@runuai/host 0.9.101 → 0.9.103

package/lib/engine-accounts.ts

@@ -537,6 +537,16 @@ async function copyDirInto(
       }
     };
     await run(["/bin/mkdir", "-p", containerDir], `mkdir ${containerDir}`);
+    // The mkdir above runs as root, but a MACHINE copy extracts as the ssh
+    // user (node) — into a root-owned directory it dies with "Cannot open:
+    // Permission denied" and the account never authenticates (live
+    // 2026-09-07, first scoped Codex account on the shared host). Hand the
+    // directory to node BEFORE the copy; this also repairs a directory an
+    // earlier failed attempt left root-owned on a still-running machine.
+    await run(
+      ["/bin/chown", "-R", "node:node", containerDir],
+      `chown -R node:node ${containerDir}`,
+    );
     await environment.copy({
       direction: "into",
       source: hostDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.101",
+  "version": "0.9.103",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -229,6 +229,7 @@ import {
   type TaskDownInput,
   type TaskLaunchInput,
   type FilesOpInput,
+  engineAccountScopeFromWire,
 } from "./protocol";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -3205,6 +3206,9 @@ function expectChannelEnsureInput(
   if (typeof input.globalContext === "string") {
     out.globalContext = input.globalContext;
   }
+  // ADR-131 D3: same scope the task launched with (refreshChannel adopts it).
+  const channelScope = engineAccountScopeFromWire(input.engineAccountScope);
+  if (channelScope !== undefined) out.engineAccountScope = channelScope;
   // ADR-083: secretary identity drives the role-specific transcript preamble.
   // Both are optional for wire compatibility with older clouds.
   const mode = parseChannelMode(input.mode);
@@ -3307,6 +3311,14 @@ function expectTaskCommandTask(value: unknown): TaskCommandTask {
   ) {
     out.sharedFiles = row.sharedFiles;
   }
+  // ADR-131 D3: the workspace whose engine accounts this task resolves.
+  // Dropping it here silently re-scoped every shared-host task to the host's
+  // own credentials (live 2026-09-07) — see engineAccountScopeFromWire.
+  const taskScope = engineAccountScopeFromWire(
+    row.engineAccountScope,
+    "task.engineAccountScope",
+  );
+  if (taskScope !== undefined) out.engineAccountScope = taskScope;
   return out;
 }
 

package/src/protocol.ts

@@ -121,6 +121,26 @@ export function isEngineAccountScope(value: unknown): value is string {
     (typeof value === "string" && ORG_ACCOUNT_SCOPE_RE.test(value))
   );
 }
+
+/**
+ * ADR-131 D3: read an optional `engineAccountScope` off a wire object.
+ * Returns the scope when present and well-formed, undefined when absent, and
+ * THROWS on a malformed value — a tenant scope must never degrade silently
+ * to the host's credentials. LIVE 2026-09-07: the host's task-up and
+ * channel-ensure validators rebuilt their inputs field by field and never
+ * copied this key, so every shared-host task ran in the HOST scope — Codex
+ * had no account there and looped "Reconnecting" while the cloud had sent
+ * `org:<id>` all along. Every `expect*Input` that carries a scope must call
+ * this; `host-agent/src/protocol.test.ts` pins the shape.
+ */
+export function engineAccountScopeFromWire(
+  value: unknown,
+  field = "engineAccountScope",
+): string | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (isEngineAccountScope(value)) return value;
+  throw new Error(`invalid ${field}`);
+}
 export const MAX_ENGINE_CONNECT_SECRET_CHARS = 8_192;
 export const MAX_ENGINE_CONNECT_LINE_CHARS = 512;
 export const MAX_ENGINE_CATALOG_ENTRIES = 8;