@runuai/host 0.9.111 → 0.9.113

package/db/migrations/0020_user_credential_store_ref.sql

@@ -0,0 +1,6 @@
+-- ADR-134 slice 2 (host 0.9.113): per-user credentials mirror to the
+-- credential store on Uai-operated hosts. Null on owned hosts and before the
+-- first successful mirror.
+ALTER TABLE `host_github_tokens` ADD `store_ref` text;--> statement-breakpoint
+ALTER TABLE `host_ssh_keys` ADD `store_ref` text;--> statement-breakpoint
+ALTER TABLE `host_mcp_connections` ADD `store_ref` text;

package/db/migrations/meta/_journal.json

@@ -141,6 +141,13 @@
       "when": 1788900000001,
       "tag": "0019_engine_account_store_ref",
       "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "6",
+      "when": 1788900000002,
+      "tag": "0020_user_credential_store_ref",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -129,6 +129,8 @@ export const githubTokens = sqliteTable("host_github_tokens", {
   // "access" (non-expiring, ADR-033) | "refresh" (expiring, ADR-027).
   kind: text("kind").notNull().default("refresh"),
   updatedAt: integer("updated_at").notNull(),
+  // ADR-134 slice 2: the credential-store parameter this row mirrors to.
+  storeRef: text("store_ref"),
 });
 
 export type GithubToken = typeof githubTokens.$inferSelect;
@@ -158,6 +160,8 @@ export const sshKeys = sqliteTable("host_ssh_keys", {
   privateKeyNonce: blob("private_key_nonce").notNull(),
   createdAt: integer("created_at").notNull(),
   updatedAt: integer("updated_at").notNull(),
+  // ADR-134 slice 2: the credential-store parameter this row mirrors to.
+  storeRef: text("store_ref"),
 });
 
 export type SshKey = typeof sshKeys.$inferSelect;
@@ -253,6 +257,8 @@ export const mcpConnections = sqliteTable("host_mcp_connections", {
   status: text("status").notNull().default("pending"), // pending|connected
   scopes: text("scopes"),
   updatedAt: integer("updated_at", { mode: "number" }).notNull(),
+  // ADR-134 slice 2: the credential-store parameter this row mirrors to.
+  storeRef: text("store_ref"),
 });
 
 export type McpConnection = typeof mcpConnections.$inferSelect;

package/lib/credential-store.ts

@@ -237,6 +237,47 @@ export class AwsSsmCredentialStore implements CredentialStore {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Write queue shared by every mirrored table (engine accounts, GitHub tokens,
+// SSH keys, MCP connections). Mirrors are async and best effort: a store
+// outage delays a mirror, never a task-up or a UI action.
+// ---------------------------------------------------------------------------
+
+const inflight = new Set<Promise<void>>();
+
+/** Run `work` against the configured store off the caller's path; a no-op on
+ *  owned hosts. Failures are logged (never the value) and never thrown. */
+export function queueStoreWrite(
+  what: string,
+  work: (store: CredentialStore) => Promise<void>,
+): void {
+  const store = configuredCredentialStore();
+  if (!store) return;
+  const p: Promise<void> = work(store)
+    .catch((err: unknown) => {
+      console.warn(
+        `[credential-store] ${what} failed: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    })
+    .finally(() => {
+      inflight.delete(p);
+    });
+  inflight.add(p);
+}
+
+/** Tests / shutdown: wait for every queued mirror or delete to settle. */
+export async function settleStoreWrites(): Promise<void> {
+  while (inflight.size > 0) await Promise.allSettled([...inflight]);
+}
+
+/** `<prefix>/users/<userId>/<…>` — the per-user subtree (GitHub token, SSH
+ *  key, MCP connections). The STS `user` session tag scopes it later. */
+export function userParameterName(userId: string, ...segments: string[]): string {
+  return parameterName(credentialStorePrefix(), "users", userId, ...segments);
+}
+
 // ---------------------------------------------------------------------------
 // Process-wide configuration.
 // ---------------------------------------------------------------------------

package/lib/engine-accounts.ts

@@ -46,6 +46,8 @@ import {
   credentialStorePrefix,
   isParameterPathSegment,
   parameterName,
+  queueStoreWrite,
+  settleStoreWrites,
   type CredentialStore,
 } from "./credential-store";
 import { getDb, schema } from "./db";
@@ -1127,7 +1129,6 @@ type StoreRow = {
 
 let storeHostId: string | null = null;
 let warnedNoHostId = false;
-const inflight = new Set<Promise<void>>();
 
