@runuai/host 0.9.11 → 0.9.13

package/db/migrations/0013_github_credential_generations.sql

@@ -0,0 +1,11 @@
+ALTER TABLE `host_github_tokens` ADD `generation` integer DEFAULT 0 NOT NULL;
+--> statement-breakpoint
+CREATE TABLE `host_github_credential_generations` (
+	`user_id` text PRIMARY KEY NOT NULL,
+	`generation` integer DEFAULT 0 NOT NULL,
+	`mutation` text DEFAULT 'set' NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+INSERT INTO `host_github_credential_generations` (`user_id`, `generation`, `mutation`, `updated_at`)
+SELECT `user_id`, 0, 'set', `updated_at` FROM `host_github_tokens`;

package/db/migrations/meta/_journal.json

@@ -92,6 +92,13 @@
       "when": 1779900013000,
       "tag": "0012_agent_session_attach_key",
       "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1786045000000,
+      "tag": "0013_github_credential_generations",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -62,6 +62,11 @@ export type NewHostEventRow = typeof hostEvents.$inferInsert;
 export const githubTokens = sqliteTable("host_github_tokens", {
   userId: text("user_id").primaryKey(),
   installationId: integer("installation_id").notNull(),
+  /** Generation of the cloud binding whose credential this row contains.
+   * Readers trust the token only while it matches the durable mutation fence
+   * below, so a crash between claiming a newer generation and deleting this
+   * row leaves a safely inert old ciphertext rather than a usable old token. */
+  generation: integer("generation").notNull().default(0),
   // ADR-033: holds a long-lived ACCESS token when kind="access", or a refresh
   // token when kind="refresh" (legacy ADR-027). Encrypted at rest either way.
   refreshTokenCt: blob("refresh_token_ct").notNull(),
@@ -75,6 +80,19 @@ export const githubTokens = sqliteTable("host_github_tokens", {
 export type GithubToken = typeof githubTokens.$inferSelect;
 export type NewGithubToken = typeof githubTokens.$inferInsert;
 
+// Durable monotonic tombstone for GitHub credential mutations. Kept separate
+// from the token row so a disconnect can reject a delayed older connect even
+// after the encrypted credential itself has been deleted.
+export const githubCredentialGenerations = sqliteTable(
+  "host_github_credential_generations",
+  {
+    userId: text("user_id").primaryKey(),
+    generation: integer("generation").notNull().default(0),
+    mutation: text("mutation").notNull().default("set"),
+    updatedAt: integer("updated_at").notNull(),
+  },
+);
+
 // Per-user ed25519 SSH key (ADR-029). Generated ON the host; the private key
 // lives encrypted at rest with the host master key (same secret-blind pattern
 // as host_github_tokens — ADR-015). The cloud only ever sees `public_key`,

package/lib/env.ts

@@ -22,9 +22,14 @@ const schema = z.object({
   UAI_HOST_ID: z.string().min(1).optional(),
   // Host master key file (ADR-027) — 32 bytes, AES-256-GCM for the host
   // secret store. Defaults to $UAI_DATA_DIR/host-master.key; generated on
-  // first use. Optional transitional GitHub PAT for unconnected users.
+  // first use.
   UAI_HOST_KEY_FILE: z.string().min(1).optional(),
+  // Transitional single-user GitHub PAT, for the one user who has not
+  // connected GitHub. Inert without UAI_GH_PAT_FALLBACK_USER_ID: the PAT is a
+  // host-wide credential, so it may only be injected into tasks owned by the
+  // user it belongs to. See setupTaskGithub().
   UAI_GH_PAT_FALLBACK: z.string().min(1).optional(),
+  UAI_GH_PAT_FALLBACK_USER_ID: z.string().min(1).optional(),
   UAI_WORKSPACE_ROOT: z.string().min(1).default("~/.uai"),
   // Crash reporting (ADR-071, docs/observability.md). Default-ON for
   // installed hosts via the DSN baked into lib/obs.ts; UAI_SENTRY_DSN