@runuai/host 0.8.38 → 0.8.40

package/db/migrations/0011_codex_thread_id.sql

@@ -0,0 +1,5 @@
+-- ADR-078: Codex restart-survival. Persist the app-server thread id so a
+-- respawned Codex (allowAttach:false → kill+respawn on host restart) can
+-- `thread/resume` the SAME durable thread from its on-disk rollout instead of
+-- starting a fresh one and losing the conversation. Null for non-codex kinds.
+ALTER TABLE `host_agent_sessions` ADD `codex_thread_id` text;

package/db/migrations/meta/_journal.json

@@ -78,6 +78,13 @@
       "when": 1779900011000,
       "tag": "0010_host_engine_accounts",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1779900012000,
+      "tag": "0011_codex_thread_id",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -144,6 +144,10 @@ export const hostAgentSessions = sqliteTable(
       .notNull()
       .default(0),
     status: text("status").notNull().default("running"), // running|closed
+    // ADR-078: Codex thread id (from thread/start). Persisted so a respawned
+    // app-server after a host restart resumes the SAME thread (thread/resume)
+    // instead of losing the conversation. Null for non-codex kinds / pre-resume.
+    codexThreadId: text("codex_thread_id"),
     createdAt: integer("created_at", { mode: "number" }).notNull(),
     updatedAt: integer("updated_at", { mode: "number" }).notNull(),
   },

package/lib/agents/codex.ts

@@ -32,6 +32,9 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { and, eq } from "drizzle-orm";
+
+import { getDb, schema } from "../db";
 import { newId } from "../ulid";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { isRateLimitMessage } from "./rate-limit";
@@ -211,6 +214,64 @@ const APPROVAL_METHODS = new Set([
  *  can legitimately run for minutes. */
 const RPC_TIMEOUT_MS = 30_000;
 
+/**
+ * ADR-078 thread/resume lock retry. Right after a host restart the previous
+ * (durable, in-container) app-server may still hold the thread's rollout lock;
+ * `thread/resume` then fails with JSON-RPC -32600 until the stop we sent the old
+ * runner lands. Retry that specific error a bounded number of times.
+ */
+const RESUME_LOCK_ATTEMPTS = 10;
+const RESUME_LOCK_BACKOFF_MS = 1_000;
+
+const delay = (ms: number): Promise<void> =>
+  new Promise((resolve) => setTimeout(resolve, ms));
+
+// ---------------------------------------------------------------------------
+// Thread persistence (ADR-078) — resume the SAME thread across a host restart.
+// ---------------------------------------------------------------------------
+
+/** The Codex thread id persisted for (task, agent), or null if none yet. */
+function readCodexThreadId(taskId: string, agentId: string): string | null {
+  try {
+    const row = getDb()
+      .select({ id: schema.hostAgentSessions.codexThreadId })
+      .from(schema.hostAgentSessions)
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, taskId),
+          eq(schema.hostAgentSessions.agentId, agentId),
+        ),
+      )
+      .get();
+    return row?.id ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Persist the Codex thread id for (task, agent) so a later host process resumes
+ * it. Best-effort — a write failure just means the next restart starts a fresh
+ * thread (today's behavior). The transport's session-row upsert never clears
+ * this column, so it survives the kill+respawn of a host restart.
+ */
+function saveCodexThreadId(taskId: string, agentId: string, threadId: string): void {
+  try {
+    getDb()
+      .update(schema.hostAgentSessions)
+      .set({ codexThreadId: threadId, updatedAt: Date.now() })
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, taskId),
+          eq(schema.hostAgentSessions.agentId, agentId),
+        ),
+      )
+      .run();
+  } catch {
+    /* best effort — see doc comment */
+  }
+}
+
 // ---------------------------------------------------------------------------
 // The session.
 // ---------------------------------------------------------------------------
@@ -222,6 +283,9 @@ export class CodexSession implements AgentSession {
   private readonly proc: LineTransport;
   private readonly handlers = new Set<AgentEventHandler>();
   private readonly systemPreamble: string;
+  private readonly taskId: string;
+  /** ADR-078: a thread id persisted by a PRIOR host process, to resume. */
+  private readonly resumeThreadId: string | null;
   private closed = false;
   private handshakeOk = false;
 
