@runuai/host 0.4.3 → 0.6.0

package/lib/agents/transport.ts

@@ -0,0 +1,229 @@
+/**
+ * Agent transport selection (ADR-061). Adapters call createAgentTransport()
+ * where they used to build a LineProcess directly; it returns either:
+ *
+ *  - legacy pipes (`docker exec -i <cli>`, LineProcess) when
+ *    UAI_DURABLE_SESSIONS=0, or
+ *  - the durable path: an in-container runner owning the CLI, driven through
+ *    inbox/outbox files on the workspace mount (DurableProcess).
+ *
+ * Durable mode makes host restarts transparent WITHOUT orchestrator
+ * changes: the orchestrator's lazy respawn calls factory.create as always,
+ * and this helper quietly ATTACHES to a still-live runner (fresh heartbeat +
+ * a `running` host_agent_sessions row) at the persisted outbox offset
+ * instead of spawning a new CLI — the agent's in-memory context survives.
+ * Adapters that re-handshake per process (codex) pass allowAttach:false and
+ * get a fresh runner each create — the stale predecessor is asked to stop
+ * via its inbox first.
+ *
+ * The runner script is COPIED into each session dir (not bind-mounted):
+ * every existing container already sees the workspace at its identical host
+ * path, so durable sessions work for containers created before this
+ * feature, and each spawn ships the runner version matching this host.
+ */
+
+import { copyFileSync, mkdirSync, statSync, promises as fsp } from "node:fs";
+import { join } from "node:path";
+
+import { and, eq } from "drizzle-orm";
+
+import { getDb, schema } from "../db";
+import { taskWorkspaceDir } from "../env";
+import { DurableProcess, runnerScriptPath } from "./durable-proc";
+import { LineProcess, dockerExecArgs, type ExitHandler, type LineHandler } from "./proc";
+
+/** The shared surface adapters program against (LineProcess's shape). */
+export interface LineTransport {
+  onLine(handler: LineHandler): void;
+  onExit(handler: ExitHandler): void;
+  writeLine(value: unknown): void;
+  readonly stderrTail: string;
+  readonly isClosed: boolean;
+  close(): Promise<void>;
+}
+
+export interface AgentTransportOptions {
+  taskId: string;
+  agentId: string;
+  containerName: string;
+  /** CLI + args exactly as they'd follow `docker exec -i <container>`. */
+  cli: string;
+  cliArgs: string[];
+  /** Env names forwarded from the host's own env (`-e NAME`). */
+  passEnv?: string[];
+  /** Explicit per-exec env values (`-e NAME=value`). */
+  explicitEnv?: Record<string, string>;
+  /**
+   * Whether a live runner from a previous host process may be attached to.
+   * True for stateless adapters (claude); false for ones whose host-side
+   * protocol state can't outlive the host process (codex handshake).
+   */
+  allowAttach: boolean;
+  kind: string;
+  debugLabel?: string;
+}
+
+/** Runner heartbeat is 5 s; older than this = not attachable. */
+const ATTACH_HEARTBEAT_FRESH_MS = 20_000;
+
+function durableEnabled(): boolean {
+  return process.env.UAI_DURABLE_SESSIONS !== "0";
+}
+
+export function createAgentTransport(opts: AgentTransportOptions): LineTransport {
+  if (!durableEnabled()) {
+    const { command, args } = dockerExecArgs(
+      opts.containerName,
+      opts.cli,
+      opts.cliArgs,
+      opts.passEnv ?? [],
+      opts.explicitEnv ?? {},
+    );
+    return new LineProcess({ command, args, debugLabel: opts.debugLabel });
+  }
+
+  const db = getDb();
+  const row = db
+    .select()
+    .from(schema.hostAgentSessions)
+    .where(
+      and(
+        eq(schema.hostAgentSessions.taskId, opts.taskId),
+        eq(schema.hostAgentSessions.agentId, opts.agentId),
+      ),
+    )
+    .get();
+
+  const persistOffset = (offset: number): void => {
+    db.update(schema.hostAgentSessions)
+      .set({ outboxOffset: offset, updatedAt: Date.now() })
