@runuai/host 0.9.1 → 0.9.2

package/lib/orchestrator.ts

@@ -35,7 +35,7 @@ import {
 } from "./agents/types";
 import { ACTIVE_STATUSES } from "./task-status";
 import { getHostTask, upsertHostTask } from "./runtime-state";
-import { clearRefresh, setupTaskGithub } from "./github-tokens";
+import { clearRefresh, reconcileTaskGitAuth } from "./github-tokens";
 import { ensureTaskSshIdentity, setupTaskGitIdentity } from "./git-identity";
 import { dockerCli } from "./docker-exec";
 import {
@@ -1362,27 +1362,31 @@ export class Orchestrator {
     const initialRoster = [...channel.roster];
 
     // Set the task creator's git author identity in the container (ADR-029).
-    // The SSH key itself is installed earlier by task-up.sh (host clone +
-    // container), using the creator's per-user key. Best-effort. Awaited but
+    // The optional SSH signing/fallback key is installed earlier by
+    // task-up.sh using the creator's per-user key. Best-effort. Awaited but
     // async (docker exec via dockerCli) so it doesn't block the event loop —
     // this runs on every channel ensure, including each post-restart reconnect.
     await setupTaskGitIdentity(channel.taskId, task.ownerName, task.ownerEmail);
     if (!this.isActiveChannel(channel)) return false;
 
-    // GitHub auth for `gh` (ADR-027): mint + inject the access token and
-    // (re)start its refresh schedule. Done here — not only at task-up — so it
-    // survives a host restart: recovery recreates the channel and re-runs
-    // ensureSessions, whereas the in-memory refresh timer from the original
-    // task-up is gone. Guarded + best-effort + non-blocking; the token lands
-    // before the agents (spawned just below) make their first `gh` call.
+    // GitHub auth for both `gh` and HTTPS Git (ADR-027): inject the token,
+    // configure gh's credential helper, and (re)start refresh. Await the
+    // serialized reconcile so agents cannot race their first fetch/push after
+    // task creation, reconnect, or host recovery.
     if (task.ownerUserId) {
-      void setupTaskGithub(channel.taskId, task.ownerUserId);
+      await reconcileTaskGitAuth(channel.taskId, task.ownerUserId);
     }
 
-    // SSH push identity + its git config, re-asserted like the gh token above
-    // (one-shot at task-up proved fragile — recreated containers lose the key
-    // silently; live 2026-07-21). Best-effort + non-blocking.
-    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId);
+    // SSH signing identity, re-asserted independently of transport. Connected
+    // users still push through gh over HTTPS; disconnected users select the
+    // SSH transport fallback inside the reconcile above.
+    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId).catch((err) =>
+      console.warn(
+        `[ssh] task ${channel.taskId}: signing identity reconciliation failed: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      ),
+    );
 
     // ADR-047: install any package skills (native Claude Agent Skills) into the
     // container BEFORE spawning agents, so they're discoverable on the first
@@ -1579,7 +1583,7 @@ export class Orchestrator {
     // Cancel any armed auto-retry chain so this manual attempt runs fresh
     // (setup's duplicate-chain guard would otherwise no-op it).
     clearRefresh(taskId);
-    const ok = await setupTaskGithub(taskId, owner);
+    const ok = await reconcileTaskGitAuth(taskId, owner);
     this.emitSystemNote(
       taskId,
       ok
@@ -2772,8 +2776,9 @@ export function buildSystemPreamble(
       ? [
           "## Commit policy",
           "",
-          "Commits are SSH-signed automatically (git is configured for it) — do",
-          "not disable or override signing. Do NOT add any `Co-Authored-By:`",
+          "When this task has an optional SSH signing key configured, Git signs",
+          "commits automatically; do not disable or override it. Do NOT add any",
+          "`Co-Authored-By:`",
           "trailers to commit messages, and do NOT add 'Generated with …' or any",
           "tool/agent attribution footer to commit messages or PR/issue bodies.",
           "Write commit messages and PR descriptions plainly, as the author, with",
@@ -3128,9 +3133,21 @@ async function recoverOneTask(
     // ~8h later. Cheap with the per-user access-token cache — one exchange
     // per user, every task re-injects from it. Best-effort.
     if (task.ownerUserId) {
-      void setupTaskGithub(task.taskId, task.ownerUserId);
+      void reconcileTaskGitAuth(task.taskId, task.ownerUserId).catch((err) =>
+        console.warn(
+          `[github] task ${task.taskId}: running recovery reconciliation failed: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        ),
+      );
     }
-    void ensureTaskSshIdentity(task.taskId, task.ownerUserId);
+    void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+      console.warn(
+        `[ssh] task ${task.taskId}: running recovery reconciliation failed: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      ),
+    );
     return true;
   }
 
