@runuai/host 0.8.5 → 0.8.7

package/lib/agents/cursor.ts

@@ -212,6 +212,7 @@ export class CursorSession implements AgentSession {
       "--stream-partial-output",
       "--force", // container is the sandbox — auto-run tools
       "--trust", // skip the workspace-trust prompt in headless
+      "--approve-mcps", // load the gateway MCP servers from ~/.cursor/mcp.json (ADR-057)
     );
     if (this.model && this.model !== "auto") args.push("-m", this.model);
     if (this.sessionId) args.push("--resume", this.sessionId);

package/lib/engines.ts

@@ -0,0 +1,486 @@
+/**
+ * Engine connect/disconnect for the local host UI (ADR-028, ADR-044 P2).
+ *
+ * A single descriptor table for the AI coding engines the host can run
+ * (Claude, Codex, Kimi, Grok, Cursor) plus the connect/disconnect/status logic
+ * the local UI drives. This is the host-side twin of the desktop's
+ * `apps/host-desktop/src/llm.ts`, but it writes the `.env.local` the RUNNING
+ * launchd/npm host reads (UAI_HOME) and sets `process.env` so a connect takes
+ * effect WITHOUT a host restart — the adapters' `available()` and task-up's env
+ * injection both read `process.env`.
+ *
+ * Three auth modes:
+ *   - token-command  (Claude): `claude setup-token` prints a token to stdout;
+ *                    we capture it (an `sk-ant-oat…` value) and persist it as
+ *                    CLAUDE_CODE_OAUTH_TOKEN. A pasted token is accepted too.
+ *   - login-command  (Codex/Kimi/Grok): `<cli> login` runs a browser OAuth and
+ *                    writes a config file; success = that file appearing.
+ *   - api-key        (Cursor): no command — persist a pasted CURSOR_API_KEY.
+ *
+ * Detection mirrors each adapter's `available()`: env/`.env.local` for
+ * claude/cursor, a config file under the owner home for codex/kimi/grok.
+ *
+ * Every side-effecting seam (spawn, the `.env.local` path, the owner home,
+ * process.env) is injectable so the flows are unit-testable without touching
+ * the real filesystem or spawning anything.
+ */
+
+import { spawn as nodeSpawn, type ChildProcess } from "node:child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+import { env } from "./env";
+
+export type EngineKind = "claude" | "codex" | "kimi" | "grok" | "cursor";
+export type EngineAuthMode = "token-command" | "login-command" | "api-key";
+
+/** One entry of the engine catalog the UI's "Add engine" panel renders. */
+export interface EngineCatalogEntry {
+  kind: EngineKind;
+  label: string;
+  authMode: EngineAuthMode;
+  /** One-line help shown under the engine in the picker. */
+  notes: string | null;
+  /** Where to mint an API key (api-key mode only). */
+  getKeyUrl: string | null;
+}
+
+interface EngineDescriptor {
+  label: string;
+  authMode: EngineAuthMode;
+  notes: string;
+  getKeyUrl?: string;
+}
+
+/** Static descriptor table — the single source of truth for engine metadata. */
+const DESCRIPTORS: Record<EngineKind, EngineDescriptor> = {
+  claude: {
+    label: "Claude",
+    authMode: "token-command",
+    notes:
+      "Opens your browser to authorize Claude, then captures the token automatically.",
+  },
+  codex: {
+    label: "Codex",
+    authMode: "login-command",
+    notes: "Opens your browser to sign in to your OpenAI Codex account.",
+  },
+  kimi: {
+    label: "Kimi Code",
+    authMode: "login-command",
+    notes:
+      "Sign in with your Moonshot Kimi Code subscription. Activates after the next image rebuild.",
+  },
+  grok: {
+    label: "Grok",
+    authMode: "login-command",
+    notes:
+      "Sign in with your xAI Grok subscription. Activates after the next image rebuild.",
+  },
+  cursor: {
+    label: "Cursor",
+    authMode: "api-key",
+    notes: "Paste a Cursor API key. Requires Cursor Pro.",
+    getKeyUrl: "https://cursor.com/dashboard?tab=integrations",
+  },
+};
+
+/** Display order (matches the cloud picker's ordering intent). */
+const ORDER: EngineKind[] = ["claude", "codex", "kimi", "grok", "cursor"];
