@runuai/host 0.8.22 → 0.8.24

package/lib/agents/cursor.ts

@@ -244,9 +244,31 @@ export class CursorSession implements AgentSession {
         const m = mapCursorLine(line);
         if (m.sessionId) this.sessionId = m.sessionId;
         if (typeof m.textDelta === "string") {
-          sawText = true;
-          acc += m.textDelta;
-          this.emit({ type: "message_delta", text: m.textDelta });
+          // Cursor (--stream-partial-output) streams incremental token deltas
+          // and then a REDUNDANT full-message snapshot. The timestamp_ms
+          // heuristic in mapCursorLine drops that final snapshot for models
+          // whose final line is untagged — but Cursor's multi-model support
+          // (ADR-068) means SOME models tag the final full snapshot with
+          // timestamp_ms too, so it slips through and gets appended on top of
+          // the tokens: every message doubled (live 2026-07-21). Reconcile
+          // against what we've already streamed instead of trusting the tag —
+          // robust to incremental tokens, cumulative snapshots, and the
+          // redundant final repeat alike.
+          const t = m.textDelta;
+          let delta: string | null;
+          if (t === acc) {
+            delta = null; // full-message snapshot we've already emitted
+          } else if (acc.length > 0 && t.startsWith(acc)) {
+            delta = t.slice(acc.length); // cumulative snapshot → growth only
+            acc = t;
+          } else {
+            delta = t; // incremental token / genuinely new text
+            acc += t;
+          }
+          if (delta) {
+            sawText = true;
+            this.emit({ type: "message_delta", text: delta });
+          }
         }
         if (m.toolCall) {
           this.emit({

package/lib/git-identity.ts

@@ -123,38 +123,86 @@ export async function injectSshIdentity(
   return true;
 }
 
+// One in-flight ensure per task. Channel-ensure fires on every reconnect/
+// nudge (seconds apart under load), and `docker cp` is unlink+create — two
+// concurrent injects interleave so one's `cp id_ed25519` lands AFTER the
+// other's chown, leaving the private key owned by the macOS uid and
+// UNREADABLE by node inside the container ("Load key: Permission denied",
+// live 2026-07-21). Serialize, and skip entirely when the key is already
+// good, so the steady state does zero docker work.
+const sshEnsureInFlight = new Set<string>();
+
+/** True when node can already read a correctly-owned key in the container. */
+async function sshKeyHealthy(
+  taskId: string,
+  exec: DockerExec,
+): Promise<boolean> {
+  const res = await exec([
+    "exec",
+    "-u",
+    "node",
+    `task-${taskId}-app-1`,
+    "test",
+    "-r",
+    "/home/node/.ssh/id_ed25519",
+  ]);
+  return res.status === 0;
+}
+
 /**
- * Materialize the task creator's SSH key (operator identity as fallback,
- * mirroring task-up.sh), inject it + its git config into the container, and
- * clean the on-disk private key back up. Safe to call on every channel
- * ensure; a task with no identity anywhere logs once and pushes stay HTTPS.
+ * Ensure the task container has a node-readable SSH push identity + git
+ * config. Idempotent and race-free: skips the copy when the key is already
+ * healthy (the common case), and never runs two injects for one task at
+ * once. Only (re)materializes + copies the key when it is missing or
+ * unreadable. Safe to call on every channel ensure.
  */
 export async function ensureTaskSshIdentity(
   taskId: string,
   ownerUserId: string | null | undefined,
   exec: DockerExec = defaultExec,
 ): Promise<boolean> {
-  let keyPath: string | null = null;
-  let perTask = false;
-  const dir = writeTaskIdentity(taskId, ownerUserId);
-  if (dir) {
-    keyPath = resolve(dir, "id_ed25519");
-    perTask = true;
-  } else {
-    const operatorKey = resolve(env.dataDir, "identity", "id_ed25519");
-    if (existsSync(operatorKey)) keyPath = operatorKey;
-  }
-  if (!keyPath) {
-    console.log(
-      `[ssh] task ${taskId}: no SSH identity for owner or operator — git pushes stay on HTTPS`,
-    );
-    return false;
-  }
+  if (sshEnsureInFlight.has(taskId)) return true; // another ensure owns it
+  sshEnsureInFlight.add(taskId);
   try {
-    return await injectSshIdentity(taskId, keyPath, exec);
+    // Fast path: key already good → re-assert only the (cheap, idempotent)
+    // git config and skip the docker cp churn that causes the ownership race.
+    if (await sshKeyHealthy(taskId, exec)) {
+      await exec([
+        "exec",
+        "-u",
+        "node",
+        `task-${taskId}-app-1`,
+        "sh",
+        "-c",
+        SSH_GIT_CONFIG,
+      ]);
+      return true;
+    }
+
+    let keyPath: string | null = null;
+    let perTask = false;
+    const dir = writeTaskIdentity(taskId, ownerUserId);
+    if (dir) {
+      keyPath = resolve(dir, "id_ed25519");
+      perTask = true;
+    } else {
+      const operatorKey = resolve(env.dataDir, "identity", "id_ed25519");
+      if (existsSync(operatorKey)) keyPath = operatorKey;
+    }
+    if (!keyPath) {
+      console.log(
+        `[ssh] task ${taskId}: no SSH identity for owner or operator — git pushes stay on HTTPS`,
+      );
+      return false;
+    }
+    try {
+      return await injectSshIdentity(taskId, keyPath, exec);
+    } finally {
+      // Host hygiene (same as task-up): the materialized private key never
+      // outlives the injection.
+      if (perTask) removeTaskIdentity(taskId);
+    }
   } finally {
-    // Host hygiene (same as task-up): the materialized private key never
-    // outlives the injection.
-    if (perTask) removeTaskIdentity(taskId);
+    sshEnsureInFlight.delete(taskId);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.22",
+  "version": "0.8.24",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",