@@ -3152,11 +3169,35 @@ async function recoverOneTask(
   // possibly host-uid-owned 0600 files Codex can't read. Failure is surfaced
   // by the inject itself and must not abort the task's recovery.
   await injectCodexIntoContainer(containerName);
+  // Establish the task owner's GitHub transport BEFORE uai-init performs any
+  // dependency-network work. This matters for package manifests that refer to
+  // private GitHub repositories: gh's credential helper must already be live
+  // when pnpm/npm/uv/cargo resolves them. Reconciliation is best-effort, just
+  // like the prior post-init call, but it is now ordered rather than raced.
+  if (task.ownerUserId) {
+    try {
+      await reconcileTaskGitAuth(task.taskId, task.ownerUserId);
+    } catch (err) {
+      console.warn(
+        `[orchestrator] recovery: ${task.taskId} GitHub auth setup failed before uai-init: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
+  }
   // uai-init reinstalls workspace deps (pnpm/npm install) — minutes on a big
   // repo. dockerCli's 30s default would SIGKILL it mid-install.
-  if (
-    !(await dockerExec(containerName, ["/usr/local/bin/uai-init"], 10 * 60_000))
-  ) {
+  const initResult = await dockerCli(
+    [
+      "exec",
+      "-e",
+      "UAI_SKIP_GIT_TRANSPORT=1",
+      containerName,
+      "/usr/local/bin/uai-init",
+    ],
+    { timeoutMs: 10 * 60_000 },
+  );
+  if (initResult.status !== 0) {
     console.warn(
       `[orchestrator] recovery: ${task.taskId} uai-init failed; container is up but Editor may be down`,
     );
@@ -3165,12 +3206,13 @@ async function recoverOneTask(
   db_setRuntime(task.taskId, {
     codeServerPort: port,
   });
-  // Same gh re-establish as the running branch — the restarted container's gh
-  // config is whatever it held when it exited.
-  if (task.ownerUserId) {
-    void setupTaskGithub(task.taskId, task.ownerUserId);
-  }
-  void ensureTaskSshIdentity(task.taskId, task.ownerUserId);
+  void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+    console.warn(
+      `[ssh] task ${task.taskId}: resumed signing identity reconciliation failed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    ),
+  );
   console.log(
     `[orchestrator] recovery: ${task.taskId} resumed (port ${port ?? "?"})`,
   );