+
+// ---------------------------------------------------------------------------
+// Injectable seams.
+// ---------------------------------------------------------------------------
+
+/** How a login/token command is spawned. Tests provide a fake. */
+export type EngineSpawn = (command: string, args: string[]) => ChildProcess;
+
+export interface EngineSeams {
+  /** Spawn a CLI, piping stdout/stderr. */
+  spawn: EngineSpawn;
+  /** Absolute path to the `.env.local` the running host reads (UAI_HOME). */
+  envLocalPath: () => string;
+  /** The owner's real home — where codex/kimi/grok write their config dirs. */
+  ownerHome: () => string;
+  /** The live process env (adapters + task-up read creds from here). */
+  procEnv: NodeJS.ProcessEnv;
+}
+
+function defaultSeams(): EngineSeams {
+  return {
+    spawn: (command, args) =>
+      nodeSpawn(command, args, { stdio: ["ignore", "pipe", "pipe"] }),
+    envLocalPath: () => join(env.uaiHome, ".env.local"),
+    ownerHome: () => process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    procEnv: process.env,
+  };
+}
+
+function withDefaults(seams: Partial<EngineSeams>): EngineSeams {
+  return { ...defaultSeams(), ...seams };
+}
+
+// ---------------------------------------------------------------------------
+// Public catalog / status.
+// ---------------------------------------------------------------------------
+
+/** The static engine catalog (kind, label, authMode, notes, getKeyUrl). */
+export function engineCatalog(): EngineCatalogEntry[] {
+  return ORDER.map((kind) => {
+    const d = DESCRIPTORS[kind];
+    return {
+      kind,
+      label: d.label,
+      authMode: d.authMode,
+      notes: d.notes,
+      getKeyUrl: d.getKeyUrl ?? null,
+    };
+  });
+}
+
+/** kind → connected, for every engine. */
+export function engineStatuses(
+  seams: Partial<EngineSeams> = {},
+): Record<EngineKind, boolean> {
+  const s = withDefaults(seams);
+  return {
+    claude: detect("claude", s),
+    codex: detect("codex", s),
+    kimi: detect("kimi", s),
+    grok: detect("grok", s),
+    cursor: detect("cursor", s),
+  };
+}
+
+/** Whether a single engine is connected on this host right now. */
+export function detectEngine(
+  kind: EngineKind,
+  seams: Partial<EngineSeams> = {},
+): boolean {
+  return detect(kind, withDefaults(seams));
+}
+
+export function isEngineKind(value: unknown): value is EngineKind {
+  return (
+    value === "claude" ||
+    value === "codex" ||
+    value === "kimi" ||
+    value === "grok" ||
+    value === "cursor"
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Connect / disconnect.
+// ---------------------------------------------------------------------------
+
+export interface ConnectOptions {
+  /** api-key mode: the pasted key (Cursor). */
+  apiKey?: string;
+  /** token-command manual fallback: a pasted token (Claude). */
+  pastedToken?: string;
+}
+
+export interface ConnectResult {
+  ok: boolean;
+  message: string;
+}
+
+/**
+ * Connect an engine. api-key/paste resolve synchronously; login/token spawn a
+ * CLI and stream its output to `onLog` (the browser OAuth happens meanwhile).
+ */
+export async function connectEngine(
+  kind: EngineKind,
+  opts: ConnectOptions,
+  onLog: (line: string) => void,
+  seams: Partial<EngineSeams> = {},
+): Promise<ConnectResult> {
+  const s = withDefaults(seams);
+  const d = DESCRIPTORS[kind];
+
+  if (d.authMode === "api-key") {
+    const key = (opts.apiKey ?? "").trim();
+    if (!key) return { ok: false, message: `Paste your ${d.label} API key.` };
+    if (/\s/.test(key) || key.length < 8) {
+      return {
+        ok: false,
+        message: "That doesn't look like an API key. Paste just the value.",
+      };
+    }
+    upsertEnvLocal("CURSOR_API_KEY", key, s);
+    return { ok: true, message: `${d.label} connected.` };
+  }
+
+  if (d.authMode === "token-command") {
+    // Manual paste fallback — accept a token without spawning the CLI.
