@runuai/host 0.9.11 → 0.9.13

package/lib/github-tokens.ts

@@ -7,7 +7,7 @@
  * exchange is a host→cloud HTTP POST to /api/github/oauth/exchange.
  */
 
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
@@ -16,7 +16,12 @@ import {
   configureTaskSshTransport,
   ensureTaskSshIdentity,
 } from "./git-identity";
-import type { CloudToHost } from "../src/protocol";
+import {
+  MAX_GITHUB_INSTALLATIONS,
+  MAX_GITHUB_REPOSITORIES_PER_INSTALLATION,
+  type CloudToHost,
+  type GitHubRepositoryAccessErrorCode,
+} from "../src/protocol";
 
 const REFRESH_LEAD_MS = 5 * 60 * 1000; // refresh 5 min before expiry
 const EXEC_TIMEOUT_MS = 10_000;
@@ -145,6 +150,102 @@ export function runGithubConnectionTransition<T>(
   return result;
 }
 
+/**
+ * Persist a monotonic credential mutation fence before changing the token row.
+ * The generation survives disconnect because it lives in a separate table, so
+ * a delayed older connect cannot recreate a credential after a newer clear.
+ */
+export type GitHubCredentialMutation = "set" | "clear";
+
+export interface GitHubCredentialGenerationClaim {
+  generation: number;
+  replay: boolean;
+}
+
+export function claimGithubCredentialGeneration(
+  userId: string,
+  requestedGeneration: number | undefined,
+  mutation: GitHubCredentialMutation,
+): GitHubCredentialGenerationClaim | null {
+  if (
+    requestedGeneration !== undefined &&
+    (!Number.isSafeInteger(requestedGeneration) || requestedGeneration < 0)
+  ) {
+    return null;
+  }
+  return getDb().transaction((tx) => {
+    const current = tx
+      .select({
+        generation: schema.githubCredentialGenerations.generation,
+        mutation: schema.githubCredentialGenerations.mutation,
+      })
+      .from(schema.githubCredentialGenerations)
+      .where(eq(schema.githubCredentialGenerations.userId, userId))
+      .get();
+    // Generationless frames belong permanently to the legacy generation-zero
+    // namespace. Never derive a newer value from local state: a delayed old
+    // cloud frame must not outrank an explicit generation from a newer cloud.
+    // Once a clear has closed generation zero, the normal clear->set replay
+    // rule below deliberately requires a cloud upgrade before reconnecting.
+    const generation = requestedGeneration ?? 0;
+    if (!Number.isSafeInteger(generation) || generation < 0) return null;
+    if (current && current.generation > generation) return null;
+    if (current && current.generation === generation) {
+      if (current.mutation === mutation) {
+        return { generation, replay: true };
+      }
+      // Clearing the exact generation that was just stored is the safe
+      // compensation path when the cloud mirror is superseded between host
+      // storage and DB attachment. The reverse transition would resurrect a
+      // cleared credential and is always rejected.
+      if (current.mutation === "set" && mutation === "clear") {
+        tx.update(schema.githubCredentialGenerations)
+          .set({ mutation: "clear", updatedAt: Date.now() })
+          .where(eq(schema.githubCredentialGenerations.userId, userId))
+          .run();
+        return { generation, replay: false };
+      }
+      return null;
+    }
+    const values = { userId, generation, mutation, updatedAt: Date.now() };
+    tx.insert(schema.githubCredentialGenerations)
+      .values(values)
+      .onConflictDoUpdate({
+        target: schema.githubCredentialGenerations.userId,
+        set: { generation, mutation, updatedAt: values.updatedAt },
+      })
+      .run();
+    return { generation, replay: false };
+  });
+}
+
+export function githubCredentialGenerationMatches(
+  userId: string,
+  generation: number,
+): boolean {
+  if (!Number.isSafeInteger(generation) || generation < 0) return false;
+  return getDb().transaction((tx) => {
+    const fence = tx
+      .select({
+        generation: schema.githubCredentialGenerations.generation,
+        mutation: schema.githubCredentialGenerations.mutation,
+      })
+      .from(schema.githubCredentialGenerations)
+      .where(eq(schema.githubCredentialGenerations.userId, userId))
+      .get();
+    const token = tx
+      .select({ generation: schema.githubTokens.generation })
+      .from(schema.githubTokens)
+      .where(eq(schema.githubTokens.userId, userId))
+      .get();
+    return (
+      fence?.mutation === "set" &&
+      fence.generation === generation &&
+      token?.generation === generation
+    );
+  });
+}
+
 // --- token store ------------------------------------------------------------
 