package/lib/repo-clone.ts

@@ -1,33 +1,18 @@
 /**
- * Bare-mirror clone helper.
+ * Retired bare-mirror host command.
  *
- * Used by project creation. A project is a single repo (ADR-022), bare-
- * mirrored into `<projectDir>/repo.git/` — one mirror per project, no repoId.
- * Per-task worktrees pick it up from there (see scripts/agent/task-up.sh).
+ * Project creation stores metadata only. Repository access happens at
+ * task-up, after the task creator and host are known, using that user's
+ * connected GitHub credential or their explicit SSH fallback. This legacy
+ * protocol command cannot express either principal, so running Git here would
+ * necessarily risk borrowing the host operator's ambient credential.
  *
- * Uses the same init + remote-add + refspec + fetch pattern as `task-up`
- * instead of `git clone --bare`. Plain `git clone --bare` copies upstream
- * heads straight into `refs/heads/*` and never populates
- * `refs/remotes/origin/*`, so a later `git worktree add ...
- * origin/<defaultBranch>` would fail with "invalid reference". `task-up`
- * self-heals an existing mirror's refspec on subsequent runs, but only
- * if the first task-up runs online — initialising the mirror correctly
- * here closes the offline-first-task gap.
- *
- * Sync in v0.1 — the spec doesn't pin sync-vs-async, and async pipelines
- * add a state machine we don't need until the UI shows progress.
- *
- * Idempotent: if the bare mirror already exists, (re-)assert the refspec
- * and treat the repo as ready without re-fetching. Healing an existing
- * mirror's refspec is cheap and protects against a mirror created before
- * this helper learned the right refspec.
+ * Keep the command-shaped response for rolling-version compatibility, but
+ * fail closed without touching the filesystem or network. A future preflight
+ * needs a user/host-aware protocol of its own; see
+ * docs/repo-access-preflight.md.
  */
 
-import { spawnSync } from "node:child_process";
-import { existsSync, rmSync, statSync } from "node:fs";
-import { mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-
 import { projectRepoMirror } from "./env";
 
 export interface CloneRepoInput {
@@ -42,86 +27,12 @@ export interface CloneRepoResult {
   absolutePath: string;
 }
 
-const REMOTE_REFSPEC = "+refs/heads/*:refs/remotes/origin/*";
-
 export function cloneRepo(input: CloneRepoInput): CloneRepoResult {
   const target = projectRepoMirror(input.projectId);
-
-  if (existsSync(target) && statSync(target).isDirectory()) {
-    // Heal an existing mirror's refspec — no-op when already correct.
-    const setRefspec = git(target, [
-      "config",
-      "remote.origin.fetch",
-      REMOTE_REFSPEC,
-    ]);
-    if (setRefspec.status !== 0) {
-      return errorResult(target, setRefspec, "git config remote.origin.fetch");
-    }
-    return { status: "ready", absolutePath: target };
-  }
-
-  mkdirSync(dirname(target), { recursive: true });
-
-  const init = spawnSync("git", ["init", "--bare", target], { encoding: "utf8" });
-  if (init.status !== 0) {
-    return errorResult(target, init, "git init --bare");
-  }
-
-  const remote = git(target, ["remote", "add", "origin", input.url]);
-  if (remote.status !== 0) {
-    cleanup(target);
-    return errorResult(target, remote, "git remote add origin");
-  }
-
-  const refspec = git(target, [
-    "config",
-    "remote.origin.fetch",
-    REMOTE_REFSPEC,
-  ]);
-  if (refspec.status !== 0) {
-    cleanup(target);
-    return errorResult(target, refspec, "git config remote.origin.fetch");
-  }
-
-  const fetch = git(target, ["fetch", "origin"]);
-  if (fetch.status !== 0) {
-    // A failed initial fetch leaves a half-built mirror that task-up
-    // would later mistake for a healthy one. Tear it down so the next
-    // retry starts clean.
-    cleanup(target);
-    return errorResult(target, fetch, "git fetch origin");
-  }
-
-  return { status: "ready", absolutePath: target };
-}
-
-function git(
-  cwd: string,
-  args: string[],
-): ReturnType<typeof spawnSync> {
-  return spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8" });
-}
-
-function cleanup(target: string): void {
-  try {
-    rmSync(target, { recursive: true, force: true });
-  } catch {
-    // Best-effort: the caller will surface the original error.
-  }
-}
-
-function errorResult(
-  target: string,
-  result: ReturnType<typeof spawnSync>,
-  step: string,
-): CloneRepoResult {
   return {
     status: "error",
     absolutePath: target,
-    error: (
-      `${step}: ${result.stderr || result.stdout || "failed"}`
-    )
-      .trim()
-      .slice(0, 1024),
+    error:
+      "repo.clone is retired because it has no task creator credential; start a task to perform the user-scoped repository fetch",
   };
 }

