@runuai/host 0.9.0 → 0.9.2

package/images/standard/container/uai-init

@@ -37,33 +37,52 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 0. GitHub auth for in-container git (ADR-027). git rides the host's uai SSH
-#    identity (docker-cp'd to ~/.ssh, registered on GitHub for auth + signing),
-#    NOT an HTTPS token. Route every GitHub remote — including https:// ones —
-#    over SSH so a project's clone scheme doesn't matter, and trust github's
-#    host key non-interactively so a fresh container's first push doesn't stall
-#    on a prompt. `gh` is separate: it authenticates from its own config file,
-#    which the host writes via `gh auth login --with-token` with the user's
-#    short-lived token. We must NOT set GH_TOKEN in the env — `gh` would prefer
-#    it over that stored credential (and re-attribute every PR to it).
+# 0. Git transport selection (ADR-027). A connected user's App token is the
+#    primary clone/fetch/push credential over HTTPS; the host writes it into
+#    gh's private config and runs `gh auth setup-git` before agents start. SSH
+#    transport is only the no-GitHub-connection fallback. The SSH key remains
+#    useful in either mode for commit/tag signing.
 # ---------------------------------------------------------------------------
 
-if [ -f "$HOME/.ssh/id_ed25519" ]; then
-  log "routing git GitHub remotes over the uai SSH identity"
-  git config --global url."git@github.com:".insteadOf "https://github.com/"
-  git config --global core.sshCommand "ssh -o StrictHostKeyChecking=accept-new"
+if [ "${UAI_SKIP_GIT_TRANSPORT:-0}" = "1" ]; then
+  # Recovery/connect/disconnect reconciles the current credential immediately
+  # before invoking us. Do not overwrite that live decision with the static
+  # transport marker captured when Compose was first created.
+  log "keeping the reconciled GitHub transport"
+elif [ "${UAI_GIT_TRANSPORT:-anonymous}" = "ssh" ]; then
+  # Remove a prior token-mode reverse rewrite if this container is being
+  # repaired after disconnect, then route canonical HTTPS origins over SSH.
+  /usr/bin/git config --global --unset-all url."https://github.com/".insteadOf \
+    >/dev/null 2>&1 || true
+  /usr/bin/git config --global url."git@github.com:".insteadOf "https://github.com/"
+  /usr/bin/git config --global core.sshCommand "/usr/bin/ssh -o StrictHostKeyChecking=accept-new"
+  log "using SSH as the GitHub transport fallback"
+else
+  # Heal containers created by the old SSH-only policy. Canonical origins are
+  # HTTPS; reverse legacy SSH URLs (including submodules) through gh as well.
+  /usr/bin/git config --global --unset-all url."git@github.com:".insteadOf \
+    >/dev/null 2>&1 || true
+  /usr/bin/git config --global --unset-all core.sshCommand >/dev/null 2>&1 || true
+  /usr/bin/git config --global --replace-all url."https://github.com/".insteadOf \
+    "git@github.com:"
+  /usr/bin/git config --global --add url."https://github.com/".insteadOf \
+    "ssh://git@github.com/"
+  if [ "${UAI_GIT_TRANSPORT:-}" = "https" ]; then
+    log "using the connected GitHub credential for HTTPS Git"
+  else
+    log "using anonymous HTTPS Git for public repositories"
+  fi
 fi
 
 # Signed commits (policy): when the uai SSH identity is present, configure git
 # to SSH-sign every commit + tag with it. The pubkey is registered on GitHub
-# (via `setup-identity`) so commits show as Verified. The same key also carries
-# git push over SSH (configured above).
+# so commits show as Verified. Signing is independent of Git transport.
 if [ -f "$HOME/.ssh/id_ed25519.pub" ]; then
   log "enabling SSH commit signing with the uai identity"
-  git config --global gpg.format ssh
-  git config --global user.signingkey "$HOME/.ssh/id_ed25519.pub"
-  git config --global commit.gpgsign true
-  git config --global tag.gpgsign true
+  /usr/bin/git config --global gpg.format ssh
+  /usr/bin/git config --global user.signingkey "$HOME/.ssh/id_ed25519.pub"
+  /usr/bin/git config --global commit.gpgsign true
+  /usr/bin/git config --global tag.gpgsign true
 fi
 