 /** main.ts: the host id that names `host`-scope parameters. */
 export function configureEngineAccountStore(opts: { hostId: string | null }): void {
@@ -1136,7 +1137,7 @@ export function configureEngineAccountStore(opts: { hostId: string | null }): vo
 
 /** Tests: wait for every queued mirror/delete to settle. */
 export async function settleEngineAccountStoreWrites(): Promise<void> {
-  while (inflight.size > 0) await Promise.allSettled([...inflight]);
+  await settleStoreWrites();
 }
 
 /**
@@ -1240,22 +1241,6 @@ function parseStoredAccount(value: string): StoredEngineAccount {
   };
 }
 
-function queueStoreWrite(what: string, work: (store: CredentialStore) => Promise<void>): void {
-  const store = configuredCredentialStore();
-  if (!store) return;
-  const p: Promise<void> = work(store)
-    .catch((err: unknown) => {
-      console.warn(
-        `[engine-accounts] credential store ${what} failed: ${
-          err instanceof Error ? err.message : String(err)
-        }`,
-      );
-    })
-    .finally(() => {
-      inflight.delete(p);
-    });
-  inflight.add(p);
-}
 
 function selectRow(id: string): StoreRow | undefined {
   return getDb()

package/lib/engine-login.ts

@@ -27,6 +27,7 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 
 import {
+  ENGINE_LOGIN_KINDS,
   HOST_ACCOUNT_SCOPE,
   isEngineAccountLabel,
   isEngineAccountScope,
@@ -808,7 +809,14 @@ export class EngineLoginManager {
             "The login container stopped unexpectedly.",
           ),
       );
-    } catch {
+    } catch (error) {
+      // The operator sees a one-line failure; the journal must say WHY (the
+      // 2026-09-09 sweep refusal was silent for six hours).
+      console.warn(
+        `[engine-login] ${operation.engine} login could not start: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
       if (processHandle && !operation.process) {
         await this.stopDetachedProcess(processHandle);
       }
@@ -2260,8 +2268,15 @@ export function codexCallbackReplayDockerRequest(
   };
 }
 
-function isEngineLoginContainerName(value: string): boolean {
-  return /^uai-login-(?:claude|codex)-[0-9a-f]{16}$/.test(value);
+const ENGINE_LOGIN_CONTAINER_NAME = new RegExp(
+  `^uai-login-(?:${ENGINE_LOGIN_KINDS.join("|")})-[0-9a-f]{16}$`,
+);
+
+/** `uai-login-<kind>-<16 hex>` for every login kind. The sweep, the log
+ *  follower, the remover, and the codex callback replay all gate on this, so
+ *  a kind missing here strands its containers AND blocks every later login. */
+export function isEngineLoginContainerName(value: string): boolean {
+  return ENGINE_LOGIN_CONTAINER_NAME.test(value);
 }
 
 /** The CLI that owns login containers (ADR-106): the ambient docker client,

package/lib/github-tokens.ts

@@ -9,6 +9,7 @@
 
 import { and, eq } from "drizzle-orm";
 
+import { queueStoreWrite, userParameterName } from "./credential-store";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import { dockerCli } from "./docker-exec";
@@ -446,10 +447,13 @@ export async function onConnectSet(
 }
 
 function deleteStoredTokenRow(userId: string): void {
-  getDb()
+  const result = getDb()
     .delete(schema.githubTokens)
     .where(eq(schema.githubTokens.userId, userId))
     .run();
+  // A connect clears any prior grant first; with none stored there is no
+  // parameter to delete either.
+  if (result.changes > 0) deleteGithubTokenFromStore(userId);
 }
 