 /**
@@ -157,12 +258,13 @@ export interface ConnectSetDeps {
   invalidateCredentials?: (userId: string) => Promise<void>;
   readStored?: (
     userId: string,
-  ) => { token: string; kind: string } | null;
+  ) => StoredGitHubGrant | null;
   deleteLocal?: (userId: string) => void;
   storeLocal?: (
     userId: string,
     fields: {
       installationId: number;
+      generation: number;
       refreshTokenCt: Buffer;
       refreshTokenNonce: Buffer;
       refreshTokenExpiresAt: number | null;
@@ -183,15 +285,17 @@ export async function onConnectSet(
 ): Promise<{ ok: boolean; error?: string }> {
   let oldGrantRemoved = false;
   let replacementStored = false;
-  let priorGrant: { token: string; kind: string } | null = null;
+  let priorGrant: StoredGitHubGrant | null = null;
   try {
     const token = frame.accessToken ?? frame.refreshToken;
     if (!token) return { ok: false, error: "gh.connect.set carried no token" };
     const kind = frame.accessToken ? "access" : "refresh";
+    const credentialGeneration = frame.generation ?? 0;
     const sealed = (deps.seal ?? sealAesGcm)(token);
     const now = Date.now();
     const fields = {
       installationId: frame.installationId,
+      generation: credentialGeneration,
       refreshTokenCt: sealed.ct,
       refreshTokenNonce: sealed.nonce,
       refreshTokenExpiresAt: frame.refreshTokenExpiresAt ?? null,
@@ -211,6 +315,22 @@ export async function onConnectSet(
       );
     }
 
+    // A retry of the exact same operation is safe and still reconciles tasks;
+    // reusing one generation for different credential material is not. Without
+    // this check a replayed opId/generation could replace the token while the
+    // cloud continued to trust the original binding generation.
+    if (
+      priorGrant?.generation === credentialGeneration &&
+      (priorGrant.token !== token ||
+        priorGrant.kind !== kind ||
+        priorGrant.installationId !== frame.installationId)
+    ) {
+      return {
+        ok: false,
+        error: "conflicting GitHub credential replay for one generation",
+      };
+    }
+
     // Remove the old grant before fencing host-side Git. A task that begins
     // while account switching is in progress must not mint or seed the old
     // user's credential. The replacement is already sealed above, so failures
@@ -225,7 +345,7 @@ export async function onConnectSet(
       priorGrant?.kind === "access" &&
       priorGrant.token !== token
     ) {
-      startBestEffortRevoke(
+      await bestEffortRevoke(
         frame.userId,
         priorGrant.token,
         deps.revoke ?? revokeAtGitHub,
@@ -291,6 +411,7 @@ function storeTokenRow(
   userId: string,
   fields: {
     installationId: number;
+    generation: number;
     refreshTokenCt: Buffer;
     refreshTokenNonce: Buffer;
     refreshTokenExpiresAt: number | null;
@@ -298,26 +419,35 @@ function storeTokenRow(
     updatedAt: number;
   },
 ): void {
-  getDb()
-    .insert(schema.githubTokens)
-    .values({ userId, ...fields })
-    .onConflictDoUpdate({ target: schema.githubTokens.userId, set: fields })
-    .run();
+  getDb().transaction((tx) => {
+    const fence = tx
+      .select({
+        generation: schema.githubCredentialGenerations.generation,
+        mutation: schema.githubCredentialGenerations.mutation,
+      })
+      .from(schema.githubCredentialGenerations)
+      .where(eq(schema.githubCredentialGenerations.userId, userId))
+      .get();
+    if (
+      fence?.mutation !== "set" ||
+      fence.generation !== fields.generation
+    ) {
+      throw new Error("GitHub credential generation changed before storage");
+    }
+    tx.insert(schema.githubTokens)
+      .values({ userId, ...fields })
+      .onConflictDoUpdate({ target: schema.githubTokens.userId, set: fields })
+      .run();
+  });
 }
 
