@runuai/host 0.9.10 → 0.9.12

package/db/migrations/0013_github_credential_generations.sql

@@ -0,0 +1,11 @@
+ALTER TABLE `host_github_tokens` ADD `generation` integer DEFAULT 0 NOT NULL;
+--> statement-breakpoint
+CREATE TABLE `host_github_credential_generations` (
+	`user_id` text PRIMARY KEY NOT NULL,
+	`generation` integer DEFAULT 0 NOT NULL,
+	`mutation` text DEFAULT 'set' NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+INSERT INTO `host_github_credential_generations` (`user_id`, `generation`, `mutation`, `updated_at`)
+SELECT `user_id`, 0, 'set', `updated_at` FROM `host_github_tokens`;

package/db/migrations/meta/_journal.json

@@ -92,6 +92,13 @@
       "when": 1779900013000,
       "tag": "0012_agent_session_attach_key",
       "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1786045000000,
+      "tag": "0013_github_credential_generations",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -62,6 +62,11 @@ export type NewHostEventRow = typeof hostEvents.$inferInsert;
 export const githubTokens = sqliteTable("host_github_tokens", {
   userId: text("user_id").primaryKey(),
   installationId: integer("installation_id").notNull(),
+  /** Generation of the cloud binding whose credential this row contains.
+   * Readers trust the token only while it matches the durable mutation fence
+   * below, so a crash between claiming a newer generation and deleting this
+   * row leaves a safely inert old ciphertext rather than a usable old token. */
+  generation: integer("generation").notNull().default(0),
   // ADR-033: holds a long-lived ACCESS token when kind="access", or a refresh
   // token when kind="refresh" (legacy ADR-027). Encrypted at rest either way.
   refreshTokenCt: blob("refresh_token_ct").notNull(),
@@ -75,6 +80,19 @@ export const githubTokens = sqliteTable("host_github_tokens", {
 export type GithubToken = typeof githubTokens.$inferSelect;
 export type NewGithubToken = typeof githubTokens.$inferInsert;
 
+// Durable monotonic tombstone for GitHub credential mutations. Kept separate
+// from the token row so a disconnect can reject a delayed older connect even
+// after the encrypted credential itself has been deleted.
+export const githubCredentialGenerations = sqliteTable(
+  "host_github_credential_generations",
+  {
+    userId: text("user_id").primaryKey(),
+    generation: integer("generation").notNull().default(0),
+    mutation: text("mutation").notNull().default("set"),
+    updatedAt: integer("updated_at").notNull(),
+  },
+);
+
 // Per-user ed25519 SSH key (ADR-029). Generated ON the host; the private key
 // lives encrypted at rest with the host master key (same secret-blind pattern
 // as host_github_tokens — ADR-015). The cloud only ever sees `public_key`,

package/images/standard/container/code-server-settings.json

@@ -9,28 +9,55 @@
   "workbench.welcomePage.walkthroughs.openOnInstall": false,
   "window.commandCenter": false,
   "chat.commandCenter.enabled": false,
+  "chat.viewSessions.enabled": false,
+  "chat.disableAIFeatures": true,
   "update.mode": "none",
   "extensions.autoCheckUpdates": false,
   "extensions.autoUpdate": false,
   "git.openRepositoryInParentFolders": "always",
-  "workbench.activityBar.location": "top",
-  "chat.viewSessions.enabled": false,
   "workbench.secondarySideBar.defaultVisibility": "hidden",
+
+  "//4": "Colour theme. Overwritten at FIRST init by uai-init when the task",
+  "//5": "carries UAI_EDITOR_THEME (ADR-091); this value is the fallback for",
+  "//6": "tasks created before that shipped, or created outside a browser.",
   "workbench.colorTheme": "Dark 2026",
 
-  "//4": "Workspace Trust — every task runs in an isolated container off the",
-  "//5": "user's own repos. The 'do you trust this folder?' prompt is pure",
-  "//6": "friction here; the user already trusts their code and the container",
-  "//7": "is the security boundary.",
+  "//7": "An editor, not an IDE (ADR-092). This pane is one of three in a",
+  "//8": "task's right panel and is often half a screen wide, so every bar it",
+  "//9": "does not need is width the code does. Cut here is chrome only: the",
+  "//10": "status bar, the layout buttons, the menu bar, the empty-editor",
+  "//11": "watermark, Open Editors, the minimap and the terminal's chat hint.",
+  "//12": "Breadcrumbs STAY: with the status bar gone they are the only thing",
+  "//13": "naming the path, and a tab reading 'route.ts' is worth little in a",
+  "//14": "repo with eleven of them.",
+  "workbench.statusBar.visible": false,
+  "workbench.layoutControl.enabled": false,
+  "window.menuBarVisibility": "hidden",
+  "workbench.editor.empty.hint": "hidden",
+  "explorer.openEditors.visible": 0,
+  "editor.minimap.enabled": false,
+  "terminal.integrated.initialHint": false,
+
+  "//15": "Hide the activity bar and its custom title strip. Explorer stays",
+  "//16": "open; the Editor pane's own toolbar provides the pointer route to",
+  "//17": "Terminal. Individual pins still live in the BROWSER's IndexedDB; the",
+  "//18": "guarded migration keeps the requested containers ready if a user",
+  "//19": "later restores the bar.",
+  "workbench.activityBar.location": "hidden",
+
+  "//22": "Workspace Trust — every task runs in an isolated container off the",
+  "//23": "user's own repos. The 'do you trust this folder?' prompt is pure",
+  "//24": "friction here; the user already trusts their code and the container",
+  "//25": "is the security boundary.",
   "security.workspace.trust.enabled": false,
 