@@ -245,6 +309,10 @@ export class CodexSession implements AgentSession {
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
+    this.taskId = args.taskId;
+    // ADR-078: read BEFORE createAgentTransport (whose session-row upsert
+    // preserves this column). Non-null → a host restart; resume the thread.
+    this.resumeThreadId = readCodexThreadId(args.taskId, args.agent.id);
 
     // The agent's model / effort (when set) are selected via config overrides
     // (`-c model=<model>`, `-c model_reasoning_effort=<effort>`) on the
@@ -328,7 +396,15 @@ export class CodexSession implements AgentSession {
       if (waiter) {
         this.pending.delete(id);
         if (isObj(msg.error)) {
-          waiter.reject(new Error(str(msg.error.message, "rpc error")));
+          // Preserve the JSON-RPC code so thread/resume can retry -32600
+          // (the thread's single-writer lock still held by a dying app-server).
+          const code =
+            typeof msg.error.code === "number" ? msg.error.code : undefined;
+          waiter.reject(
+            Object.assign(new Error(str(msg.error.message, "rpc error")), {
+              rpcCode: code,
+            }),
+          );
         } else {
           waiter.resolve(msg.result);
         }
@@ -355,6 +431,7 @@ export class CodexSession implements AgentSession {
         const thread = msg.params.thread;
         if (isObj(thread) && typeof thread.id === "string") {
           this.threadId = thread.id;
+          saveCodexThreadId(this.taskId, this.agentId, thread.id);
         }
       }
       for (const ev of mapCodexNotification(method, msg.params)) {
@@ -450,9 +527,22 @@ export class CodexSession implements AgentSession {
       clientInfo: { name: "uai", version: "0.2" },
     });
     this.notify("initialized", {});
-    // The uai channel briefing (how to @-mention, the roster, the
-    // project's defaultPrompt) goes in as developer instructions so it
-    // applies to every turn on the thread.
+    // ADR-078: a thread id from a prior host process means this is a restart —
+    // resume the SAME durable thread so the conversation survives, instead of
+    // starting fresh. Fall back to a new thread if resume isn't possible
+    // (thread gone/corrupt, or the old writer never released the lock).
+    if (this.resumeThreadId && (await this.tryResumeThread(this.resumeThreadId))) {
+      this.handshakeOk = true;
+      return;
+    }
+    await this.startThread();
+    this.handshakeOk = true;
+  }
+
+  private async startThread(): Promise<void> {
+    // The uai channel briefing (how to @-mention, the roster, the project's
+    // defaultPrompt) goes in as developer instructions so it applies to every
+    // turn on the thread (persisted with the thread, so resume needn't resend).
     const threadParams: Record<string, unknown> = {
       approvalPolicy: "never",
       sandbox: "danger-full-access",
@@ -462,9 +552,51 @@ export class CodexSession implements AgentSession {
     }
     const result = await this.request("thread/start", threadParams);
     if (isObj(result) && isObj(result.thread)) {
-      this.threadId = str(result.thread.id) || this.threadId;
+      const id = str(result.thread.id) || this.threadId;
+      this.threadId = id;
+      if (id) saveCodexThreadId(this.taskId, this.agentId, id);
     }
-    this.handshakeOk = true;
+  }
+
+  /**
+   * Reopen the persisted thread by id (ADR-078). `excludeTurns:true` returns
+   * only metadata — no history replay, which would double-post the transcript
+   * the cloud already holds. The app-server allows one writer per thread, so a
+   * -32600 (lock still held by the dying predecessor app-server) is retried with
+   * backoff; any other failure returns false and the caller starts a fresh
+   * thread. Returns true iff the thread is now open for turns.
+   */
+  private async tryResumeThread(threadId: string): Promise<boolean> {
+    for (let attempt = 0; attempt < RESUME_LOCK_ATTEMPTS; attempt++) {
+      try {
+        const result = await this.request("thread/resume", {
+          threadId,
+          excludeTurns: true,
+          approvalPolicy: "never",
+          sandbox: "danger-full-access",
+        });
+        const id =
+          isObj(result) && isObj(result.thread) && str(result.thread.id)
+            ? str(result.thread.id)
+            : threadId;
+        this.threadId = id;
+        saveCodexThreadId(this.taskId, this.agentId, id);
+        return true;
+      } catch (err) {
+        const code = (err as { rpcCode?: number }).rpcCode;
+        if (code === -32600 && attempt < RESUME_LOCK_ATTEMPTS - 1) {
+          await delay(RESUME_LOCK_BACKOFF_MS);
+          continue;
+        }
+        console.warn(
+          `[codex] thread/resume ${threadId} failed (${
+            err instanceof Error ? err.message : String(err)
+          }) — starting a fresh thread`,
+        );
+        return false;
+      }
+    }
+    return false;
   }
 