 # Attribution policy: never co-author with the agents. Claude Code honors

package/lib/agent.ts

@@ -33,6 +33,11 @@ import { getHostTask } from "./runtime-state";
 import { removeTaskIdentity, writeTaskIdentity } from "./ssh";
 import type { TaskDownInput, TaskLaunchInput } from "../src/protocol";
 
+interface TaskUpCredentials {
+  /** Path to the task owner's private, ephemeral Git credential cache. */
+  githubCredentialSocket?: string;
+}
+
 // ---------------------------------------------------------------------------
 // Locate the agent scripts. They ship inside the package, so by default we
 // resolve them relative to this module — which works identically in a repo
@@ -136,11 +141,12 @@ async function runAgent<T extends z.ZodTypeAny>(
   dataSchema: T,
   commandDbPath: string,
   extraEnv: Record<string, string> = {},
+  stdinPayload?: string,
 ): Promise<z.infer<T>> {
   const scriptPath = resolve(agentDir(), scriptName);
 
   const child = spawn(scriptPath, args, {
-    stdio: ["ignore", "pipe", "pipe"],
+    stdio: [stdinPayload === undefined ? "ignore" : "pipe", "pipe", "pipe"],
     env: {
       ...process.env,
       UAI_DB_PATH: commandDbPath,
@@ -151,12 +157,19 @@ async function runAgent<T extends z.ZodTypeAny>(
 
   let stdoutBuf = "";
   let stderrBuf = "";
-  child.stdout.on("data", (chunk) => {
+  child.stdout?.on("data", (chunk) => {
     stdoutBuf += chunk.toString("utf8");
   });
-  child.stderr.on("data", (chunk) => {
+  child.stderr?.on("data", (chunk) => {
     stderrBuf += chunk.toString("utf8");
   });
+  if (stdinPayload !== undefined && child.stdin) {
+    // A script that exits before consuming stdin may close the pipe first.
+    // The process exit/error below is authoritative; do not turn EPIPE into an
+    // unhandled stream error in the host agent.
+    child.stdin.on("error", () => {});
+    child.stdin.end(stdinPayload);
+  }
 
   const exitCode: number = await new Promise((res, rej) => {
     child.on("error", rej);
@@ -267,27 +280,39 @@ export function toolStderrDetail(stderr: string): string {
 // ---------------------------------------------------------------------------
 
 export const agent = {
-  async taskUp(input: TaskLaunchInput): Promise<TaskUpResult> {
+  async taskUp(
+    input: TaskLaunchInput,
+    credentials: TaskUpCredentials = {},
+  ): Promise<TaskUpResult> {
     const commandDbPath = createTaskUpCommandDb(input);
-    // Materialize the creator's per-user SSH key so task-up.sh clones + pushes
-    // as them (ADR-029); null → task-up.sh falls back to the operator identity.
+    // Materialize the creator's per-user SSH key for commit signing and the
+    // explicit no-GitHub-connection transport fallback (ADR-029).
     const identityDir = writeTaskIdentity(input.task.id, input.task.ownerUserId);
-    // Per-(project, key) env var VALUES: each project on the task contributes
-    // its own decrypted values, which go straight into the child ENV (never
-    // args/logs/the compose YAML). task-up.sh already renders a `${KEY:-}`
-    // pass-through for each project's DECLARED keys, so docker interpolates the
-    // value from this child's env at up-time — mirroring CLAUDE_CODE_OAUTH_TOKEN
-    // and secret-blind end to end (ADR-015). On a key collision across projects
-    // the LEAD project (position 0) wins: iterate in DESCENDING position order
-    // so position-0's assignments are applied LAST and overwrite the rest.
-    const extraEnv: Record<string, string> = {};
+    // Per-(project, key) env values must NEVER enter task-up's host process
+    // environment. Besides ordinary app names, projects can declare names such
+    // as BASH_ENV, PATH, GIT_CONFIG_*, or UAI_*; exposing those before the host
+    // clone would let container-owned configuration influence host commands or
+    // read another credential boundary. Send one JSON object over stdin
+    // instead. task-up feeds it directly to Compose as an in-memory override,
+    // so values reach only the task container and are never written to disk.
+    // On a key collision the LEAD project (position 0) wins: iterate in
+    // descending position order so position-0 assignments apply last.
+    const projectEnv: Record<string, string> = {};
     const orderedProjects = [...input.projects].sort(
       (a, b) => b.position - a.position,
     );
     for (const project of orderedProjects) {
-      Object.assign(extraEnv, getDecryptedForProject(project.id));
+      Object.assign(projectEnv, getDecryptedForProject(project.id));
     }
+    const extraEnv: Record<string, string> = {};
     if (identityDir) extraEnv.UAI_TASK_IDENTITY_DIR = identityDir;
+    // Only a non-secret socket path crosses into Bash. The token itself was
+    // seeded over stdin and never enters argv, env, project data, Compose, or
+    // the task container.
+    if (credentials.githubCredentialSocket) {
+      extraEnv.UAI_GITHUB_CREDENTIAL_SOCKET =
+        credentials.githubCredentialSocket;
+    }
     try {
       return await runAgent(
         "task-up.sh",
@@ -295,6 +320,7 @@ export const agent = {
         TaskUpData,
         commandDbPath,
         extraEnv,
+        JSON.stringify(projectEnv),
       );
     } finally {
       removeCommandDb(commandDbPath);