package/lib/ssh.ts

@@ -143,11 +143,12 @@ export function keyPairForUser(
   };
 }
 
-// --- per-task on-disk identity (host clone + container, ADR-029) -------------
+// --- per-task on-disk identity (optional SSH fallback + signing, ADR-029) -----
 //
-// task-up.sh installs the creator's key into the container (and uses it for the
-// host clone). The cloud relays ssh.key.get/ensure/delete for the Account card
-// via the store functions above; there is no separate docker-exec injection.
+// task-up.sh uses the creator's key for host Git only when GitHub is not
+// connected, and installs it in the container for signing (plus that same
+// fallback). The cloud relays ssh.key.get/ensure/delete for the Account card
+// via the store functions above.
 
 function taskIdentityDir(taskId: string): string {
   return resolve(env.dataDir, "identity", "tasks", taskId);
@@ -155,10 +156,12 @@ function taskIdentityDir(taskId: string): string {
 
 /**
  * Materialize the task creator's keypair to a per-task on-disk identity that
- * task-up.sh uses for BOTH the host-side bare clone and the container copy
- * (ADR-029) — so a task clones + pushes as its creator, not the operator.
- * Returns the dir, or null when the creator has no key on this host (task-up.sh
- * then falls back to the operator identity from `pnpm setup-identity`). The
+ * task-up.sh uses for the disconnected user's host-side SSH fallback and the
+ * container's optional signing/fallback identity (ADR-029). Connected users
+ * clone + push with their GitHub App user token over HTTPS instead.
+ * Returns the dir, or null when the creator has no key on this host. A task
+ * never borrows the host operator's identity: without a connected GitHub
+ * credential, SSH transport is available only through this owner's key. The
  * decrypted key lives only on the trusted host (ADR-015) and is removed right
  * after task-up — see {@link removeTaskIdentity}.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/scripts/agent/_common.sh