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, opts.taskId),
+          eq(schema.hostAgentSessions.agentId, opts.agentId),
+        ),
+      )
+      .run();
+  };
+  const markClosed = (): void => {
+    db.update(schema.hostAgentSessions)
+      .set({ status: "closed", updatedAt: Date.now() })
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, opts.taskId),
+          eq(schema.hostAgentSessions.agentId, opts.agentId),
+        ),
+      )
+      .run();
+  };
+
+  // ---- Attach: a previous host process left this agent's runner alive. ----
+  if (opts.allowAttach && row && row.status === "running" && heartbeatFresh(row.sessionDir)) {
+    const proc = new DurableProcess({
+      hostSessionDir: row.sessionDir,
+      initialOutboxOffset: row.outboxOffset,
+      onOffsetAdvance: persistOffset,
+      onCloseRequested: markClosed,
+      debugLabel: opts.debugLabel,
+    });
+    proc.onExit(markClosed);
+    return proc;
+  }
+
+  // ---- Spawn a fresh runner, asking any predecessor to stop. --------------
+  // Unconditional (not gated on row.status): a runner falsely marked closed
+  // by a stale-heartbeat verdict may still be alive, and a stop appended to
+  // a dead session's inbox is harmless — this is what guarantees one live
+  // CLI per (task, agent).
+  if (row) {
+    void fsp
+      .appendFile(join(row.sessionDir, "inbox.jsonl"), '{"__uai":"stop"}\n')
+      .catch(() => {
+        // Dir already gone / runner already dead — nothing to stop.
+      });
+  }
+
+  const sessionDir = join(
+    taskWorkspaceDir(opts.taskId),
+    ".uai",
+    "sessions",
+    opts.agentId,
+    String(Date.now()),
+  );
+  mkdirSync(sessionDir, { recursive: true });
+  // Ship this host's runner with the session: works in containers created
+  // before this feature (the workspace is mounted at its host path) and
+  // never skews against the host version.
+  const runnerInSession = join(sessionDir, "runner.mjs");
+  copyFileSync(runnerScriptPath(), runnerInSession);
+
+  const envArgs: string[] = [];
+  for (const name of opts.passEnv ?? []) {
+    if (process.env[name]) envArgs.push("-e", name);
+  }
+  for (const [name, value] of Object.entries(opts.explicitEnv ?? {})) {
+    envArgs.push("-e", `${name}=${value}`);
+  }
+
+  const proc = new DurableProcess({
+    hostSessionDir: sessionDir,
+    onOffsetAdvance: persistOffset,
+    onCloseRequested: markClosed,
+    debugLabel: opts.debugLabel,
+    spawnCommand: {
+      command: "docker",
+      args: [
+        "exec",
+        "-d",
+        ...envArgs,
+        opts.containerName,
+        "node",
+        runnerInSession, // identical path in-container (workspace self-mount)
+        sessionDir,
+        "--",
+        opts.cli,
+        ...opts.cliArgs,
+      ],
+    },
+  });
+
+  const now = Date.now();
+  db.insert(schema.hostAgentSessions)
+    .values({
+      taskId: opts.taskId,
+      agentId: opts.agentId,
+      sessionDir,
+      containerName: opts.containerName,
+      kind: opts.kind,
+      outboxOffset: 0,
+      status: "running",
+      createdAt: now,
+      updatedAt: now,
+    })
+    .onConflictDoUpdate({
+      target: [schema.hostAgentSessions.taskId, schema.hostAgentSessions.agentId],
+      set: {
+        sessionDir,
+        containerName: opts.containerName,
+        kind: opts.kind,
+        outboxOffset: 0,
+        status: "running",
+        updatedAt: now,
+      },
+    })
+    .run();
+
+  proc.onExit(markClosed);
+  return proc;
+}
+
+function heartbeatFresh(sessionDir: string): boolean {
+  try {
+    return (
+      Date.now() - statSync(join(sessionDir, "heartbeat")).mtimeMs <
+      ATTACH_HEARTBEAT_FRESH_MS
+    );
+  } catch {
+    return false;
+  }
+}