-function startBestEffortRevoke(
+async function bestEffortRevoke(
   userId: string,
   token: string,
   revoke: (token: string) => Promise<void>,
-): void {
+): Promise<void> {
   try {
-    void revoke(token).catch((err) =>
-      console.warn(
-        `[github] user ${userId}: token revoke failed after local removal: ${
-          err instanceof Error ? err.message : err
-        }`,
-      ),
-    );
+    await revoke(token);
   } catch (err) {
     console.warn(
       `[github] user ${userId}: token revoke failed after local removal: ${
@@ -329,11 +459,11 @@ function startBestEffortRevoke(
 
 /**
  * Disconnect GitHub on this host (gh.connect.clear handler). Deletes the token
- * locally FIRST (so capabilities re-advertise immediately and the UI reflects
- * removal without waiting on the network), starts best-effort revocation, then
- * waits only for every live container to drop the credential and select its
- * disconnected transport. The bridge ack is therefore truthful without being
- * gated on GitHub's revoke round-trip.
+ * locally FIRST (so capability readers stop trusting it immediately), waits
+ * for best-effort revocation, then waits for every live container to drop the
+ * credential and select its disconnected transport. The surrounding
+ * generation transition is serialized so a delayed revoke cannot target a
+ * subsequently stored replacement.
  *
  * ADR-033: only a non-expiring ACCESS token can be revoked by token
  * (`DELETE /applications/{client_id}/token` matches access tokens only — a
@@ -344,7 +474,7 @@ function startBestEffortRevoke(
 export interface ConnectClearDeps {
   readStored?: (
     userId: string,
-  ) => { token: string; kind: string } | null;
+  ) => StoredGitHubGrant | null;
   deleteLocal?: (userId: string) => void;
   activeTaskIds?: (userId: string) => string[];
   reconcile?: (taskId: string, userId: string) => Promise<boolean>;
@@ -356,7 +486,7 @@ export async function onConnectClear(
   userId: string,
   deps: ConnectClearDeps = {},
 ): Promise<void> {
-  let stored: { token: string; kind: string } | null = null;
+  let stored: StoredGitHubGrant | null = null;
   try {
     stored = (deps.readStored ?? readStoredToken)(userId);
   } catch (err) {
@@ -374,11 +504,11 @@ export async function onConnectClear(
   // even when token decryption or GitHub's revoke endpoint is unavailable.
   (deps.deleteLocal ?? deleteToken)(userId);
 
-  // Start remote revocation immediately but do not put it on the ack path.
-  // revokeAtGitHub catches its own failures; the catch also makes injected
-  // test/alternate implementations safely fire-and-forget.
+  // Await best-effort remote revocation while the caller still owns the
+  // per-user transition lock. revokeAtGitHub catches its own failures; the
+  // wrapper also contains failures from injected test/alternate implementations.
   if (stored?.kind === "access") {
-    startBestEffortRevoke(
+    await bestEffortRevoke(
       userId,
       stored.token,
       deps.revoke ?? revokeAtGitHub,
@@ -411,10 +541,50 @@ export async function onConnectClear(
   if (failed) throw failed.reason;
 }
 
