@runuai/host 0.8.1 → 0.8.3

package/images/standard/Dockerfile

@@ -219,6 +219,16 @@ RUN bash -lc '\
   asdf reshim nodejs; \
 '
 
+# Kimi Code CLI (Moonshot) — single-binary install to /home/node/.kimi-code/bin.
+# The adapter invokes it by absolute path (docker exec ignores login-shell PATH),
+# and task-up copies the operator subscription creds in. Non-fatal: a Kimi CDN
+# hiccup must not break the image for Claude/Codex (the kimi engine just won't
+# be runnable until rebuilt).
+RUN bash -lc '\
+  curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash \
+    || echo "[warn] kimi-code install failed — kimi engine unavailable in this image"; \
+'
+
 ENV PATH=/home/node/.local/bin:$PATH
 
 # ---------------------------------------------------------------------------

package/lib/agents/factory.ts

@@ -17,6 +17,7 @@
 // Side-effect imports: register the built-in adapters with the registry.
 import "./claude";
 import "./codex";
+import "./kimi";
 
 import { factoryFor } from "./registry";
 import type { AgentSession, AgentSessionFactory } from "./types";

package/lib/agents/kimi.ts

@@ -0,0 +1,313 @@
+/**
+ * KimiSession — a real AgentSession backed by Moonshot's **Kimi Code** CLI,
+ * run inside the task container:
+ *
+ *   docker exec -i task-<id>-app-1 ~/.kimi-code/bin/kimi \
+ *     -p "<prompt>" -m kimi-code/k3 --output-format stream-json [-r <sessionId>]
+ *
+ * Unlike Claude (persistent stdin session) and Codex (`app-server` JSON-RPC),
+ * Kimi Code is **one-shot per turn**: `-p` runs a single prompt to completion,
+ * streams newline-delimited JSON to stdout, and exits. Multi-turn continuity is
+ * `-r <sessionId>` (the session lives in Kimi's cloud + the container's
+ * ~/.kimi-code). So each `send()` spawns a fresh `docker exec`; sends are
+ * serialized so a second message can't race a running turn.
+ *
+ * Stream-json vocabulary (reverse-engineered — OpenAI-chat-style role lines):
+ *   {"role":"assistant","content":"…"}                       → message_complete
+ *   {"role":"assistant","tool_calls":[{function:{name,arguments}}]} → tool_call
+ *   {"role":"tool","tool_call_id":…,"content":…}             → (no event; folded)
+ *   {"role":"meta","type":"session.resume_hint","session_id"} → captured for -r
+ *
+ * AUTH is the operator's Kimi Code **subscription**: `~/.kimi-code` (config +
+ * credentials/kimi-code.json) is docker-cp'd into the container at task-up
+ * (task-up.sh), same pattern as Codex's ~/.codex — never the cloud (ADR-015).
+ * `-p` runs non-interactively and auto-runs tools (the container is the
+ * isolation boundary), so there are no permission prompts to resolve.
+ */
+import { spawn, type ChildProcess } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import { newId } from "../ulid";
+import { register } from "./registry";
+import type {
+  AgentEvent,
+  AgentEventHandler,
+  AgentKind,
+  AgentSession,
+  RosterAgent,
+} from "./types";
+
+/** Installed by the image's install.sh (code.kimi.com); absolute so a
+ *  non-login `docker exec` doesn't depend on PATH. */
+const KIMI_BIN = "/home/node/.kimi-code/bin/kimi";
+
+// Model ids from `~/.kimi-code/config.toml` (`kimi -m <id>`). k3 is the
+// frontier model; the K2.7 coding pair are cheaper/faster. UPDATE WHEN KIMI
+// CHANGES its lineup. Order = display order in the cloud picker.
+const KIMI_MODELS = [
+  "kimi-code/k3",
+  "kimi-code/kimi-for-coding",
+  "kimi-code/kimi-for-coding-highspeed",
+];
+const KIMI_DEFAULT_MODEL = "kimi-code/k3";
+
+// Kimi Code has no per-invocation reasoning-effort flag (effort is a
+// config.toml model default), so nothing to offer in the picker.
+const KIMI_EFFORTS: string[] = [];
+
+/** Host path to the subscription credential — its presence gates the engine
+ *  (mirrors Codex's ~/.codex/auth.json check). */
+function kimiCredPath(): string {
+  return join(
+    process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    ".kimi-code",
+    "credentials",
+    "kimi-code.json",
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Pure protocol mapping — one stream-json line → AgentEvent[] (+ session id).
