@runuai/host 0.8.0 → 0.8.1

package/lib/github-tokens.ts

@@ -56,6 +56,11 @@ export function onConnectSet(frame: GhConnectSet): { ok: boolean; error?: string
       .onConflictDoUpdate({ target: schema.githubTokens.userId, set: fields })
       .run();
     notifyGithubChange();
+    // A reconnect must reach ALREADY-RUNNING containers, not just new tasks:
+    // each container's gh config is written once, at task setup, so a fresh
+    // grant otherwise sits unused until /retry-gh. Re-inject into the user's
+    // live tasks now. Fire-and-forget — never blocks the token store.
+    reinjectRunningTasks(frame.userId);
     return { ok: true };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : "store failed" };
@@ -170,6 +175,20 @@ function activeTaskIdsForUser(userId: string): string[] {
     .map((r) => r.taskId);
 }
 
+/**
+ * Re-mint + inject a (re)connected token into the user's live tasks — so a
+ * reconnect on Account applies to running containers, not only new tasks. Clear
+ * any armed retry chain first (a fresh grant must not be swallowed by an outage
+ * backoff, and `setupTaskGithub`'s duplicate-chain guard would no-op it) then
+ * run setup fresh. Fire-and-forget per task; best-effort by construction.
+ */
+export function reinjectRunningTasks(userId: string): void {
+  for (const taskId of activeTaskIdsForUser(userId)) {
+    clearRefresh(taskId);
+    void setupTaskGithub(taskId, userId);
+  }
+}
+
 // --- access-token exchange --------------------------------------------------
 
 function cloudHttpBase(): string {
@@ -434,6 +453,37 @@ function isRevokedTokenError(reason: string): boolean {
   return /revoked|invalid_grant|bad_refresh/i.test(reason);
 }
 
+/**
+ * True when the failure names a genuinely bad credential — GitHub answered the
+ * validation with 401/403 ("Bad credentials"), so the token really is wrong and
+ * only a reconnect fixes it. Distinct from a 5xx blip (see below).
+ */
+function isBadCredentialError(reason: string): boolean {
+  return /validating token: HTTP 40[13]\b|Bad credentials|401 Unauthorized|403 Forbidden/i.test(
+    reason,
+  );
+}
+
+/**
+ * True when the failure is a GitHub-side / network blip that a retry will heal
+ * — the API returned 5xx (as happens when `gh auth login` validates the token
+ * against api.github.com during an outage), a rate-limit, or the fetch itself
+ * failed. Such a failure must NOT be surfaced as "authentication expired —
+ * reconnect": the token is fine, GitHub is briefly unavailable. A genuine bad
+ * credential (401/403) is explicitly excluded so it still routes to reconnect.
+ */
+export function isTransientGithubError(reason: string): boolean {
+  if (isBadCredentialError(reason)) return false;
+  return (
+    /HTTP 5\d\d|Service Unavailable|Bad Gateway|Gateway Time-?out|server error|rate limit|too many requests|secondary rate|unavailable|unreachable/i.test(
+      reason,
+    ) ||
+    /\bfetch failed\b|timeout|timed out|ETIMEDOUT|ECONNRESET|ECONNREFUSED|ECONNABORTED|ENOTFOUND|EAI_AGAIN|socket hang up|\bnetwork\b/i.test(
+      reason,
+    )
+  );
+}
+
 async function runRefresh(taskId: string, userId: string): Promise<void> {
   try {
     const tok = await requestAccessToken(userId);
@@ -602,10 +652,16 @@ export async function setupTaskGithub(
       authExpiredHandler?.(taskId, userId, reason);
       return false;
     }
+    // A retry chain already armed for this task means a sibling entry point
+    // (task-up and channel-ensure both call setup) already reported this and
+    // owns recovery — don't post a duplicate note or start a competing chain.
+    // `/retry-gh` clears the chain first, so a manual retry is never swallowed.
+    if (attempt === 0 && retryTimers.has(taskId)) return false;
     // Transient: self-heal with bounded backoff. Post the chat note only on
     // the FIRST failure of a chain — each retry re-enters this catch, and six
     // "gh auth" notes for one outage is noise. Exhaustion posts its own note
-    // (in scheduleGithubRetry).
+    // (in scheduleGithubRetry). The handler classifies the reason (transient
+    // 5xx blip vs. genuine expiry) and words the note accordingly.
     if (attempt === 0) authExpiredHandler?.(taskId, userId, reason);
     scheduleGithubRetry(taskId, userId, attempt, deps);
     return false;

package/lib/orchestrator.ts

@@ -34,7 +34,7 @@ import {
 } from "./agents/types";
 import { ACTIVE_STATUSES } from "./task-status";
 import { getHostTask, upsertHostTask } from "./runtime-state";
-import { setupTaskGithub } from "./github-tokens";
+import { clearRefresh, setupTaskGithub } from "./github-tokens";
 import { setupTaskGitIdentity } from "./git-identity";
 import { dockerCli } from "./docker-exec";
 import {
@@ -571,6 +571,9 @@ class Orchestrator {
       return;
     }
     this.emitSystemNote(taskId, "gh: retrying authentication…");
+    // Cancel any armed auto-retry chain so this manual attempt runs fresh
+    // (setup's duplicate-chain guard would otherwise no-op it).
+    clearRefresh(taskId);
     const ok = await setupTaskGithub(taskId, owner);
     this.emitSystemNote(
       taskId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/src/main.ts

@@ -26,6 +26,7 @@ import { getHostTask } from "../lib/runtime-state";
 import { getOrchestrator } from "../lib/orchestrator";
 import {
   connectedUserIds,
+  isTransientGithubError,
   onConnectClear,
   onConnectSet,
   onGithubChange,
@@ -135,14 +136,20 @@ interface PausableSource {
 
 console.log(`[host-agent] starting host ${hostId}`);
 migrateHostDb();
-// When a task's GitHub token can't be refreshed (revoked, disconnected,
-// expired), surface it in the task channel so the user can re-grant (ADR-027).
+// Surface a task's GitHub setup failure in its channel (ADR-027). Classify the
+// reason first: a GitHub-side 5xx / network blip (e.g. `gh auth login`
+// validating the token during a github.com outage) is transient and self-heals
+// on the bounded retry — telling the user their auth "expired" and to reconnect
+// would be wrong and alarming. Only a genuine expiry/revocation asks for a
+// reconnect. Both cases keep retrying in the background regardless.
 setAuthExpiredHandler((taskId, _userId, reason) => {
-  getOrchestrator().emitSystemNote(
-    taskId,
-    `gh authentication expired (reason: ${reason}). Reconnect GitHub on ` +
-      `Account, then run /retry-gh in this task to restore.`,
-  );
+  const note = isTransientGithubError(reason)
+    ? `GitHub is temporarily unavailable — ${reason}. Uai is retrying ` +
+      `automatically; no action needed unless this persists (then run ` +
+      `/retry-gh).`
+    : `gh authentication expired (reason: ${reason}). Reconnect GitHub on ` +
+      `Account, then run /retry-gh in this task to restore.`;
+  getOrchestrator().emitSystemNote(taskId, note);
 });
 // Best-effort: build the standard image + asdf volume if missing. Logs and
 // continues on failure (e.g. docker unavailable) so the host still boots.