-/** Decrypt the user's stored token + its kind, or null if none. */
+/** Fail-closed rollback for a generation that was claimed for set but could
+ * not be fully reconciled. The tombstone transition happens before cleanup is
+ * awaited, so task/token readers stop trusting the credential immediately. */
+export async function rollbackClaimedGitHubCredentialSet(
+  userId: string,
+  generation: number,
+  deps: ConnectClearDeps = {},
+): Promise<boolean> {
+  const rollback = claimGithubCredentialGeneration(
+    userId,
+    generation,
+    "clear",
+  );
+  if (!rollback) return false;
+  try {
+    await onConnectClear(userId, deps);
+  } catch (err) {
+    console.warn(
+      `[github] user ${userId}: claimed set rollback cleanup failed: ${
+        err instanceof Error ? err.message : err
+      }`,
+    );
+  }
+  return true;
+}
+
+interface StoredGitHubGrant {
+  token: string;
+  kind: string;
+  installationId?: number;
+  generation?: number;
+}
+
+type PersistedGitHubGrant = StoredGitHubGrant & {
+  installationId: number;
+  generation: number;
+};
+
+/** Decrypt any stored token, including an inert row from an older generation.
+ * Transition handlers need the old ciphertext solely so they can revoke it;
+ * task and verification readers use `readCurrentStoredToken` below. */
 function readStoredToken(
   userId: string,
-): { token: string; kind: string } | null {
+): PersistedGitHubGrant | null {
   const row = getDb()
     .select()
     .from(schema.githubTokens)
@@ -425,7 +595,20 @@ function readStoredToken(
     Buffer.from(row.refreshTokenCt as Uint8Array),
     Buffer.from(row.refreshTokenNonce as Uint8Array),
   );
-  return { token, kind: row.kind };
+  return {
+    token,
+    kind: row.kind,
+    installationId: row.installationId,
+    generation: row.generation,
+  };
+}
+
+function readCurrentStoredToken(userId: string): PersistedGitHubGrant | null {
+  const stored = readStoredToken(userId);
+  return stored &&
+    githubCredentialGenerationMatches(userId, stored.generation)
+    ? stored
+    : null;
 }
 
 export function deleteToken(userId: string): void {
@@ -438,13 +621,7 @@ export function deleteToken(userId: string): void {
 }
 
 export function hasToken(userId: string): boolean {
-  return (
-    getDb()
-      .select({ userId: schema.githubTokens.userId })
-      .from(schema.githubTokens)
-      .where(eq(schema.githubTokens.userId, userId))
-      .get() != null
-  );
+  return readCurrentStoredToken(userId) !== null;
 }
 
 /** All cloud user ids with a GitHub token on this host (for capabilities). */
@@ -452,6 +629,20 @@ export function connectedUserIds(): string[] {
   return getDb()
     .select({ userId: schema.githubTokens.userId })
     .from(schema.githubTokens)
+    .innerJoin(
+      schema.githubCredentialGenerations,
+      and(
+        eq(
+          schema.githubCredentialGenerations.userId,
+          schema.githubTokens.userId,
+        ),
+        eq(
+          schema.githubCredentialGenerations.generation,
+          schema.githubTokens.generation,
+        ),
+      ),
+    )
+    .where(eq(schema.githubCredentialGenerations.mutation, "set"))
     .all()
     .map((r) => r.userId);
 }
@@ -617,6 +808,326 @@ const accessCache = new Map<
   { accessToken: string; expiresAt: number }
 >();
 