   // -- AgentSession ---------------------------------------------------------

package/lib/engines.ts

@@ -414,6 +414,13 @@ export interface ConnectOptions {
   apiKey?: string;
   /** token-command manual fallback: a pasted token or API key (Claude). */
   pastedToken?: string;
+  /**
+   * ADR-076: when set, a token captured by the token-command flow (or pasted)
+   * is handed to this sink INSTEAD of being persisted as the default credential
+   * — used to register an EXTRA account. The sink's result becomes the connect
+   * result.
+   */
+  onToken?: (token: string) => ConnectResult | Promise<ConnectResult>;
 }
 
 export interface ConnectResult {
@@ -465,6 +472,9 @@ export async function connectEngine(
           message: "That doesn't look like a token. Paste just the value.",
         };
       }
+      // Adding an extra account? Route the pasted value to the sink instead of
+      // the default credential.
+      if (opts.onToken) return await opts.onToken(token);
       // One paste box serves both credential kinds — classify by prefix so an
       // `sk-ant-api…` platform key doesn't get stored as an OAuth token.
       upsertEnvLocal(
@@ -476,7 +486,7 @@ export async function connectEngine(
       );
       return { ok: true, message: `${d.label} connected.` };
     }
-    return runTokenCommand(kind, d.label, onLog, s);
+    return runTokenCommand(kind, d.label, onLog, s, opts.onToken);
   }
 
   return runLoginCommand(kind, d.label, onLog, s);
@@ -1028,6 +1038,7 @@ async function runTokenCommand(
   label: string,
   onLog: (line: string) => void,
   s: EngineSeams,
+  onToken?: (token: string) => ConnectResult | Promise<ConnectResult>,
 ): Promise<ConnectResult> {
   let child: ChildProcess;
   try {
@@ -1052,9 +1063,26 @@ async function runTokenCommand(
       resolve(r);
     };
     let raw = "";
+    let capturing = false;
     const forwarded = new Set<string>();
     const acked = new Set<string>();
     const saveToken = (token: string): void => {
+      // The token renders on several redraws (and again on exit) — capture once.
+      if (capturing) return;
+      capturing = true;
+      // ADR-076: adding an EXTRA account routes the captured token to the sink
+      // (which stores it as a separate account) instead of the default env.
+      if (onToken) {
+        Promise.resolve(onToken(token))
+          .then((r) => done(r, true))
+          .catch((err) =>
+            done(
+              { ok: false, message: err instanceof Error ? err.message : String(err) },
+              true,
+            ),
+          );
+        return;
+      }
       upsertEnvLocal("CLAUDE_CODE_OAUTH_TOKEN", token, s);
       done({ ok: true, message: `${label} connected.` }, true);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.38",
+  "version": "0.8.40",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/src/ui/server.ts

@@ -162,6 +162,8 @@ async function handle(
           return await handleEngineInstall(req, res);
         case "/api/engines/disconnect":
           return await handleEngineDisconnect(req, res, opts);
+        case "/api/engines/accounts/connect":
+          return await handleEngineAccountConnect(req, res, opts);
         case "/api/engines/accounts/add":
           return await handleEngineAccountAdd(req, res, opts);
         case "/api/engines/accounts/remove":
@@ -357,6 +359,58 @@ async function handleEngineAccountAdd(
   });
 }
 