+// ---------------------------------------------------------------------------
+
+/** Best-effort one-line detail for a tool card from the tool's JSON args. */
+function toolDetail(rawArgs: unknown): string {
+  if (typeof rawArgs !== "string") return "";
+  try {
+    const a = JSON.parse(rawArgs) as Record<string, unknown>;
+    const pick = a.command ?? a.path ?? a.file_path ?? a.pattern ?? a.query;
+    return typeof pick === "string" ? pick : rawArgs;
+  } catch {
+    return rawArgs;
+  }
+}
+
+export interface MappedLine {
+  events: AgentEvent[];
+  /** A session.resume_hint id, when this line carried one. */
+  sessionId?: string;
+}
+
+/**
+ * Map a single Kimi stream-json line. Non-JSON lines (a tool's raw stdout that
+ * Kimi echoes) and lines with no user-facing meaning (`role:"tool"` results,
+ * `role:"user"` echoes) map to no events.
+ */
+export function mapKimiLine(line: string): MappedLine {
+  const trimmed = line.trim();
+  if (!trimmed.startsWith("{")) return { events: [] };
+  let msg: Record<string, unknown>;
+  try {
+    msg = JSON.parse(trimmed) as Record<string, unknown>;
+  } catch {
+    return { events: [] };
+  }
+
+  if (msg.role === "assistant") {
+    if (typeof msg.content === "string" && msg.content.length > 0) {
+      return { events: [{ type: "message_complete", text: msg.content }] };
+    }
+    if (Array.isArray(msg.tool_calls)) {
+      const events: AgentEvent[] = [];
+      for (const raw of msg.tool_calls) {
+        const tc = (raw ?? {}) as Record<string, unknown>;
+        const fn = (tc.function ?? {}) as Record<string, unknown>;
+        const name = typeof fn.name === "string" ? fn.name : "tool";
+        events.push({
+          type: "tool_call",
+          id: typeof tc.id === "string" ? tc.id : newId(),
+          title: name,
+          detail: toolDetail(fn.arguments),
+        });
+      }
+      return { events };
+    }
+    return { events: [] };
+  }
+
+  if (
+    msg.role === "meta" &&
+    msg.type === "session.resume_hint" &&
+    typeof msg.session_id === "string"
+  ) {
+    return { events: [], sessionId: msg.session_id };
+  }
+
+  return { events: [] };
+}
+
+// ---------------------------------------------------------------------------
+// Session
+// ---------------------------------------------------------------------------
+
+/** Injectable spawn seam (tests provide a fake). */
+export type Spawner = (args: string[]) => ChildProcess;
+const defaultSpawn: Spawner = (args) =>
+  spawn("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+
+export class KimiSession implements AgentSession {
+  readonly agentId: string;
+  readonly kind: AgentKind = "kimi";
+
+  private readonly containerName: string;
+  private readonly model?: string;
+  private readonly systemPreamble: string;
+  private readonly agentEnv: Record<string, string>;
+  private readonly spawner: Spawner;
+
+  private readonly handlers = new Set<AgentEventHandler>();
+  private sessionId: string | null = null;
+  private current: ChildProcess | null = null;
+  private queue: Promise<void> = Promise.resolve();
+  private sentPreamble = false;
+  private closed = false;
+
+  constructor(args: {
+    taskId: string;
+    agent: RosterAgent;
+    containerName: string;
+    systemPreamble: string;
+    agentEnv?: Record<string, string>;
+    spawner?: Spawner;
+  }) {
+    this.agentId = args.agent.id;
+    this.containerName = args.containerName;
+    this.model = args.agent.model;
+    this.systemPreamble = args.systemPreamble;
+    this.agentEnv = args.agentEnv ?? {};
+    this.spawner = args.spawner ?? defaultSpawn;
+  }
+
+  onEvent(handler: AgentEventHandler): () => void {
+    this.handlers.add(handler);
+    return () => this.handlers.delete(handler);
+  }
+
+  private emit(event: AgentEvent): void {
+    if (this.closed && event.type !== "exit") return;
+    for (const h of this.handlers) h(event);
+  }
+
+  /** Kimi is one-shot; serialize turns so a second message queues behind the