package/lib/agents/claude.ts

@@ -52,6 +52,13 @@ const CLAUDE_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 // High is the default reasoning level. Update alongside CLAUDE_EFFORTS.
 const CLAUDE_DEFAULT_EFFORT = "high";
 
+// ADR-083: cheap defaults apply at the enforcement boundary as well as in the
+// picker. Explicit per-agent choices still win; an API client that omits them
+// must not accidentally run the communicator on Claude's costly account
+// defaults merely because it bypassed the web recommendation button.
+const CLAUDE_COMMUNICATOR_MODEL = "haiku";
+const CLAUDE_COMMUNICATOR_EFFORT = "low";
+
 // ---------------------------------------------------------------------------
 // Pure protocol mapping — stream-json line → AgentEvent[].
 // ---------------------------------------------------------------------------
@@ -177,7 +184,7 @@ function safeStringify(v: unknown): string {
 // The session.
 // ---------------------------------------------------------------------------
 
-const CLAUDE_ARGS = [
+const CLAUDE_BASE_ARGS = [
   "--print",
   "--input-format",
   "stream-json",
@@ -190,6 +197,10 @@ const CLAUDE_ARGS = [
   // 400s when a later turn sees a changed thinking block, so keep each
   // managed stream-json process in-memory only.
   "--no-session-persistence",
+];
+
+const CLAUDE_FULL_ACCESS_ARGS = [
+  ...CLAUDE_BASE_ARGS,
   // Full tool access, no per-call prompts. Safe here precisely because
   // a uai task runs in a throwaway, isolated container operating on a
   // disposable worktree (ADR-001 / ADR-010) — the container *is* the
@@ -208,6 +219,29 @@ const CLAUDE_ARGS = [
   "--strict-mcp-config",
 ];
 