+    if (opts.pastedToken !== undefined) {
+      const token = opts.pastedToken.trim();
+      if (!token) return { ok: false, message: "Paste a token." };
+      if (/\s/.test(token) || token.length < 20) {
+        return {
+          ok: false,
+          message: "That doesn't look like a token. Paste just the value.",
+        };
+      }
+      upsertEnvLocal("CLAUDE_CODE_OAUTH_TOKEN", token, s);
+      return { ok: true, message: `${d.label} connected.` };
+    }
+    return runTokenCommand(kind, d.label, onLog, s);
+  }
+
+  return runLoginCommand(kind, d.label, onLog, s);
+}
+
+/** Disconnect an engine: forget its credential (env line and/or config file). */
+export function disconnectEngine(
+  kind: EngineKind,
+  seams: Partial<EngineSeams> = {},
+): void {
+  const s = withDefaults(seams);
+  if (kind === "cursor") {
+    removeEnvLocal("CURSOR_API_KEY", s);
+    return;
+  }
+  if (kind === "claude") {
+    removeEnvLocal("CLAUDE_CODE_OAUTH_TOKEN", s);
+    removeEnvLocal("ANTHROPIC_API_KEY", s);
+    removeEnvLocal("ANTHROPIC_AUTH_TOKEN", s);
+    return;
+  }
+  // login-command engines: remove the config file the adapter detects.
+  try {
+    rmSync(configPath(kind, s), { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
+/**
+ * Extract a Claude OAuth token from `claude setup-token` stdout. The CLI prints
+ * the token (an `sk-ant-oat…` value) on its own line near the end; scan from the
+ * bottom for it, falling back to a lone long token-charset line.
+ */
+export function extractClaudeToken(stdout: string): string | null {
+  const lines = stdout
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const m = /(sk-ant-[A-Za-z0-9_-]{16,})/.exec(lines[i] ?? "");
+    if (m?.[1]) return m[1];
+  }
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const line = lines[i] ?? "";
+    if (/^[A-Za-z0-9_-]{40,}$/.test(line)) return line;
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Internals.
+// ---------------------------------------------------------------------------
+
+function detect(kind: EngineKind, s: EngineSeams): boolean {
+  switch (kind) {
+    case "claude":
+      return (
+        envOrFileHas("CLAUDE_CODE_OAUTH_TOKEN", s) ||
+        envOrFileHas("ANTHROPIC_API_KEY", s) ||
+        envOrFileHas("ANTHROPIC_AUTH_TOKEN", s)
+      );
+    case "cursor":
+      return envOrFileHas("CURSOR_API_KEY", s);
+    case "codex":
+    case "kimi":
+    case "grok":
+      return existsSync(configPath(kind, s));
+  }
+}
+
+/** True when `key` is set in process.env or present in `.env.local`. */
+function envOrFileHas(key: string, s: EngineSeams): boolean {
+  if (s.procEnv[key]) return true;
+  try {
+    const body = readFileSync(s.envLocalPath(), "utf8");
+    return new RegExp(`^${key}=.+`, "m").test(body);
+  } catch {
+    return false;
+  }
+}
+
+/** Config file whose presence gates a login-command engine. */
+function configPath(kind: EngineKind, s: EngineSeams): string {
+  const home = s.ownerHome();
+  if (kind === "codex") return join(home, ".codex", "auth.json");
+  if (kind === "kimi") {
+    return join(home, ".kimi-code", "credentials", "kimi-code.json");
+  }
+  return join(home, ".grok", "auth.json");
+}
+
+/** Resolve the login/token CLI binary — absolute for kimi/grok, else on PATH. */
+function resolveBin(kind: EngineKind, s: EngineSeams): string {
+  if (kind === "kimi") {
+    const local = join(s.ownerHome(), ".kimi-code", "bin", "kimi");
+    return existsSync(local) ? local : "kimi";
+  }
+  if (kind === "grok") {
+    const local = join(s.ownerHome(), ".grok", "bin", "grok");
+    return existsSync(local) ? local : "grok";
+  }
+  // claude / codex are on PATH.
+  return kind;
+}
+
+function runTokenCommand(
+  kind: EngineKind,
+  label: string,
+  onLog: (line: string) => void,
+  s: EngineSeams,
+): Promise<ConnectResult> {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (r: ConnectResult): void => {
+      if (!settled) {