@@ -204,6 +204,69 @@ UAI_CURRENT_STEP=""
 UAI_ERROR_CODE="UNKNOWN"
 UAI_TASK_ID=""
 UAI_LOCK_HELD=""
+UAI_PROJECT_LOCK_PATH=""
+UAI_PROJECT_LOCK_TOKEN=""
+
+# Shared project mirrors are mutated by task-up and task-down across different
+# task processes. A task-row lock cannot serialize those operations, so use a
+# portable atomic directory lock (macOS does not ship `flock`). Never reclaim
+# a stale lock automatically: checking a PID and unlinking a fixed path creates
+# a TOCTOU window where a new owner's lock can be deleted. A stale directory is
+# deliberately surfaced for an operator to inspect and remove.
+acquire_project_lock() {
+  local projects_root="$1" project_id="$2"
+  local project_parent="$projects_root/$project_id"
+  local lock_path="$project_parent/.uai-repo.lock"
+  local owner_pid attempts=0
+  mkdir -p "$project_parent"
+  while ! mkdir "$lock_path" 2>/dev/null; do
+    if [ ! -d "$lock_path" ]; then
+      emit_err "FETCH_FAILED" \
+        "project $project_id has an obsolete or invalid repository lock at $lock_path. Confirm no task-up/task-down process is active, remove that lock manually, then retry." \
+        "acquire project cache lock"
+    fi
+    owner_pid=$(cat "$lock_path/pid" 2>/dev/null || true)
+    case "$owner_pid" in
+      ''|*[!0-9]*) ;;
+      *)
+        if ! kill -0 "$owner_pid" 2>/dev/null; then
+          emit_err "FETCH_FAILED" \
+            "project $project_id has a stale repository lock at $lock_path (owner pid $owner_pid). Confirm no task-up/task-down process is active, remove that lock directory manually, then retry." \
+            "acquire project cache lock"
+        fi
+        ;;
+    esac
+    attempts=$((attempts + 1))
+    if [ "$attempts" -ge 300 ]; then
+      emit_err "FETCH_FAILED" \
+        "project $project_id is busy in another host operation, or has an incomplete lock at $lock_path. Confirm no task-up/task-down process is active; if none is, remove that lock directory manually, then retry." \
+        "acquire project cache lock"
+    fi
+    sleep 0.1
+  done
+  UAI_PROJECT_LOCK_TOKEN="$$:${RANDOM:-0}"
+  printf '%s\n' "$$" > "$lock_path/pid"
+  printf '%s\n' "$UAI_PROJECT_LOCK_TOKEN" > "$lock_path/owner"
+  UAI_PROJECT_LOCK_PATH="$lock_path"
+}
+
+release_project_lock() {
+  [ -n "$UAI_PROJECT_LOCK_PATH" ] || return 0
+  local owner
+  owner=$(cat "$UAI_PROJECT_LOCK_PATH/owner" 2>/dev/null || true)
+  if [ -n "$UAI_PROJECT_LOCK_TOKEN" ] \
+     && [ "$owner" = "$UAI_PROJECT_LOCK_TOKEN" ]; then
+    rm -f "$UAI_PROJECT_LOCK_PATH/pid" "$UAI_PROJECT_LOCK_PATH/owner" \
+      2>/dev/null || true
+    rmdir "$UAI_PROJECT_LOCK_PATH" 2>/dev/null || true
+  fi
+  UAI_PROJECT_LOCK_PATH=""
+  UAI_PROJECT_LOCK_TOKEN=""
+}
+
+_uai_on_exit() {
+  release_project_lock || true
+}
 
