@runuai/host 0.9.102 → 0.9.104

package/db/migrations/0018_engine_account_position.sql

@@ -0,0 +1,3 @@
+-- Manage-v1 (host 0.9.104): explicit priority order for a kind's extra
+-- accounts within a scope. Existing rows keep 0 and fall back to created_at.
+ALTER TABLE `host_engine_accounts` ADD `position` integer NOT NULL DEFAULT 0;

package/db/migrations/meta/_journal.json

@@ -127,6 +127,13 @@
       "when": 1788820000000,
       "tag": "0017_engine_account_scope",
       "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "6",
+      "when": 1788900000000,
+      "tag": "0018_engine_account_position",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -278,6 +278,9 @@ export const engineAccounts = sqliteTable("host_engine_accounts", {
   // ADR-131 D3: "host" (owner-level, default) or "org:<orgId>" (a workspace's
   // account on a shared host). Resolution is by exact scope.
   scope: text("scope").notNull().default("host"),
+  // Manage-v1: priority within (scope, kind) — tasks pick the first healthy
+  // account in ascending position; ties break on created_at.
+  position: integer("position", { mode: "number" }).notNull().default(0),
   createdAt: integer("created_at", { mode: "number" }).notNull(),
 });
 

package/lib/engine-accounts.ts

@@ -25,6 +25,7 @@
 import {
   HOST_ACCOUNT_SCOPE,
   isEngineAccountScope,
+  isEngineAccountLabel,
 } from "../src/protocol";
 import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -280,7 +281,8 @@ function resolveExtras(
       (r) =>
         r.kind === kind &&
         accountInScope((r as { scope?: string | null }).scope, scope),
-    );
+    )
+    .sort(compareAccountRows);
   const out: ResolvedEngineAccount[] = [];
   for (const row of rows) {
     if (row.authKind === "env") {
@@ -440,8 +442,16 @@ export function selectAccount(
   if (candidates.length === 0) return null;
   const lru = (a: ResolvedEngineAccount): number => state(a.id).lastUsedAt;
   const healthy = candidates.filter((a) => state(a.id).cooldownUntil <= now);
-  const pool = healthy.length > 0 ? healthy : candidates;
-  return pool.reduce((best, a) => (lru(a) < lru(best) ? a : best), pool[0]!);
+  // Manage-v1: the list arrives in PRIORITY order (default slot, then extras
+  // by position) — the first healthy account wins, so the operator's
+  // ordering decides which account a task uses and which are fallbacks.
+  // Only when every account is cooling do we fall back to the least recently
+  // used one (the stalest cooldown is the likeliest to have lifted).
+  if (healthy.length > 0) return healthy[0]!;
+  return candidates.reduce(
+    (best, a) => (lru(a) < lru(best) ? a : best),
+    candidates[0]!,
+  );
 }
 
 /** Pick an account for a kind (default + extras), applying rotation state. */
@@ -537,6 +547,16 @@ async function copyDirInto(
       }
     };
     await run(["/bin/mkdir", "-p", containerDir], `mkdir ${containerDir}`);
+    // The mkdir above runs as root, but a MACHINE copy extracts as the ssh
+    // user (node) — into a root-owned directory it dies with "Cannot open:
+    // Permission denied" and the account never authenticates (live
+    // 2026-09-07, first scoped Codex account on the shared host). Hand the
+    // directory to node BEFORE the copy; this also repairs a directory an
+    // earlier failed attempt left root-owned on a still-running machine.
+    await run(
+      ["/bin/chown", "-R", "node:node", containerDir],
+      `chown -R node:node ${containerDir}`,
+    );
     await environment.copy({
       direction: "into",
       source: hostDir,
@@ -653,6 +673,30 @@ export async function provisionEngineAccounts(
   return { copied, failed, mayHaveMutated };
 }
 