+const INSTALLATION_PAGE_SIZE = 100;
+const REPOSITORY_PAGE_SIZE = 100;
+const REPOSITORY_PAGE_CAP = Math.ceil(
+  MAX_GITHUB_REPOSITORIES_PER_INSTALLATION / REPOSITORY_PAGE_SIZE,
+);
+const GITHUB_LIST_TIMEOUT_MS = 10_000;
+// Bound only the GitHub listing phase. The installation bridge allows 60s so a
+// legacy refresh-token exchange (up to 30s) can precede this 25s window; the
+// repository bridge uses 30s because the complete installation call has just
+// warmed that user's access-token cache. Every REST page gets the smaller of
+// its normal timeout and the remaining listing budget.
+const GITHUB_LIST_OPERATION_TIMEOUT_MS = 25_000;
+
+function githubListSignal(deadline: number): AbortSignal {
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) throw new Error("github list operation timed out");
+  return AbortSignal.timeout(Math.min(GITHUB_LIST_TIMEOUT_MS, remaining));
+}
+
+export class GitHubRepositoryAccessError extends Error {
+  constructor(
+    readonly code: GitHubRepositoryAccessErrorCode,
+    message: string,
+  ) {
+    super(message);
+    this.name = "GitHubRepositoryAccessError";
+  }
+}
+
+interface GitHubListDeps {
+  requestAccessToken?: typeof requestAccessToken;
+  fetch?: typeof fetch;
+  credentialGenerationMatches?: typeof githubCredentialGenerationMatches;
+}
+
+/**
+ * GitHub REST origin. Mirrors the cloud's lib/github/origins.ts contract,
+ * including its most important property: production ignores the override
+ * entirely, so a staged URL can never be pointed at a real user's token.
+ */
+function githubApiOrigin(): string {
+  const fallback = "https://api.github.com";
+  if (process.env.NODE_ENV === "production") return fallback;
+  const configured = process.env.UAI_GITHUB_API_URL?.trim();
+  if (!configured) return fallback;
+  const url = new URL(configured);
+  if (
+    (url.protocol !== "http:" && url.protocol !== "https:") ||
+    url.username ||
+    url.password
+  ) {
+    throw new Error("UAI_GITHUB_API_URL must be an HTTP(S) origin");
+  }
+  return url.origin;
+}
+
+/**
+ * Every installation GitHub currently lists for this user, read with the token
+ * this host already holds — the host-side half of `gh.installations.list`.
+ *
+ * This is what lets a misbound installation row be pruned without the user
+ * reconnecting: the cloud mirror predates `(user_id, installation_id)` keying
+ * and cannot be trusted, but the host can ask GitHub on the user's behalf at
+ * any time, with no browser round trip.
+ *
+ * THROWS rather than returning a partial list. The caller prunes bindings that
+ * are absent from the result, so a truncated or failed read would delete
+ * legitimate grants — absence is only meaningful in a list we fully retrieved.
+ */
+export async function listUserInstallationIds(
+  userId: string,
+  deps: GitHubListDeps = {},
+  generation = 0,
+): Promise<number[]> {
+  if (
+    !(deps.credentialGenerationMatches ?? githubCredentialGenerationMatches)(
+      userId,
+      generation,
+    )
+  ) {
+    throw new GitHubRepositoryAccessError(
+      "reauth_required",
+      "the host GitHub credential belongs to a different binding generation",
+    );
+  }
+  let tok: Awaited<ReturnType<typeof requestAccessToken>>;
+  try {
+    tok = await (deps.requestAccessToken ?? requestAccessToken)(userId);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new GitHubRepositoryAccessError(
+      isTransientGithubError(reason) ? "github_unavailable" : "reauth_required",
+      reason,
+    );
+  }
+  if (!tok) {
+    throw new GitHubRepositoryAccessError(
+      "token_missing",
+      `no github token stored for user ${userId}`,
+    );
+  }
+  const ids = new Set<number>();
+  const deadline = Date.now() + GITHUB_LIST_OPERATION_TIMEOUT_MS;
+  let res: Response;
+  try {
+    res = await (deps.fetch ?? fetch)(
+      `${githubApiOrigin()}/user/installations` +