-  "//8": "Port forwarding — code-server's own auto-forward / 'Open in Browser'",
-  "//9": "popup can't reach anything useful here: dev servers are exposed",
-  "//10": "through uai's preview tunnel (ADR-025), not code-server's forwarder.",
-  "//11": "Disable it so the popup doesn't mislead.",
+  "//26": "Port forwarding — code-server's own auto-forward / 'Open in Browser'",
+  "//27": "popup can't reach anything useful here: dev servers are exposed",
+  "//28": "through uai's preview tunnel (ADR-025), not code-server's forwarder.",
+  "//29": "Disable it so the popup doesn't mislead.",
   "remote.autoForwardPorts": false,
   "remote.restoreForwardedPorts": false,
 
-  "//12": "Integrated terminal uses zsh + oh-my-zsh (the node login shell).",
+  "//30": "Integrated terminal uses zsh + oh-my-zsh (the node login shell).",
   "terminal.integrated.defaultProfile.linux": "zsh"
 }

package/images/standard/container/uai-init

@@ -219,11 +219,41 @@ cs_source_seed="$(dirname "${BASH_SOURCE[0]}")/code-server-settings.json"
 if [ ! -f "$cs_seed" ] && [ -f "$cs_source_seed" ]; then
   cs_seed="$cs_source_seed"
 fi
+
+# ADR-091: seed the Editor pane in the palette the task was created from.
+# UAI_EDITOR_THEME carries a VS Code theme LABEL ("Quiet Light"), already
+# resolved cloud-side from the theme registry — the container never maps a Uai
+# palette id and never sees a raw user string. Unset is the normal state for a
+# task created before this shipped or outside a browser; the seed's own baked
+# default then stands.
+#
+# Applied ONLY while seeding. An existing settings.json is still left entirely
+# alone, so a user's own editor tweaks survive a restart — which is also why
+# changing the app's palette later does not re-theme an already-created task
+# (docs/theming.md). If jq is missing or the filter fails, fall through to the
+# plain copy: a themed editor is worth less than an editor that starts.
+seed_code_server_settings() {
+  local seed="$1" dest="$2" theme="${UAI_EDITOR_THEME:-}"
+  if [ -n "$theme" ] && command -v jq >/dev/null 2>&1; then
+    if jq --arg theme "$theme" '.["workbench.colorTheme"] = $theme' \
+      "$seed" >"$dest.tmp" 2>/dev/null && [ -s "$dest.tmp" ]; then
+      mv "$dest.tmp" "$dest"
+      log "seeded code-server settings (theme: $theme)"
+      return 0
+    fi
+    rm -f "$dest.tmp"
+    log "warning: could not apply UAI_EDITOR_THEME=$theme; using image default"
+  fi
+  cp "$seed" "$dest" || return 1
+  log "seeded code-server settings"
+}
+
 if [ ! -f "$cs_user_dir/settings.json" ]; then
   if [ ! -f "$cs_seed" ]; then
     log "warning: code-server settings seed missing at $cs_seed"
-  elif mkdir -p "$cs_user_dir" && cp "$cs_seed" "$cs_user_dir/settings.json"; then
-    log "seeded code-server settings"
+  elif mkdir -p "$cs_user_dir" &&
+    seed_code_server_settings "$cs_seed" "$cs_user_dir/settings.json"; then
+    :
   else
     log "warning: could not seed code-server settings at $cs_user_dir/settings.json"
   fi
@@ -238,6 +268,7 @@ else
     --disable-workspace-trust \
     --auth none \
     --disable-telemetry \
+    --disable-update-check \
     --bind-addr 0.0.0.0:8080 \
     "$editor_root" \
     >/tmp/code-server.log 2>&1 &

package/lib/env.ts

@@ -22,9 +22,14 @@ const schema = z.object({
   UAI_HOST_ID: z.string().min(1).optional(),
   // Host master key file (ADR-027) — 32 bytes, AES-256-GCM for the host
   // secret store. Defaults to $UAI_DATA_DIR/host-master.key; generated on
-  // first use. Optional transitional GitHub PAT for unconnected users.
+  // first use.
   UAI_HOST_KEY_FILE: z.string().min(1).optional(),
+  // Transitional single-user GitHub PAT, for the one user who has not
+  // connected GitHub. Inert without UAI_GH_PAT_FALLBACK_USER_ID: the PAT is a
+  // host-wide credential, so it may only be injected into tasks owned by the
+  // user it belongs to. See setupTaskGithub().
   UAI_GH_PAT_FALLBACK: z.string().min(1).optional(),
+  UAI_GH_PAT_FALLBACK_USER_ID: z.string().min(1).optional(),
   UAI_WORKSPACE_ROOT: z.string().min(1).default("~/.uai"),
   // Crash reporting (ADR-071, docs/observability.md). Default-ON for
   // installed hosts via the DSN baked into lib/obs.ts; UAI_SENTRY_DSN