+/** Priority order within (scope, kind): position, then age. Rows from before
+ *  manage-v1 all carry 0 and therefore keep their creation order. */
+function compareAccountRows(
+  a: { position?: number | null; createdAt: number; id: string },
+  b: { position?: number | null; createdAt: number; id: string },
+): number {
+  return (
+    (a.position ?? 0) - (b.position ?? 0) ||
+    a.createdAt - b.createdAt ||
+    a.id.localeCompare(b.id)
+  );
+}
+
+/** New accounts join the END of their (scope, kind) order. */
+function nextPosition(kind: string, scope: string): number {
+  let max = -1;
+  for (const row of getDb().select().from(schema.engineAccounts).all()) {
+    if (row.kind !== kind) continue;
+    if (((row as { scope?: string | null }).scope ?? HOST_ACCOUNT_SCOPE) !== scope) continue;
+    max = Math.max(max, (row as { position?: number | null }).position ?? 0);
+  }
+  return max + 1;
+}
+
 // ---------------------------------------------------------------------------
 // Mutations (host UI).
 // ---------------------------------------------------------------------------
@@ -705,6 +749,7 @@ export function addEngineAccount(
         configDir: null,
         createdAt: now,
         scope,
+        position: nextPosition(kind, scope),
       })
       .run();
     return { ok: true, message: `Added Claude account "${trimmedLabel}".`, id };
@@ -723,6 +768,7 @@ export function addEngineAccount(
         configDir: null,
         createdAt: now,
         scope,
+        position: nextPosition(kind, scope),
       })
       .run();
     return {
@@ -768,6 +814,7 @@ export function addEngineAccount(
         configDir: hostDir,
         createdAt: now,
         scope,
+        position: nextPosition(kind, scope),
       })
       .run();
     return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
@@ -842,6 +889,7 @@ export function addCodexAccountFromAuthJson(
       configDir: hostDir,
       createdAt: Date.now(),
       scope,
+      position: nextPosition("codex", scope),
     })
     .run();
   return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
@@ -890,3 +938,78 @@ export function removeEngineAccount(
   }
   return { ok: true, message: `Removed "${row.label}".` };
 }
+
+/** Manage-v1: relabel an extra account. Same scope rule as removal. */
+export function renameEngineAccount(
+  id: string,
+  label: string,
+  scope?: string,
+): { ok: boolean; message: string } {
+  if (id.startsWith("default:")) {
+    return { ok: false, message: "The default account cannot be renamed." };
+  }
+  const trimmed = label.trim();
+  if (!isEngineAccountLabel(trimmed)) {
+    return { ok: false, message: "Give the account a label (up to 64 characters)." };
+  }
+  const row = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .where(eq(schema.engineAccounts.id, id))
+    .get();
+  if (!row) return { ok: false, message: "That account no longer exists." };
+  if (!accountRemovableInScope(row, scope)) {
+    return { ok: false, message: "That account belongs to a different scope." };
+  }
+  getDb()
+    .update(schema.engineAccounts)
+    .set({ label: trimmed })
+    .where(eq(schema.engineAccounts.id, id))
+    .run();
+  return { ok: true, message: `Renamed to "${trimmed}".` };
+}
+
+/**
+ * Manage-v1: set the priority order of `kind`'s extra accounts in `scope`.
+ * `ids` must be exactly the set of that kind's rows in the scope — a stale
+ * list (an account added or removed meanwhile) is refused rather than
+ * silently partially applied.
+ */
+export function reorderEngineAccounts(
+  kind: string,
+  ids: readonly string[],
+  scope: string = HOST_ACCOUNT_SCOPE,
+): { ok: boolean; message: string } {
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
+  const rows = getDb()
+    .select()
+    .from(schema.engineAccounts)
+    .all()
+    .filter(
+      (r) =>
+        r.kind === kind &&
+        ((r as { scope?: string | null }).scope ?? HOST_ACCOUNT_SCOPE) === scope,
+    );
+  const have = new Set(rows.map((r) => r.id));
+  const want = new Set(ids);
+  if (
+    have.size !== want.size ||
+    ids.length !== want.size ||
+    [...have].some((id) => !want.has(id))
+  ) {
+    return {
+      ok: false,
+      message: "The account list changed — refresh and try again.",
+    };
+  }
+  ids.forEach((id, index) => {
+    getDb()
+      .update(schema.engineAccounts)
+      .set({ position: index })
+      .where(eq(schema.engineAccounts.id, id))
+      .run();
+  });
+  return { ok: true, message: "Order saved." };
+}

