@runuai/host 0.9.0 → 0.9.2

package/src/index.ts

@@ -4,7 +4,14 @@ import { cloneRepo } from "../lib/repo-clone";
 import { handleFilesOp } from "../lib/shared-files";
 import { getOrchestrator } from "../lib/orchestrator";
 import { storeTaskCliSecret } from "../lib/agent-cli";
-import { setupTaskGithub, clearRefresh } from "../lib/github-tokens";
+import {
+  clearRefresh,
+  reconcileTaskGitAuth,
+} from "../lib/github-tokens";
+import {
+  prepareTaskGithubGitCredential,
+  type TaskGithubGitCredential,
+} from "../lib/github-git-auth";
 import { readAttachment, writeAttachment } from "../lib/attachments";
 import { appendTranscript as writeTranscript } from "../lib/transcript";
 import { buildTaskDiff } from "../lib/task-diff";
@@ -67,6 +74,7 @@ export {
   factoryFor as agentFactoryFor,
   list as listAgentAdapters,
   register as registerAgentAdapter,
+  supportsExecutionProfile,
 } from "../lib/agents/registry";
 export type {
   AgentKindCapability,
@@ -218,7 +226,37 @@ export const hostCommands: HostCommands = {
             {},
           );
         }
-        return agent.taskUp(input);
+        let gitCredential: TaskGithubGitCredential | null;
+        try {
+          gitCredential = input.projects.some((project) =>
+            isGithubRepo(project.repoUrl),
+          )
+            ? await prepareTaskGithubGitCredential(input.task.ownerUserId)
+            : null;
+        } catch {
+          throw new AgentError(
+            "GITHUB_AUTH_UNAVAILABLE",
+            "GitHub is connected on this host, but Uai could not prepare its credential for Git. Retry the task; if it persists, reconnect GitHub on this host.",
+          );
+        }
+        try {
+          return gitCredential
+            ? await gitCredential.run(() =>
+                agent.taskUp(input, {
+                  githubCredentialSocket: gitCredential.socketPath,
+                }),
+              )
+            : await agent.taskUp(input);
+        } finally {
+          await gitCredential?.close().catch((error: unknown) => {
+            // Cleanup must not replace the actual task-up result/error. The
+            // credential is short-lived and close() also removes its private
+            // directory in a finally block; retain diagnostics for operators.
+            console.warn(
+              `[github] task ${input.task.id}: credential cleanup failed: ${error instanceof Error ? error.message : String(error)}`,
+            );
+          });
+        }
       });
       if (result.ok) {
         orchestrator.allowChannel(input.task.id);
@@ -236,10 +274,19 @@ export const hostCommands: HostCommands = {
         // background — it must never block or fail task-up. Awaiting it here would
         // couple the command result to a network token-exchange: a slow/hung
         // exchange (e.g. cloud mid-deploy) would trip the cloud's command timeout
-        // and mark a running task as errored. setupTaskGithub injects + schedules
+        // and mark a running task as errored. The reconciler injects + schedules
         // (or emits a system note on failure) on its own; the agents come up
         // regardless and the token lands well before the first `gh` call.
-        void setupTaskGithub(input.task.id, input.task.ownerUserId);
+        void reconcileTaskGitAuth(
+          input.task.id,
+          input.task.ownerUserId,
+        ).catch((err) =>
+          console.warn(
+            `[github] task ${input.task.id}: post-start reconciliation failed: ${
+              err instanceof Error ? err.message : String(err)
+            }`,
+          ),
+        );
       } else {
         recordTaskError(input.task.id);
       }
@@ -482,10 +529,10 @@ export const hostCommands: HostCommands = {
     }
   },
 
-  async appendTranscript(_ctx, taskId, author, text) {
+  async appendTranscript(_ctx, taskId, author, text, targets) {
     // Per-message + high-frequency, so no logCommand (avoid log spam).
     try {
-      writeTranscript(taskId, author, text);
+      writeTranscript(taskId, author, text, targets);
       return ok(undefined);
     } catch (err) {
       return failFromUnknown(err);
@@ -553,6 +600,14 @@ function mapAgentError(code: string): HostErrorCode {
       return HostErrorCode.WorktreeFailed;
     case "CLONE_FAILED":
       return HostErrorCode.CloneFailed;
+    case "GITHUB_SSH_ACCESS_DENIED":
+      return HostErrorCode.GitHubSshAccessDenied;
+    case "GITHUB_TOKEN_ACCESS_DENIED":
+      return HostErrorCode.GitHubTokenAccessDenied;
+    case "GITHUB_AUTH_UNAVAILABLE":
+      return HostErrorCode.GitHubAuthUnavailable;
+    case "GITHUB_CONNECTION_REQUIRED":
+      return HostErrorCode.GitHubConnectionRequired;
     case "FETCH_FAILED":
       return HostErrorCode.FetchFailed;
     case "RENDER_FAILED":
@@ -566,6 +621,21 @@ function mapAgentError(code: string): HostErrorCode {
   }
 }
 
