@runuai/host 0.9.0 → 0.9.2

package/lib/github-tokens.ts

@@ -7,11 +7,15 @@
  * exchange is a host→cloud HTTP POST to /api/github/oauth/exchange.
  */
 
-import { and, eq, isNull } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import { dockerCli } from "./docker-exec";
+import {
+  configureTaskSshTransport,
+  ensureTaskSshIdentity,
+} from "./git-identity";
 import type { CloudToHost } from "../src/protocol";
 
 const REFRESH_LEAD_MS = 5 * 60 * 1000; // refresh 5 min before expiry
@@ -21,9 +25,126 @@ const EXEC_TIMEOUT_MS = 10_000;
 // (we never see the rotated replacement), so a slow success beats a fast
 // ambiguous abort.
 const EXCHANGE_TIMEOUT_MS = 30_000;
+const MANAGED_GH_CONFIG_DIR = "/home/node/.config/gh";
+const SAFE_CONTAINER_PATH = "/usr/bin:/bin";
+
+// `docker exec` inherits the task container's project environment. Override
+// loader/config variables before the first executable starts, then use env -i
+// so arbitrary GIT_CONFIG_KEY_* and similar project keys cannot influence the
+// managed gh/git mutation. Commands themselves use absolute paths.
+const SANITIZED_DOCKER_EXEC_ENV = [
+  "-e",
+  "HOME=/home/node",
+  "-e",
+  `GH_CONFIG_DIR=${MANAGED_GH_CONFIG_DIR}`,
+  "-e",
+  `PATH=${SAFE_CONTAINER_PATH}`,
+  "-e",
+  "XDG_CONFIG_HOME=",
+  "-e",
+  "LD_PRELOAD=",
+  "-e",
+  "LD_LIBRARY_PATH=",
+  "-e",
+  "DYLD_INSERT_LIBRARIES=",
+  "-e",
+  "DYLD_LIBRARY_PATH=",
+  "-e",
+  "GIT_CONFIG=",
+  "-e",
+  "GIT_CONFIG_GLOBAL=",
+  "-e",
+  "GIT_CONFIG_SYSTEM=",
+  "-e",
+  "GIT_CONFIG_NOSYSTEM=",
+  "-e",
+  "GIT_CONFIG_COUNT=0",
+  "-e",
+  "GIT_EXEC_PATH=",
+  "-e",
+  "GIT_SSH=",
+  "-e",
+  "GIT_SSH_COMMAND=",
+  "-e",
+  "GIT_ASKPASS=",
+  "-e",
+  "SSH_ASKPASS=",
+] as const;
+
+const CLEAN_CONTAINER_ENV = [
+  "/usr/bin/env",
+  "-i",
+  "HOME=/home/node",
+  `GH_CONFIG_DIR=${MANAGED_GH_CONFIG_DIR}`,
+  `PATH=${SAFE_CONTAINER_PATH}`,
+] as const;
+
+function managedContainerExecArgs(
+  container: string,
+  command: string[],
+  stdin = false,
+): string[] {
+  return [
+    "exec",
+    ...(stdin ? ["-i"] : []),
+    "-u",
+    "node",
+    ...SANITIZED_DOCKER_EXEC_ENV,
+    container,
+    ...CLEAN_CONTAINER_ENV,
+    ...command,
+  ];
+}
 
 type GhConnectSet = Extract<CloudToHost, { kind: "gh.connect.set" }>;
 
+// Every local grant replacement/removal advances the user's generation. Slow
+// token exchanges and container mutations capture the generation they began
+// under and must not publish their result after a newer connect/disconnect.
+const githubAuthGenerations = new Map<string, number>();
+const githubConnectionTransitionQueues = new Map<string, Promise<void>>();
+
+function githubAuthGeneration(userId: string): number {
+  return githubAuthGenerations.get(userId) ?? 0;
+}
+
+function advanceGithubAuthGeneration(userId: string): number {
+  const next = githubAuthGeneration(userId) + 1;
+  githubAuthGenerations.set(userId, next);
+  accessCache.delete(userId);
+  // The request itself cannot be cancelled safely (the refresh token may have
+  // rotated at GitHub), but a new grant must never join that stale promise.
+  inflightExchanges.delete(userId);
+  return next;
+}
+
+/** Serialize connect/set/clear for one user. Without this outer fence, a clear
+ * that lands while set is awaiting task-up invalidation can be overwritten by
+ * the older set storing its token afterward. */
+export function runGithubConnectionTransition<T>(
+  userId: string,
+  transition: () => Promise<T>,
+): Promise<T> {
+  const previous =
+    githubConnectionTransitionQueues.get(userId) ?? Promise.resolve();
+  let result!: Promise<T>;
+  let tail!: Promise<void>;
+  result = previous
+    .catch(() => {})
+    .then(transition)
+    .finally(() => {
+      if (githubConnectionTransitionQueues.get(userId) === tail) {
+        githubConnectionTransitionQueues.delete(userId);
+      }
+    });
+  tail = result.then(
+    () => {},
+    () => {},
+  );
+  githubConnectionTransitionQueues.set(userId, tail);
+  return result;
+}
+
 // --- token store ------------------------------------------------------------
 