+        settled = true;
+        resolve(r);
+      }
+    };
+    let child: ChildProcess;
+    try {
+      child = s.spawn(resolveBin(kind, s), ["setup-token"]);
+    } catch (err) {
+      done({ ok: false, message: err instanceof Error ? err.message : String(err) });
+      return;
+    }
+    let stdout = "";
+    child.stdout?.on("data", (b: Buffer) => {
+      const text = b.toString("utf8");
+      stdout += text;
+      relay(text, onLog);
+    });
+    child.stderr?.on("data", (b: Buffer) => relay(b.toString("utf8"), onLog));
+    child.on("error", (err: NodeJS.ErrnoException) =>
+      done({
+        ok: false,
+        message:
+          err.code === "ENOENT"
+            ? `${label} CLI not found on PATH — install Claude Code first.`
+            : err.message,
+      }),
+    );
+    child.on("exit", () => {
+      const token = extractClaudeToken(stdout);
+      if (!token) {
+        done({
+          ok: false,
+          message:
+            "Couldn't read a token from the CLI output. Try again, or paste the token manually.",
+        });
+        return;
+      }
+      upsertEnvLocal("CLAUDE_CODE_OAUTH_TOKEN", token, s);
+      done({ ok: true, message: `${label} connected.` });
+    });
+  });
+}
+
+function runLoginCommand(
+  kind: EngineKind,
+  label: string,
+  onLog: (line: string) => void,
+  s: EngineSeams,
+): Promise<ConnectResult> {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (r: ConnectResult): void => {
+      if (!settled) {
+        settled = true;
+        resolve(r);
+      }
+    };
+    let child: ChildProcess;
+    try {
+      child = s.spawn(resolveBin(kind, s), ["login"]);
+    } catch (err) {
+      done({ ok: false, message: err instanceof Error ? err.message : String(err) });
+      return;
+    }
+    child.stdout?.on("data", (b: Buffer) => relay(b.toString("utf8"), onLog));
+    child.stderr?.on("data", (b: Buffer) => relay(b.toString("utf8"), onLog));
+    child.on("error", (err: NodeJS.ErrnoException) =>
+      done({
+        ok: false,
+        message:
+          err.code === "ENOENT"
+            ? `${label} CLI not found — install it first.`
+            : err.message,
+      }),
+    );
+    child.on("exit", () => {
+      done(
+        detect(kind, s)
+          ? { ok: true, message: `${label} connected.` }
+          : { ok: false, message: `${label} login didn't complete.` },
+      );
+    });
+  });
+}
+
+function relay(text: string, onLog: (line: string) => void): void {
+  for (const l of text.split(/\r?\n/)) {
+    if (l.trim()) onLog(l.trim());
+  }
+}
+
+/** Upsert KEY=value into the host's `.env.local` (0600) AND process.env. */
+function upsertEnvLocal(key: string, value: string, s: EngineSeams): void {
+  const file = s.envLocalPath();
+  mkdirSync(dirname(file), { recursive: true });
+  let body = "";
+  try {
+    body = readFileSync(file, "utf8");
+  } catch {
+    /* new file */
+  }
+  const line = `${key}=${value}`;
+  const re = new RegExp(`^${key}=.*$`, "m");
+  body = re.test(body)
+    ? body.replace(re, line)
+    : body + (body && !body.endsWith("\n") ? "\n" : "") + line + "\n";
+  writeFileSync(file, body, { mode: 0o600 });
+  try {
+    chmodSync(file, 0o600);
+  } catch {
+    /* best effort */
+  }
+  // Immediate effect: the running host reads creds from process.env (adapters'
+  // available() + task-up env injection), not by reloading .env.local — so set
+  // it here or a connect wouldn't take effect until a restart.
+  s.procEnv[key] = value;
+}
+
+/** Remove a KEY line from `.env.local` and process.env (no-op if absent). */
+function removeEnvLocal(key: string, s: EngineSeams): void {
+  const file = s.envLocalPath();
+  try {
+    const body = readFileSync(file, "utf8");
+    const next = body
+      .split(/\r?\n/)
+      .filter((l) => !new RegExp(`^${key}=`).test(l))
+      .join("\n");
+    writeFileSync(file, next, { mode: 0o600 });
+  } catch {
+    /* no file */
+  }
+  delete s.procEnv[key];
+}