 function storeTokenRow(
@@ -484,6 +488,117 @@ function storeTokenRow(
       .onConflictDoUpdate({ target: schema.githubTokens.userId, set: fields })
       .run();
   });
+  mirrorGithubTokenToStore(userId);
+}
+
+// ---------------------------------------------------------------------------
+// Credential store mirror (ADR-134 slice 2): `<prefix>/users/<userId>/github`.
+// The generation rides along so a replacement host imports the row behind the
+// same durable fence (a later disconnect this host never saw still wins).
+// Owned hosts: no-ops.
+// ---------------------------------------------------------------------------
+
+export interface StoredGithubToken {
+  v: 1;
+  kind: "github";
+  userId: string;
+  installationId: number;
+  generation: number;
+  tokenKind: string;
+  token: string;
+  expiresAt: number | null;
+  updatedAt: number;
+}
+
+export function githubTokenParameterName(userId: string): string {
+  return userParameterName(userId, "github");
+}
+
+/** The row as it is mirrored (token decrypted). Never logged. */
+export function githubTokenStoreValue(userId: string): StoredGithubToken | null {
+  const row = getDb()
+    .select()
+    .from(schema.githubTokens)
+    .where(eq(schema.githubTokens.userId, userId))
+    .get();
+  if (!row) return null;
+  return {
+    v: 1,
+    kind: "github",
+    userId,
+    installationId: row.installationId,
+    generation: row.generation,
+    tokenKind: row.kind,
+    token: openAesGcm(
+      Buffer.from(row.refreshTokenCt as Uint8Array),
+      Buffer.from(row.refreshTokenNonce as Uint8Array),
+    ),
+    expiresAt: row.refreshTokenExpiresAt ?? null,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function setGithubTokenStoreRef(userId: string, storeRef: string): void {
+  getDb()
+    .update(schema.githubTokens)
+    .set({ storeRef })
+    .where(eq(schema.githubTokens.userId, userId))
+    .run();
+}
+
+export function listGithubTokenStoreRows(): Array<{ userId: string; storeRef: string | null }> {
+  return getDb()
+    .select({ userId: schema.githubTokens.userId, storeRef: schema.githubTokens.storeRef })
+    .from(schema.githubTokens)
+    .all();
+}
+
+export function mirrorGithubTokenToStore(userId: string): void {
+  queueStoreWrite(`mirror github token ${userId}`, async (store) => {
+    const value = githubTokenStoreValue(userId);
+    if (!value) return;
+    const name = githubTokenParameterName(userId);
+    await store.put(name, JSON.stringify(value));
+    setGithubTokenStoreRef(userId, name);
+  });
+}
+
+export function deleteGithubTokenFromStore(userId: string): void {
+  queueStoreWrite(`delete github token ${userId}`, (store) =>
+    store.delete(githubTokenParameterName(userId)),
+  );
+}
+
+/**
+ * Reconcile import: a token this host lacks. Claims the stored generation as
+ * a `set` first — refused (false) when this host's fence already moved past
+ * it, so a disconnect that outran the store's delete can never resurrect a
+ * token here.
+ */
+export function importGithubTokenFromStore(
+  value: StoredGithubToken,
+  storeRef: string,
+): boolean {
+  const claim = claimGithubCredentialGeneration(value.userId, value.generation, "set");
+  if (!claim) return false;
+  const sealed = sealAesGcm(value.token);
+  const fields = {
+    installationId: value.installationId,
+    generation: value.generation,
+    refreshTokenCt: sealed.ct,
+    refreshTokenNonce: sealed.nonce,
+    refreshTokenExpiresAt: value.expiresAt,
+    kind: value.tokenKind,
+    updatedAt: value.updatedAt,
+    storeRef,
+  };
+  getDb()
+    .insert(schema.githubTokens)
+    .values({ userId: value.userId, ...fields })
+    .onConflictDoUpdate({ target: schema.githubTokens.userId, set: fields })
+    .run();
+  notifyGithubChange();
+  return true;
 }
 
 async function bestEffortRevoke(
@@ -663,6 +778,7 @@ export function deleteToken(userId: string): void {
     .delete(schema.githubTokens)
     .where(eq(schema.githubTokens.userId, userId))
     .run();
+  deleteGithubTokenFromStore(userId);
   advanceGithubAuthGeneration(userId);
   notifyGithubChange();
 }

package/lib/mcp-connections.ts

@@ -14,6 +14,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { eq } from "drizzle-orm";
 
+import { queueStoreWrite, userParameterName } from "./credential-store";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import type { McpOp } from "../src/protocol";
@@ -276,10 +277,7 @@ export async function handleMcpOp(op: McpOp): Promise<McpAck> {
     case "oauth.complete":
       return oauthComplete(op.connectionId, op.code);
     case "disconnect": {
-      getDb()
-        .delete(schema.mcpConnections)
-        .where(eq(schema.mcpConnections.id, op.connectionId))
-        .run();
+      deleteMcpConnectionLocal(op.connectionId);
       return { status: "disconnected" };
     }
   }
@@ -334,6 +332,7 @@ async function probe(op: Extract<McpOp, { kind: "probe" }>): Promise<McpAck> {
         },
       })
       .run();
+    mirrorMcpConnectionToStore(op.connectionId);
     return { status: "connected" };
   }
 
