@runuai/host 0.8.21 → 0.8.23

package/lib/agents/cursor.ts

@@ -244,9 +244,31 @@ export class CursorSession implements AgentSession {
         const m = mapCursorLine(line);
         if (m.sessionId) this.sessionId = m.sessionId;
         if (typeof m.textDelta === "string") {
-          sawText = true;
-          acc += m.textDelta;
-          this.emit({ type: "message_delta", text: m.textDelta });
+          // Cursor (--stream-partial-output) streams incremental token deltas
+          // and then a REDUNDANT full-message snapshot. The timestamp_ms
+          // heuristic in mapCursorLine drops that final snapshot for models
+          // whose final line is untagged — but Cursor's multi-model support
+          // (ADR-068) means SOME models tag the final full snapshot with
+          // timestamp_ms too, so it slips through and gets appended on top of
+          // the tokens: every message doubled (live 2026-07-21). Reconcile
+          // against what we've already streamed instead of trusting the tag —
+          // robust to incremental tokens, cumulative snapshots, and the
+          // redundant final repeat alike.
+          const t = m.textDelta;
+          let delta: string | null;
+          if (t === acc) {
+            delta = null; // full-message snapshot we've already emitted
+          } else if (acc.length > 0 && t.startsWith(acc)) {
+            delta = t.slice(acc.length); // cumulative snapshot → growth only
+            acc = t;
+          } else {
+            delta = t; // incremental token / genuinely new text
+            acc += t;
+          }
+          if (delta) {
+            sawText = true;
+            this.emit({ type: "message_delta", text: delta });
+          }
         }
         if (m.toolCall) {
           this.emit({

package/lib/git-identity.ts

@@ -3,9 +3,20 @@
  * are authored as the user who created the task, not the image's generic
  * identity. Best-effort, mirrors the SSH setup: a failure logs but never aborts
  * task-up. Name falls back to the email when no display name is known.
+ *
+ * ensureTaskSshIdentity re-asserts the SSH push identity + its DEPENDENT git
+ * config the same way gh tokens are re-asserted at channel ensure — the
+ * one-shot copy at task-up proved fragile (live 2026-07-21: a recreated
+ * container lost the key silently; a later repair restored the key WITHOUT
+ * the config and pushes stayed on HTTPS → 403). Key and config are a unit.
  */
 
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+
 import { dockerCli } from "./docker-exec";
+import { env } from "./env";
+import { removeTaskIdentity, writeTaskIdentity } from "./ssh";
 
 const EXEC_TIMEOUT_MS = 10_000;
 
@@ -60,3 +71,90 @@ export async function setupTaskGitIdentity(
   console.log(`[git] task ${taskId}: git identity → ${displayName} <${email}>`);
   return true;
 }
+
+// The key's dependent git config, applied as one unit with the key itself:
+// SSH routing for every GitHub remote (mirrors are born with the project's
+// clone URL, usually https) + SSH commit/tag signing. Same statements as
+// uai-init's key-gated block — which silently self-skips when the key is
+// missing at ITS run time, hence re-applying here.
+const SSH_GIT_CONFIG =
+  'git config --global url."git@github.com:".insteadOf "https://github.com/"' +
+  ' && git config --global core.sshCommand "ssh -o StrictHostKeyChecking=accept-new"' +
+  " && git config --global gpg.format ssh" +
+  " && git config --global user.signingkey /home/node/.ssh/id_ed25519.pub" +
+  " && git config --global commit.gpgsign true" +
+  " && git config --global tag.gpgsign true";
+
+/**
+ * Copy the SSH identity at `keyPath` into the task container and apply its
+ * dependent git config. Every failure is LOGGED with its step — the silent
+ * `|| true` chain this replaces let a missing key masquerade as a GitHub
+ * permissions problem for an entire afternoon.
+ */
+export async function injectSshIdentity(
+  taskId: string,
+  keyPath: string,
+  exec: DockerExec = defaultExec,
+): Promise<boolean> {
+  const container = `task-${taskId}-app-1`;
+  const steps: ReadonlyArray<readonly [string, string[]]> = [
+    ["mkdir ~/.ssh", ["exec", "-u", "root", container, "mkdir", "-p", "/home/node/.ssh"]],
+    ["copy key", ["cp", keyPath, `${container}:/home/node/.ssh/id_ed25519`]],
+    ["copy pubkey", ["cp", `${keyPath}.pub`, `${container}:/home/node/.ssh/id_ed25519.pub`]],
+    [
+      "own + chmod",
+      [
+        "exec", "-u", "root", container, "sh", "-c",
+        "chown -R node:node /home/node/.ssh && chmod 700 /home/node/.ssh && chmod 600 /home/node/.ssh/id_ed25519",
+      ],
+    ],
+    ["ssh routing + signing config", ["exec", "-u", "node", container, "sh", "-c", SSH_GIT_CONFIG]],
+  ];
+  for (const [label, args] of steps) {
+    const res = await exec(args);
+    if (res.status !== 0) {
+      console.warn(
+        `[ssh] task ${taskId}: ${label} failed: ${res.stderr.trim() || `exit ${res.status}`}`,
+      );
+      return false;
+    }
+  }
+  console.log(`[ssh] task ${taskId}: push identity + git SSH config asserted`);
+  return true;
+}
+
+/**
+ * Materialize the task creator's SSH key (operator identity as fallback,
+ * mirroring task-up.sh), inject it + its git config into the container, and
+ * clean the on-disk private key back up. Safe to call on every channel
+ * ensure; a task with no identity anywhere logs once and pushes stay HTTPS.
+ */
+export async function ensureTaskSshIdentity(
+  taskId: string,
+  ownerUserId: string | null | undefined,
+  exec: DockerExec = defaultExec,
+): Promise<boolean> {
+  let keyPath: string | null = null;
+  let perTask = false;
+  const dir = writeTaskIdentity(taskId, ownerUserId);
+  if (dir) {
+    keyPath = resolve(dir, "id_ed25519");
+    perTask = true;
+  } else {
+    const operatorKey = resolve(env.dataDir, "identity", "id_ed25519");
+    if (existsSync(operatorKey)) keyPath = operatorKey;
+  }
+  if (!keyPath) {
+    console.log(
+      `[ssh] task ${taskId}: no SSH identity for owner or operator — git pushes stay on HTTPS`,
+    );
+    return false;
+  }
+  try {
+    return await injectSshIdentity(taskId, keyPath, exec);
+  } finally {
+    // Host hygiene (same as task-up): the materialized private key never
+    // outlives the injection.
+    if (perTask) removeTaskIdentity(taskId);
+  }
+}