 /**
@@ -32,15 +153,42 @@ type GhConnectSet = Extract<CloudToHost, { kind: "gh.connect.set" }>;
  * directly); a legacy expiring grant carries `refreshToken` (kind="refresh",
  * exchanged per task). Exactly one is present.
  */
-export function onConnectSet(frame: GhConnectSet): { ok: boolean; error?: string } {
+export interface ConnectSetDeps {
+  invalidateCredentials?: (userId: string) => Promise<void>;
+  readStored?: (
+    userId: string,
+  ) => { token: string; kind: string } | null;
+  deleteLocal?: (userId: string) => void;
+  storeLocal?: (
+    userId: string,
+    fields: {
+      installationId: number;
+      refreshTokenCt: Buffer;
+      refreshTokenNonce: Buffer;
+      refreshTokenExpiresAt: number | null;
+      kind: string;
+      updatedAt: number;
+    },
+  ) => void;
+  taskIds?: (userId: string) => string[];
+  reconcile?: (taskId: string, userId: string) => Promise<boolean>;
+  revoke?: (token: string) => Promise<void>;
+  seal?: typeof sealAesGcm;
+  notifyChange?: () => void;
+}
+
+export async function onConnectSet(
+  frame: GhConnectSet,
+  deps: ConnectSetDeps = {},
+): Promise<{ ok: boolean; error?: string }> {
+  let oldGrantRemoved = false;
+  let replacementStored = false;
+  let priorGrant: { token: string; kind: string } | null = null;
   try {
-    // Fresh grant — a cached access token from the previous grant may be
-    // revoked; drop it so the next mint exchanges against the new token.
-    clearAccessCache(frame.userId);
     const token = frame.accessToken ?? frame.refreshToken;
     if (!token) return { ok: false, error: "gh.connect.set carried no token" };
     const kind = frame.accessToken ? "access" : "refresh";
-    const sealed = sealAesGcm(token);
+    const sealed = (deps.seal ?? sealAesGcm)(token);
     const now = Date.now();
     const fields = {
       installationId: frame.installationId,
@@ -50,29 +198,142 @@ export function onConnectSet(frame: GhConnectSet): { ok: boolean; error?: string
       kind,
       updatedAt: now,
     };
-    getDb()
-      .insert(schema.githubTokens)
-      .values({ userId: frame.userId, ...fields })
-      .onConflictDoUpdate({ target: schema.githubTokens.userId, set: fields })
-      .run();
-    notifyGithubChange();
-    // A reconnect must reach ALREADY-RUNNING containers, not just new tasks:
-    // each container's gh config is written once, at task setup, so a fresh
-    // grant otherwise sits unused until /retry-gh. Re-inject into the user's
-    // live tasks now. Fire-and-forget — never blocks the token store.
-    reinjectRunningTasks(frame.userId);
+
+    try {
+      priorGrant = (deps.readStored ?? readStoredToken)(frame.userId);
+    } catch (err) {
+      // A corrupt superseded row must not prevent replacement. It can still be
+      // deleted locally and every container is authoritatively scrubbed below.
+      console.warn(
+        `[github] user ${frame.userId}: could not read token before replacement: ${
+          err instanceof Error ? err.message : err
+        }`,
+      );
+    }
+
+    // Remove the old grant before fencing host-side Git. A task that begins
+    // while account switching is in progress must not mint or seed the old
+    // user's credential. The replacement is already sealed above, so failures
+    // before this point leave the existing connection untouched.
+    (deps.deleteLocal ?? deleteStoredTokenRow)(frame.userId);
+    oldGrantRemoved = true;
+    advanceGithubAuthGeneration(frame.userId);
+
+    // Account switching must also retire A remotely. Skip when GitHub sent the
+    // same access token again, which would otherwise revoke replacement B.
+    if (
+      priorGrant?.kind === "access" &&
+      priorGrant.token !== token
+    ) {
+      startBestEffortRevoke(
+        frame.userId,
+        priorGrant.token,
+        deps.revoke ?? revokeAtGitHub,
+      );
+    }
+
+    // Existing task-up operations may still be using the old ephemeral cache.
+    // Invalidate and drain them before publishing the replacement grant.
+    await deps.invalidateCredentials?.(frame.userId);
+
+    (deps.storeLocal ?? storeTokenRow)(frame.userId, fields);
+    replacementStored = true;
+    // Advance again only after the replacement is durable. This detaches work
+    // started during the no-grant fence and lets reconciliation capture B.
+    advanceGithubAuthGeneration(frame.userId);
+    (deps.notifyChange ?? notifyGithubChange)();
+
+    // Account-switch acknowledgement is a credential boundary: wait until each
+    // container that could retain A has been removed or scrubbed and configured
+    // with B. Main injects a task-lifecycle wrapper so a concurrent task-up is
+    // completed before this per-task credential transition runs.
+    const taskIds = (deps.taskIds ?? credentialCleanupTaskIdsForUser)(
+      frame.userId,
+    );
+    const reconcile = deps.reconcile ?? reconcileTaskGitAuth;
+    const settled = await Promise.allSettled(
+      taskIds.map((taskId) => reconcile(taskId, frame.userId)),
+    );
+    const rejected = settled.find(
+      (result): result is PromiseRejectedResult => result.status === "rejected",
+    );
+    if (rejected) throw rejected.reason;
+    if (settled.some((result) => result.status === "fulfilled" && !result.value)) {
+      throw new Error("GitHub credential replacement did not reach every task");
+    }
     return { ok: true };
   } catch (err) {
+    // If the old grant was already removed, advertise the authoritative local
+    // state and scrub live containers through the normal no-token reconciler.
+    // Never leave a failed account switch looking connected to the old user.
+    if (oldGrantRemoved && !replacementStored) {
+      (deps.notifyChange ?? notifyGithubChange)();
+      const taskIds = (deps.taskIds ?? credentialCleanupTaskIdsForUser)(
+        frame.userId,
+      );
+      const reconcile = deps.reconcile ?? reconcileTaskGitAuth;
+      await Promise.allSettled(
+        taskIds.map((taskId) => reconcile(taskId, frame.userId)),
+      );
+    }
     return { ok: false, error: err instanceof Error ? err.message : "store failed" };
   }
 }
 