@@ -354,6 +353,7 @@ async function probe(op: Extract<McpOp, { kind: "probe" }>): Promise<McpAck> {
         set: { url: op.url, authKind: "none", status: "connected", updatedAt: now },
       })
       .run();
+    mirrorMcpConnectionToStore(op.connectionId);
     return { status: "connected" };
   }
   if (res.status !== 401 && res.status !== 403) {
@@ -414,6 +414,7 @@ async function probe(op: Extract<McpOp, { kind: "probe" }>): Promise<McpAck> {
     .values({ id: op.connectionId, ...fields })
     .onConflictDoUpdate({ target: schema.mcpConnections.id, set: fields })
     .run();
+  mirrorMcpConnectionToStore(op.connectionId);
   return { status: "auth_required", authorizeUrl: authorize.toString() };
 }
 
@@ -472,6 +473,7 @@ async function oauthComplete(connectionId: string, code: string): Promise<McpAck
     })
     .where(eq(schema.mcpConnections.id, connectionId))
     .run();
+  mirrorMcpConnectionToStore(connectionId);
   return {
     status: "connected",
     scopes: scopes ? scopes.split(" ").filter(Boolean) : undefined,
@@ -611,5 +613,137 @@ async function refreshTokens(
     .set({ secretEnc: pack(JSON.stringify(next)), updatedAt: Date.now() })
     .where(eq(schema.mcpConnections.id, row.id))
     .run();
+  mirrorMcpConnectionToStore(row.id);
   return next;
 }
+
+// ---------------------------------------------------------------------------
+// Credential store mirror (ADR-134 slice 2):
+// `<prefix>/users/<userId>/mcp/<connectionId>`. The connection id is the
+// cloud's, which is org-bound there; on the host the owner is the user.
+// Owned hosts: no-ops.
+// ---------------------------------------------------------------------------
+
+export interface StoredMcpConnection {
+  v: 1;
+  kind: "mcp";
+  id: string;
+  userId: string;
+  url: string;
+  authKind: string;
+  tokenEndpoint: string | null;
+  redirectUri: string | null;
+  clientId: string | null;
+  clientSecret: string | null;
+  pkceVerifier: string | null;
+  /** The sealed JSON, decrypted: header or OAuth tokens. */
+  secret: string | null;
+  status: string;
+  scopes: string | null;
+  updatedAt: number;
+}
+
+export function mcpConnectionParameterName(userId: string, id: string): string {
+  return userParameterName(userId, "mcp", id);
+}
+
+/** The row as it is mirrored (secrets decrypted). Never logged. */
+export function mcpConnectionStoreValue(id: string): StoredMcpConnection | null {
+  const row = getDb()
+    .select()
+    .from(schema.mcpConnections)
+    .where(eq(schema.mcpConnections.id, id))
+    .get();
+  if (!row) return null;
+  return {
+    v: 1,
+    kind: "mcp",
+    id: row.id,
+    userId: row.userId,
+    url: row.url,
+    authKind: row.authKind,
+    tokenEndpoint: row.tokenEndpoint,
+    redirectUri: row.redirectUri,
+    clientId: row.clientId,
+    clientSecret: row.clientSecretEnc ? unpack(row.clientSecretEnc) : null,
+    pkceVerifier: row.pkceVerifierEnc ? unpack(row.pkceVerifierEnc) : null,
+    secret: row.secretEnc ? unpack(row.secretEnc) : null,
+    status: row.status,
+    scopes: row.scopes,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function setMcpConnectionStoreRef(id: string, storeRef: string): void {
+  getDb()
+    .update(schema.mcpConnections)
+    .set({ storeRef })
+    .where(eq(schema.mcpConnections.id, id))
+    .run();
+}
+
+export function listMcpConnectionStoreRows(): Array<{
+  id: string;
+  userId: string;
+  storeRef: string | null;
+}> {
+  return getDb()
+    .select({
+      id: schema.mcpConnections.id,
+      userId: schema.mcpConnections.userId,
+      storeRef: schema.mcpConnections.storeRef,
+    })
+    .from(schema.mcpConnections)
+    .all();
+}
+
+export function mirrorMcpConnectionToStore(id: string): void {
+  queueStoreWrite(`mirror mcp connection ${id}`, async (store) => {
+    const value = mcpConnectionStoreValue(id);
+    if (!value) return;
+    const name = mcpConnectionParameterName(value.userId, id);
+    await store.put(name, JSON.stringify(value));
+    setMcpConnectionStoreRef(id, name);
+  });
+}
+
+/** Delete the row and its parameter (the disconnect op and reconcile). */
+export function deleteMcpConnectionLocal(id: string): void {
+  const row = getDb()
+    .select({ userId: schema.mcpConnections.userId, storeRef: schema.mcpConnections.storeRef })
+    .from(schema.mcpConnections)
+    .where(eq(schema.mcpConnections.id, id))
+    .get();
+  getDb().delete(schema.mcpConnections).where(eq(schema.mcpConnections.id, id)).run();
+  if (!row) return;
+  const name = row.storeRef ?? mcpConnectionParameterName(row.userId, id);
+  queueStoreWrite(`delete mcp connection ${id}`, (store) => store.delete(name));
+}
+
+/** Reconcile import: a connection this host lacks. Existing rows win. */
+export function importMcpConnectionFromStore(
+  value: StoredMcpConnection,
+  storeRef: string,
+): boolean {
+  const result = getDb()
+    .insert(schema.mcpConnections)
+    .values({
+      id: value.id,
+      userId: value.userId,
+      url: value.url,
+      authKind: value.authKind,
+      tokenEndpoint: value.tokenEndpoint,
+      redirectUri: value.redirectUri,
+      clientId: value.clientId,
+      clientSecretEnc: value.clientSecret === null ? null : pack(value.clientSecret),
+      pkceVerifierEnc: value.pkceVerifier === null ? null : pack(value.pkceVerifier),
+      secretEnc: value.secret === null ? null : pack(value.secret),
+      status: value.status,
+      scopes: value.scopes,
+      updatedAt: value.updatedAt,
+      storeRef,
+    })
+    .onConflictDoNothing({ target: schema.mcpConnections.id })
+    .run();
+  return result.changes > 0;
+}