+        `?per_page=${INSTALLATION_PAGE_SIZE}&page=1`,
+      {
+        headers: {
+          authorization: `Bearer ${tok.accessToken}`,
+          accept: "application/vnd.github+json",
+          "user-agent": "uai-host",
+        },
+        signal: githubListSignal(deadline),
+      },
+    );
+  } catch (err) {
+    throw new GitHubRepositoryAccessError(
+      "github_unavailable",
+      err instanceof Error ? err.message : String(err),
+    );
+  }
+  if (!res.ok) {
+    throw new GitHubRepositoryAccessError(
+      res.status === 401 ? "reauth_required" : "github_unavailable",
+      `github installation list failed: HTTP ${res.status}`,
+    );
+  }
+  let data: { total_count?: unknown; installations?: unknown };
+  try {
+    data = (await res.json()) as {
+      total_count?: unknown;
+      installations?: unknown;
+    };
+  } catch {
+    throw new GitHubRepositoryAccessError(
+      "invalid_response",
+      "github installation list returned invalid json",
+    );
+  }
+  if (
+    !Number.isSafeInteger(data.total_count) ||
+    (data.total_count as number) < 0 ||
+    (data.total_count as number) > MAX_GITHUB_INSTALLATIONS ||
+    !Array.isArray(data.installations) ||
+    data.installations.length !== data.total_count
+  ) {
+    throw new GitHubRepositoryAccessError(
+      "invalid_response",
+      "github installation list returned an incomplete body",
+    );
+  }
+  for (const inst of data.installations) {
+    // Reject the whole response rather than skipping the entry. The caller
+    // prunes bindings absent from this list, so a silently dropped or duplicate
+    // id is indistinguishable from a complete GitHub verdict.
+    if (!inst || typeof inst !== "object") {
+      throw new GitHubRepositoryAccessError(
+        "invalid_response",
+        "github returned a malformed installation entry",
+      );
+    }
+    const id = (inst as { id?: unknown }).id;
+    if (
+      !Number.isSafeInteger(id) ||
+      (id as number) <= 0 ||
+      ids.has(id as number)
+    ) {
+      throw new GitHubRepositoryAccessError(
+        "invalid_response",
+        "github returned a malformed or duplicate installation id",
+      );
+    }
+    ids.add(id as number);
+  }
+
+  // A newer set/clear may have landed while GitHub was answering. Returning
+  // the old actor's complete list after that point would let the cloud prune
+  // bindings under the newer credential, so re-check at the publication edge.
+  if (
+    !(deps.credentialGenerationMatches ?? githubCredentialGenerationMatches)(
+      userId,
+      generation,
+    )
+  ) {
+    throw new GitHubRepositoryAccessError(
+      "reauth_required",
+      "the host GitHub credential changed during installation verification",
+    );
+  }
+
+  return [...ids];
+}
+
+export async function listUserInstallationRepositoryIds(
+  userId: string,
+  installationId: number,
+  deps: GitHubListDeps = {},
+  generation = 0,
+): Promise<{ repositoryIds: number[]; truncated: boolean }> {
+  if (
+    !(deps.credentialGenerationMatches ?? githubCredentialGenerationMatches)(
+      userId,
+      generation,
+    )
+  ) {
+    throw new GitHubRepositoryAccessError(
+      "reauth_required",
+      "the host GitHub credential belongs to a different binding generation",
+    );
+  }
+  let tok: Awaited<ReturnType<typeof requestAccessToken>>;
+  try {
+    tok = await (deps.requestAccessToken ?? requestAccessToken)(userId);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new GitHubRepositoryAccessError(
+      isTransientGithubError(reason) ? "github_unavailable" : "reauth_required",
+      reason,
+    );
+  }
+  if (!tok) {
+    throw new GitHubRepositoryAccessError(
+      "token_missing",
+      `no github token stored for user ${userId}`,
+    );
+  }
+  const repositoryIds = new Set<number>();
+  let truncated = false;
+  const deadline = Date.now() + GITHUB_LIST_OPERATION_TIMEOUT_MS;