package/lib/engine-connect.ts

@@ -166,7 +166,7 @@ export class EngineConnectManager {
         scope ?? HOST_ACCOUNT_SCOPE,
       );
       if (added.ok) this.afterMutation(engine, false);
-      this.finish(operation, added.ok, added.message);
+      this.finish(operation, added.ok, added.message, added.id);
       return;
     }
     // ADR-131 D3: everything below writes the host's DEFAULT slot or re-detects
@@ -207,6 +207,7 @@ export class EngineConnectManager {
     operation: ConnectOperation,
     ok: boolean,
     message: string,
+    accountId?: string,
   ): void {
     if (operation.done) return;
     operation.done = true;
@@ -221,6 +222,7 @@ export class EngineConnectManager {
       phase: "done",
       ok,
       message,
+      ...(ok && accountId !== undefined ? { accountId } : {}),
     });
   }
 }

package/lib/engine-login.ts

@@ -151,12 +151,12 @@ export interface EngineLoginSeams {
     label: string,
     token: string,
     scope: string,
-  ): { ok: boolean; message: string };
+  ): { ok: boolean; message: string; id?: string };
   addCodexAccount(
     label: string,
     authJson: string,
     scope: string,
-  ): { ok: boolean; message: string };
+  ): { ok: boolean; message: string; id?: string };
   refreshEngineAccountAgents(engine: "claude"): Promise<void>;
   reinjectCodexRunningTasks(): Promise<void>;
   ownerHome(): string;
@@ -868,6 +868,7 @@ export class EngineLoginManager {
           opId: operation.opId,
           engine: operation.engine,
           phase: "awaiting_confirmation",
+          code: device.userCode,
           message: `Enter code ${device.userCode} on the verification page. Nothing to paste here — this completes on its own.`,
         });
         return;
@@ -983,6 +984,7 @@ export class EngineLoginManager {
             engine: operation.engine,
             phase: "succeeded",
             message: added.message,
+            ...(added.id === undefined ? {} : { accountId: added.id }),
           }
         : failedEvent(
             operation.opId,
@@ -1039,7 +1041,7 @@ export class EngineLoginManager {
     if (operation.accountLabel !== null) {
       // ADR-116: labeled capture — the auth.json this login produced becomes
       // an isolated extra account instead of overwriting ~/.codex.
-      let added: { ok: boolean; message: string };
+      let added: { ok: boolean; message: string; id?: string };
       try {
         const contents = await readFile(
           join(tempDir, "codex", "auth.json"),
@@ -1063,6 +1065,7 @@ export class EngineLoginManager {
             engine: operation.engine,
             phase: "succeeded",
             message: added.message,
+            ...(added.id === undefined ? {} : { accountId: added.id }),
           }
         : failedEvent(
             operation.opId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.102",
+  "version": "0.9.104",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -118,7 +118,11 @@ export type {
   TaskUpResult,
 } from "../lib/agent";
 
-import { removeEngineAccount } from "../lib/engine-accounts";
+import {
+  removeEngineAccount,
+  renameEngineAccount,
+  reorderEngineAccounts,
+} from "../lib/engine-accounts";
 
 export {
   parseMentions,
@@ -1239,6 +1243,34 @@ export const hostCommands: HostCommands = {
     }
   },
 
+  async engineAccountRename(ctx, input) {
+    logCommand(ctx, "engineAccountRename", input.id);
+    try {
+      const result = renameEngineAccount(input.id, input.label, input.scope);
+      return ok(
+        result.ok
+          ? { renamed: true }
+          : { renamed: false, message: result.message },
+      );
+    } catch (err) {
+      return failFromUnknown(err);
+    }
+  },
+
+  async engineAccountReorder(ctx, input) {
+    logCommand(ctx, "engineAccountReorder", input.kind);
+    try {
+      const result = reorderEngineAccounts(input.kind, input.ids, input.scope);
+      return ok(
+        result.ok
+          ? { reordered: true }
+          : { reordered: false, message: result.message },
+      );
+    } catch (err) {
+      return failFromUnknown(err);
+    }
+  },
+
   async channelResolvePermission(ctx, taskId, agentId, requestId, decision) {
     logCommand(ctx, "channelResolvePermission", taskId, agentId, requestId);
     try {