+function deleteStoredTokenRow(userId: string): void {
+  getDb()
+    .delete(schema.githubTokens)
+    .where(eq(schema.githubTokens.userId, userId))
+    .run();
+}
+
+function storeTokenRow(
+  userId: string,
+  fields: {
+    installationId: number;
+    refreshTokenCt: Buffer;
+    refreshTokenNonce: Buffer;
+    refreshTokenExpiresAt: number | null;
+    kind: string;
+    updatedAt: number;
+  },
+): void {
+  getDb()
+    .insert(schema.githubTokens)
+    .values({ userId, ...fields })
+    .onConflictDoUpdate({ target: schema.githubTokens.userId, set: fields })
+    .run();
+}
+
+function startBestEffortRevoke(
+  userId: string,
+  token: string,
+  revoke: (token: string) => Promise<void>,
+): void {
+  try {
+    void revoke(token).catch((err) =>
+      console.warn(
+        `[github] user ${userId}: token revoke failed after local removal: ${
+          err instanceof Error ? err.message : err
+        }`,
+      ),
+    );
+  } catch (err) {
+    console.warn(
+      `[github] user ${userId}: token revoke failed after local removal: ${
+        err instanceof Error ? err.message : err
+      }`,
+    );
+  }
+}
+
 /**
  * Disconnect GitHub on this host (gh.connect.clear handler). Deletes the token
  * locally FIRST (so capabilities re-advertise immediately and the UI reflects
- * removal without waiting on the network), then best-effort revokes it at
- * GitHub. Whole body is guarded — a fired-and-forgotten failure must never
- * crash the host (no global unhandledRejection handler).
+ * removal without waiting on the network), starts best-effort revocation, then
+ * waits only for every live container to drop the credential and select its
+ * disconnected transport. The bridge ack is therefore truthful without being
+ * gated on GitHub's revoke round-trip.
  *
  * ADR-033: only a non-expiring ACCESS token can be revoked by token
  * (`DELETE /applications/{client_id}/token` matches access tokens only — a
@@ -80,26 +341,74 @@ export function onConnectSet(frame: GhConnectSet): { ok: boolean; error?: string
  * Legacy refresh tokens aren't single-token revocable; the short-lived access
  * tokens they mint expire on their own.
  */
-export async function onConnectClear(userId: string): Promise<void> {
+export interface ConnectClearDeps {
+  readStored?: (
+    userId: string,
+  ) => { token: string; kind: string } | null;
+  deleteLocal?: (userId: string) => void;
+  activeTaskIds?: (userId: string) => string[];
+  reconcile?: (taskId: string, userId: string) => Promise<boolean>;
+  revoke?: (token: string) => Promise<void>;
+  invalidateCredentials?: (userId: string) => Promise<void>;
+}
+
+export async function onConnectClear(
+  userId: string,
+  deps: ConnectClearDeps = {},
+): Promise<void> {
+  let stored: { token: string; kind: string } | null = null;
   try {
-    const stored = readStoredToken(userId);
-    deleteToken(userId); // fires onGithubChange → re-advertise capabilities
-    for (const taskId of activeTaskIdsForUser(userId)) {
-      clearRefresh(taskId);
-      authExpiredHandler?.(taskId, userId, "GitHub disconnected");
-    }
-    if (stored && stored.kind === "access") {
-      await revokeAtGitHub(stored.token);
-    } else if (stored) {
-      console.warn(
-        `[github] user ${userId}: legacy refresh token cleared locally; cannot single-token revoke at GitHub`,
-      );
-    }
+    stored = (deps.readStored ?? readStoredToken)(userId);
   } catch (err) {
+    // A corrupt legacy row must not make Disconnect impossible. We can still
+    // delete it locally and clean every live container; only remote revocation
+    // is unavailable because the token could not be decrypted.
     console.warn(
-      `[github] disconnect failed: ${err instanceof Error ? err.message : err}`,
+      `[github] user ${userId}: could not read token before disconnect: ${
+        err instanceof Error ? err.message : err
+      }`,
     );
   }
+
+  // Local capability removal is synchronous and authoritative. It must happen
+  // even when token decryption or GitHub's revoke endpoint is unavailable.
+  (deps.deleteLocal ?? deleteToken)(userId);
+
+  // Start remote revocation immediately but do not put it on the ack path.
+  // revokeAtGitHub catches its own failures; the catch also makes injected
+  // test/alternate implementations safely fire-and-forget.
+  if (stored?.kind === "access") {
+    startBestEffortRevoke(
+      userId,
+      stored.token,
+      deps.revoke ?? revokeAtGitHub,
+    );
+  } else if (stored) {
+    console.warn(
+      `[github] user ${userId}: legacy refresh token cleared locally; cannot single-token revoke at GitHub`,
+    );
+  }
+
+  // Incrementing the host-Git generation prevents any not-yet-started use of
+  // an old prepared handle. Await already-started task-up operations before
+  // discovering and scrubbing containers: a task may create its app container
+  // while Disconnect is in flight.
+  await deps.invalidateCredentials?.(userId);
+
+  const activeTasks = (deps.activeTaskIds ?? credentialCleanupTaskIdsForUser)(
+    userId,
+  );
+  for (const taskId of activeTasks) {
+    clearRefresh(taskId);
+  }
+  const reconcile = deps.reconcile ?? reconcileTaskGitAuth;
+  const settled = await Promise.allSettled(
+    activeTasks.map((taskId) => reconcile(taskId, userId)),
+  );
+  const failed = settled.find(
+    (result): result is PromiseRejectedResult => result.status === "rejected",
+  );
+  if (failed) throw failed.reason;
 }
 
