@runuai/host 0.2.8 → 0.4.0

package/lib/agent-cli.ts

@@ -0,0 +1,223 @@
+/**
+ * In-container `uai` CLI materialisation (ADR-048).
+ *
+ * At task-up the host writes two files into the task workspace (bind-mounted at
+ * /workspace, like skills — no docker cp/exec needed):
+ *   - `.uai/cli.mjs`   — the self-contained agent CLI (Node ESM, fetch-only).
+ *   - `.uai/uai.json`  — { apiUrl, token, permissions } the CLI reads.
+ *
+ * The token is minted here (host-side) carrying the task id, its owner user, and
+ * the UNION of the roster's permissions; the cloud verifies it. Agents invoke it
+ * as `node /workspace/.uai/cli.mjs <cmd>` (surfaced in the system preamble).
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { env, taskWorkspaceDir } from "./env";
+import { signTaskToken } from "./task-token";
+import type { RosterAgent } from "./agents/types";
+
+/** Container path of the CLI — what the preamble tells agents to run. */
+export const CONTAINER_CLI_PATH = "/workspace/.uai/cli.mjs";
+
+// The task's cli secret lives HOST-PRIVATE (never the container), so it survives
+// host restarts without a DB migration. The cloud re-sends it on each task-up.
+function taskSecretPath(taskId: string): string {
+  return resolve(env.dataDir, "task-secrets", taskId);
+}
+
+/** Persist the cloud-issued per-task cli secret (ADR-048). Best-effort. */
+export function storeTaskCliSecret(taskId: string, secret: string): void {
+  try {
+    mkdirSync(resolve(env.dataDir, "task-secrets"), { recursive: true });
+    writeFileSync(taskSecretPath(taskId), secret, { mode: 0o600 });
+  } catch {
+    // best-effort — the CLI is simply unavailable if we can't persist it
+  }
+}
+
+/** Read the per-task cli secret, or null if we don't have it. */
+export function loadTaskCliSecret(taskId: string): string | null {
+  try {
+    return readFileSync(taskSecretPath(taskId), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/** The union of a roster's permissions (ADR-048) — the task's effective powers. */
+export function rosterPermissions(roster: RosterAgent[]): string[] {
+  return Array.from(new Set(roster.flatMap((a) => a.permissions ?? [])));
+}
+
+/** Derive the cloud HTTPS API base from the host's cloud WSS url. */
+export function apiUrlFromCloudUrl(cloudUrl: string | undefined): string | null {
+  if (!cloudUrl) return null;
+  try {
+    const u = new URL(cloudUrl);
+    const proto = u.protocol === "wss:" ? "https:" : u.protocol === "ws:" ? "http:" : u.protocol;
+    return `${proto}//${u.host}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Write the CLI script + shared config (apiUrl only — NO token) into the task
+ * workspace. Each agent's OWN token is injected per-agent via its docker exec
+ * env (agentCliEnv), so no shared file ever holds a token. Best-effort +
+ * idempotent. No-op (false) if there's no api url or the roster has zero
+ * permissions — nothing the CLI could do.
+ */
+export function writeAgentCli(
+  taskId: string,
+  roster: RosterAgent[],
+  apiUrl: string | null,
+): boolean {
+  if (!apiUrl || rosterPermissions(roster).length === 0) return false;
+  try {
+    const dir = resolve(taskWorkspaceDir(taskId), ".uai");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(resolve(dir, "uai.json"), `${JSON.stringify({ apiUrl }, null, 2)}\n`);
+    const cliPath = resolve(dir, "cli.mjs");
+    writeFileSync(cliPath, CLI_SOURCE);
+    try {
+      chmodSync(cliPath, 0o755);
+    } catch {
+      // best-effort
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Per-agent env for the `docker exec` that spawns one agent (ADR-048): its OWN
+ * task token (carrying only ITS permissions) + the API url. Empty when the agent
+ * has no permissions (or no owner/url) — its `uai` CLI then reports "not
+ * available" rather than borrowing anyone else's powers.
+ */
+export function agentCliEnv(
+  taskId: string,
+  agent: RosterAgent,
+  ownerUserId: string | null,
+  apiUrl: string | null,
+  cliSecret: string | null,
+): Record<string, string> {
+  const permissions = agent.permissions ?? [];
+  if (!ownerUserId || !apiUrl || !cliSecret || permissions.length === 0) return {};
+  return {
+    UAI_TASK_TOKEN: signTaskToken(