package/lib/mcp-gateway.ts

@@ -270,16 +270,20 @@ export function startMcpGateway(): void {
 
 // --- task container wiring (ADR-057 task-up writers) -------------------------
 
-/** Idempotent node -e merge of entries into /workspace/.mcp.json. */
+/** Idempotent node -e merge of entries (argv[2]) into an mcpServers file
+ *  (argv[1]) — reused for Claude's /workspace/.mcp.json and Cursor's
+ *  ~/.cursor/mcp.json. Creates the parent dir when missing. */
 const MERGE_MCP_JSON = `
 const fs = require("fs");
-const p = "/workspace/.mcp.json";
+const path = require("path");
+const p = process.argv[1];
+try { fs.mkdirSync(path.dirname(p), { recursive: true }); } catch {}
 let j = {};
 let existed = true;
 try { j = JSON.parse(fs.readFileSync(p, "utf8")); } catch { existed = false; }
 j.mcpServers = j.mcpServers || {};
 let changed = false;
-for (const [k, v] of Object.entries(JSON.parse(process.argv[1]))) {
+for (const [k, v] of Object.entries(JSON.parse(process.argv[2]))) {
   if (JSON.stringify(j.mcpServers[k]) !== JSON.stringify(v)) { j.mcpServers[k] = v; changed = true; }
 }
 if (changed || !existed) fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\\n");
@@ -290,16 +294,21 @@ function shellQuote(value: string): string {
 }
 
 /**
- * Write the task's MCP configs inside the container: gateway-URL entries per
- * connection for Claude (/workspace/.mcp.json, merged — coexists with the
- * ADR-053 browser server) and mcp-remote shims for Codex (config.toml,
- * append-once per slug). Safe to re-run every ensure.
+ * Write the task's MCP configs inside the container, one shape per engine on
+ * the roster — all pointing at the same host gateway URLs:
+ *   - Claude — /workspace/.mcp.json (merged; coexists with the ADR-053 browser
+ *     server). Written unconditionally: the adapter passes `--mcp-config`.
+ *   - Codex — mcp-remote shims appended once per slug to config.toml.
+ *   - Cursor — ~/.cursor/mcp.json ({ url } form; the adapter passes
+ *     `--approve-mcps`).
+ *   - Grok — `grok mcp add` writes ~/.grok/config.toml (idempotent per slug).
+ * Safe to re-run every ensure. `engineKinds` is the roster's agent kinds.
  */
 export async function setupMcpTaskConfig(
   taskId: string,
   containerName: string,
   connections: TaskMcpConnection[],
-  hasCodex: boolean,
+  engineKinds: string[],
 ): Promise<void> {
   // No early return on empty: the claude adapter passes
   // `--mcp-config /workspace/.mcp.json` unconditionally (ADR-057), so the
@@ -308,18 +317,25 @@ export async function setupMcpTaskConfig(
     const acl = ensureTaskGatewayAcl(taskId, connections);
     const urlFor = (slug: string): string =>
       `http://host.docker.internal:${MCP_GATEWAY_PORT}/t/${acl.token}/${slug}`;
+    const has = (kind: string): boolean => engineKinds.includes(kind);
 