 /** Decrypt the user's stored token + its kind, or null if none. */
@@ -120,11 +429,11 @@ function readStoredToken(
 }
 
 export function deleteToken(userId: string): void {
-  clearAccessCache(userId);
   getDb()
     .delete(schema.githubTokens)
     .where(eq(schema.githubTokens.userId, userId))
     .run();
+  advanceGithubAuthGeneration(userId);
   notifyGithubChange();
 }
 
@@ -161,20 +470,48 @@ function notifyGithubChange(): void {
   }
 }
 
-function activeTaskIdsForUser(userId: string): string[] {
+export function taskMayRetainGithubCredential(task: {
+  endedAt: number | null;
+  composeProject: string | null;
+  statusMirror: string | null;
+}): boolean {
+  // Active/starting rows may gain a container while Disconnect is running.
+  // Ended rows need cleanup only when their compose identity is preserved;
+  // task-down clears composeProject after destroying the stack. A failed
+  // task-up can leave a conventional app container before compose metadata was
+  // persisted, so error rows are probed by task id as well.
+  return (
+    task.endedAt == null ||
+    task.composeProject != null ||
+    task.statusMirror === "error"
+  );
+}
+
+function taskCredentialRowsForUser(userId: string) {
   return getDb()
-    .select({ taskId: schema.hostTasks.taskId })
+    .select({
+      taskId: schema.hostTasks.taskId,
+      endedAt: schema.hostTasks.endedAt,
+      composeProject: schema.hostTasks.composeProject,
+      statusMirror: schema.hostTasks.statusMirror,
+    })
     .from(schema.hostTasks)
-    .where(
-      and(
-        eq(schema.hostTasks.ownerUserId, userId),
-        isNull(schema.hostTasks.endedAt),
-      ),
-    )
-    .all()
+    .where(eq(schema.hostTasks.ownerUserId, userId))
+    .all();
+}
+
+function credentialCleanupTaskIdsForUser(userId: string): string[] {
+  return taskCredentialRowsForUser(userId)
+    .filter(taskMayRetainGithubCredential)
     .map((r) => r.taskId);
 }
 
+function runningTaskIdsForUser(userId: string): string[] {
+  return taskCredentialRowsForUser(userId)
+    .filter((task) => task.endedAt == null)
+    .map((task) => task.taskId);
+}
+
 /**
  * Re-mint + inject a (re)connected token into the user's live tasks — so a
  * reconnect on Account applies to running containers, not only new tasks. Clear
@@ -183,9 +520,15 @@ function activeTaskIdsForUser(userId: string): string[] {
  * run setup fresh. Fire-and-forget per task; best-effort by construction.
  */
 export function reinjectRunningTasks(userId: string): void {
-  for (const taskId of activeTaskIdsForUser(userId)) {
+  for (const taskId of runningTaskIdsForUser(userId)) {
     clearRefresh(taskId);
-    void setupTaskGithub(taskId, userId);
+    void reconcileTaskGitAuth(taskId, userId).catch((err) =>
+      console.warn(
+        `[github] task ${taskId}: credential reconciliation failed: ${
+          err instanceof Error ? err.message : err
+        }`,
+      ),
+    );
   }
 }
 
@@ -252,7 +595,10 @@ interface ExchangeResult {
  */
 const inflightExchanges = new Map<
   string,
-  Promise<{ accessToken: string; expiresAt: number } | null>
+  {
+    generation: number;
+    promise: Promise<{ accessToken: string; expiresAt: number } | null>;
+  }
 >();
 
 /**
@@ -271,19 +617,17 @@ const accessCache = new Map<
   { accessToken: string; expiresAt: number }
 >();
 