+   *  running one instead of spawning a racing `kimi -p`. */
+  async send(text: string): Promise<void> {
+    if (this.closed) return;
+    this.queue = this.queue.then(() => this.runTurn(text));
+    return this.queue;
+  }
+
+  private buildArgs(prompt: string): string[] {
+    const args = ["exec", "-i", "-u", "node"];
+    for (const [k, v] of Object.entries(this.agentEnv)) {
+      args.push("-e", `${k}=${v}`);
+    }
+    args.push(
+      this.containerName,
+      KIMI_BIN,
+      "-p",
+      prompt,
+      "--output-format",
+      "stream-json",
+    );
+    if (this.model) args.push("-m", this.model);
+    // Continue the same Kimi session across turns (captured from the first
+    // turn's resume_hint). First turn has none → a fresh session.
+    if (this.sessionId) args.push("-r", this.sessionId);
+    return args;
+  }
+
+  private async runTurn(text: string): Promise<void> {
+    if (this.closed) return;
+    // Kimi's `-p` has no system-prompt flag, so fold the channel briefing into
+    // the FIRST turn's prompt (later turns carry it via the resumed session).
+    const prompt =
+      !this.sentPreamble && this.systemPreamble.trim().length > 0
+        ? `${this.systemPreamble}\n\n---\n\n${text}`
+        : text;
+    this.sentPreamble = true;
+
+    const child = this.spawner(this.buildArgs(prompt));
+    this.current = child;
+
+    let buf = "";
+    const consume = (chunk: string): void => {
+      buf += chunk;
+      let nl: number;
+      while ((nl = buf.indexOf("\n")) >= 0) {
+        const line = buf.slice(0, nl);
+        buf = buf.slice(nl + 1);
+        const { events, sessionId } = mapKimiLine(line);
+        if (sessionId) this.sessionId = sessionId;
+        for (const e of events) this.emit(e);
+      }
+    };
+    child.stdout?.on("data", (b: Buffer) => consume(b.toString("utf8")));
+    let stderr = "";
+    child.stderr?.on("data", (b: Buffer) => {
+      stderr += b.toString("utf8");
+    });
+
+    await new Promise<void>((resolve) => {
+      child.on("exit", (code) => {
+        this.current = null;
+        if (buf.trim().length > 0) consume("\n"); // flush a trailing line
+        if (!this.closed) {
+          if (code !== 0) {
+            const tail = stderr.trim().slice(-500);
+            this.emit({
+              type: "error",
+              message: `kimi exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`,
+            });
+          }
+          this.emit({ type: "turn_complete" });
+        }
+        resolve();
+      });
+      child.on("error", (err) => {
+        this.current = null;
+        if (!this.closed) {
+          this.emit({ type: "error", message: `kimi spawn failed: ${err.message}` });
+          this.emit({ type: "turn_complete" });
+        }
+        resolve();
+      });
+    });
+  }
+
+  async interrupt(): Promise<void> {
+    // Kill the running turn's exec. Best-effort — the in-container `kimi` may
+    // finish the current tool, but no further output is emitted.
+    this.current?.kill("SIGKILL");
+  }
+
+  // `-p` mode auto-approves tools (the container is the sandbox), so no
+  // permission requests are ever emitted — nothing to resolve.
+  async resolvePermission(): Promise<void> {
+    /* no-op */
+  }
+
+  async close(): Promise<void> {
+    if (this.closed) return;
+    this.closed = true;
+    this.current?.kill("SIGKILL");
+    this.current = null;
+    this.emit({ type: "exit", code: 0 });
+    this.handlers.clear();
+  }
+}
+
+// Register the Kimi Code adapter at module load (ADR-021).
+register({
+  kind: "kimi",
+  label: "Kimi Code",
+  supportedModels: () => [...KIMI_MODELS],
+  defaultModel: KIMI_DEFAULT_MODEL,
+  supportedEfforts: () => [...KIMI_EFFORTS],
+  // Gated on the operator's Kimi Code subscription credential (copied into
+  // containers at task-up). No login → the engine isn't advertised.
+  available: () => existsSync(kimiCredPath()),
+  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
+    new KimiSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+});