package/lib/ssh.ts

@@ -23,6 +23,7 @@ import { join, resolve } from "node:path";
 
 import { eq } from "drizzle-orm";
 
+import { queueStoreWrite, userParameterName } from "./credential-store";
 import { getDb, schema } from "./db";
 import { env } from "./env";
 import { sealAesGcm, openAesGcm } from "./secrets";
@@ -104,12 +105,102 @@ export function ensureKeyForUser(userId: string): string {
     })
     .onConflictDoNothing({ target: schema.sshKeys.userId })
     .run();
+  mirrorSshKeyToStore(userId);
   // Re-read in case a concurrent task-up won the insert race.
   return getPublicKey(userId) ?? publicKey;
 }
 
 export function deleteKey(userId: string): void {
   getDb().delete(schema.sshKeys).where(eq(schema.sshKeys.userId, userId)).run();
+  queueStoreWrite(`delete ssh key ${userId}`, (store) =>
+    store.delete(sshKeyParameterName(userId)),
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Credential store mirror (ADR-134 slice 2): `<prefix>/users/<userId>/ssh`.
+// A replacement Uai-operated host imports the SAME keypair, so the public key
+// the user pasted into GitHub keeps working. Owned hosts: no-ops.
+// ---------------------------------------------------------------------------
+
+export interface StoredSshKey {
+  v: 1;
+  kind: "ssh";
+  userId: string;
+  publicKey: string;
+  privateKey: string;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export function sshKeyParameterName(userId: string): string {
+  return userParameterName(userId, "ssh");
+}
+
+/** The row as it is mirrored (private key decrypted). Never logged. */
+export function sshKeyStoreValue(userId: string): StoredSshKey | null {
+  const row = getDb()
+    .select()
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  if (!row) return null;
+  return {
+    v: 1,
+    kind: "ssh",
+    userId,
+    publicKey: row.publicKey,
+    privateKey: openAesGcm(
+      Buffer.from(row.privateKeyCt as Uint8Array),
+      Buffer.from(row.privateKeyNonce as Uint8Array),
+    ),
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function setSshKeyStoreRef(userId: string, storeRef: string): void {
+  getDb()
+    .update(schema.sshKeys)
+    .set({ storeRef })
+    .where(eq(schema.sshKeys.userId, userId))
+    .run();
+}
+
+export function listSshKeyStoreRows(): Array<{ userId: string; storeRef: string | null }> {
+  return getDb()
+    .select({ userId: schema.sshKeys.userId, storeRef: schema.sshKeys.storeRef })
+    .from(schema.sshKeys)
+    .all();
+}
+
+export function mirrorSshKeyToStore(userId: string): void {
+  queueStoreWrite(`mirror ssh key ${userId}`, async (store) => {
+    const value = sshKeyStoreValue(userId);
+    if (!value) return;
+    const name = sshKeyParameterName(userId);
+    await store.put(name, JSON.stringify(value));
+    setSshKeyStoreRef(userId, name);
+  });
+}
+
+/** Reconcile import: a keypair this host lacks. Existing rows win. */
+export function importSshKeyFromStore(value: StoredSshKey, storeRef: string): boolean {
+  const sealed = sealAesGcm(value.privateKey);
+  const result = getDb()
+    .insert(schema.sshKeys)
+    .values({
+      userId: value.userId,
+      publicKey: value.publicKey,
+      privateKeyCt: sealed.ct,
+      privateKeyNonce: sealed.nonce,
+      createdAt: value.createdAt,
+      updatedAt: value.updatedAt,
+      storeRef,
+    })
+    .onConflictDoNothing({ target: schema.sshKeys.userId })
+    .run();
+  return result.changes > 0;
 }
 