+  for (let page = 1; page <= REPOSITORY_PAGE_CAP; page++) {
+    let res: Response;
+    try {
+      res = await (deps.fetch ?? fetch)(
+        `${githubApiOrigin()}/user/installations/${installationId}/repositories` +
+          `?per_page=${REPOSITORY_PAGE_SIZE}&page=${page}`,
+        {
+          headers: {
+            authorization: `Bearer ${tok.accessToken}`,
+            accept: "application/vnd.github+json",
+            "user-agent": "uai-host",
+          },
+          signal: githubListSignal(deadline),
+        },
+      );
+    } catch (err) {
+      throw new GitHubRepositoryAccessError(
+        "github_unavailable",
+        err instanceof Error ? err.message : String(err),
+      );
+    }
+    if (!res.ok) {
+      const code: GitHubRepositoryAccessErrorCode =
+        res.status === 401
+          ? "reauth_required"
+          : res.status === 404
+            ? "installation_inaccessible"
+            : "github_unavailable";
+      throw new GitHubRepositoryAccessError(
+        code,
+        `github repository list failed for installation ${installationId}: HTTP ${res.status}`,
+      );
+    }
+    let data: { repositories?: unknown };
+    try {
+      data = (await res.json()) as { repositories?: unknown };
+    } catch {
+      throw new GitHubRepositoryAccessError(
+        "invalid_response",
+        "github repository list returned invalid json",
+      );
+    }
+    if (!Array.isArray(data.repositories)) {
+      throw new GitHubRepositoryAccessError(
+        "invalid_response",
+        "github repository list returned an invalid body",
+      );
+    }
+    const batch = data.repositories;
+    for (const repo of batch) {
+      if (!repo || typeof repo !== "object") {
+        // Repository results are an allowlist. Omitting an unparseable entry
+        // can only withhold access, so preserve the valid IDs but make the
+        // partial result explicit. (Installation-list entries are different:
+        // omission there could drive a destructive prune and must throw.)
+        truncated = true;
+        continue;
+      }
+      const id = (repo as { id?: unknown }).id;
+      if (!Number.isSafeInteger(id) || (id as number) <= 0) {
+        truncated = true;
+        continue;
+      }
+      repositoryIds.add(id as number);
+    }
+    if (batch.length < REPOSITORY_PAGE_SIZE) break;
+    if (page === REPOSITORY_PAGE_CAP) truncated = true;
+  }
+  if (
+    !(deps.credentialGenerationMatches ?? githubCredentialGenerationMatches)(
+      userId,
+      generation,
+    )
+  ) {
+    throw new GitHubRepositoryAccessError(
+      "reauth_required",
+      "the host GitHub credential changed during repository verification",
+    );
+  }
+  return {
+    repositoryIds: [...repositoryIds].slice(
+      0,
+      MAX_GITHUB_REPOSITORIES_PER_INSTALLATION,
+    ),
+    truncated:
+      truncated || repositoryIds.size > MAX_GITHUB_REPOSITORIES_PER_INSTALLATION,
+  };
+}
+
 /** Test hook: reset the access-token cache. */
 export function clearAllAccessCache(): void {
   accessCache.clear();
@@ -630,17 +1141,10 @@ export function requestAccessToken(
   const generation = githubAuthGeneration(userId);
   // ADR-033 non-expiring path: the stored token IS the access token — return it
   // directly, no exchange/cache/rotation. `expiresAt: null` ⇒ no refresh.
-  const row = getDb()
-    .select({ kind: schema.githubTokens.kind })
-    .from(schema.githubTokens)
-    .where(eq(schema.githubTokens.userId, userId))
-    .get();
+  const row = readCurrentStoredToken(userId);
   if (!row) return Promise.resolve(null);
   if (row.kind === "access") {
-    const stored = readStoredToken(userId);
-    return Promise.resolve(
-      stored ? { accessToken: stored.token, expiresAt: null } : null,
-    );
+    return Promise.resolve({ accessToken: row.token, expiresAt: null });
   }
 
