@runuai/host 0.9.1 → 0.9.2

package/images/standard/container/uai-init

@@ -37,33 +37,52 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 0. GitHub auth for in-container git (ADR-027). git rides the host's uai SSH
-#    identity (docker-cp'd to ~/.ssh, registered on GitHub for auth + signing),
-#    NOT an HTTPS token. Route every GitHub remote — including https:// ones —
-#    over SSH so a project's clone scheme doesn't matter, and trust github's
-#    host key non-interactively so a fresh container's first push doesn't stall
-#    on a prompt. `gh` is separate: it authenticates from its own config file,
-#    which the host writes via `gh auth login --with-token` with the user's
-#    short-lived token. We must NOT set GH_TOKEN in the env — `gh` would prefer
-#    it over that stored credential (and re-attribute every PR to it).
+# 0. Git transport selection (ADR-027). A connected user's App token is the
+#    primary clone/fetch/push credential over HTTPS; the host writes it into
+#    gh's private config and runs `gh auth setup-git` before agents start. SSH
+#    transport is only the no-GitHub-connection fallback. The SSH key remains
+#    useful in either mode for commit/tag signing.
 # ---------------------------------------------------------------------------
 
-if [ -f "$HOME/.ssh/id_ed25519" ]; then
-  log "routing git GitHub remotes over the uai SSH identity"
-  git config --global url."git@github.com:".insteadOf "https://github.com/"
-  git config --global core.sshCommand "ssh -o StrictHostKeyChecking=accept-new"
+if [ "${UAI_SKIP_GIT_TRANSPORT:-0}" = "1" ]; then
+  # Recovery/connect/disconnect reconciles the current credential immediately
+  # before invoking us. Do not overwrite that live decision with the static
+  # transport marker captured when Compose was first created.
+  log "keeping the reconciled GitHub transport"
+elif [ "${UAI_GIT_TRANSPORT:-anonymous}" = "ssh" ]; then
+  # Remove a prior token-mode reverse rewrite if this container is being
+  # repaired after disconnect, then route canonical HTTPS origins over SSH.
+  /usr/bin/git config --global --unset-all url."https://github.com/".insteadOf \
+    >/dev/null 2>&1 || true
+  /usr/bin/git config --global url."git@github.com:".insteadOf "https://github.com/"
+  /usr/bin/git config --global core.sshCommand "/usr/bin/ssh -o StrictHostKeyChecking=accept-new"
+  log "using SSH as the GitHub transport fallback"
+else
+  # Heal containers created by the old SSH-only policy. Canonical origins are
+  # HTTPS; reverse legacy SSH URLs (including submodules) through gh as well.
+  /usr/bin/git config --global --unset-all url."git@github.com:".insteadOf \
+    >/dev/null 2>&1 || true
+  /usr/bin/git config --global --unset-all core.sshCommand >/dev/null 2>&1 || true
+  /usr/bin/git config --global --replace-all url."https://github.com/".insteadOf \
+    "git@github.com:"
+  /usr/bin/git config --global --add url."https://github.com/".insteadOf \
+    "ssh://git@github.com/"
+  if [ "${UAI_GIT_TRANSPORT:-}" = "https" ]; then
+    log "using the connected GitHub credential for HTTPS Git"
+  else
+    log "using anonymous HTTPS Git for public repositories"
+  fi
 fi
 
 # Signed commits (policy): when the uai SSH identity is present, configure git
 # to SSH-sign every commit + tag with it. The pubkey is registered on GitHub
-# (via `setup-identity`) so commits show as Verified. The same key also carries
-# git push over SSH (configured above).
+# so commits show as Verified. Signing is independent of Git transport.
 if [ -f "$HOME/.ssh/id_ed25519.pub" ]; then
   log "enabling SSH commit signing with the uai identity"
-  git config --global gpg.format ssh
-  git config --global user.signingkey "$HOME/.ssh/id_ed25519.pub"
-  git config --global commit.gpgsign true
-  git config --global tag.gpgsign true
+  /usr/bin/git config --global gpg.format ssh
+  /usr/bin/git config --global user.signingkey "$HOME/.ssh/id_ed25519.pub"
+  /usr/bin/git config --global commit.gpgsign true
+  /usr/bin/git config --global tag.gpgsign true
 fi
 
 # Attribution policy: never co-author with the agents. Claude Code honors

package/lib/agent.ts

@@ -33,6 +33,11 @@ import { getHostTask } from "./runtime-state";
 import { removeTaskIdentity, writeTaskIdentity } from "./ssh";
 import type { TaskDownInput, TaskLaunchInput } from "../src/protocol";
 