package/lib/orchestrator.ts

@@ -35,7 +35,7 @@ import {
 import { ACTIVE_STATUSES } from "./task-status";
 import { getHostTask, upsertHostTask } from "./runtime-state";
 import { clearRefresh, setupTaskGithub } from "./github-tokens";
-import { setupTaskGitIdentity } from "./git-identity";
+import { ensureTaskSshIdentity, setupTaskGitIdentity } from "./git-identity";
 import { dockerCli } from "./docker-exec";
 import {
   containerSkillFile,
@@ -455,6 +455,11 @@ class Orchestrator {
       void setupTaskGithub(channel.taskId, task.ownerUserId);
     }
 
+    // SSH push identity + its git config, re-asserted like the gh token above
+    // (one-shot at task-up proved fragile — recreated containers lose the key
+    // silently; live 2026-07-21). Best-effort + non-blocking.
+    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId);
+
     // ADR-047: install any package skills (native Claude Agent Skills) into the
     // container BEFORE spawning agents, so they're discoverable on the first
     // turn. Idempotent + best-effort (returns fast when there are none); a slow
@@ -1647,6 +1652,7 @@ async function recoverOneTask(
     if (task.ownerUserId) {
       void setupTaskGithub(task.taskId, task.ownerUserId);
     }
+    void ensureTaskSshIdentity(task.taskId, task.ownerUserId);
     return true;
   }
 
@@ -1686,6 +1692,7 @@ async function recoverOneTask(
   if (task.ownerUserId) {
     void setupTaskGithub(task.taskId, task.ownerUserId);
   }
+  void ensureTaskSshIdentity(task.taskId, task.ownerUserId);
   console.log(
     `[orchestrator] recovery: ${task.taskId} resumed (port ${port ?? "?"})`,
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.21",
+  "version": "0.8.23",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/scripts/agent/task-up.sh

@@ -532,17 +532,24 @@ docker exec -u root "$app_container" \
 # else the operator identity — see above) into the container, so the agent signs
 # + pushes with the key whose .pub the user registered on GitHub. ADR-027 drops
 # the HTTPS/GH_TOKEN path; uai-init routes every GitHub remote over SSH.
-# Best-effort: signing + SSH push just stay off if the identity is absent.
+# Best-effort: signing + SSH push just stay off if the identity is absent —
+# but every failure is LOGGED (a silent miss here reads as a GitHub
+# permissions problem hours later; live 2026-07-21). The channel-ensure path
+# (ensureTaskSshIdentity) re-asserts all of this on reconnects.
 if [ -f "$uai_identity_key" ]; then
   docker exec -u root "$app_container" \
-    mkdir -p /home/node/.ssh >/dev/null 2>&1 || true
+    mkdir -p /home/node/.ssh >/dev/null 2>&1 \
+    || log "warning: ssh setup: mkdir ~/.ssh failed in $app_container"
   docker cp "$uai_identity_key" \
-    "$app_container":/home/node/.ssh/id_ed25519 >/dev/null 2>&1 || true
+    "$app_container":/home/node/.ssh/id_ed25519 >/dev/null 2>&1 \
+    || log "warning: ssh setup: key copy failed — pushes will fall back to HTTPS"
   docker cp "${uai_identity_key}.pub" \
-    "$app_container":/home/node/.ssh/id_ed25519.pub >/dev/null 2>&1 || true
+    "$app_container":/home/node/.ssh/id_ed25519.pub >/dev/null 2>&1 \
+    || log "warning: ssh setup: pubkey copy failed (signing will be off)"
   docker exec -u root "$app_container" sh -c \
     'chown -R node:node /home/node/.ssh && chmod 700 /home/node/.ssh && chmod 600 /home/node/.ssh/id_ed25519' \
-    >/dev/null 2>&1 || true
+    >/dev/null 2>&1 \
+    || log "warning: ssh setup: chown/chmod failed — key may be unreadable by node"
 fi
 
 # uai-init (workspace deps + code-server) is re-runnable, and its death must