     const claudeEntries: Record<string, unknown> = {};
+    const cursorEntries: Record<string, unknown> = {};
     for (const c of connections) {
       claudeEntries[c.slug] = { type: "http", url: urlFor(c.slug) };
+      // Cursor's mcp.json wants a bare { url } for remote (http/sse) servers.
+      cursorEntries[c.slug] = { url: urlFor(c.slug) };
     }
     const steps = [
       "mkdir -p /workspace/.claude",
       `[ -f /workspace/.claude/settings.json ] || printf '%s\\n' ${shellQuote(
         JSON.stringify({ enableAllProjectMcpServers: true }, null, 2),
       )} > /workspace/.claude/settings.json`,
-      `node -e ${shellQuote(MERGE_MCP_JSON)} ${shellQuote(JSON.stringify(claudeEntries))}`,
-      ...(hasCodex
+      `node -e ${shellQuote(MERGE_MCP_JSON)} /workspace/.mcp.json ${shellQuote(
+        JSON.stringify(claudeEntries),
+      )}`,
+      // Codex: stdio-only, so each connection is an mcp-remote shim.
+      ...(has("codex")
         ? connections.map(
             (c) =>
               `grep -q "mcp_servers.${c.slug}]" /home/node/.codex/config.toml 2>/dev/null || printf '%s' ${shellQuote(
@@ -327,6 +343,23 @@ export async function setupMcpTaskConfig(
               )} >> /home/node/.codex/config.toml`,
           )
         : []),
+      // Cursor: reads ~/.cursor/mcp.json (the adapter passes --approve-mcps).
+      ...(has("cursor") && connections.length > 0
+        ? [
+            `node -e ${shellQuote(MERGE_MCP_JSON)} /home/node/.cursor/mcp.json ${shellQuote(
+              JSON.stringify(cursorEntries),
+            )}`,
+          ]
+        : []),
+      // Grok: `grok mcp add` writes ~/.grok/config.toml. Idempotent + tolerant.
+      ...(has("grok")
+        ? connections.map(
+            (c) =>
+              `/home/node/.local/bin/grok mcp add ${shellQuote(c.slug)} ${shellQuote(
+                urlFor(c.slug),
+              )} -t http -s user >/dev/null 2>&1 || true`,
+          )
+        : []),
     ].join(" && ");
     const result = await dockerCli(
       ["exec", containerName, "sh", "-lc", steps],

package/lib/orchestrator.ts

@@ -172,6 +172,14 @@ class Orchestrator {
   /** Fold a fresh channel spec into a live channel (ADR-049). */
   private refreshChannel(channel: Channel, spec: ChannelEnsureInput): void {
     const known = new Set(channel.roster.map((a) => a.id));
+    // Replace EXISTING agents' data with the fresh spec — a mid-task roster edit
+    // can change permissions, model, brief, role or skills, and without this the
+    // stale snapshot persists (e.g. granting `uai` CLI permissions mid-task never
+    // took effect: writeAgentCli kept seeing the old empty list). Swapping the
+    // object (not merging) also drops fields that were removed. The token/model a
+    // LIVE session already carries only changes on its next respawn.
+    const bySpecId = new Map(spec.agents.map((a) => [a.id, a]));
+    channel.roster = channel.roster.map((a) => bySpecId.get(a.id) ?? a);
     for (const agent of spec.agents) {
       if (!known.has(agent.id)) {
         channel.roster.push(agent);
@@ -321,7 +329,7 @@ class Orchestrator {
       channel.taskId,
       channel.containerName,
       channel.mcpConnections,
-      channel.roster.some((a) => a.kind === "codex"),
+      channel.roster.map((a) => a.kind),
     );
     // Agent CLIs read MCP servers once, at process start — and durable
     // sessions (ADR-061) make processes long-lived, so without this a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",
@@ -75,10 +75,10 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@typescript-eslint/eslint-plugin": "^8.59.4",
-    "@typescript-eslint/parser": "^8.59.4",
     "@types/node": "^22.9.0",
     "@types/ws": "^8.18.1",
+    "@typescript-eslint/eslint-plugin": "^8.59.4",
+    "@typescript-eslint/parser": "^8.59.4",
     "eslint": "^9.14.0",
     "typescript": "^5.6.3",
     "vitest": "^2.1.4"

package/src/main.ts

@@ -180,6 +180,9 @@ async function startLocalUi(): Promise<void> {
       hostId,
       logPath: serviceLogPath(),
       taskMemory: dockerMemoryBytes,
+      // Engine connect/disconnect in the local UI re-advertises capabilities so
+      // the cloud's task picker reflects a newly-configured engine promptly.
+      readvertise: sendCapabilities,
     });
     console.log(`[host-agent] local UI on http://127.0.0.1:${handle.port}`);
   } catch (err) {