+interface TaskUpCredentials {
+  /** Path to the task owner's private, ephemeral Git credential cache. */
+  githubCredentialSocket?: string;
+}
+
 // ---------------------------------------------------------------------------
 // Locate the agent scripts. They ship inside the package, so by default we
 // resolve them relative to this module — which works identically in a repo
@@ -136,11 +141,12 @@ async function runAgent<T extends z.ZodTypeAny>(
   dataSchema: T,
   commandDbPath: string,
   extraEnv: Record<string, string> = {},
+  stdinPayload?: string,
 ): Promise<z.infer<T>> {
   const scriptPath = resolve(agentDir(), scriptName);
 
   const child = spawn(scriptPath, args, {
-    stdio: ["ignore", "pipe", "pipe"],
+    stdio: [stdinPayload === undefined ? "ignore" : "pipe", "pipe", "pipe"],
     env: {
       ...process.env,
       UAI_DB_PATH: commandDbPath,
@@ -151,12 +157,19 @@ async function runAgent<T extends z.ZodTypeAny>(
 
   let stdoutBuf = "";
   let stderrBuf = "";
-  child.stdout.on("data", (chunk) => {
+  child.stdout?.on("data", (chunk) => {
     stdoutBuf += chunk.toString("utf8");
   });
-  child.stderr.on("data", (chunk) => {
+  child.stderr?.on("data", (chunk) => {
     stderrBuf += chunk.toString("utf8");
   });
+  if (stdinPayload !== undefined && child.stdin) {
+    // A script that exits before consuming stdin may close the pipe first.
+    // The process exit/error below is authoritative; do not turn EPIPE into an
+    // unhandled stream error in the host agent.
+    child.stdin.on("error", () => {});
+    child.stdin.end(stdinPayload);
+  }
 
   const exitCode: number = await new Promise((res, rej) => {
     child.on("error", rej);
@@ -267,27 +280,39 @@ export function toolStderrDetail(stderr: string): string {
 // ---------------------------------------------------------------------------
 
 export const agent = {
-  async taskUp(input: TaskLaunchInput): Promise<TaskUpResult> {
+  async taskUp(
+    input: TaskLaunchInput,
+    credentials: TaskUpCredentials = {},
+  ): Promise<TaskUpResult> {
     const commandDbPath = createTaskUpCommandDb(input);
-    // Materialize the creator's per-user SSH key so task-up.sh clones + pushes
-    // as them (ADR-029); null → task-up.sh falls back to the operator identity.
+    // Materialize the creator's per-user SSH key for commit signing and the
+    // explicit no-GitHub-connection transport fallback (ADR-029).
     const identityDir = writeTaskIdentity(input.task.id, input.task.ownerUserId);
-    // Per-(project, key) env var VALUES: each project on the task contributes
-    // its own decrypted values, which go straight into the child ENV (never
-    // args/logs/the compose YAML). task-up.sh already renders a `${KEY:-}`
-    // pass-through for each project's DECLARED keys, so docker interpolates the
-    // value from this child's env at up-time — mirroring CLAUDE_CODE_OAUTH_TOKEN
-    // and secret-blind end to end (ADR-015). On a key collision across projects
-    // the LEAD project (position 0) wins: iterate in DESCENDING position order
-    // so position-0's assignments are applied LAST and overwrite the rest.
-    const extraEnv: Record<string, string> = {};
+    // Per-(project, key) env values must NEVER enter task-up's host process
+    // environment. Besides ordinary app names, projects can declare names such
+    // as BASH_ENV, PATH, GIT_CONFIG_*, or UAI_*; exposing those before the host
+    // clone would let container-owned configuration influence host commands or
+    // read another credential boundary. Send one JSON object over stdin
+    // instead. task-up feeds it directly to Compose as an in-memory override,
+    // so values reach only the task container and are never written to disk.
+    // On a key collision the LEAD project (position 0) wins: iterate in
+    // descending position order so position-0 assignments apply last.
+    const projectEnv: Record<string, string> = {};
     const orderedProjects = [...input.projects].sort(
       (a, b) => b.position - a.position,
     );
     for (const project of orderedProjects) {
-      Object.assign(extraEnv, getDecryptedForProject(project.id));
+      Object.assign(projectEnv, getDecryptedForProject(project.id));
     }
+    const extraEnv: Record<string, string> = {};
     if (identityDir) extraEnv.UAI_TASK_IDENTITY_DIR = identityDir;
+    // Only a non-secret socket path crosses into Bash. The token itself was
+    // seeded over stdin and never enters argv, env, project data, Compose, or
+    // the task container.
+    if (credentials.githubCredentialSocket) {
+      extraEnv.UAI_GITHUB_CREDENTIAL_SOCKET =
+        credentials.githubCredentialSocket;
+    }
     try {
       return await runAgent(
         "task-up.sh",
@@ -295,6 +320,7 @@ export const agent = {
         TaskUpData,
         commandDbPath,
         extraEnv,
+        JSON.stringify(projectEnv),
       );
     } finally {
       removeCommandDb(commandDbPath);