package/lib/codex-auth.ts

@@ -0,0 +1,155 @@
+/**
+ * Codex credential re-injection — the symmetric partner to the GitHub reinject
+ * in {@link ./github-tokens} (ADR-027/033 → host 0.8.1).
+ *
+ * The host owner's `~/.codex` is docker-cp'd into each task container ONCE, at
+ * task-up (`scripts/agent/task-up.sh`). When the owner re-logs into Codex —
+ * the refresh token gets revoked (a login elsewhere) and `codex login` rewrites
+ * `~/.codex/auth.json` — already-running containers keep their stale copy, so a
+ * re-login otherwise only helps NEW tasks. This re-copies the fresh `~/.codex`
+ * into the running task containers so live tasks self-heal.
+ *
+ * Two triggers, covering both re-login paths:
+ *   - {@link watchCodexAuth} — fs.watch on `~/.codex`, for `codex login` run
+ *     from a terminal while the host stays up.
+ *   - {@link reinjectCodexRunningTasks} at host start — for the desktop
+ *     "Connect Codex" flow, which writes `~/.codex` then restarts the host
+ *     (durable sessions reattach to containers that still hold the old creds).
+ *
+ * Codex auth is host-wide (the operator's single `~/.codex`, not per-user), so
+ * this targets ALL running tasks — matching task-up, which copies it into every
+ * container regardless of roster.
+ */
+import { existsSync, watch } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import { isNull } from "drizzle-orm";
+
+import { getDb, schema } from "./db";
+import { dockerCli } from "./docker-exec";
+
+/** The exact set task-up.sh copies into `/home/node/.codex`. */
+const CODEX_ITEMS = [
+  "auth.json",
+  "config.toml",
+  "AGENTS.md",
+  "version.json",
+  "installation_id",
+  "rules",
+] as const;
+const EXEC_TIMEOUT_MS = 15_000;
+
+/** Injectable seams (defaults hit the real DB / docker / fs) so the copy logic
+ *  is testable without either. */
+export interface CodexDeps {
+  exec?: (args: string[]) => Promise<{ status: number | null; stderr: string }>;
+  runningContainers?: () => string[];
+  fileExists?: (path: string) => boolean;
+}
+
+function ownerCodexDir(): string {
+  return join(process.env.UAI_OWNER_HOME?.trim() || homedir(), ".codex");
+}
+
+const defaultExec: NonNullable<CodexDeps["exec"]> = async (args) => {
+  const res = await dockerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
+  return { status: res.status, stderr: res.stderr };
+};
+
+function defaultRunningContainers(): string[] {
+  return getDb()
+    .select({ taskId: schema.hostTasks.taskId })
+    .from(schema.hostTasks)
+    .where(isNull(schema.hostTasks.endedAt))
+    .all()
+    .map((r) => `task-${r.taskId}-app-1`);
+}
+
+/**
+ * Re-copy `~/.codex/<items>` into one container — mirrors task-up.sh exactly:
+ * ensure the dir (root), cp each item that exists, chown back to node. Best
+ * effort; a stopped/removed container makes the exec fail and is caught by the
+ * caller.
+ */
+async function copyCodexInto(container: string, deps: CodexDeps): Promise<void> {
+  const exec = deps.exec ?? defaultExec;
+  const exists = deps.fileExists ?? existsSync;
+  const dir = ownerCodexDir();
+  await exec(["exec", "-u", "root", container, "mkdir", "-p", "/home/node/.codex"]);
+  for (const item of CODEX_ITEMS) {
+    const src = join(dir, item);
+    if (!exists(src)) continue;
+    await exec(["cp", src, `${container}:/home/node/.codex/`]);
+  }
+  await exec([
+    "exec",
+    "-u",
+    "root",
+    container,
+    "chown",
+    "-R",
+    "node:node",
+    "/home/node/.codex",
+  ]);
+}
+
+/**
+ * Re-copy the freshly (re)logged-in `~/.codex` into every running task
+ * container on this host. No-op when there is no `~/.codex/auth.json` (nothing
+ * to inject) or no running tasks. Best-effort per container.
+ */
+export async function reinjectCodexRunningTasks(deps: CodexDeps = {}): Promise<void> {
+  const exists = deps.fileExists ?? existsSync;
+  if (!exists(join(ownerCodexDir(), "auth.json"))) return;
+  const containers = (deps.runningContainers ?? defaultRunningContainers)();
+  if (containers.length === 0) return;
+  console.log(`[codex] re-copying ~/.codex into ${containers.length} running task(s)`);
+  for (const container of containers) {
+    try {
+      await copyCodexInto(container, deps);
+    } catch (err) {
+      console.warn(
+        `[codex] reinject into ${container} failed: ${err instanceof Error ? err.message : err}`,
+      );
+    }
+  }
+}
+
+let watcher: ReturnType<typeof watch> | null = null;
+let debounceTimer: ReturnType<typeof setTimeout> | null = null;
+
+/**
+ * Watch `~/.codex` for `auth.json` changes (a re-login) and re-inject into
+ * running tasks, debounced (a login writes several files). Idempotent; a
+ * missing `~/.codex` dir is a no-op — the host-start reinject already handles
+ * a first login that flips Codex available. UAI_CODEX_REINJECT=0 disables it.
+ */
+export function watchCodexAuth(): void {
+  if (watcher || process.env.UAI_CODEX_REINJECT === "0") return;
+  const dir = ownerCodexDir();
+  if (!existsSync(dir)) return;
+  try {
+    watcher = watch(dir, (_event, filename) => {
+      // filename is null on some platforms — then we can't tell, so proceed.
+      if (filename && filename !== "auth.json") return;
+      if (debounceTimer) clearTimeout(debounceTimer);
+      debounceTimer = setTimeout(() => void reinjectCodexRunningTasks(), 2_000);
+      debounceTimer.unref?.();
+    });
+  } catch (err) {
+    console.warn(
+      `[codex] could not watch ${dir}: ${err instanceof Error ? err.message : err}`,
+    );
+  }
+}
+
+/** Test/teardown hook. */
+export function stopWatchingCodexAuth(): void {
+  watcher?.close();
+  watcher = null;
+  if (debounceTimer) {
+    clearTimeout(debounceTimer);
+    debounceTimer = null;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/scripts/agent/task-up.sh