+      { taskId, userId: ownerUserId, permissions, agentId: agent.id },
+      cliSecret,
+    ),
+    UAI_API_URL: apiUrl,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// The CLI itself — kept as a self-contained ESM string so the host writes ONE
+// file with no dependencies (Node 22 in the image provides global fetch).
+// ---------------------------------------------------------------------------
+
+const CLI_SOURCE = `#!/usr/bin/env node
+// uai — in-task agent CLI (ADR-048). Talks to the cloud agent API as the task.
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+let cfg = {};
+try { cfg = JSON.parse(readFileSync(join(here, "uai.json"), "utf8")); } catch {}
+// Per-agent token comes from the env (each agent's docker exec carries only its
+// own — ADR-048); apiUrl from env or the shared config file.
+const TOKEN = process.env.UAI_TASK_TOKEN || cfg.token;
+const API_URL = process.env.UAI_API_URL || cfg.apiUrl;
+if (!TOKEN || !API_URL) {
+  console.error("uai: not available for this agent — no permissions granted (or not inside a task).");
+  process.exit(1);
+}
+
+function parseFlags(args) {
+  const flags = {}; const rest = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("--")) { const k = a.slice(2); const v = args[i + 1] && !args[i + 1].startsWith("--") ? args[++i] : "true"; flags[k] = v; }
+    else rest.push(a);
+  }
+  return { flags, rest };
+}
+
+async function api(method, path, body) {
+  const res = await fetch(API_URL + path, {
+    method,
+    headers: { authorization: "Bearer " + TOKEN, "content-type": "application/json" },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = text; }
+  if (!res.ok) {
+    const msg = (json && json.error && json.error.message) || text || res.statusText;
+    console.error("uai: " + res.status + " " + msg);
+    process.exit(1);
+  }
+  return json;
+}
+function out(v) { console.log(typeof v === "string" ? v : JSON.stringify(v, null, 2)); }
+
+const argv = process.argv.slice(2);
+const [group, action, ...rest] = argv;
+const { flags, rest: pos } = parseFlags(rest);
+
+async function main() {
+  const key = group + " " + (action || "");
+  switch (key) {
+    case "projects list": out((await api("GET", "/api/agent/projects")).projects); break;
+    case "people list": out(await api("GET", "/api/agent/people")); break;
+    case "task list": out((await api("GET", "/api/agent/tasks")).tasks); break;
+    case "memory search": {
+      const q = pos.join(" ") || flags.q || "";
+      const author = flags.as ? "&author=" + encodeURIComponent(flags.as) : "";
+      out((await api("GET", "/api/agent/memory?q=" + encodeURIComponent(q) + author)).memories);
+      break;
+    }
+    case "memory save": {
+      const text = pos.join(" ") || flags.text || "";
+      if (!text) { console.error("uai: memory save needs text"); process.exit(1); }
+      out((await api("POST", "/api/agent/memory", {
+        text,
+        author: flags.as || null,
+        projectId: flags.project || null,
+        tags: flags.tags ? String(flags.tags).split(",").map((s) => s.trim()).filter(Boolean) : [],
+      })).memory);
+      break;
+    }
+    case "task create": {
+      out((await api("POST", "/api/agent/tasks", {
+        name: flags.name,
+        prompt: flags.prompt,
+        projects: flags.projects ? String(flags.projects).split(",").map((s) => s.trim()).filter(Boolean) : [],
+        team: flags.team || null,
+        agents: flags.agents ? String(flags.agents).split(",").map((s) => s.trim()).filter(Boolean) : [],
+        parent: flags.parent || null,
+      })).task);
+      break;
+    }
+    case "whoami ": case "whoami undefined": out({ apiUrl: API_URL }); break;
+    default:
+      console.error([
+        "uai — agent CLI. Commands:",
+        "  uai projects list",
+        "  uai people list",
+        "  uai task list",
+        "  uai task create --name <n> --prompt <p> [--projects id,id] [--team id] [--agents handle,handle]",
+        "  uai memory search <query>",
+        "  uai memory save <text> [--project id] [--tags a,b]",
+        "  uai whoami",
+      ].join("\\n"));
+      process.exit(argv.length ? 1 : 0);
+  }
+}
+main().catch((e) => { console.error("uai: " + (e && e.message ? e.message : e)); process.exit(1); });
+`;