 step() {
   UAI_ERROR_CODE="$1"
@@ -230,6 +293,7 @@ _uai_on_err() {
 
 setup_err_trap() {
   trap _uai_on_err ERR
+  trap _uai_on_exit EXIT
 }
 
 # ---------------------------------------------------------------------------
@@ -246,3 +310,153 @@ compose_project_for_task()    { printf 'task-%s' "$(_uai_lower "$1")"; }
 # ever do scale, swap to discovering the container name via the
 # `com.docker.compose.project` + `com.docker.compose.service` labels.
 app_container_for_task()      { printf 'task-%s-app-1' "$(_uai_lower "$1")"; }
+
+# Canonicalise every GitHub URL shape to credential-free HTTPS. task-up selects
+# the credential per task: the creator's connected GitHub token is primary;
+# SSH is a fallback only when that user has no GitHub connection on this host.
+# Keeping the stored/shared origin transport-neutral avoids binding a project
+# to whichever user's credential happened to touch its mirror first.
+#
+# Mirrors normalizeRepoUrl() in lib/github/repo-url.ts — keep the two in step.
+# Non-GitHub remotes are returned untouched: we only know how to speak for
+# GitHub, and Uai supports any git remote.
+#
+# Bash 3.2 (macOS /bin/bash): no ${var,,}, no associative arrays.
+normalize_github_repo_url() {
+  local input="$1" url after_scheme authority host_port host host_lc
+  local path owner rest repo repo_lc left
+  url=$(printf '%s' "$input" | sed \
+    -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+  if [ "${url#*://}" != "$url" ]; then
+    after_scheme=${url#*://}
+    authority=${after_scheme%%/*}
+    [ "$after_scheme" != "$authority" ] || {
+      printf '%s' "$url"
+      return
+    }
+    host_port=${authority##*@}
+    host=${host_port%%:*}
+    host_lc=$(printf '%s' "$host" | tr '[:upper:]' '[:lower:]')
+    case "$host_lc" in
+      github.com|www.github.com) path=${after_scheme#*/} ;;
+      *)
+        printf '%s' "$url"
+        return
+        ;;
+    esac
+  elif [ "${url#*:}" != "$url" ]; then
+    left=${url%%:*}
+    host=${left##*@}
+    host_lc=$(printf '%s' "$host" | tr '[:upper:]' '[:lower:]')
+    case "$host_lc" in
+      github.com|www.github.com) path=${url#*:} ;;
+      *)
+        printf '%s' "$url"
+        return
+        ;;
+    esac
+  else
+    case "$url" in
+      */*/*|/*)
+        printf '%s' "$url"
+        return
+        ;;
+      */*) path=$url ;;
+      *)
+        printf '%s' "$url"
+        return
+        ;;
+    esac
+  fi
+
+  # Keep only owner/repo. Browser URLs can include /tree/branch/path, and a
+  # pasted clone URL can carry both `.git` and a trailing slash.
+  path=${path%%\?*}
+  path=${path%%\#*}
+  path=$(printf '%s' "$path" | sed -e 's#/*$##')
+  owner=${path%%/*}
+  rest=${path#*/}
+  if [ -z "$owner" ] || [ "$rest" = "$path" ]; then
+    printf '%s' "$url"
+    return
+  fi
+  repo=${rest%%/*}
+  repo=${repo%%\?*}
+  repo=${repo%%\#*}
+  repo_lc=$(printf '%s' "$repo" | tr '[:upper:]' '[:lower:]')
+  case "$repo_lc" in
+    *.git) repo=${repo%????} ;;
+  esac
+  if [ -z "$repo" ]; then
+    printf '%s' "$url"
+    return
+  fi
+  printf 'https://github.com/%s/%s.git' "$owner" "$repo"
+}
+
+# True for a reference whose explicit authority is github.com, even if its
+# path is malformed. Callers use this to fail closed rather than handing a
+# GitHub-looking URL to a generic Git command with ambient credentials.
+is_github_hosted_url() {
+  local input="$1" url after_scheme authority host_port host host_lc left
+  url=$(printf '%s' "$input" | sed \
+    -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+  if [ "${url#*://}" != "$url" ]; then
+    after_scheme=${url#*://}
+    authority=${after_scheme%%/*}
+    host_port=${authority##*@}
+    host=${host_port%%:*}
+  elif [ "${url#*:}" != "$url" ]; then
+    left=${url%%:*}
+    host=${left##*@}
+  else
+    case "$url" in
+      */*/*|/*|*://*) return 1 ;;
+      */*) return 0 ;;
+      *) return 1 ;;
+    esac
+  fi
+  host_lc=$(printf '%s' "$host" | tr '[:upper:]' '[:lower:]')
+  case "$host_lc" in
+    github.com|www.github.com) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# HTTPS spelling of a github.com repository. Empty for non-GitHub remotes.
+github_https_repo_url() {
+  local https_url rest owner repo
+  https_url=$(normalize_github_repo_url "$1")
+  case "$https_url" in
+    https://github.com/*)
+      rest=${https_url#https://github.com/}
+      owner=${rest%%/*}
+      repo=${rest#*/}
+      if [ "$repo" = "$rest" ]; then
+        printf ''
+      else
+        case "$owner/$repo" in
+          /*|*/|*/*/*) printf '' ;;
+          *) printf '%s' "$https_url" ;;
+        esac
+      fi
+      ;;
+    *)
+      printf ''
+      ;;
+  esac
+}
+
+# SSH spelling used only when the task owner has not connected GitHub.
+github_ssh_repo_url() {
+  local https_url
+  https_url=$(github_https_repo_url "$1")
+  case "$https_url" in
+    https://github.com/*)
+      printf 'git@github.com:%s' "${https_url#https://github.com/}"
+      ;;
+    *)
+      printf ''
+      ;;
+  esac
+}