@@ -469,6 +469,29 @@ done
 docker exec -u root "$app_container" \
   chown -R node:node /home/node/.codex >/dev/null 2>&1 || true
 
+# Copy Kimi Code subscription/config into a task-private /home/node/.kimi-code.
+# The Linux `kimi` binary is baked into the image; here we copy ONLY the
+# arch-independent config + credential (never the host's macOS bin/, nor live
+# session state) so the container's kimi runs on the operator's subscription.
+docker exec -u root "$app_container" \
+  mkdir -p /home/node/.kimi-code/credentials >/dev/null 2>&1 || true
+if [ -e "$UAI_OWNER_HOME/.kimi-code/config.toml" ]; then
+  docker cp "$UAI_OWNER_HOME/.kimi-code/config.toml" \
+    "$app_container":/home/node/.kimi-code/config.toml >/dev/null 2>&1 \
+    || log "warning: docker cp of .kimi-code/config.toml failed; kimi may need re-login"
+fi
+if [ -e "$UAI_OWNER_HOME/.kimi-code/device_id" ]; then
+  docker cp "$UAI_OWNER_HOME/.kimi-code/device_id" \
+    "$app_container":/home/node/.kimi-code/device_id >/dev/null 2>&1 || true
+fi
+if [ -e "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" ]; then
+  docker cp "$UAI_OWNER_HOME/.kimi-code/credentials/kimi-code.json" \
+    "$app_container":/home/node/.kimi-code/credentials/kimi-code.json >/dev/null 2>&1 \
+    || log "warning: docker cp of .kimi-code credential failed; kimi may need re-login"
+fi
+docker exec -u root "$app_container" \
+  chown -R node:node /home/node/.kimi-code >/dev/null 2>&1 || true
+
 # Copy the same resolved SSH identity (task creator's per-user key when present,
 # else the operator identity — see above) into the container, so the agent signs
 # + pushes with the key whose .pub the user registered on GitHub. ADR-027 drops

package/src/main.ts

@@ -32,6 +32,7 @@ import {
   onGithubChange,
   setAuthExpiredHandler,
 } from "../lib/github-tokens";
+import { reinjectCodexRunningTasks, watchCodexAuth } from "../lib/codex-auth";
 import {
   deleteKey as deleteSshKey,
   ensureKeyForUser as ensureSshKeyForUser,
@@ -154,6 +155,12 @@ setAuthExpiredHandler((taskId, _userId, reason) => {
 // Best-effort: build the standard image + asdf volume if missing. Logs and
 // continues on failure (e.g. docker unavailable) so the host still boots.
 void ensureStandardImage();
+// Codex creds are docker-cp'd into containers at task-up. A re-login (revoked
+// token → `codex login`) otherwise reaches only NEW tasks — re-copy into
+// running tasks on start (covers the desktop "Connect Codex", which restarts
+// the host) and watch ~/.codex for future logins (a terminal `codex login`).
+void reinjectCodexRunningTasks();
+watchCodexAuth();
 connect();
 // Local browser UI (ADR-028) — same single process, alongside the WSS client.
 // Best-effort: a UI bind failure must not take the host service down.