-/** Drop a user's cached access token (token deleted / re-granted). */
-function clearAccessCache(userId: string): void {
-  accessCache.delete(userId);
-}
-
 /** Test hook: reset the access-token cache. */
 export function clearAllAccessCache(): void {
   accessCache.clear();
+  inflightExchanges.clear();
+  githubAuthGenerations.clear();
 }
 
 export function requestAccessToken(
   userId: string,
 ): Promise<{ accessToken: string; expiresAt: number | null } | null> {
+  const generation = githubAuthGeneration(userId);
   // ADR-033 non-expiring path: the stored token IS the access token — return it
   // directly, no exchange/cache/rotation. `expiresAt: null` ⇒ no refresh.
   const row = getDb()
@@ -305,21 +649,27 @@ export function requestAccessToken(
     return Promise.resolve(cached);
   }
   const existing = inflightExchanges.get(userId);
-  if (existing) return existing;
-  const run = doRequestAccessToken(userId)
+  if (existing?.generation === generation) return existing.promise;
+  let run!: Promise<{ accessToken: string; expiresAt: number } | null>;
+  run = doRequestAccessToken(userId, generation)
     .then((tok) => {
-      if (tok) accessCache.set(userId, tok);
+      if (tok && githubAuthGeneration(userId) === generation) {
+        accessCache.set(userId, tok);
+      }
       return tok;
     })
     .finally(() => {
-      inflightExchanges.delete(userId);
+      if (inflightExchanges.get(userId)?.promise === run) {
+        inflightExchanges.delete(userId);
+      }
     });
-  inflightExchanges.set(userId, run);
+  inflightExchanges.set(userId, { generation, promise: run });
   return run;
 }
 
 async function doRequestAccessToken(
   userId: string,
+  generation: number,
 ): Promise<{ accessToken: string; expiresAt: number } | null> {
   const row = getDb()
     .select()
@@ -357,7 +707,13 @@ async function doRequestAccessToken(
     throw new Error(`gh token exchange failed: HTTP ${res.status}${detail}`);
   }
   const data = (await res.json()) as ExchangeResult;
-  if (data.refreshToken) {
+  // A reconnect/disconnect may have replaced the DB row while the network
+  // exchange was in flight. Never overwrite that newer grant with the rotated
+  // refresh token from the superseded exchange.
+  if (
+    data.refreshToken &&
+    githubAuthGeneration(userId) === generation
+  ) {
     const sealed = sealAesGcm(data.refreshToken);
     getDb()
       .update(schema.githubTokens)
@@ -388,30 +744,68 @@ const defaultExec: DockerExec = async (args, input) => {
   return { status: res.status, stderr: res.stderr };
 };
 
-/** Write the access token into the container's gh config via `gh auth login`. */
+/**
+ * Write the access token into the container's gh config and make gh Git's
+ * HTTPS credential helper. Also removes the legacy global HTTPS→SSH rewrite so
+ * reconnecting heals already-running containers without recreation.
+ */
 export async function injectIntoContainer(
   taskId: string,
   accessToken: string,
   exec: DockerExec = defaultExec,
 ): Promise<void> {
   const container = `task-${taskId}-app-1`;
-  const args = [
-    "exec",
-    "-i",
-    "-u",
-    "node",
+  const args = managedContainerExecArgs(
     container,
-    "gh",
-    "auth",
-    "login",
-    "--with-token",
-    "--hostname",
-    "github.com",
-  ];
+    [
+      "/usr/bin/gh",
+      "auth",
+      "login",
+      "--with-token",
+      "--hostname",
+      "github.com",
+      "--git-protocol",
+      "https",
+    ],
+    true,
+  );
   const res = await exec(args, `${accessToken}\n`);
   if (res.status !== 0) {
     throw new Error(`gh auth login failed in ${container}: ${res.stderr.trim()}`);
   }
+
+  const setup = await exec(
+    managedContainerExecArgs(container, [
+      "/usr/bin/gh",
+      "auth",
+      "setup-git",
+      "--hostname",
+      "github.com",
+    ]),
+    "",
+  );
+  if (setup.status !== 0) {
+    throw new Error(
+      `gh git credential setup failed in ${container}: ${setup.stderr.trim()}`,
+    );
+  }
+
+  const transport = await exec(
+    managedContainerExecArgs(container, [
+      "/bin/sh",
+      "-c",
+      "/usr/bin/git config --global --unset-all 'url.git@github.com:.insteadOf' >/dev/null 2>&1 || true; " +
+        "/usr/bin/git config --global --unset-all core.sshCommand >/dev/null 2>&1 || true; " +
+        "/usr/bin/git config --global --replace-all 'url.https://github.com/.insteadOf' 'git@github.com:'; " +
+        "/usr/bin/git config --global --add 'url.https://github.com/.insteadOf' 'ssh://git@github.com/'",
+    ]),
+    "",
+  );
+  if (transport.status !== 0) {
+    throw new Error(
+      `Git HTTPS transport setup failed in ${container}: ${transport.stderr.trim()}`,
+    );
+  }
 }
 