+/**
+ * ADR-083 communicator profile. This is deliberately an engine-level tool
+ * boundary, not prompt advice: safe mode suppresses project/user extensions,
+ * the explicit tool set contains no shell or mutation primitive, `dontAsk`
+ * denies anything outside it in headless mode, and the empty strict MCP config
+ * prevents a user-installed server from reintroducing a write/deploy tool.
+ */
+const CLAUDE_COMMUNICATOR_ARGS = [
+  ...CLAUDE_BASE_ARGS,
+  "--safe-mode",
+  "--disable-slash-commands",
+  "--no-chrome",
+  "--permission-mode",
+  "dontAsk",
+  "--tools",
+  "Read,Glob,Grep",
+  "--disallowedTools",
+  "Bash,Edit,Write,NotebookEdit,Agent,Task,WebFetch,WebSearch",
+  "--mcp-config",
+  '{"mcpServers":{}}',
+  "--strict-mcp-config",
+];
+
 export class ClaudeSession implements AgentSession {
   readonly agentId: string;
   readonly kind: AgentKind = "claude";
@@ -228,6 +262,7 @@ export class ClaudeSession implements AgentSession {
     agent: RosterAgent;
     containerName: string;
     systemPreamble: string;
+    executionProfile?: "communicator";
     agentEnv?: Record<string, string>;
   }) {
     this.agentId = args.agent.id;
@@ -236,19 +271,31 @@ export class ClaudeSession implements AgentSession {
     // project's defaultPrompt) is passed as a real system prompt via
     // `--append-system-prompt`, so it applies to every turn — not
     // smuggled into the first user message.
-    const cliArgs = [...CLAUDE_ARGS];
+    const cliArgs = [
+      ...(args.executionProfile === "communicator"
+        ? CLAUDE_COMMUNICATOR_ARGS
+        : CLAUDE_FULL_ACCESS_ARGS),
+    ];
     if (process.env.UAI_CLAUDE_INCLUDE_PARTIAL_MESSAGES === "1") {
       cliArgs.push("--include-partial-messages");
     }
-    // The agent's model (when set) selects which Claude model the CLI
-    // drives. Without it the CLI uses the account default.
-    if (args.agent.model) {
-      cliArgs.push("--model", args.agent.model);
+    // Explicit task configuration wins; the communicator uses its declared
+    // fast/cheap defaults when the task left either choice unspecified.
+    const model =
+      args.agent.model ??
+      (args.executionProfile === "communicator"
+        ? CLAUDE_COMMUNICATOR_MODEL
+        : undefined);
+    if (model) {
+      cliArgs.push("--model", model);
     }
-    // The agent's effort (when set) selects the CLI reasoning level. Without
-    // it the CLI uses its own default.
-    if (args.agent.effort) {
-      cliArgs.push("--effort", args.agent.effort);
+    const effort =
+      args.agent.effort ??
+      (args.executionProfile === "communicator"
+        ? CLAUDE_COMMUNICATOR_EFFORT
+        : undefined);
+    if (effort) {
+      cliArgs.push("--effort", effort);
     }
     if (args.systemPreamble.trim().length > 0) {
       cliArgs.push("--append-system-prompt", args.systemPreamble);
@@ -261,7 +308,10 @@ export class ClaudeSession implements AgentSession {
     // ADR-061: durable by default — the CLI is owned by an in-container
     // runner and survives host restarts (attach resumes it); legacy pipes
     // behind UAI_DURABLE_SESSIONS=0. Claude is host-side stateless, so a
-    // live runner can be re-attached (allowAttach).
+    // live runner can be re-attached (allowAttach). The communicator profile
+    // is the exception: attach is keyed only by task + agent identity, not by
+    // execution profile, so a pre-existing full-access runner must be stopped
+    // and replaced rather than inherited across this security boundary.
     this.proc = createAgentTransport({
       taskId: args.taskId,
       agentId: this.agentId,
@@ -270,7 +320,7 @@ export class ClaudeSession implements AgentSession {
       cliArgs,
       passEnv: ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
       explicitEnv: args.agentEnv ?? {},
-      allowAttach: true,
+      allowAttach: args.executionProfile !== "communicator",
       kind: "claude",
       debugLabel: `claude:${this.agentId}`,
     });
@@ -389,6 +439,14 @@ register({
   defaultModel: CLAUDE_DEFAULT_MODEL,
   supportedEfforts: () => [...CLAUDE_EFFORTS],
   defaultEffort: CLAUDE_DEFAULT_EFFORT,
+  executionProfiles: [
+    {
+      id: "communicator",
+      mechanism: "claude-safe-mode-tool-allowlist-v1",
+      defaultModel: CLAUDE_COMMUNICATOR_MODEL,
+      defaultEffort: CLAUDE_COMMUNICATOR_EFFORT,
+    },
+  ],
   // Usable only when a Claude credential is in the env (injected into task
   // containers at task-up). Gates advertisement (ADR-044 P2).
   available: () =>
@@ -397,6 +455,20 @@ register({
         process.env.ANTHROPIC_API_KEY ||
         process.env.ANTHROPIC_AUTH_TOKEN,
     ),
-  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
-    new ClaudeSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+  create: async ({
+    taskId,
+    agent,
+    containerName,
+    systemPreamble,
+    executionProfile,
+    agentEnv,
+  }) =>
+    new ClaudeSession({
+      taskId,
+      agent,
+      containerName,
+      systemPreamble,
+      executionProfile,
+      agentEnv,
+    }),
 });