 /** Decrypt + return the user's private key, or null if they have none. */

package/lib/user-credentials-store.ts

@@ -0,0 +1,310 @@
+/**
+ * ADR-134 slice 2 — per-user credentials on a Uai-operated host reconcile
+ * with the credential store at start, the same way engine accounts do
+ * (`reconcileEngineAccountsFromStore`):
+ *
+ *   <prefix>/users/<userId>/github         GitHub App user token
+ *   <prefix>/users/<userId>/ssh            the user's host-minted keypair
+ *   <prefix>/users/<userId>/mcp/<connId>   an MCP connection
+ *
+ *  - a parameter with no local row is imported (a replacement host inherits
+ *    every user's credentials without anyone reconnecting);
+ *  - a local row with no `store_ref` is uploaded (first start with the flag);
+ *  - a local row whose `store_ref` is under the listed path but absent from
+ *    it was removed elsewhere — it goes locally too.
+ * The write-through mirrors live next to each table's writes (ssh.ts,
+ * github-tokens.ts, mcp-connections.ts). Owned hosts: `configuredCredentialStore()`
+ * is null and nothing here runs.
+ */
+
+import {
+  configuredCredentialStore,
+  credentialStorePrefix,
+  isParameterPathSegment,
+  type CredentialStore,
+} from "./credential-store";
+import {
+  deleteToken as deleteGithubTokenLocal,
+  githubTokenParameterName,
+  githubTokenStoreValue,
+  importGithubTokenFromStore,
+  listGithubTokenStoreRows,
+  setGithubTokenStoreRef,
+  type StoredGithubToken,
+} from "./github-tokens";
+import {
+  deleteMcpConnectionLocal,
+  importMcpConnectionFromStore,
+  listMcpConnectionStoreRows,
+  mcpConnectionParameterName,
+  mcpConnectionStoreValue,
+  setMcpConnectionStoreRef,
+  type StoredMcpConnection,
+} from "./mcp-connections";
+import {
+  deleteKey as deleteSshKeyLocal,
+  importSshKeyFromStore,
+  listSshKeyStoreRows,
+  setSshKeyStoreRef,
+  sshKeyParameterName,
+  sshKeyStoreValue,
+  type StoredSshKey,
+} from "./ssh";
+
+export interface ReconcileUserCredentialsResult {
+  skipped: boolean;
+  imported: number;
+  uploaded: number;
+  removed: number;
+  errors: number;
+}
+
+type ParsedName =
+  | { kind: "github"; userId: string }
+  | { kind: "ssh"; userId: string }
+  | { kind: "mcp"; userId: string; id: string };
+
+/** `<prefix>/users/<u>/github|ssh|mcp/<id>`; null for anything else. */
+export function parseUserParameterName(
+  name: string,
+  prefix: string = credentialStorePrefix(),
+): ParsedName | null {
+  if (!name.startsWith(`${prefix}/users/`)) return null;
+  const parts = name.slice(prefix.length + 1).split("/");
+  if (!parts.every((p) => isParameterPathSegment(p))) return null;
+  const [, userId, what, id] = parts;
+  if (!userId || !what) return null;
+  if (parts.length === 3 && what === "github") return { kind: "github", userId };
+  if (parts.length === 3 && what === "ssh") return { kind: "ssh", userId };
+  if (parts.length === 4 && what === "mcp" && id) return { kind: "mcp", userId, id };
+  return null;
+}
+
+function obj(value: string): Record<string, unknown> {
+  const parsed: unknown = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("not an object");
+  }
+  const o = parsed as Record<string, unknown>;
+  if (o.v !== 1) throw new Error(`unsupported version ${String(o.v)}`);
+  return o;
+}
+function str(o: Record<string, unknown>, key: string): string {
+  const v = o[key];
+  if (typeof v !== "string") throw new Error(`bad ${key}`);
+  return v;
+}
+function strOrNull(o: Record<string, unknown>, key: string): string | null {
+  const v = o[key];
+  if (v === null || v === undefined) return null;
+  if (typeof v !== "string") throw new Error(`bad ${key}`);
+  return v;
+}
+function num(o: Record<string, unknown>, key: string): number {
+  const v = o[key];
+  if (typeof v !== "number" || !Number.isFinite(v)) throw new Error(`bad ${key}`);
+  return v;
+}
+function numOrNull(o: Record<string, unknown>, key: string): number | null {
+  const v = o[key];
+  if (v === null || v === undefined) return null;
+  if (typeof v !== "number" || !Number.isFinite(v)) throw new Error(`bad ${key}`);
+  return v;
+}
+
+export function parseStoredGithubToken(value: string): StoredGithubToken {
+  const o = obj(value);
+  if (o.kind !== "github") throw new Error("not a github token");
+  const generation = num(o, "generation");
+  if (!Number.isSafeInteger(generation) || generation < 0) throw new Error("bad generation");
+  return {
+    v: 1,
+    kind: "github",
+    userId: str(o, "userId"),
+    installationId: num(o, "installationId"),
+    generation,
+    tokenKind: str(o, "tokenKind"),
+    token: str(o, "token"),
+    expiresAt: numOrNull(o, "expiresAt"),
+    updatedAt: num(o, "updatedAt"),
+  };
+}
+
+export function parseStoredSshKey(value: string): StoredSshKey {
+  const o = obj(value);
+  if (o.kind !== "ssh") throw new Error("not an ssh key");
+  return {
+    v: 1,
+    kind: "ssh",
+    userId: str(o, "userId"),
+    publicKey: str(o, "publicKey"),
+    privateKey: str(o, "privateKey"),
+    createdAt: num(o, "createdAt"),
+    updatedAt: num(o, "updatedAt"),
+  };
+}
+
+export function parseStoredMcpConnection(value: string): StoredMcpConnection {
+  const o = obj(value);
+  if (o.kind !== "mcp") throw new Error("not an mcp connection");
+  return {
+    v: 1,
+    kind: "mcp",
+    id: str(o, "id"),
+    userId: str(o, "userId"),
+    url: str(o, "url"),
+    authKind: str(o, "authKind"),
+    tokenEndpoint: strOrNull(o, "tokenEndpoint"),
+    redirectUri: strOrNull(o, "redirectUri"),
+    clientId: strOrNull(o, "clientId"),
+    clientSecret: strOrNull(o, "clientSecret"),
+    pkceVerifier: strOrNull(o, "pkceVerifier"),
+    secret: strOrNull(o, "secret"),
+    status: str(o, "status"),
+    scopes: strOrNull(o, "scopes"),
+    updatedAt: num(o, "updatedAt"),
+  };
+}
+
+async function upload(
+  store: CredentialStore,