 // --- refresh schedule -------------------------------------------------------
@@ -430,11 +824,26 @@ export function scheduleRefresh(
   taskId: string,
   userId: string,
   expiresAt: number,
+  generation = githubAuthGeneration(userId),
 ): void {
   clearRefresh(taskId);
   const delay = Math.max(0, expiresAt - Date.now() - REFRESH_LEAD_MS);
   const timer = setTimeout(() => {
-    void runRefresh(taskId, userId);
+    timers.delete(taskId);
+    if (githubAuthGeneration(userId) !== generation) return;
+    void enqueueTaskGitAuth(taskId, userId, {}, {
+      generation,
+      getGeneration: () => githubAuthGeneration(userId),
+      attempt: 0,
+    }).catch((err) => {
+      if (githubAuthGeneration(userId) !== generation) return;
+      console.warn(
+        `[github] task ${taskId}: refresh reconciliation failed: ${
+          err instanceof Error ? err.message : err
+        }`,
+      );
+      scheduleGithubRetry(taskId, userId, 0, {}, generation);
+    });
   }, delay);
   timer.unref?.();
   timers.set(taskId, timer);
@@ -484,30 +893,6 @@ export function isTransientGithubError(reason: string): boolean {
   );
 }
 
-async function runRefresh(taskId: string, userId: string): Promise<void> {
-  try {
-    const tok = await requestAccessToken(userId);
-    if (!tok) {
-      authExpiredHandler?.(taskId, userId, "no GitHub token on host");
-      return;
-    }
-    await injectIntoContainer(taskId, tok.accessToken);
-    // Only re-schedule for an expiring token; non-expiring needs no refresh.
-    if (tok.expiresAt !== null) scheduleRefresh(taskId, userId, tok.expiresAt);
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    // A revoked / expired refresh token can't recover — drop it to force a
-    // clean re-grant through the OAuth flow. Anything else is likely transient
-    // (network / cloud blip) — self-heal with a bounded retry.
-    if (isRevokedTokenError(reason)) {
-      deleteToken(userId);
-    } else {
-      scheduleGithubRetry(taskId, userId, 0);
-    }
-    authExpiredHandler?.(taskId, userId, reason);
-  }
-}
-
 export function clearRefresh(taskId: string): void {
   clearGithubRetry(taskId);
   const t = timers.get(taskId);
@@ -551,6 +936,7 @@ function scheduleGithubRetry(
   userId: string,
   attempt: number,
   deps: SetupTaskDeps = {},
+  generation = githubAuthGeneration(userId),
 ): void {
   clearGithubRetry(taskId);
   if (attempt >= RETRY_BACKOFF_MS.length) {
@@ -568,9 +954,23 @@ function scheduleGithubRetry(
   const delay = RETRY_BACKOFF_MS[attempt] ?? 300_000;
   const timer = setTimeout(() => {
     retryTimers.delete(taskId);
+    if (githubAuthGeneration(userId) !== generation) return;
     const isActive = deps.taskIsActive ?? taskIsActive;
     if (!isActive(taskId)) return; // task ended while we backed off
-    void setupTaskGithub(taskId, userId, deps, attempt + 1);
+    void enqueueTaskGitAuth(taskId, userId, {}, {
+      generation,
+      getGeneration: () => githubAuthGeneration(userId),
+      setupDeps: deps,
+      attempt: attempt + 1,
+    }).catch((err) => {
+      if (githubAuthGeneration(userId) !== generation) return;
+      console.warn(
+        `[github] task ${taskId}: retry reconciliation failed: ${
+          err instanceof Error ? err.message : err
+        }`,
+      );
+      scheduleGithubRetry(taskId, userId, attempt + 1, deps, generation);
+    });
   }, delay);
   timer.unref?.();
   retryTimers.set(taskId, timer);
@@ -594,6 +994,7 @@ export interface SetupTaskDeps {
   schedule?: (taskId: string, userId: string, expiresAt: number) => void;
   deleteToken?: (userId: string) => void;
   taskIsActive?: (taskId: string) => boolean;
+  scrub?: (taskId: string) => Promise<boolean | void>;
 }
 
 /**
@@ -603,36 +1004,55 @@ export interface SetupTaskDeps {
  * a failure emits the auth-expired note but never aborts task-up. Returns true
  * iff a token was injected.
  */
-/** Tasks whose gh setup is currently in flight. task-up and the first
- *  channel-ensure both kick this off and can overlap; a second concurrent
- *  `gh auth login` would race the container's gh config, so we dedupe. */
-const setupInFlight = new Set<string>();
+interface SetupExecutionGuard {
+  generation: number;
+  isCurrent: () => boolean;
+}
 