package/lib/agents/claude.ts

@@ -200,6 +200,7 @@ export class ClaudeSession implements AgentSession {
     agent: RosterAgent;
     containerName: string;
     systemPreamble: string;
+    agentEnv?: Record<string, string>;
   }) {
     this.agentId = args.agent.id;
 
@@ -234,6 +235,7 @@ export class ClaudeSession implements AgentSession {
       "claude",
       cliArgs,
       ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
+      args.agentEnv ?? {},
     );
     this.proc = new LineProcess({
       command,
@@ -338,6 +340,14 @@ register({
   defaultModel: CLAUDE_DEFAULT_MODEL,
   supportedEfforts: () => [...CLAUDE_EFFORTS],
   defaultEffort: CLAUDE_DEFAULT_EFFORT,
-  create: async ({ agent, containerName, systemPreamble }) =>
-    new ClaudeSession({ agent, containerName, systemPreamble }),
+  // Usable only when a Claude credential is in the env (injected into task
+  // containers at task-up). Gates advertisement (ADR-044 P2).
+  available: () =>
+    Boolean(
+      process.env.CLAUDE_CODE_OAUTH_TOKEN ||
+        process.env.ANTHROPIC_API_KEY ||
+        process.env.ANTHROPIC_AUTH_TOKEN,
+    ),
+  create: async ({ agent, containerName, systemPreamble, agentEnv }) =>
+    new ClaudeSession({ agent, containerName, systemPreamble, agentEnv }),
 });

package/lib/agents/codex.ts

@@ -28,6 +28,10 @@
  * namespaces inside it anyway.
  */
 
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
 import { newId } from "../ulid";
 import { dockerExecArgs, LineProcess } from "./proc";
 import { register } from "./registry";
@@ -223,6 +227,7 @@ export class CodexSession implements AgentSession {
     agent: RosterAgent;
     containerName: string;
     systemPreamble: string;
+    agentEnv?: Record<string, string>;
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
@@ -243,6 +248,8 @@ export class CodexSession implements AgentSession {
       args.containerName,
       "codex",
       codexArgs,
+      [],
+      args.agentEnv ?? {},
     );
     this.proc = new LineProcess({
       command,
@@ -517,6 +524,13 @@ register({
   defaultModel: CODEX_DEFAULT_MODEL,
   supportedEfforts: () => [...CODEX_EFFORTS],
   defaultEffort: CODEX_DEFAULT_EFFORT,
-  create: async ({ agent, containerName, systemPreamble }) =>
-    new CodexSession({ agent, containerName, systemPreamble }),
+  // Usable only when the owner's ~/.codex login exists — task-up copies it into
+  // each container from UAI_OWNER_HOME (default $HOME). Gates advertisement
+  // (ADR-044 P2).
+  available: () =>
+    existsSync(
+      join(process.env.UAI_OWNER_HOME?.trim() || homedir(), ".codex", "auth.json"),
+    ),
+  create: async ({ agent, containerName, systemPreamble, agentEnv }) =>
+    new CodexSession({ agent, containerName, systemPreamble, agentEnv }),
 });

package/lib/agents/proc.ts

@@ -160,11 +160,20 @@ export function dockerExecArgs(
    * cloud (ADR-015). Only vars actually set on the host are forwarded.
    */
   passEnv: string[] = [],
+  /**
+   * Explicit per-exec env values (`-e NAME=value`) — used for per-agent values
+   * that don't live in the host's own env, e.g. the agent's task-scoped
+   * `UAI_TASK_TOKEN` (ADR-048). Values are argv, never a shell string.
+   */
+  explicitEnv: Record<string, string> = {},
 ): { command: string; args: string[] } {
   const envArgs: string[] = [];
   for (const name of passEnv) {
     if (process.env[name]) envArgs.push("-e", name);
   }
+  for (const [name, value] of Object.entries(explicitEnv)) {
+    envArgs.push("-e", `${name}=${value}`);
+  }
   return {
     command: "docker",
     args: ["exec", "-i", ...envArgs, containerName, cli, ...cliArgs],

package/lib/agents/registry.ts

@@ -32,6 +32,14 @@ export interface RegisteredAdapter {
   supportedEfforts(): string[];
   /** Preferred effort when the user doesn't pick one. */
   defaultEffort?: string;
+  /**
+   * Whether this kind is usable on THIS host right now — i.e. its credentials
+   * are present (ADR-044 P2). Gates advertisement: an unavailable kind is left
+   * out of `capabilities()` so the cloud's task picker doesn't offer an LLM the
+   * host can't actually run. Omit (or return true) to always advertise; the
+   * session factory stays permissive regardless.
+   */
+  available?: () => boolean;
   /** Builds an AgentSession for a roster entry of this kind. */
   create: AgentSessionFactory["create"];
 }
@@ -76,7 +84,9 @@ export function factoryFor(kind: string): AgentSessionFactory | undefined {
  * Each adapter's `supportedModels()` / `supportedEfforts()` is evaluated here.
  */
 export function capabilities(): AgentKindCapability[] {
-  return list().map((adapter) => {
+  return list()
+    .filter((adapter) => adapter.available?.() ?? true)
+    .map((adapter) => {
     const out: AgentKindCapability = {
       kind: adapter.kind,
       label: adapter.label,