+  name: string,
+  value: unknown,
+  setRef: (ref: string) => void,
+): Promise<void> {
+  await store.put(name, JSON.stringify(value));
+  setRef(name);
+}
+
+export async function reconcileUserCredentialsFromStore(): Promise<ReconcileUserCredentialsResult> {
+  const result: ReconcileUserCredentialsResult = {
+    skipped: false,
+    imported: 0,
+    uploaded: 0,
+    removed: 0,
+    errors: 0,
+  };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  const path = `${prefix}/users`;
+  const warn = (line: string): void =>
+    console.warn(`[user-credentials] credential store: ${line}`);
+
+  let listed: Array<{ name: string; value: string }>;
+  try {
+    listed = await store.list(path);
+  } catch (err) {
+    result.errors++;
+    warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
+    // Nothing else is safe to decide without the inventory.
+    return result;
+  }
+
+  const github = new Map(listGithubTokenStoreRows().map((r) => [r.userId, r.storeRef]));
+  const ssh = new Map(listSshKeyStoreRows().map((r) => [r.userId, r.storeRef]));
+  const mcp = new Map(listMcpConnectionStoreRows().map((r) => [r.id, r]));
+  const seen = new Set<string>();
+
+  for (const param of listed) {
+    const at = parseUserParameterName(param.name, prefix);
+    if (!at) continue; // a neighbour from a later slice
+    seen.add(param.name);
+    try {
+      if (at.kind === "github") {
+        const value = parseStoredGithubToken(param.value);
+        if (value.userId !== at.userId) throw new Error("payload names another user");
+        if (github.has(at.userId)) {
+          if (github.get(at.userId) !== param.name) setGithubTokenStoreRef(at.userId, param.name);
+        } else if (importGithubTokenFromStore(value, param.name)) {
+          result.imported++;
+        }
+      } else if (at.kind === "ssh") {
+        const value = parseStoredSshKey(param.value);
+        if (value.userId !== at.userId) throw new Error("payload names another user");
+        if (ssh.has(at.userId)) {
+          if (ssh.get(at.userId) !== param.name) setSshKeyStoreRef(at.userId, param.name);
+        } else if (importSshKeyFromStore(value, param.name)) {
+          result.imported++;
+        }
+      } else {
+        const value = parseStoredMcpConnection(param.value);
+        if (value.userId !== at.userId || value.id !== at.id) {
+          throw new Error("payload does not describe the connection its path names");
+        }
+        const local = mcp.get(at.id);
+        if (local) {
+          if (local.storeRef !== param.name) setMcpConnectionStoreRef(at.id, param.name);
+        } else if (importMcpConnectionFromStore(value, param.name)) {
+          result.imported++;
+        }
+      }
+    } catch (err) {
+      result.errors++;
+      warn(`${param.name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  const under = (ref: string): boolean => ref.startsWith(`${path}/`);
+  for (const [userId, storeRef] of github) {
+    try {
+      if (storeRef) {
+        if (under(storeRef) && !seen.has(storeRef)) {
+          deleteGithubTokenLocal(userId);
+          result.removed++;
+        }
+        continue;
+      }
+      const value = githubTokenStoreValue(userId);
+      if (!value) continue;
+      await upload(store, githubTokenParameterName(userId), value, (ref) =>
+        setGithubTokenStoreRef(userId, ref),
+      );
+      result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`github token ${userId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const [userId, storeRef] of ssh) {
+    try {
+      if (storeRef) {
+        if (under(storeRef) && !seen.has(storeRef)) {
+          deleteSshKeyLocal(userId);
+          result.removed++;
+        }
+        continue;
+      }
+      const value = sshKeyStoreValue(userId);
+      if (!value) continue;
+      await upload(store, sshKeyParameterName(userId), value, (ref) =>
+        setSshKeyStoreRef(userId, ref),
+      );
+      result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`ssh key ${userId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const [id, row] of mcp) {
+    try {
+      if (row.storeRef) {
+        if (under(row.storeRef) && !seen.has(row.storeRef)) {
+          deleteMcpConnectionLocal(id);
+          result.removed++;
+        }
+        continue;
+      }
+      const value = mcpConnectionStoreValue(id);
+      if (!value) continue;
+      await upload(store, mcpConnectionParameterName(row.userId, id), value, (ref) =>
+        setMcpConnectionStoreRef(id, ref),
+      );
+      result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`mcp connection ${id}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.111",
+  "version": "0.9.113",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -157,6 +157,7 @@ import {
   listEngineAccountsAllScopes,
   reconcileEngineAccountsFromStore,
 } from "../lib/engine-accounts";
+import { reconcileUserCredentialsFromStore } from "../lib/user-credentials-store";
 import { createEngineConnectManager } from "../lib/engine-connect";
 import { createEngineLoginManager } from "../lib/engine-login";
 import {
@@ -458,6 +459,18 @@ void reconcileEngineAccountsFromStore({ hostId })
       `[engine-accounts] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
     );
   });
+void reconcileUserCredentialsFromStore()
+  .then((r) => {
+    if (r.skipped) return;
+    console.log(
+      `[user-credentials] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
+    );
+  })
+  .catch((error: unknown) => {
+    console.warn(
+      `[user-credentials] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  });
 // Reconcile a durable retention-off setting before recovery/connect can make
 // crash-left owner-facing terminal history observable again. Correctness
 // tombstones remain intact inside applyTerminalHistoryRetention.