package/src/main.ts

@@ -186,6 +186,7 @@ import {
   HOST_TASK_STOP_PROTOCOL_FEATURE,
   HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
   HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
+  HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE,
   HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
   isEngineAccountScope,
@@ -230,6 +231,7 @@ import {
   type TaskLaunchInput,
   type FilesOpInput,
   engineAccountScopeFromWire,
+  isEngineAccountLabel,
 } from "./protocol";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -609,6 +611,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
       HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
       HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE,
+      HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
       // dispatch in mock mode would let the composer create a Secretary that
       // has no way to wake crew.
@@ -2443,9 +2446,70 @@ async function dispatchCommand(
       if (removal.ok) sendCapabilities();
       return removal;
     }
+    case "engineAccountRename": {
+      const renamed = await hostCommands.engineAccountRename(
+        ctx,
+        expectEngineAccountRenameInput(args, 0),
+      );
+      if (renamed.ok) sendCapabilities();
+      return renamed;
+    }
+    case "engineAccountReorder": {
+      const reordered = await hostCommands.engineAccountReorder(
+        ctx,
+        expectEngineAccountReorderInput(args, 0),
+      );
+      if (reordered.ok) sendCapabilities();
+      return reordered;
+    }
   }
 }
 
+function expectEngineAccountRenameInput(
+  args: unknown[],
+  index: number,
+): { id: string; label: string; scope?: string } {
+  const base = expectEngineAccountRemoveInput(args, index);
+  const label = (args[index] as { label?: unknown }).label;
+  if (!isEngineAccountLabel(label)) {
+    throw new Error(`invalid command args: bad account label at ${index}`);
+  }
+  return { ...base, label };
+}
+
+function expectEngineAccountReorderInput(
+  args: unknown[],
+  index: number,
+): { kind: string; ids: string[]; scope?: string } {
+  const value = args[index];
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`invalid command args: expected reorder input at ${index}`);
+  }
+  const { kind, ids, scope } = value as {
+    kind?: unknown;
+    ids?: unknown;
+    scope?: unknown;
+  };
+  if (typeof kind !== "string" || !/^[a-z][a-z0-9-]{0,31}$/.test(kind)) {
+    throw new Error(`invalid command args: bad account kind at ${index}`);
+  }
+  if (
+    !Array.isArray(ids) ||
+    ids.length > 64 ||
+    ids.some((id) => typeof id !== "string" || id.length === 0 || id.length > 256)
+  ) {
+    throw new Error(`invalid command args: bad account id list at ${index}`);
+  }
+  if (scope !== undefined && !isEngineAccountScope(scope)) {
+    throw new Error(`invalid command args: bad account scope at ${index}`);
+  }
+  return {
+    kind,
+    ids: ids as string[],
+    ...(scope !== undefined ? { scope } : {}),
+  };
+}
+
 function expectEngineAccountRemoveInput(
   args: unknown[],
   index: number,
@@ -2981,6 +3045,8 @@ const HOST_COMMAND_NAMES = {
   appendTranscript: true,
   previewEnsure: true,
   engineAccountRemove: true,
+  engineAccountRename: true,
+  engineAccountReorder: true,
 } satisfies Record<keyof HostCommands, true>;
 
 function isHostCommand(command: string): command is keyof HostCommands {

package/src/protocol.ts

@@ -109,6 +109,12 @@ export const HOST_ENGINE_CONNECT_PROTOCOL_FEATURE = "host-engine-connect-v1";
  * and stamps `scope` on every EngineAccountSummary it advertises. The cloud
  * sends none of those to a host without the feature (the v1 exact-shape
  * guards would reject the frames). */
+/** Account management v1 (host 0.9.104): `engineAccountRename` and
+ * `engineAccountReorder` commands; login `succeeded` events carry the created
+ * `accountId` for labeled captures; codex `awaiting_confirmation` carries the
+ * device `code`. Extras are advertised in priority order (position). */
+export const HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE =
+  "host-engine-account-manage-v1";
 export const HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE =
   "host-engine-account-scopes-v1";
 /** The owner-level account scope; every pre-scope account lives here. */
@@ -386,11 +392,15 @@ export type EngineLoginEventFrame =
       phase: "authorize";
       url: string;
       errorCode?: never;
+      code?: never;
+      accountId?: never;
     })
   | (EngineLoginEventBase & {
       phase: "failed" | "timed_out";
       url?: never;
       errorCode?: EngineLoginErrorCode;
+      code?: never;
+      accountId?: never;
     })
   | (EngineLoginEventBase & {
       phase:
@@ -404,6 +414,12 @@ export type EngineLoginEventFrame =
         | "cancelled";
       url?: never;
       errorCode?: never;
+      /** Device-code flow only (`awaiting_confirmation`): the one-time code
+       * the operator enters on the provider's page — shown large in the UI. */
+      code?: string;
+      /** `succeeded` of a LABELED capture: the id of the account it created,
+       * so the client can rename/order it right away. */
+      accountId?: string;
     });
 