package/lib/command-db.ts

@@ -135,12 +135,12 @@ function insertTask(db: Database.Database, task: CommandTaskRow): void {
       id, owner_user_id, host_id, name, slug, branch, status,
       global_context, reviewer_order, agents, pr_context,
       worktree_path, compose_project, code_server_port, preview_ports,
-      preview_env, locked_at, started_at, ended_at
+      preview_env, owner_org_id, shared_files, locked_at, started_at, ended_at
     ) VALUES (
       @id, @owner_user_id, @host_id, @name, @slug, @branch, @status,
       @global_context, @reviewer_order, @agents, @pr_context,
       @worktree_path, @compose_project, @code_server_port, @preview_ports,
-      @preview_env, @locked_at, @started_at, @ended_at
+      @preview_env, @owner_org_id, @shared_files, @locked_at, @started_at, @ended_at
     )`,
   ).run(task);
 }
@@ -167,6 +167,8 @@ interface CommandTaskRow {
   code_server_port: number | null;
   preview_ports: string;
   preview_env: string | null;
+  owner_org_id: string | null;
+  shared_files: string | null;
   locked_at: number | null;
   started_at: number | null;
   ended_at: number | null;
@@ -195,6 +197,8 @@ function withRuntime(
     code_server_port: runtime?.codeServerPort ?? null,
     preview_ports: runtime?.previewPorts ?? "[]",
     preview_env: task.previewEnv ? JSON.stringify(task.previewEnv) : null,
+    owner_org_id: task.ownerOrgId ?? null,
+    shared_files: task.sharedFiles ?? null,
     locked_at: runtime?.lockedAt ?? null,
     started_at: runtime?.startedAt ?? null,
     ended_at: runtime?.endedAt ?? null,
@@ -219,6 +223,8 @@ function runtimeTask(taskId: string, runtime: HostTask | null): CommandTaskRow {
     code_server_port: runtime?.codeServerPort ?? null,
     preview_ports: runtime?.previewPorts ?? "[]",
     preview_env: null,
+    owner_org_id: null,
+    shared_files: null,
     locked_at: runtime?.lockedAt ?? null,
     started_at: runtime?.startedAt ?? null,
     ended_at: runtime?.endedAt ?? null,
@@ -266,6 +272,8 @@ CREATE TABLE IF NOT EXISTS uai_tasks (
   code_server_port integer,
   preview_ports text NOT NULL DEFAULT '[]',
   preview_env text,
+  owner_org_id text,
+  shared_files text,
   pr_url text,
   locked_at integer,
   started_at integer,

package/lib/mcp-connections.ts

@@ -368,31 +368,23 @@ async function oauthComplete(connectionId: string, code: string): Promise<McpAck
     throw new Error("connection has no pending OAuth flow");
   }
 
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: row.redirectUri,
-    client_id: row.clientId,
-    code_verifier: unpack(row.pkceVerifierEnc),
-    // RFC 8707, mirrored from the authorize request.
-    resource: row.url,
-  });
-  const headers: Record<string, string> = {
-    "content-type": "application/x-www-form-urlencoded",
-    accept: "application/json",
-  };
-  if (row.clientSecretEnc) {
-    headers.authorization =
-      "Basic " +
-      Buffer.from(`${row.clientId}:${unpack(row.clientSecretEnc)}`).toString(
-        "base64",
-      );
-  }
-  const res = await timedFetch(row.tokenEndpoint, { method: "POST", headers, body });
-  const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-  if (!res.ok || typeof json.access_token !== "string") {
+  const { ok, status, json } = await postTokenEndpoint(
+    row.tokenEndpoint,
+    {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: row.redirectUri,
+      client_id: row.clientId,
+      code_verifier: unpack(row.pkceVerifierEnc),
+      // RFC 8707, mirrored from the authorize request.
+      resource: row.url,
+    },
+    row.clientId,
+    row.clientSecretEnc ? unpack(row.clientSecretEnc) : undefined,
+  );
+  if (!ok || typeof json.access_token !== "string") {
     const detail =
-      typeof json.error === "string" ? json.error : `status ${res.status}`;
+      typeof json.error === "string" ? json.error : `status ${status}`;
     throw new Error(`token exchange failed (${detail})`);
   }
 