+/**
+ * POST /api/engines/accounts/connect `{kind, label}` → run the engine's
+ * token-command sign-in (streamed NDJSON exactly like /api/engines/connect) and
+ * store the captured token as an EXTRA account (ADR-076) rather than the default
+ * credential. Only meaningful for token-command kinds (Claude); the browser
+ * OAuth authorizes whichever account you sign in with, so run it signed-out /
+ * incognito for the browser to prompt for the second account.
+ */
+async function handleEngineAccountConnect(
+  req: IncomingMessage,
+  res: ServerResponse,
+  opts: UiServerOptions,
+): Promise<void> {
+  const body = await readJsonBody(req);
+  const kind = body?.kind;
+  if (!isEngineKind(kind)) {
+    return sendError(res, 400, "unknown or missing engine kind");
+  }
+  const label = typeof body?.label === "string" ? body.label.trim() : "";
+  if (!label) {
+    return sendError(res, 400, "give the account a label");
+  }
+
+  res.writeHead(200, {
+    "content-type": "application/x-ndjson; charset=utf-8",
+    "cache-control": "no-store",
+  });
+  const emit = (obj: unknown): void => {
+    res.write(`${JSON.stringify(obj)}\n`);
+  };
+
+  let result: { ok: boolean; message: string };
+  try {
+    result = await connectEngine(
+      kind,
+      { onToken: (token) => addEngineAccount(kind, label, { token }) },
+      (line) => emit({ line }),
+    );
+  } catch (err) {
+    result = {
+      ok: false,
+      message: err instanceof Error ? err.message : "sign-in failed",
+    };
+  }
+  if (result.ok) {
+    opts.readvertise?.();
+    void ensureStandardImage();
+  }
+  emit({ done: true, ok: result.ok, message: result.message });
+  res.end();
+}
+
 /** POST /api/engines/accounts/remove `{id}` → forget an EXTRA account. */
 async function handleEngineAccountRemove(
   req: IncomingMessage,

package/ui/app.js

@@ -390,15 +390,15 @@ function openAddAccount(e) {
 }
 
 function addAccountForm(e) {
+  const isToken = e.authMode === "token-command"; // Claude: browser sign-in
   const form = document.createElement("div");
   form.className = "engine-setup";
 
   const note = document.createElement("p");
   note.className = "setup-note";
-  note.textContent =
-    e.kind === "claude"
-      ? "Paste a token from `claude setup-token` (a long value, usually starting with sk-ant-oat…) or an API key. This account rotates in automatically when another Claude account hits its limit."
-      : "Paste an OpenAI API key (starts with sk-…). This account rotates in automatically when another account of this kind hits its limit.";
+  note.textContent = isToken
+    ? "Sign in with the account you want to add — a browser opens to authorize Claude and the token is captured here automatically. This account rotates in automatically when another Claude account hits its limit."
+    : "Paste an OpenAI API key (starts with sk-…). This account rotates in automatically when another account of this kind hits its limit.";
   form.append(note);
 
   const labelField = document.createElement("div");
@@ -412,33 +412,89 @@ function addAccountForm(e) {
   labelField.append(labelInput);
   form.append(labelField);
 
+  const status = document.createElement("div");
+  status.className = "setup-status";
+  const log = document.createElement("pre");
+  log.className = "log";
+  log.hidden = true;
+  const pushLine = (line) => {
+    log.textContent += (log.textContent ? "\n" : "") + line;
+    log.scrollTop = log.scrollHeight;
+  };
+  const fail = (msg) => {
+    status.className = "setup-status err";
+    status.textContent = msg;
+  };
+
+  const actions = document.createElement("div");
+  actions.className = "setup-actions";
+
+  // --- Automatic sign-in (token-command / Claude) --------------------------
+  if (isToken) {
+    const signIn = document.createElement("button");
+    signIn.className = "btn";
+    signIn.type = "button";
+    signIn.textContent = "Sign in with Claude";
+    signIn.addEventListener("click", async () => {
+      const label = labelInput.value.trim();
+      if (!label) return fail("Give the account a label first.");
+      signIn.disabled = true;
+      signIn.textContent = "Signing in…";
+      status.className = "setup-status";
+      status.textContent = "A browser will open to authorize Claude…";
+      log.hidden = false;
+      log.textContent = "";
+      const result = await runStream(
+        "/api/engines/accounts/connect",
+        { kind: e.kind, label },
+        pushLine,
+      );
+      if (result.ok) {
+        await poll();
+        closeModal();
+        return;
+      }
+      signIn.disabled = false;
+      signIn.textContent = "Try again";
+      fail(result.message || "Sign-in failed.");
+    });
+    actions.append(signIn);
+  }
+
+  const cancel = document.createElement("button");
+  cancel.className = "link-btn";
+  cancel.type = "button";
+  cancel.textContent = "Cancel";
+  cancel.addEventListener("click", closeModal);
+  actions.append(cancel);
+  form.append(actions, status, log);
+
+  // --- Manual fallback: copyable command + paste box -----------------------
+  if (isToken) {
+    const or = document.createElement("p");
+    or.className = "setup-note setup-or";
+    or.textContent =
+      "Can't use the browser here? Run this in a terminal, then paste the token:";
+    form.append(or, copyRow("claude setup-token"));
+  }
+
   const secretField = document.createElement("div");
   secretField.className = "field";
   const secretInput = document.createElement("textarea");
   secretInput.className = "text-input token-area";
   secretInput.rows = 3;
-  secretInput.placeholder =
-    e.kind === "claude" ? "Claude token or API key" : "OpenAI API key";
+  secretInput.placeholder = isToken ? "Claude token or API key" : "OpenAI API key";
   secretInput.autocomplete = "off";
   secretInput.spellcheck = false;
   secretField.append(secretInput);
   form.append(secretField);
 