 /** Rolling-safe, secret-free engine state. v1 intentionally makes no claim
@@ -482,6 +498,9 @@ export interface EngineConnectEventFrame {
   line?: string;
   ok?: boolean;
   message?: string;
+  /** Manage-v1: `done` of a LABELED connect — the id of the account it
+   * created, so the client can name/order it right away. */
+  accountId?: string;
 }
 
 export function isEngineConnectKind(
@@ -541,7 +560,7 @@ export function isEngineConnectEventFrame(
   const frame = exactWireObject(
     value,
     ["kind", "opId", "engine", "phase"],
-    ["line", "ok", "message"],
+    ["line", "ok", "message", "accountId"],
   );
   if (
     !frame ||
@@ -551,6 +570,16 @@ export function isEngineConnectEventFrame(
   ) {
     return false;
   }
+  if (
+    Object.hasOwn(frame, "accountId") &&
+    (frame.phase !== "done" ||
+      frame.ok !== true ||
+      typeof frame.accountId !== "string" ||
+      frame.accountId.length < 1 ||
+      frame.accountId.length > 256)
+  ) {
+    return false;
+  }
   if (frame.phase === "line") {
     return (
       typeof frame.line === "string" &&
@@ -773,6 +802,16 @@ export function isEngineLoginStartFrame(
 /** ADR-116 account labels: operator-chosen display names, never secrets.
  * Single-line, bounded, and visibly printable so they render safely in every
  * surface (capability frames, UI chips, log lines). */
+/** A provider device code: short, printable, no whitespace (`AC57-MDV9G`). */
+export function isEngineLoginDeviceCode(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length >= 4 &&
+    value.length <= 32 &&
+    /^[A-Za-z0-9-]+$/.test(value)
+  );
+}
+
 export function isEngineAccountLabel(value: unknown): value is string {
   return (
     typeof value === "string" &&
@@ -826,7 +865,7 @@ export function isEngineLoginEventFrame(
   const frame = exactWireObject(
     value,
     ["kind", "opId", "engine", "phase"],
-    ["url", "errorCode", "message"],
+    ["url", "errorCode", "message", "code", "accountId"],
   );
   if (
     !frame ||
@@ -837,6 +876,22 @@ export function isEngineLoginEventFrame(
   ) {
     return false;
   }
+  // Manage-v1 extras ride exactly one phase each.
+  if (
+    Object.hasOwn(frame, "code") &&
+    (frame.phase !== "awaiting_confirmation" || !isEngineLoginDeviceCode(frame.code))
+  ) {
+    return false;
+  }
+  if (
+    Object.hasOwn(frame, "accountId") &&
+    (frame.phase !== "succeeded" ||
+      typeof frame.accountId !== "string" ||
+      frame.accountId.length < 1 ||
+      frame.accountId.length > 256)
+  ) {
+    return false;
+  }
   if (frame.phase === "authorize") {
     return (
       isHttpsUrl(frame.url) &&
@@ -1422,6 +1477,19 @@ export interface HostCommands {
     ctx: CommandContext,
     input: { id: string; scope?: string },
   ): Promise<HostCommandResult<{ removed: boolean; message?: string }>>;
+  /** Manage-v1: relabel an extra account (never `default:*`); a scope may
+   * rename only its own accounts. Re-advertises on success. */
+  engineAccountRename(
+    ctx: CommandContext,
+    input: { id: string; label: string; scope?: string },
+  ): Promise<HostCommandResult<{ renamed: boolean; message?: string }>>;
+  /** Manage-v1: set the priority order of a kind's extra accounts within a
+   * scope — `ids` must be exactly that set. Tasks pick the first healthy
+   * account in this order. Re-advertises on success. */
+  engineAccountReorder(
+    ctx: CommandContext,
+    input: { kind: string; ids: string[]; scope?: string },
+  ): Promise<HostCommandResult<{ reordered: boolean; message?: string }>>;
   cloneRepo(
     ctx: CommandContext,
     input: CloneRepoInput,