+/** Host-side predicate only; API-boundary normalization already canonicalizes
+ * normal GitHub projects. Keep scratchpads/GitLab/local remotes independent of
+ * an unrelated broken GitHub connection on the same host. */
+function isGithubRepo(input: string): boolean {
+  const value = input.trim();
+  if (/^(?:[^@/]+@)?(?:www\.)?github\.com:/i.test(value)) return true;
+  if (/^[\w.-]+\/[\w.-]+(?:\.git)?\/?$/i.test(value)) return true;
+  try {
+    const url = new URL(value);
+    return /^(?:www\.)?github\.com$/i.test(url.hostname);
+  } catch {
+    return false;
+  }
+}
+
 function mapDeliverError(message: string): HostErrorCode {
   if (message.includes("not found")) return HostErrorCode.TaskNotFound;
   if (message.includes("not running")) return HostErrorCode.TaskNotRunning;
@@ -574,7 +644,11 @@ function mapDeliverError(message: string): HostErrorCode {
 }
 
 function isRetryableAgentError(code: string): boolean {
-  return code === "FETCH_FAILED" || code === "CONTAINER_INIT_FAILED";
+  return (
+    code === "FETCH_FAILED" ||
+    code === "CONTAINER_INIT_FAILED" ||
+    code === "GITHUB_AUTH_UNAVAILABLE"
+  );
 }
 
