@runuai/host 0.9.105 → 0.9.107

package/lib/machine-provider-aws.ts

@@ -279,10 +279,19 @@ async function hostEgressIp(): Promise<string> {
   );
 }
 
+/** How long a resolved payload AMI is trusted before the newest published
+ * image is looked up again. Long enough that a burst of launches shares one
+ * describe-images; short enough that a freshly published image reaches every
+ * RUNNING host — shared and BYO — on its next task without a host restart
+ * (before 0.9.106 the answer was kept for the process lifetime). */
+export const PAYLOAD_AMI_TTL_MS = 5 * 60_000;
+
 export function createAwsMachineProvider(
   config: AwsMachineConfig,
   runner: Runner = defaultRunner(config.region),
+  deps: { now?: () => number } = {},
 ): MachineProvider {
+  const now = deps.now ?? (() => Date.now());
   const taskIdOf = (machineId: string): string => {
     if (!machineId.startsWith("uai-machine-")) {
       throw new Error(`not a uai machine id: ${machineId}`);
@@ -332,10 +341,12 @@ export function createAwsMachineProvider(
   // orchestrator can never reach.
   // -------------------------------------------------------------------------
 
-  let resolvedImage: string | null = null;
+  let resolvedImage: { id: string; at: number } | null = null;
   async function resolveImage(specImage: string): Promise<string> {
     if (specImage.startsWith("ami-")) return specImage;
-    if (resolvedImage) return resolvedImage;
+    if (resolvedImage && now() - resolvedImage.at < PAYLOAD_AMI_TTL_MS) {
+      return resolvedImage.id;
+    }
     const res = await runner([
       "ec2",
       "describe-images",
@@ -356,12 +367,24 @@ export function createAwsMachineProvider(
       }
     }
     if (typeof image !== "string" || !image.startsWith("ami-")) {
+      // A stale-but-known image beats a failed launch when the lookup itself
+      // hiccups; only a host that never resolved one has nothing to offer.
+      if (resolvedImage) return resolvedImage.id;
       throw new Error(
         `no uai machine payload AMI is published in ${config.region} — set ` +
           "UAI_MACHINE_IMAGE to an AMI id, or ask Uai to publish this region",
       );
     }
-    resolvedImage = image;
+    if (resolvedImage?.id !== image) {
+      // The journal line that tells an operator which payload a task got —
+      // an exit 127 for a missing CLI is otherwise the only symptom of a
+      // region that never received the latest publish.
+      console.log(
+        `[machine-aws] payload image for ${config.region}: ${image}` +
+          (resolvedImage ? ` (was ${resolvedImage.id})` : ""),
+      );
+    }
+    resolvedImage = { id: image, at: now() };
     return image;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.105",
+  "version": "0.9.107",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -123,6 +123,7 @@ import {
   renameEngineAccount,
   reorderEngineAccounts,
 } from "../lib/engine-accounts";
+import { disconnectEngine } from "../lib/engines";
 
 export {
   parseMentions,
@@ -1271,6 +1272,16 @@ export const hostCommands: HostCommands = {
     }
   },
 
+  async engineDisconnect(ctx, input) {
+    logCommand(ctx, "engineDisconnect", input.engine);
+    try {
+      disconnectEngine(input.engine);
+      return ok({ disconnected: true });
+    } catch (err) {
+      return failFromUnknown(err);
+    }
+  },
+
   async channelResolvePermission(ctx, taskId, agentId, requestId, decision) {
     logCommand(ctx, "channelResolvePermission", taskId, agentId, requestId);
     try {

package/src/main.ts

@@ -188,6 +188,7 @@ import {
   HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
   HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE,
   HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE,
+  HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
   isEngineAccountScope,
   HOST_LOGS_PROTOCOL_FEATURE,
@@ -232,6 +233,7 @@ import {
   type FilesOpInput,
   engineAccountScopeFromWire,
   isEngineAccountLabel,
+  isEngineConnectKind,
 } from "./protocol";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -615,6 +617,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
       HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE,
       HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE,
+      HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
       // dispatch in mock mode would let the composer create a Secretary that
       // has no way to wake crew.
@@ -2465,6 +2468,16 @@ async function dispatchCommand(
       if (reordered.ok) sendCapabilities();
       return reordered;
     }
+    case "engineDisconnect": {
+      const value = args[0];
+      const engine = (value as { engine?: unknown } | undefined)?.engine;
+      if (!isEngineConnectKind(engine)) {
+        throw new Error("invalid command args: expected an engine kind at 0");
+      }
+      const result = await hostCommands.engineDisconnect(ctx, { engine });
+      if (result.ok) sendCapabilities();
+      return result;
+    }
   }
 }
 
@@ -3050,6 +3063,7 @@ const HOST_COMMAND_NAMES = {
   engineAccountRemove: true,
   engineAccountRename: true,
   engineAccountReorder: true,
+  engineDisconnect: true,
 } satisfies Record<keyof HostCommands, true>;
 
 function isHostCommand(command: string): command is keyof HostCommands {

package/src/protocol.ts

@@ -113,6 +113,9 @@ export const HOST_ENGINE_CONNECT_PROTOCOL_FEATURE = "host-engine-connect-v1";
  * `engineAccountReorder` commands; login `succeeded` events carry the created
  * `accountId` for labeled captures; codex `awaiting_confirmation` carries the
  * device `code`. Extras are advertised in priority order (position). */
+/** Host 0.9.107: `engineDisconnect` — forget the HOST's own credential for an
+ * engine (the default slot: .env.local key / login file). Owner-only. */
+export const HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE = "host-engine-disconnect-v1";
 export const HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE =
   "host-engine-account-manage-v1";
 export const HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE =
@@ -1493,6 +1496,13 @@ export interface HostCommands {
     ctx: CommandContext,
     input: { kind: string; ids: string[]; scope?: string },
   ): Promise<HostCommandResult<{ reordered: boolean; message?: string }>>;
+  /** Disconnect-v1: forget the host's DEFAULT credential for an engine — the
+   * .env.local key and/or the login file the adapter detects. Extras are
+   * untouched (remove them by id). Re-advertises on success. */
+  engineDisconnect(
+    ctx: CommandContext,
+    input: { engine: EngineConnectKind },
+  ): Promise<HostCommandResult<{ disconnected: boolean; message?: string }>>;
   cloneRepo(
     ctx: CommandContext,
     input: CloneRepoInput,