   // Legacy expiring path (ADR-027): cache + in-flight dedupe + exchange.
@@ -671,11 +1175,26 @@ async function doRequestAccessToken(
   userId: string,
   generation: number,
 ): Promise<{ accessToken: string; expiresAt: number } | null> {
-  const row = getDb()
-    .select()
-    .from(schema.githubTokens)
-    .where(eq(schema.githubTokens.userId, userId))
-    .get();
+  const row = getDb().transaction((tx) => {
+    const token = tx
+      .select()
+      .from(schema.githubTokens)
+      .where(eq(schema.githubTokens.userId, userId))
+      .get();
+    if (!token) return null;
+    const fence = tx
+      .select({
+        generation: schema.githubCredentialGenerations.generation,
+        mutation: schema.githubCredentialGenerations.mutation,
+      })
+      .from(schema.githubCredentialGenerations)
+      .where(eq(schema.githubCredentialGenerations.userId, userId))
+      .get();
+    return fence?.mutation === "set" &&
+      fence.generation === token.generation
+      ? token
+      : null;
+  });
   if (!row) return null;
 
   const refreshToken = openAesGcm(
@@ -715,17 +1234,37 @@ async function doRequestAccessToken(
     githubAuthGeneration(userId) === generation
   ) {
     const sealed = sealAesGcm(data.refreshToken);
-    getDb()
-      .update(schema.githubTokens)
-      .set({
-        refreshTokenCt: sealed.ct,
-        refreshTokenNonce: sealed.nonce,
-        refreshTokenExpiresAt:
-          data.refreshTokenExpiresAt ?? row.refreshTokenExpiresAt,
-        updatedAt: Date.now(),
-      })
-      .where(eq(schema.githubTokens.userId, userId))
-      .run();
+    getDb().transaction((tx) => {
+      const fence = tx
+        .select({
+          generation: schema.githubCredentialGenerations.generation,
+          mutation: schema.githubCredentialGenerations.mutation,
+        })
+        .from(schema.githubCredentialGenerations)
+        .where(eq(schema.githubCredentialGenerations.userId, userId))
+        .get();
+      if (
+        fence?.mutation !== "set" ||
+        fence.generation !== row.generation
+      ) {
+        return;
+      }
+      tx.update(schema.githubTokens)
+        .set({
+          refreshTokenCt: sealed.ct,
+          refreshTokenNonce: sealed.nonce,
+          refreshTokenExpiresAt:
+            data.refreshTokenExpiresAt ?? row.refreshTokenExpiresAt,
+          updatedAt: Date.now(),
+        })
+        .where(
+          and(
+            eq(schema.githubTokens.userId, userId),
+            eq(schema.githubTokens.generation, row.generation),
+          ),
+        )
+        .run();
+    });
   }
   return { accessToken: data.accessToken, expiresAt: data.expiresAt };
 }
@@ -1055,10 +1594,35 @@ export async function setupTaskGithub(
     if (!isCurrent()) return false;
     const pat = process.env.UAI_GH_PAT_FALLBACK;
     if (pat) {
-      await _inject(taskId, pat);
-      clearGithubRetry(taskId);
-      console.log(`[github] task ${taskId}: using PAT fallback (no refresh)`);
-      return true;
+      // The PAT is ONE host-wide credential, and injectIntoContainer wires it
+      // into `gh` AND all git transport. Injecting it for whoever happens to
+      // own the task therefore authenticates that user's container as the
+      // PAT's owner, handing every unconnected user the owner's full
+      // read/write repository access. That was invisible while a host had one
+      // user and became a silent cross-user credential leak the moment it had
+      // two. Bind the PAT to the single user it belongs to and fail closed
+      // otherwise: a host that upgrades into multi-user must not start
+      // leaking because nobody remembered to unset an env var.
+      const patOwner = process.env.UAI_GH_PAT_FALLBACK_USER_ID;
+      if (!patOwner) {
+        console.warn(
+          `[github] task ${taskId}: UAI_GH_PAT_FALLBACK is set but ` +
+            "UAI_GH_PAT_FALLBACK_USER_ID is not — refusing to inject a " +
+            "host-wide PAT into a task. Set the owner's user id to keep the " +
+            "single-user fallback, or remove the PAT and connect GitHub per " +
+            "user.",
+        );
+      } else if (patOwner !== userId) {
+        console.warn(
+          `[github] task ${taskId}: PAT fallback is owned by ${patOwner}, ` +
+            `not task owner ${userId} — skipping.`,
+        );
+      } else {
+        await _inject(taskId, pat);
+        clearGithubRetry(taskId);
+        console.log(`[github] task ${taskId}: using PAT fallback (no refresh)`);
+        return true;
+      }
     }
     console.log(`[github] task ${taskId}: gh not configured for user ${userId}`);
     return false;