 function toLegacyDecision(decision: PermissionDecision): "accept" | "decline" {

package/src/main.ts

@@ -30,11 +30,17 @@ import {
   onConnectClear,
   onConnectSet,
   onGithubChange,
+  reconcileTaskGitAuth,
+  runGithubConnectionTransition,
   setAuthExpiredHandler,
 } from "../lib/github-tokens";
+import { invalidateTaskGithubGitCredentials } from "../lib/github-git-auth";
+import {
+  deleteUserSshIdentity,
+  removeTaskSshIdentityFromContainer,
+} from "../lib/git-identity";
 import { reinjectCodexRunningTasks, watchCodexAuth } from "../lib/codex-auth";
 import {
-  deleteKey as deleteSshKey,
   ensureKeyForUser as ensureSshKeyForUser,
   getPublicKey as getSshPublicKey,
 } from "../lib/ssh";
@@ -72,6 +78,7 @@ import { ensureStandardImage, standardRuntimes } from "../lib/standard-image";
 import { hostCommands, hostEvents } from "./index";
 import {
   HostErrorCode,
+  TRANSCRIPT_TARGETS_PROTOCOL_FEATURE,
   type CloudToHost,
   type McpOp,
   type CommandContext,
@@ -81,6 +88,8 @@ import {
   type HostCommands,
   type HostToCloud,
   type PermissionDecision,
+  parseChannelMode,
+  parseTranscriptTargets,
   type TaskAgent,
   type TaskCommandProject,
   type TaskCommandTask,
@@ -212,6 +221,7 @@ async function startLocalUi(): Promise<void> {
 function buildCapabilities(): HostCapabilities {
   return {
     version: packageVersion(),
+    protocolFeatures: [TRANSCRIPT_TARGETS_PROTOCOL_FEATURE],
     agentKinds: agentKindCapabilities(),
     runtimes: standardRuntimes(),
     githubUsers: connectedUserIds(),
@@ -331,45 +341,108 @@ function connect(): void {
         closeTunnel(socket, frame.tunnelId, frame.reason);
         break;
       case "gh.connect.set": {
-        const result = onConnectSet(frame);
-        send(
-          socket,
-          result.ok
-            ? { kind: "gh.connect.ack", userId: frame.userId, ok: true }
-            : {
-                kind: "gh.connect.ack",
-                userId: frame.userId,
-                ok: false,
-                error: result.error ?? "store failed",
-              },
+        // Account switches fence every host-side Git operation using the old
+        // credential before the replacement grant is stored or reinjected.
+        void runGithubConnectionTransition(frame.userId, () =>
+          onConnectSet(frame, {
+            invalidateCredentials: invalidateTaskGithubGitCredentials,
+            reconcile: (taskId, userId) =>
+              getOrchestrator().runTaskLifecycle(taskId, () =>
+                reconcileTaskGitAuth(taskId, userId),
+              ),
+          }),
+        ).then(
+          (result) =>
+            send(
+              socket,
+              result.ok
+                ? { kind: "gh.connect.ack", userId: frame.userId, ok: true }
+                : {
+                    kind: "gh.connect.ack",
+                    userId: frame.userId,
+                    ok: false,
+                    error: result.error ?? "store failed",
+                  },
+            ),
+          (err) => {
+            const error = err instanceof Error ? err.message : String(err);
+            console.warn(`[github] connect.set failed: ${error}`);
+            send(socket, {
+              kind: "gh.connect.ack",
+              userId: frame.userId,
+              ok: false,
+              error,
+            });
+          },
         );
         break;
       }
-      case "gh.connect.clear":
-        // Delete-then-revoke (ADR-033) is async + best-effort; ack immediately
-        // so the UI isn't gated on the GitHub revoke round-trip. The .catch is
-        // a belt over onConnectClear's own try/catch — a fire-and-forget
-        // rejection must never crash the host.
-        void onConnectClear(frame.userId).catch((err) =>
-          console.warn(
-            `[github] connect.clear failed: ${err instanceof Error ? err.message : err}`,
-          ),
+      case "gh.connect.clear": {
+        // Local deletion happens synchronously inside onConnectClear and the
+        // remote revoke starts immediately in the background. Delay the ack
+        // only for live-container logout + transport transition, so the UI
+        // cannot report Disconnected while a task can still use the old token.
+        void runGithubConnectionTransition(frame.userId, () =>
+          onConnectClear(frame.userId, {
+            invalidateCredentials: invalidateTaskGithubGitCredentials,
+            reconcile: (taskId, userId) =>
+              getOrchestrator().runTaskLifecycle(taskId, () =>
+                reconcileTaskGitAuth(taskId, userId),
+              ),
+          }),
+        ).then(
+          () =>
+            send(socket, {
+              kind: "gh.connect.ack",
+              userId: frame.userId,
+              ok: true,
+            }),
+          (err) => {
+            const error = err instanceof Error ? err.message : String(err);
+            console.warn(`[github] connect.clear failed: ${error}`);
+            send(socket, {
+              kind: "gh.connect.ack",
+              userId: frame.userId,
+              ok: false,
+              error,
+            });
+          },
         );
-        send(socket, { kind: "gh.connect.ack", userId: frame.userId, ok: true });
         break;
+      }
       case "ssh.key.get":
       case "ssh.key.ensure":
       case "ssh.key.delete": {
+        if (frame.kind === "ssh.key.delete") {
+          void deleteUserSshIdentity(frame.userId, {
+            removeFromContainer: (taskId) =>
+              getOrchestrator().runTaskLifecycle(taskId, () =>
+                removeTaskSshIdentityFromContainer(taskId),
+              ),
+          }).then(
+            () =>
+              send(socket, {
+                kind: "ssh.key.ack",
+                userId: frame.userId,
+                ok: true,
+                publicKey: null,
+              }),
+            (err) =>
+              send(socket, {
+                kind: "ssh.key.ack",
+                userId: frame.userId,
+                ok: false,
+                error:
+                  err instanceof Error ? err.message : "ssh key delete failed",
+              }),
+          );
+          break;
+        }
         try {
-          let publicKey: string | null;
-          if (frame.kind === "ssh.key.delete") {
-            deleteSshKey(frame.userId);
-            publicKey = null;
-          } else if (frame.kind === "ssh.key.ensure") {
-            publicKey = ensureSshKeyForUser(frame.userId);
-          } else {
-            publicKey = getSshPublicKey(frame.userId);
-          }
+          const publicKey =
+            frame.kind === "ssh.key.ensure"
+              ? ensureSshKeyForUser(frame.userId)
+              : getSshPublicKey(frame.userId);
           send(socket, { kind: "ssh.key.ack", userId: frame.userId, ok: true, publicKey });
         } catch (err) {
           send(socket, {
@@ -956,6 +1029,7 @@ function dispatchCommand(
         expectString(args, 0),
         expectString(args, 1),
         expectString(args, 2),
+        parseTranscriptTargets(args[3]),
       );
     case "previewEnsure":
       return hostCommands.previewEnsure(
@@ -1402,6 +1476,13 @@ function expectChannelEnsureInput(
   if (typeof input.globalContext === "string") {
     out.globalContext = input.globalContext;
   }
+  // ADR-083: secretary identity drives the role-specific transcript preamble.
+  // Both are optional for wire compatibility with older clouds.
+  const mode = parseChannelMode(input.mode);
+  if (mode !== undefined) out.mode = mode;
+  if (typeof input.secretaryAgentId === "string") {
+    out.secretaryAgentId = input.secretaryAgentId;
+  }
   // ADR-053: browser testing flag (optional; tolerant of absence).
   if (input.browserTesting === true) out.browserTesting = true;
   // ADR-049: humans in the chat (optional; tolerant of absence for older

