@runuai/host 0.9.100 → 0.9.102

package/lib/agents/cursor.ts

@@ -192,7 +192,12 @@ export class CursorSession implements AgentSession {
     this.agentEnv = args.agentEnv ?? {};
     this.spawner =
       args.spawner ?? ((request) => spawnEnvironmentProcess(this.environment, request));
-    this.apiKey = args.apiKey ?? process.env.CURSOR_API_KEY ?? "";
+    // An account-bound key (ADR-076/ADR-131 D3, injected through agentEnv)
+    // beats the host's own .env.local key — a workspace's Cursor account must
+    // never fall through to the operator's, and on a shared host the ambient
+    // key is usually absent anyway.
+    this.apiKey =
+      args.apiKey ?? this.agentEnv.CURSOR_API_KEY ?? process.env.CURSOR_API_KEY ?? "";
   }
 
   onEvent(handler: AgentEventHandler): () => void {

package/lib/agents/registry.ts

@@ -72,6 +72,21 @@ const adapters = new Map<string, RegisteredAdapter>();
 /** Listeners fired after any registry mutation (manual re-advertise hook). */
 const changeListeners = new Set<() => void>();
 
+/**
+ * ADR-131 D3: a second source of "usable on this host" beyond the adapter's
+ * own `available()`, which only sees the host's default credential. The host
+ * agent installs the engine-account store here so a kind with a stored
+ * (workspace- or host-scoped) account is advertised even when the owner never
+ * signed in to it. Installed by main.ts; absent in unit tests.
+ */
+let advertisementFallback: (kind: string) => boolean = () => false;
+
+export function setAdvertisementFallback(
+  fallback: ((kind: string) => boolean) | null,
+): void {
+  advertisementFallback = fallback ?? (() => false);
+}
+
 /**
  * Register (or replace) an adapter for a kind. Called at module load by the
  * adapter modules. Replacing is allowed so a later import wins deterministically.
@@ -107,7 +122,10 @@ export function supportsExecutionProfile(kind: string, profileId: string): boole
  */
 export function capabilities(): AgentKindCapability[] {
   return list()
-    .filter((adapter) => adapter.available?.() ?? true)
+    .filter(
+      (adapter) =>
+        (adapter.available?.() ?? true) || advertisementFallback(adapter.kind),
+    )
     .map((adapter) => {
     const out: AgentKindCapability = {
       kind: adapter.kind,
@@ -143,4 +161,5 @@ export function onChange(listener: () => void): () => void {
 export function reset(): void {
   adapters.clear();
   changeListeners.clear();
+  advertisementFallback = () => false;
 }

package/lib/engine-accounts.ts

@@ -64,6 +64,11 @@ interface KindDescriptor {
 
 const KINDS: Record<string, KindDescriptor> = {
   claude: { authKind: "env" },
+  // API-key engines: an extra account is one env var. The default slot stays
+  // the host's own `.env.local` key (the adapters read process.env), so these
+  // never synthesize a default — `defaultAvailable` is false for them.
+  grok: { authKind: "env" },
+  cursor: { authKind: "env" },
   codex: {
     authKind: "config-dir",
     defaultHostDir: (owner) => join(owner, ".codex"),
@@ -82,6 +87,39 @@ const KINDS: Record<string, KindDescriptor> = {
   },
 };
 
+/** The env var an extra API-key account injects, per kind (the same vars the
+ *  adapters read for the host's own key). Claude is special-cased in
+ *  `addEngineAccount` (token vs. key); Codex writes an auth.json instead. */
+const API_KEY_ENV_VARS: Record<string, string> = {
+  grok: "XAI_API_KEY",
+  cursor: "CURSOR_API_KEY",
+};
+const API_KEY_ENGINE_LABELS: Record<string, string> = {
+  grok: "Grok",
+  cursor: "Cursor",
+};
+
+/**
+ * Whether ANY stored account exists for `kind`, in any scope. The
+ * advertisement fallback (ADR-131 D3): an adapter's `available()` only sees
+ * the host's own credential, so a shared host whose owner never signed in to
+ * Codex hid the kind from every workspace that had connected its own account
+ * — the cloud then refused the crew with "host does not support agent kind".
+ * A stored account is a usable credential; the cloud scopes it per caller.
+ */
+export function hasStoredEngineAccounts(kind: string): boolean {
+  if (!KINDS[kind]) return false;
+  try {
+    return getDb()
+      .select()
+      .from(schema.engineAccounts)
+      .all()
+      .some((row) => row.kind === kind);
+  } catch {
+    return false;
+  }
+}
+
 /** Public (secret-free) account descriptor for the host UI. */
 export interface EngineAccountInfo {
   id: string;
@@ -672,6 +710,28 @@ export function addEngineAccount(
     return { ok: true, message: `Added Claude account "${trimmedLabel}".`, id };
   }
 