package/src/protocol.ts

@@ -332,7 +332,12 @@ export type HostLogsEndFrame =
 /** Engines with a REMOTE sign-in (login container driven from the cloud).
  * grok since host 0.9.105: `grok login --device-auth`, same device-code shape
  * as codex. Kimi/OpenCode remain host-terminal (or key) for now. */
-export type EngineLoginKind = "claude" | "codex" | "grok";
+/** Every engine with a remote sign-in flow. ONE list: the login container
+ *  name pattern, the wire guard, and the cloud validator all derive from it
+ *  (a kind added to the type alone left grok containers unrecognized by the
+ *  stale-container sweep, which then refused EVERY login — live 2026-09-09). */
+export const ENGINE_LOGIN_KINDS = ["claude", "codex", "grok"] as const;
+export type EngineLoginKind = (typeof ENGINE_LOGIN_KINDS)[number];
 export type EngineLoginPhase =
   | "starting"
   | "authorize"
@@ -674,7 +679,7 @@ function isBoundedMessage(value: unknown): value is string {
 }
 
 function isEngineLoginKind(value: unknown): value is EngineLoginKind {
-  return value === "claude" || value === "codex" || value === "grok";
+  return (ENGINE_LOGIN_KINDS as readonly unknown[]).includes(value);
 }
 
 function isEngineLoginErrorCode(value: unknown): value is EngineLoginErrorCode {