@@ -473,6 +465,54 @@ export async function authHeaderFor(
   return { name: "authorization", value: `Bearer ${secret.accessToken}` };
 }
 
+/**
+ * POST a token-endpoint request. A client secret rides HTTP Basic first
+ * (RFC 6749's MUST-support method, what DCR vendors expect); on failure it
+ * retries once with `client_secret` in the body (client_secret_post) —
+ * some manual-creds vendors (Slack's user-token endpoint) only read body
+ * credentials and answer Basic with bad_client_secret.
+ */
+async function postTokenEndpoint(
+  tokenEndpoint: string,
+  params: Record<string, string>,
+  clientId: string,
+  clientSecret: string | undefined,
+): Promise<{ ok: boolean; status: number; json: Record<string, unknown> }> {
+  const attempt = async (mode: "basic" | "post") => {
+    const body = new URLSearchParams(params);
+    const headers: Record<string, string> = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json",
+    };
+    if (clientSecret) {
+      if (mode === "basic") {
+        headers.authorization =
+          "Basic " +
+          Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+      } else {
+        body.set("client_secret", clientSecret);
+      }
+    }
+    const res = await timedFetch(tokenEndpoint, {
+      method: "POST",
+      headers,
+      body,
+    });
+    const json = (await res.json().catch(() => ({}))) as Record<
+      string,
+      unknown
+    >;
+    return {
+      ok: res.ok && typeof json.access_token === "string",
+      status: res.status,
+      json,
+    };
+  };
+  const basic = await attempt("basic");
+  if (basic.ok || !clientSecret) return basic;
+  return attempt("post");
+}
+
 async function refreshTokens(
   row: schema.McpConnection,
   secret: OauthSecret,
@@ -480,27 +520,19 @@ async function refreshTokens(
   if (!secret.refreshToken || !row.tokenEndpoint || !row.clientId) {
     throw new Error("access token expired and no refresh token is stored");
   }
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: secret.refreshToken,
-    client_id: row.clientId,
-    resource: row.url,
-  });
-  const headers: Record<string, string> = {
-    "content-type": "application/x-www-form-urlencoded",
-    accept: "application/json",
-  };
-  if (row.clientSecretEnc) {
-    headers.authorization =
-      "Basic " +
-      Buffer.from(`${row.clientId}:${unpack(row.clientSecretEnc)}`).toString(
-        "base64",
-      );
-  }
-  const res = await timedFetch(row.tokenEndpoint, { method: "POST", headers, body });
-  const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-  if (!res.ok || typeof json.access_token !== "string") {
-    throw new Error(`token refresh failed (status ${res.status})`);
+  const { ok, status, json } = await postTokenEndpoint(
+    row.tokenEndpoint,
+    {
+      grant_type: "refresh_token",
+      refresh_token: secret.refreshToken,
+      client_id: row.clientId,
+      resource: row.url,
+    },
+    row.clientId,
+    row.clientSecretEnc ? unpack(row.clientSecretEnc) : undefined,
+  );
+  if (!ok || typeof json.access_token !== "string") {
+    throw new Error(`token refresh failed (status ${status})`);
   }
   const next: OauthSecret = {
     accessToken: json.access_token,

package/lib/mcp-gateway.ts

@@ -19,7 +19,7 @@
 import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { randomBytes, timingSafeEqual } from "node:crypto";
-import { Readable } from "node:stream";
+import { Readable, pipeline } from "node:stream";
 import { resolve } from "node:path";
 