-  const status = document.createElement("div");
-  status.className = "setup-status";
-  form.append(status);
-
-  const fail = (msg) => {
-    status.className = "setup-status err";
-    status.textContent = msg;
-  };
-
-  const actions = document.createElement("div");
-  actions.className = "setup-actions";
+  const pasteActions = document.createElement("div");
+  pasteActions.className = "setup-actions";
   const save = document.createElement("button");
-  save.className = "btn";
+  save.className = isToken ? "link-btn" : "btn";
   save.type = "button";
-  save.textContent = "Add account";
+  save.textContent = isToken ? "Add pasted token" : "Add account";
   save.addEventListener("click", async () => {
     const label = labelInput.value.trim();
     const secret = secretInput.value.trim();
@@ -467,23 +523,48 @@ function addAccountForm(e) {
       return;
     }
     save.disabled = false;
-    save.textContent = "Add account";
+    save.textContent = isToken ? "Add pasted token" : "Add account";
     fail((result && result.message) || "Couldn't add the account.");
   });
-  actions.append(save);
+  pasteActions.append(save);
+  form.append(pasteActions);
 
-  const cancel = document.createElement("button");
-  cancel.className = "link-btn";
-  cancel.type = "button";
-  cancel.textContent = "Cancel";
-  cancel.addEventListener("click", closeModal);
-  actions.append(cancel);
-
-  form.append(actions);
   setTimeout(() => labelInput.focus(), 0);
   return form;
 }
 
+/** A monospace command line with a Copy button (writes to the clipboard). */
+function copyRow(cmd) {
+  const row = document.createElement("div");
+  row.className = "copy-row";
+  const code = document.createElement("code");
+  code.className = "copy-cmd";
+  code.textContent = cmd;
+  const btn = document.createElement("button");
+  btn.className = "link-btn";
+  btn.type = "button";
+  btn.textContent = "Copy";
+  btn.addEventListener("click", async () => {
+    try {
+      await navigator.clipboard.writeText(cmd);
+      btn.textContent = "Copied";
+      setTimeout(() => {
+        btn.textContent = "Copy";
+      }, 1500);
+    } catch {
+      // Clipboard API blocked (non-secure context) — select the text so the
+      // user can copy it manually.
+      const range = document.createRange();
+      range.selectNodeContents(code);
+      const sel = window.getSelection();
+      sel.removeAllRanges();
+      sel.addRange(range);
+    }
+  });
+  row.append(code, btn);
+  return row;
+}
+
 // --- add-engine modal -------------------------------------------------------
 
 function openModal() {

package/ui/style.css

@@ -614,6 +614,29 @@ textarea.token-area {
   white-space: pre-wrap;
 }
 
+/* Copyable command row (e.g. `claude setup-token`) + Copy button. */
+.copy-row {
+  display: flex;
+  align-items: center;
+  gap: 0.6rem;
+}
+
+.copy-cmd {
+  flex: 1;
+  padding: 0.45rem 0.7rem;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  background: var(--bg);
+  color: var(--fg);
+  font-family: var(--mono);
+  font-size: 0.85rem;
+  word-break: break-all;
+}
+
+.setup-or {
+  margin-top: 0.4rem;
+}
+
 .setup-actions {
   display: flex;
   align-items: center;