+  const envKeyVar = API_KEY_ENV_VARS[kind];
+  if (envKeyVar) {
+    getDb()
+      .insert(schema.engineAccounts)
+      .values({
+        id,
+        kind,
+        label: trimmedLabel,
+        authKind: "env",
+        secretEnc: packSecret(JSON.stringify({ [envKeyVar]: secret })),
+        configDir: null,
+        createdAt: now,
+        scope,
+      })
+      .run();
+    return {
+      ok: true,
+      message: `Added ${API_KEY_ENGINE_LABELS[kind] ?? kind} account "${trimmedLabel}".`,
+      id,
+    };
+  }
+
   if (kind === "codex") {
     const d = KINDS.codex as KindDescriptor;
     const hostDir = (d.extraHostDir as (o: string, i: string) => string)(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.100",
+  "version": "0.9.102",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -132,6 +132,7 @@ import { newId } from "../lib/ulid";
 import {
   capabilities as agentKindCapabilities,
   onChange as onRegistryChange,
+  setAdvertisementFallback,
 } from "../lib/agents/registry";
 import { canAdvertiseTypedSecretaryDispatch } from "../lib/agents/mode";
 import {
@@ -150,7 +151,10 @@ import {
   patchHostConfig,
   type HostConfigResult,
 } from "../lib/host-config";
-import { listEngineAccountsAllScopes } from "../lib/engine-accounts";
+import {
+  hasStoredEngineAccounts,
+  listEngineAccountsAllScopes,
+} from "../lib/engine-accounts";
 import { createEngineConnectManager } from "../lib/engine-connect";
 import { createEngineLoginManager } from "../lib/engine-login";
 import {
@@ -225,6 +229,7 @@ import {
   type TaskDownInput,
   type TaskLaunchInput,
   type FilesOpInput,
+  engineAccountScopeFromWire,
 } from "./protocol";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -697,7 +702,7 @@ function engineCatalogCapabilities(): EngineCatalogCapability[] {
 /** ADR-116: the labeled-accounts advertisement — bounded, labels-only. */
 function engineAccountSummaries(): EngineAccountSummary[] {
   const summaries: EngineAccountSummary[] = [];
-  for (const kind of ["claude", "codex", "opencode"] as const) {
+  for (const kind of ["claude", "codex", "grok", "cursor", "opencode"] as const) {
     try {
       // ADR-131 D3: every scope — the cloud filters per caller.
       for (const account of listEngineAccountsAllScopes(kind)) {
@@ -744,6 +749,9 @@ function flushStoppedTaskStatuses(socket: WebSocket | null = ws): void {
   });
 }
 
+// ADR-131 D3: a stored account (any scope) makes a kind advertisable even
+// when the host's own credential is absent — see hasStoredEngineAccounts.
+setAdvertisementFallback((kind) => hasStoredEngineAccounts(kind));
 onRegistryChange(() => sendCapabilities());
 onContainerRuntimeChange((next, previous) => {
   if (stopping) return;
@@ -3198,6 +3206,9 @@ function expectChannelEnsureInput(
   if (typeof input.globalContext === "string") {
     out.globalContext = input.globalContext;
   }
+  // ADR-131 D3: same scope the task launched with (refreshChannel adopts it).
+  const channelScope = engineAccountScopeFromWire(input.engineAccountScope);
+  if (channelScope !== undefined) out.engineAccountScope = channelScope;
   // ADR-083: secretary identity drives the role-specific transcript preamble.
   // Both are optional for wire compatibility with older clouds.
   const mode = parseChannelMode(input.mode);
@@ -3300,6 +3311,14 @@ function expectTaskCommandTask(value: unknown): TaskCommandTask {
   ) {
     out.sharedFiles = row.sharedFiles;
   }
+  // ADR-131 D3: the workspace whose engine accounts this task resolves.
+  // Dropping it here silently re-scoped every shared-host task to the host's
+  // own credentials (live 2026-09-07) — see engineAccountScopeFromWire.
+  const taskScope = engineAccountScopeFromWire(
+    row.engineAccountScope,
+    "task.engineAccountScope",
+  );
+  if (taskScope !== undefined) out.engineAccountScope = taskScope;
   return out;
 }
 

package/src/protocol.ts

@@ -121,6 +121,26 @@ export function isEngineAccountScope(value: unknown): value is string {
     (typeof value === "string" && ORG_ACCOUNT_SCOPE_RE.test(value))
   );
 }
+
+/**
+ * ADR-131 D3: read an optional `engineAccountScope` off a wire object.
+ * Returns the scope when present and well-formed, undefined when absent, and
+ * THROWS on a malformed value — a tenant scope must never degrade silently
+ * to the host's credentials. LIVE 2026-09-07: the host's task-up and
+ * channel-ensure validators rebuilt their inputs field by field and never
+ * copied this key, so every shared-host task ran in the HOST scope — Codex
+ * had no account there and looped "Reconnecting" while the cloud had sent
+ * `org:<id>` all along. Every `expect*Input` that carries a scope must call
+ * this; `host-agent/src/protocol.test.ts` pins the shape.
+ */
+export function engineAccountScopeFromWire(
+  value: unknown,
+  field = "engineAccountScope",
+): string | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (isEngineAccountScope(value)) return value;
+  throw new Error(`invalid ${field}`);
+}
 export const MAX_ENGINE_CONNECT_SECRET_CHARS = 8_192;
 export const MAX_ENGINE_CONNECT_LINE_CHARS = 512;
 export const MAX_ENGINE_CATALOG_ENTRIES = 8;
@@ -398,7 +418,8 @@ export interface EngineLoginCapability {
  * Operator-chosen label + shape metadata only — never credentials. */
 export interface EngineAccountSummary {
   id: string;
-  kind: "claude" | "codex" | "opencode";
+  /** grok/cursor since host 0.9.101 (API-key accounts, ADR-131 D3). */
+  kind: "claude" | "codex" | "grok" | "cursor" | "opencode";
   label: string;
   authKind: "env" | "config-dir";
   isDefault: boolean;