; tunnelId: string; reason?: string }
-  // GitHub App connect lifecycle (ADR-027). The cloud forwards the user's
-  // refresh token to the host, which encrypts + persists it; the per-task
-  // access-token exchange is a host→cloud HTTP POST, not a frame.
+  // GitHub App connect lifecycle (ADR-027 / ADR-033). The cloud forwards the
+  // user's token to the host, which encrypts + persists it. Exactly one token
+  // is present:
+  //   - `accessToken`  → non-expiring per-host token (ADR-033). Injected into
+  //                      containers directly; no exchange, no refresh.
+  //   - `refreshToken` → legacy expiring token (ADR-027). The host exchanges it
+  //                      for short-lived access tokens (host→cloud HTTP POST).
   | {
       kind: "gh.connect.set";
       userId: string;
       installationId: number;
       githubLogin: string;
       targetType: "User" | "Organization";
-      refreshToken: string;
+      accessToken?: string;
+      refreshToken?: string;
       refreshTokenExpiresAt?: number;
     }
+  // Delete the user's token on the host. ADR-033: the host first POSTs the
+  // token to the cloud's /api/github/revoke (kill it at GitHub) before deleting.
   | { kind: "gh.connect.clear"; userId: string }
   // Per-user SSH key lifecycle (ADR-029). Keys are generated + stored on the
   // host; only the public key crosses the bridge (ssh.key.ack). `get` fetches