 export async function setupTaskGithub(
   taskId: string,
   userId: string,
   deps: SetupTaskDeps = {},
   attempt = 0,
+  guard?: SetupExecutionGuard,
 ): Promise<boolean> {
+  const capturedGeneration =
+    guard?.generation ?? githubAuthGeneration(userId);
+  const isCurrent =
+    guard?.isCurrent ??
+    (() => githubAuthGeneration(userId) === capturedGeneration);
   const _hasToken = deps.hasToken ?? hasToken;
   const _request = deps.requestAccessToken ?? requestAccessToken;
   const _inject =
     deps.inject ?? ((t: string, tok: string) => injectIntoContainer(t, tok));
-  const _schedule = deps.schedule ?? scheduleRefresh;
-  if (setupInFlight.has(taskId)) return false;
-  setupInFlight.add(taskId);
+  if (!isCurrent()) return false;
   try {
     if (_hasToken(userId)) {
       const tok = await _request(userId);
-      if (tok) {
+      if (tok && isCurrent()) {
         await _inject(taskId, tok.accessToken);
+        // The mutation itself cannot be interrupted, but a newer transition is
+        // already queued behind us. Do not let this stale run arm more work.
+        if (!isCurrent()) return false;
         // Non-expiring (ADR-033) tokens (expiresAt null) need no refresh timer.
-        if (tok.expiresAt !== null) _schedule(taskId, userId, tok.expiresAt);
+        if (tok.expiresAt !== null) {
+          if (deps.schedule) {
+            deps.schedule(taskId, userId, tok.expiresAt);
+          } else {
+            scheduleRefresh(
+              taskId,
+              userId,
+              tok.expiresAt,
+              capturedGeneration,
+            );
+          }
+        }
         clearGithubRetry(taskId);
         console.log(`[github] task ${taskId}: injected user access token`);
         return true;
       }
     }
+    if (!isCurrent()) return false;
     const pat = process.env.UAI_GH_PAT_FALLBACK;
     if (pat) {
       await _inject(taskId, pat);
@@ -643,6 +1063,9 @@ export async function setupTaskGithub(
     console.log(`[github] task ${taskId}: gh not configured for user ${userId}`);
     return false;
   } catch (err) {
+    // A newer connect/disconnect owns the final state and is queued behind this
+    // operation. The superseded run must neither delete its grant nor retry.
+    if (!isCurrent()) return false;
     const reason = err instanceof Error ? err.message : String(err);
     console.warn(`[github] task ${taskId}: gh setup failed: ${reason}`);
     // A revoked refresh token can't recover by retrying — drop it so the user
@@ -663,11 +1086,234 @@ export async function setupTaskGithub(
     // (in scheduleGithubRetry). The handler classifies the reason (transient
     // 5xx blip vs. genuine expiry) and words the note accordingly.
     if (attempt === 0) authExpiredHandler?.(taskId, userId, reason);
-    scheduleGithubRetry(taskId, userId, attempt, deps);
+    scheduleGithubRetry(
+      taskId,
+      userId,
+      attempt,
+      deps,
+      capturedGeneration,
+    );
+    return false;
+  }
+}
+
+// One task-local queue owns transport transitions. Connect/disconnect frames,
+// channel recovery, and /retry-gh can otherwise overlap: a slow old-token
+// injection must never win after a newer disconnect (or vice versa).
+const gitAuthReconcileQueues = new Map<string, Promise<boolean>>();
+
+const REMOVE_MANAGED_GITHUB_AUTH = [
+  "set -eu",
+  "/usr/bin/rm -f -- \"$GH_CONFIG_DIR/hosts.yml\"",
+  "test ! -e \"$GH_CONFIG_DIR/hosts.yml\"",
+  "/usr/bin/git config --global --unset-all 'credential.https://github.com.helper' >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all 'credential.https://gist.github.com.helper' >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all 'url.git@github.com:.insteadOf' >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --unset-all core.sshCommand >/dev/null 2>&1 || true",
+  "/usr/bin/git config --global --replace-all 'url.https://github.com/.insteadOf' 'git@github.com:'",
+  "/usr/bin/git config --global --add 'url.https://github.com/.insteadOf' 'ssh://git@github.com/'",
+  "test -z \"$(/usr/bin/git config --global --get-all 'credential.https://github.com.helper' 2>/dev/null || true)\"",
+  "test -z \"$(/usr/bin/git config --global --get-all 'credential.https://gist.github.com.helper' 2>/dev/null || true)\"",
+].join("; ");
+
+type DockerCommand = typeof dockerCli;
+
+async function checkedDockerCommand(
+  run: DockerCommand,
+  args: string[],
+  label: string,
+  timeoutMs = EXEC_TIMEOUT_MS,
+): Promise<Awaited<ReturnType<DockerCommand>>> {
+  const result = await run(args, { timeoutMs });
+  if (result.status !== 0) {
+    throw new Error(
+      `${label} failed: ${result.stderr.trim() || `exit ${result.status}`}`,
+    );
+  }
+  return result;
+}
+
+export async function removeGithubFromContainer(
+  taskId: string,
+  run: DockerCommand = dockerCli,
+): Promise<boolean> {
+  const container = `task-${taskId}-app-1`;
+  const listed = await checkedDockerCommand(
+    run,
+    [
+      "ps",
+      "--all",
+      "--filter",
+      `name=^/${container}$`,
+      "--format",
+      "{{.State}}",
+    ],
+    `inspect ${container}`,
+  );
+  const states = listed.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (states.length === 0) return false; // no container means no credential to retain
+  if (states.length !== 1) {
+    throw new Error(`inspect ${container} returned ${states.length} containers`);