package/lib/agents/types.ts

@@ -26,6 +26,19 @@ export type AgentKind = z.infer<typeof AgentKind>;
  *  `@<id>` mention token. `kind` selects the adapter; `model` is passed
  *  through to the CLI. There is no `role` field. `initialPrompt` (if set)
  *  drives this agent's first turn at container-ready. */
+/** Reference material (a link or inline document) materialised onto an agent
+ *  from its persona + team (ADR-046). The host writes these to a per-agent
+ *  SKILL.md at session start. */
+export const RosterSkill = z.object({
+  name: z.string().min(1),
+  type: z.string().min(1), // 'link' | 'document' | 'package' (ADR-047)
+  value: z.string(),
+  // ADR-047 package skills: 'git' | 'cli' install mode + (git) repo subpath.
+  source: z.string().nullable().optional(),
+  subpath: z.string().nullable().optional(),
+});
+export type RosterSkill = z.infer<typeof RosterSkill>;
+
 export const RosterAgent = z.object({
   id: z
     .string()
@@ -37,6 +50,8 @@ export const RosterAgent = z.object({
   effort: z.string().min(1).optional(), // CLI reasoning level, passed through
   defaultPrompt: z.string().optional(), // persona
   initialPrompt: z.string().optional(), // first-turn instructions, this task only
+  skills: z.array(RosterSkill).optional(), // ADR-046 reference material
+  permissions: z.array(z.string()).optional(), // ADR-048 `uai` CLI capabilities
 });
 export type RosterAgent = z.infer<typeof RosterAgent>;
 
@@ -129,5 +144,8 @@ export interface AgentSessionFactory {
     containerName: string;
     /** Initial briefing — project.defaultPrompt — sent on session start. */
     systemPreamble: string;
+    /** ADR-048: extra per-agent env for the `docker exec` (e.g. this agent's
+     *  own UAI_TASK_TOKEN so its `uai` CLI carries only its own permissions). */
+    agentEnv?: Record<string, string>;
   }): Promise<AgentSession>;
 }

package/lib/command-db.ts

@@ -135,12 +135,12 @@ function insertTask(db: Database.Database, task: CommandTaskRow): void {
       id, owner_user_id, host_id, name, slug, branch, status,
       global_context, reviewer_order, agents, pr_context,
       worktree_path, compose_project, code_server_port, preview_ports,
-      locked_at, started_at, ended_at
+      preview_env, locked_at, started_at, ended_at
     ) VALUES (
       @id, @owner_user_id, @host_id, @name, @slug, @branch, @status,
       @global_context, @reviewer_order, @agents, @pr_context,
       @worktree_path, @compose_project, @code_server_port, @preview_ports,
-      @locked_at, @started_at, @ended_at
+      @preview_env, @locked_at, @started_at, @ended_at
     )`,
   ).run(task);
 }
@@ -166,6 +166,7 @@ interface CommandTaskRow {
   compose_project: string | null;
   code_server_port: number | null;
   preview_ports: string;
+  preview_env: string | null;
   locked_at: number | null;
   started_at: number | null;
   ended_at: number | null;
@@ -193,6 +194,7 @@ function withRuntime(
     compose_project: runtime?.composeProject ?? null,
     code_server_port: runtime?.codeServerPort ?? null,
     preview_ports: runtime?.previewPorts ?? "[]",
+    preview_env: task.previewEnv ? JSON.stringify(task.previewEnv) : null,
     locked_at: runtime?.lockedAt ?? null,
     started_at: runtime?.startedAt ?? null,
     ended_at: runtime?.endedAt ?? null,
@@ -216,6 +218,7 @@ function runtimeTask(taskId: string, runtime: HostTask | null): CommandTaskRow {
     compose_project: runtime?.composeProject ?? null,
     code_server_port: runtime?.codeServerPort ?? null,
     preview_ports: runtime?.previewPorts ?? "[]",
+    preview_env: null,
     locked_at: runtime?.lockedAt ?? null,
     started_at: runtime?.startedAt ?? null,
     ended_at: runtime?.endedAt ?? null,
@@ -262,6 +265,7 @@ CREATE TABLE IF NOT EXISTS uai_tasks (
   compose_project text,
   code_server_port integer,
   preview_ports text NOT NULL DEFAULT '[]',
+  preview_env text,
   pr_url text,
   locked_at integer,
   started_at integer,