package/lib/agents/factory.ts

@@ -23,7 +23,7 @@ import "./cursor";
 import "./opencode";
 
 import { agentClisReady } from "../standard-image";
-import { factoryFor } from "./registry";
+import { factoryFor, supportsExecutionProfile } from "./registry";
 import type { AgentSession, AgentSessionFactory } from "./types";
 
 /** Cap the wait on agentClisReady so a spawn can never hang forever if the
@@ -54,6 +54,14 @@ export const realAgentFactory: AgentSessionFactory = {
         `no agent adapter registered for kind "${args.agent.kind}"`,
       );
     }
+    if (
+      args.executionProfile &&
+      !supportsExecutionProfile(args.agent.kind, args.executionProfile)
+    ) {
+      throw new Error(
+        `agent adapter "${args.agent.kind}" cannot enforce execution profile "${args.executionProfile}"`,
+      );
+    }
     // Don't spawn a CLI until the shared-volume agent CLIs are reconciled:
     // at boot the CLI auto-upgrade briefly removes then reinstalls codex/claude,
     // and a resume that races that window dies with "No codex executable found

package/lib/agents/registry.ts

@@ -32,6 +32,13 @@ export interface RegisteredAdapter {
   supportedEfforts(): string[];
   /** Preferred effort when the user doesn't pick one. */
   defaultEffort?: string;
+  /** Restricted profiles this adapter can enforce by construction. */
+  executionProfiles?: Array<{
+    id: string;
+    mechanism: string;
+    defaultModel?: string;
+    defaultEffort?: string;
+  }>;
   /**
    * Whether this kind is usable on THIS host right now — i.e. its credentials
    * are present (ADR-044 P2). Gates advertisement: an unavailable kind is left
@@ -52,6 +59,12 @@ export interface AgentKindCapability {
   defaultModel?: string;
   supportedEfforts: string[];
   defaultEffort?: string;
+  executionProfiles?: Array<{
+    id: string;
+    mechanism: string;
+    defaultModel?: string;
+    defaultEffort?: string;
+  }>;
 }
 
 const adapters = new Map<string, RegisteredAdapter>();
@@ -79,6 +92,15 @@ export function factoryFor(kind: string): AgentSessionFactory | undefined {
   return adapter ? { create: adapter.create } : undefined;
 }
 
+/** Whether the adapter declares an engine-enforced execution profile. */
+export function supportsExecutionProfile(kind: string, profileId: string): boolean {
+  return Boolean(
+    adapters
+      .get(kind)
+      ?.executionProfiles?.some((profile) => profile.id === profileId),
+  );
+}
+
 /**
  * The `agentKinds` capability slice, derived from the registered adapters.
  * Each adapter's `supportedModels()` / `supportedEfforts()` is evaluated here.
@@ -99,6 +121,11 @@ export function capabilities(): AgentKindCapability[] {
     if (adapter.defaultEffort !== undefined) {
       out.defaultEffort = adapter.defaultEffort;
     }
+    if (adapter.executionProfiles && adapter.executionProfiles.length > 0) {
+      out.executionProfiles = adapter.executionProfiles.map((profile) => ({
+        ...profile,
+      }));
+    }
     return out;
   });
 }

package/lib/agents/types.ts

@@ -165,6 +165,9 @@ export interface AgentSessionFactory {
     containerName: string;
     /** Initial briefing — project.defaultPrompt — sent on session start. */
     systemPreamble: string;
+    /** Host-derived restricted execution policy (ADR-083). Never supplied by
+     *  the browser or stored on the roster entry. */
+    executionProfile?: "communicator";
     /** ADR-048: extra per-agent env for the `docker exec` (e.g. this agent's
      *  own UAI_TASK_TOKEN so its `uai` CLI carries only its own permissions). */
     agentEnv?: Record<string, string>;