package/src/protocol.ts

@@ -9,6 +9,10 @@ export enum HostErrorCode {
   ComposeDownFailed = "compose_down_failed",
   WorktreeFailed = "worktree_failed",
   CloneFailed = "clone_failed",
+  GitHubSshAccessDenied = "github_ssh_access_denied",
+  GitHubTokenAccessDenied = "github_token_access_denied",
+  GitHubAuthUnavailable = "github_auth_unavailable",
+  GitHubConnectionRequired = "github_connection_required",
   FetchFailed = "fetch_failed",
   RenderFailed = "render_failed",
   DbFailed = "db_failed",
@@ -27,6 +31,10 @@ export type HostCommandResult<T> =
       retryable?: boolean;
     };
 
+/** Capability ids shared by host advertisement and fail-closed cloud gates. */
+export const TRANSCRIPT_TARGETS_PROTOCOL_FEATURE = "transcript-targets-v1";
+export const COMMUNICATOR_EXECUTION_PROFILE = "communicator";
+
 export interface CommandContext {
   commandId: string;
 }
@@ -70,6 +78,9 @@ export interface HostCapabilities {
   /** The host-agent package version — the cloud UI shows it on the host page
    *  and flags when npm has a newer release. Optional (older hosts omit it). */
   version?: string;
+  /** Optional protocol features. Absence means an older host and fails closed
+   *  for features whose fallback would weaken isolation (ADR-083). */
+  protocolFeatures?: string[];
   agentKinds: Array<{
     kind: string;
     label: string;
@@ -77,6 +88,13 @@ export interface HostCapabilities {
     defaultModel?: string;
     supportedEfforts: string[];
     defaultEffort?: string;
+    /** Execution profiles this adapter enforces, not prompt-only claims. */
+    executionProfiles?: Array<{
+      id: string;
+      mechanism: string;
+      defaultModel?: string;
+      defaultEffort?: string;
+    }>;
   }>;
   runtimes: Array<{
     kind: string;
@@ -88,6 +106,34 @@ export interface HostCapabilities {
   githubUsers?: string[];
 }
 
+/** One transcript projection the cloud asks the host to append to (ADR-083). */
+export type TranscriptTarget = "chat" | "chat-front";
+
+/** Parse the optional channel mode without turning malformed-new-cloud input
+ * into legacy Open mode. Absence is the only backwards-compatible fallback. */
+export function parseChannelMode(
+  value: unknown,
+): "open" | "secretary" | undefined {
+  if (value === undefined) return undefined;
+  if (value === "open" || value === "secretary") return value;
+  throw new Error("invalid command args: expected channel mode");
+}
+
+/** Parse the appendTranscript wire argument. `undefined` alone is the legacy
+ * three-argument command and maps to chat.md during a rolling deploy. */
+export function parseTranscriptTargets(value: unknown): TranscriptTarget[] {
+  if (value === undefined) return ["chat"];
+  if (
+    !Array.isArray(value) ||
+    value.length === 0 ||
+    value.length > 2 ||
+    value.some((target) => target !== "chat" && target !== "chat-front")
+  ) {
+    throw new Error("invalid command args: expected transcript targets");
+  }
+  return [...new Set(value)];
+}
+
 export interface TaskUpResult {
   composeProject: string;
   worktreePath: string;
@@ -200,6 +246,10 @@ export interface ChannelHuman {
 export interface ChannelEnsureInput {
   taskId: string;
   agents: TaskAgent[];
+  /** ADR-083: channel projection/routing mode. Optional for older clouds. */
+  mode?: "open" | "secretary";
+  /** The one human-facing communicator in secretary mode. */
+  secretaryAgentId?: string;
   /** ADR-049: the humans in the chat. Optional for wire back-compat; absent
    *  or single-entry behaves exactly like the pre-ADR-049 single-human task. */
   humans?: ChannelHuman[];
@@ -382,6 +432,7 @@ export interface HostCommands {
     taskId: string,
     author: string,
     text: string,
+    targets: TranscriptTarget[],
   ): Promise<HostCommandResult<void>>;
 }