+  }
+
+  const originalState = states[0];
+  if (originalState !== "running") {
+    // Never start or unpause untrusted task code while its old credential is
+    // still on disk. The app container is disposable; workspace/repository
+    // state lives outside it and Compose recreates it on Resume.
+    await checkedDockerCommand(
+      run,
+      ["rm", "--force", container],
+      `remove credential-bearing ${container}`,
+    );
+    const remaining = await checkedDockerCommand(
+      run,
+      [
+        "ps",
+        "--all",
+        "--filter",
+        `name=^/${container}$`,
+        "--format",
+        "{{.State}}",
+      ],
+      `verify removal of ${container}`,
+    );
+    if (remaining.stdout.trim()) {
+      throw new Error(`remove ${container} was not verified`);
+    }
     return false;
-  } finally {
-    setupInFlight.delete(taskId);
   }
+
+  await checkedDockerCommand(
+    run,
+    managedContainerExecArgs(container, [
+      "/bin/sh",
+      "-c",
+      REMOVE_MANAGED_GITHUB_AUTH,
+    ]),
+    `remove managed GitHub auth from ${container}`,
+  );
+  return true;
+}
+
+export interface ReconcileTaskGitAuthDeps {
+  hasToken?: (userId: string) => boolean;
+  setupGithub?: (taskId: string, userId: string) => Promise<boolean>;
+  setupDeps?: SetupTaskDeps;
+  authGeneration?: (userId: string) => number;
+  logoutContainer?: (taskId: string) => Promise<boolean | void>;
+  ensureSsh?: (taskId: string, userId: string) => Promise<boolean>;
+  selectSsh?: (taskId: string) => Promise<boolean>;
+}
+
+interface ReconcileInvocation {
+  generation: number;
+  getGeneration: () => number;
+  setupDeps?: SetupTaskDeps;
+  attempt: number;
+}
+
+/**
+ * Re-read the current host credential state and select exactly one Git
+ * transport for a live task: connected user token over HTTPS, otherwise the
+ * task owner's SSH identity. Serialized per task for reconnect safety.
+ */
+export function reconcileTaskGitAuth(
+  taskId: string,
+  userId: string,
+  deps: ReconcileTaskGitAuthDeps = {},
+): Promise<boolean> {
+  const getGeneration = () =>
+    (deps.authGeneration ?? githubAuthGeneration)(userId);
+  return enqueueTaskGitAuth(taskId, userId, deps, {
+    generation: getGeneration(),
+    getGeneration,
+    setupDeps: deps.setupDeps,
+    attempt: 0,
+  });
+}
+
+function enqueueTaskGitAuth(
+  taskId: string,
+  userId: string,
+  deps: ReconcileTaskGitAuthDeps,
+  invocation: ReconcileInvocation,
+): Promise<boolean> {
+  const previous = gitAuthReconcileQueues.get(taskId) ?? Promise.resolve(false);
+  let queued: Promise<boolean>;
+  queued = previous
+    .catch(() => false)
+    .then(async () => {
+      const isCurrent = () =>
+        invocation.getGeneration() === invocation.generation;
+      if (!isCurrent()) return false;
+
+      const connected =
+        deps.hasToken ?? invocation.setupDeps?.hasToken ?? hasToken;
+      const shouldConnect = connected(userId);
+      if (!shouldConnect) clearRefresh(taskId);
+
+      // Authoritative replacement, not gh's multi-account add/switch behavior:
+      // remove every managed account/helper first, in the same per-task queue,
+      // then install only the current user's credential. Non-running containers
+      // are removed rather than executed with the old credential on disk.
+      const canConfigureLiveTransport = await (
+        deps.logoutContainer ??
+        invocation.setupDeps?.scrub ??
+        removeGithubFromContainer
+      )(taskId);
+      if (!isCurrent()) return false;
+      if (canConfigureLiveTransport === false) {
+        // No credential-bearing container remains. A connected credential will
+        // be installed when Compose recreates it; disconnected state is already
+        // fully scrubbed.
+        return shouldConnect;
+      }
+
+      if (shouldConnect) {
+        if (deps.setupGithub) {
+          const result = await deps.setupGithub(taskId, userId);
+          return isCurrent() ? result : false;
+        }
+        return setupTaskGithub(
+          taskId,
+          userId,
+          invocation.setupDeps,
+          invocation.attempt,
+          { generation: invocation.generation, isCurrent },
+        );
+      }
+
+      // SSH remains an opt-in fallback for users who did not connect GitHub;
+      // ensuring the identity also keeps commit/tag signing available. Never
+      // select SSH transport unless a usable identity was actually asserted.
+      const hasSshIdentity = await (
+        deps.ensureSsh ?? ensureTaskSshIdentity
+      )(taskId, userId);
+      if (!isCurrent()) return false;
+      if (hasSshIdentity) {
+        const selected = await (
+          deps.selectSsh ?? configureTaskSshTransport
+        )(taskId);
+        if (!selected) {
+          throw new Error(
+            `task ${taskId}: SSH fallback transport could not be configured`,
+          );
+        }
+      } else {
+        console.log(
+          `[github] task ${taskId}: managed GitHub credential removed; using credential-free HTTPS`,
+        );
+      }
+      return false;
+    })
+    .finally(() => {
+      if (gitAuthReconcileQueues.get(taskId) === queued) {
+        gitAuthReconcileQueues.delete(taskId);
+      }
+    });
+  gitAuthReconcileQueues.set(taskId, queued);
+  return queued;
 }
 
 /** Test/maintenance hook: drop all scheduled refresh + retry timers. */