package/lib/git-diff.ts

@@ -1,9 +1,10 @@
 /**
  * Parse `git diff` unified output into structured per-file patches.
  *
- * Input is whatever `git diff origin/<base>..HEAD` produces — multi-file,
- * with headers, mode/rename/binary annotations, and `@@` hunks. The
- * output is a list of `DiffFile`s the UI can render per-file with
+ * Input is whatever `git diff <merge-base>` (committed + uncommitted) plus
+ * appended `--no-index` new-file patches for untracked files produce —
+ * multi-file, with headers, mode/rename/binary annotations, and `@@` hunks.
+ * The output is a list of `DiffFile`s the UI can render per-file with
  * collapse/expand and syntax-highlighted hunks.
  *
  * Hand-rolled rather than pulled in as a dep — the unified-diff grammar
@@ -98,34 +99,84 @@ export function runGitDiffInContainer(
   containerName: string,
   cwd: string,
   range: string,
+): Promise<string> {
+  return runDiffCommand(
+    "docker",
+    [...dockerExecPrefix(containerName, cwd), "git", ...GIT_DIFF_ARGS, range],
+    "docker exec git diff",
+    process.env,
+  );
+}
+
+/**
+ * Render a single untracked file as a new-file patch by diffing it against
+ * `/dev/null` with `--no-index`. `git diff <commit>` omits untracked files
+ * entirely, so this is how they reach the "all changes vs base" view.
+ *
+ * `--no-index` exits 1 when the inputs differ (the normal "there is a diff"
+ * case for a new file) and 0 when identical — both are success here; only
+ * code > 1 is a real error.
+ */
+export function runGitDiffUntracked(
+  cwd: string,
+  relPath: string,
+): Promise<string> {
+  return runDiffCommand(
+    "git",
+    ["-C", cwd, ...GIT_DIFF_ARGS, "--no-index", "--", "/dev/null", relPath],
+    "git diff --no-index",
+    { ...process.env, ...NON_INTERACTIVE_GIT_ENV },
+    true,
+  );
+}
+
+/** In-container variant of {@link runGitDiffUntracked}. */
+export function runGitDiffUntrackedInContainer(
+  containerName: string,
+  cwd: string,
+  relPath: string,
 ): Promise<string> {
   return runDiffCommand(
     "docker",
     [
-      "exec",
-      "-e",
-      `GIT_TERMINAL_PROMPT=${NON_INTERACTIVE_GIT_ENV.GIT_TERMINAL_PROMPT}`,
-      "-e",
-      `GCM_INTERACTIVE=${NON_INTERACTIVE_GIT_ENV.GCM_INTERACTIVE}`,
-      "-e",
-      `GIT_SSH_COMMAND=${NON_INTERACTIVE_GIT_ENV.GIT_SSH_COMMAND}`,
-      "-w",
-      cwd,
-      containerName,
+      ...dockerExecPrefix(containerName, cwd),
       "git",
       ...GIT_DIFF_ARGS,
-      range,
+      "--no-index",
+      "--",
+      "/dev/null",
+      relPath,
     ],
-    "docker exec git diff",
+    "docker exec git diff --no-index",
     process.env,
+    true,
   );
 }
 
+/** `docker exec` argv prefix with the non-interactive git env + working dir. */
+function dockerExecPrefix(containerName: string, cwd: string): string[] {
+  return [
+    "exec",
+    "-e",
+    `GIT_TERMINAL_PROMPT=${NON_INTERACTIVE_GIT_ENV.GIT_TERMINAL_PROMPT}`,
+    "-e",
+    `GCM_INTERACTIVE=${NON_INTERACTIVE_GIT_ENV.GCM_INTERACTIVE}`,
+    "-e",
+    `GIT_SSH_COMMAND=${NON_INTERACTIVE_GIT_ENV.GIT_SSH_COMMAND}`,
+    "-w",
+    cwd,
+    containerName,
+  ];
+}
+
 function runDiffCommand(
   command: string,
   args: string[],
   label: string,
   env: NodeJS.ProcessEnv,
+  /** Treat exit code 1 as success — `git diff --no-index` returns 1 when the
+   *  compared inputs differ, which for a new-file patch is the expected case. */
+  allowExitOne = false,
 ): Promise<string> {
   return new Promise((res, rej) => {
     // Force ASCII paths and pull a generous unified context so the UI
@@ -144,7 +195,7 @@ function runDiffCommand(
     });
     child.on("error", rej);
     child.on("close", (code) => {
-      if (code === 0) {
+      if (code === 0 || (allowExitOne && code === 1)) {
         res(stdout);
         return;
       }