 import { env } from "./env";
@@ -31,7 +31,11 @@ const BIND = process.env.UAI_MCP_GATEWAY_BIND ?? "127.0.0.1";
 /** MCP request bodies are small JSON-RPC frames; cap so audit parsing (and a
  *  hostile container) can't balloon host memory. Responses stream freely. */
 const MAX_BODY_BYTES = 4 * 1024 * 1024;
-const UPSTREAM_TIMEOUT_MS = 120_000;
+/** Bounds the upstream CONNECT (until response headers) only. The response
+ *  BODY must never be time-bounded: MCP streamable-HTTP clients hold SSE
+ *  streams open indefinitely, and an abort mid-pipe once took the whole host
+ *  process down as an unhandled Readable 'error' (2026-07-13). */
+const UPSTREAM_CONNECT_TIMEOUT_MS = 60_000;
 
 export interface TaskMcpConnection {
   id: string;
@@ -181,15 +185,29 @@ async function handle(req: IncomingMessage, res: ServerResponse): Promise<void>
     if (typeof v === "string") headers[name] = v;
   }
 
+  // The controller lives for the whole exchange: the timer only guards the
+  // connect phase (cleared once headers land), and a client hang-up reaps the
+  // upstream so dead streams don't accumulate.
+  const controller = new AbortController();
+  res.on("close", () => controller.abort());
+
   const attempt = async (forceRefresh: boolean): Promise<Response> => {
     const auth = await authHeaderFor(conn, forceRefresh);
     if (auth) headers[auth.name] = auth.value;
-    return fetch(conn.url, {
-      method: req.method,
-      headers,
-      body: body ?? undefined,
-      signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
-    });
+    const connectTimer = setTimeout(
+      () => controller.abort(),
+      UPSTREAM_CONNECT_TIMEOUT_MS,
+    );
+    try {
+      return await fetch(conn.url, {
+        method: req.method,
+        headers,
+        body: body ?? undefined,
+        signal: controller.signal,
+      });
+    } finally {
+      clearTimeout(connectTimer);
+    }
   };
 
   let upstream: Response;
@@ -220,8 +238,17 @@ async function handle(req: IncomingMessage, res: ServerResponse): Promise<void>
   }
   res.writeHead(upstream.status, resHeaders);
   if (upstream.body) {
-    Readable.fromWeb(upstream.body as Parameters<typeof Readable.fromWeb>[0]).pipe(
+    // pipeline (NOT .pipe) so a mid-stream error — client gone, upstream
+    // reset, abort — tears both ends down instead of crashing the process
+    // as an unhandled Readable 'error'.
+    pipeline(
+      Readable.fromWeb(upstream.body as Parameters<typeof Readable.fromWeb>[0]),
       res,
+      (err) => {
+        if (err && err.name !== "AbortError") {
+          audit({ taskId, slug, stream: "ended", error: err.name });
+        }
+      },
     );
   } else {
     res.end();
@@ -248,13 +275,14 @@ const MERGE_MCP_JSON = `
 const fs = require("fs");
 const p = "/workspace/.mcp.json";
 let j = {};
-try { j = JSON.parse(fs.readFileSync(p, "utf8")); } catch {}
+let existed = true;
+try { j = JSON.parse(fs.readFileSync(p, "utf8")); } catch { existed = false; }
 j.mcpServers = j.mcpServers || {};
 let changed = false;
 for (const [k, v] of Object.entries(JSON.parse(process.argv[1]))) {
   if (JSON.stringify(j.mcpServers[k]) !== JSON.stringify(v)) { j.mcpServers[k] = v; changed = true; }
 }
-if (changed) fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\\n");
+if (changed || !existed) fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\\n");
 `.trim();
 
 function shellQuote(value: string): string {
@@ -273,7 +301,9 @@ export async function setupMcpTaskConfig(
   connections: TaskMcpConnection[],
   hasCodex: boolean,
 ): Promise<void> {
-  if (connections.length === 0) return;
+  // No early return on empty: the claude adapter passes
+  // `--mcp-config /workspace/.mcp.json` unconditionally (ADR-057), so the
+  // file must exist — an empty mcpServers map — even with no connections.
   try {
     const acl = ensureTaskGatewayAcl(taskId, connections);
     const urlFor = (slug: string): string =>