@runuai/host 0.9.112 → 0.9.114

package/lib/token-lanes/xai-oauth.ts

@@ -0,0 +1,161 @@
+/**
+ * Lane `xai-oauth` — Grok subscription sign-ins (`grok login --device-auth`).
+ *
+ * `auth.json` is keyed by `<issuer>::<client-id>`; each entry carries
+ * `key` (the bearer the CLI sends), `refresh_token`, `expires_at` (ISO),
+ * `oidc_issuer` and `oidc_client_id`. Refresh is a standard OIDC
+ * `grant_type=refresh_token` against `https://auth.x.ai/oauth2/token`
+ * (confirmed from the issuer's discovery document, 2026-09-09; refresh_token
+ * is among its supported grants).
+ *
+ * ASSUMPTION, recorded until observed on a live refresh: `key` is the OIDC
+ * access token, so a refresh replaces it with `access_token`. The lane never
+ * writes on an answer that lacks `access_token`, so a wrong assumption costs
+ * a failed refresh (retried, then the reactive path), never a corrupted
+ * sign-in.
+ */
+
+import {
+  BROKER_REFRESH_PLACEHOLDER,
+  isTerminalOAuthError,
+  parseObjectFile,
+  type CredentialFiles,
+  type CredentialHeader,
+  type LaneHttp,
+  type RefreshOutcome,
+  type TokenLane,
+} from "./types";
+
+export const XAI_ISSUER = "https://auth.x.ai";
+export const XAI_TOKEN_ENDPOINT = `${XAI_ISSUER}/oauth2/token`;
+const HOUR_MS = 60 * 60 * 1000;
+
+interface Entry {
+  key: string;
+  doc: Record<string, unknown>;
+}
+
+function entriesOf(files: CredentialFiles): { doc: Record<string, unknown>; entries: Entry[] } | null {
+  const doc = parseObjectFile(files["auth.json"]);
+  if (!doc) return null;
+  const entries: Entry[] = [];
+  for (const [key, value] of Object.entries(doc)) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      entries.push({ key, doc: value as Record<string, unknown> });
+    }
+  }
+  return { doc, entries };
+}
+
+function expiryOf(entry: Record<string, unknown>): number | null {
+  const raw = entry.expires_at;
+  if (typeof raw !== "string") return null;
+  const ms = Date.parse(raw);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+export const xaiOAuthLane: TokenLane = {
+  id: "xai-oauth",
+  endpoints: [XAI_TOKEN_ENDPOINT],
+  // Observed 2026-09-09: the token lives SIX hours (create_time → expires_at).
+  // Refresh with three hours left — the hourly cycle then renews it at about
+  // four hours of age — and every four hours when expiry cannot be read.
+  schedule: { leadMs: 3 * HOUR_MS, everyMs: 4 * HOUR_MS },
+  reactiveSignals: [/invalid_grant/i, /token (?:has )?expired/i, /log ?in again/i, /unauthorized/i],
+
+  matches(header: CredentialHeader, files: CredentialFiles): boolean {
+    if (header.kind !== "grok" || header.authKind !== "config-dir") return false;
+    const parsed = entriesOf(files);
+    return (
+      parsed !== null && parsed.entries.some((e) => typeof e.doc.refresh_token === "string")
+    );
+  },
+
+  expiresAt(files: CredentialFiles): number | null {
+    const parsed = entriesOf(files);
+    if (!parsed) return null;
+    const known = parsed.entries.map((e) => expiryOf(e.doc)).filter((v): v is number => v !== null);
+    return known.length ? Math.min(...known) : null;
+  },
+
+  brokeredCopy(files: CredentialFiles): CredentialFiles {
+    const parsed = entriesOf(files);
+    if (!parsed) return files;
+    let changed = false;
+    for (const entry of parsed.entries) {
+      if (
+        typeof entry.doc.refresh_token === "string" &&
+        entry.doc.refresh_token !== BROKER_REFRESH_PLACEHOLDER
+      ) {
+        entry.doc.refresh_token = BROKER_REFRESH_PLACEHOLDER;
+        changed = true;
+      }
+    }
+    return changed ? { ...files, "auth.json": `${JSON.stringify(parsed.doc, null, 2)}\n` } : files;
+  },
+
+  async refresh(files: CredentialFiles, http: LaneHttp, now: number): Promise<RefreshOutcome> {
+    const parsed = entriesOf(files);
+    if (!parsed) return { ok: false, terminal: true, reason: "auth.json is not readable" };
+    let refreshed = 0;
+    let expiresAt: number | null = null;
+    for (const entry of parsed.entries) {
+      const current = entry.doc.refresh_token;
+      if (typeof current !== "string" || current === BROKER_REFRESH_PLACEHOLDER) continue;
+      const issuer = typeof entry.doc.oidc_issuer === "string" ? entry.doc.oidc_issuer : XAI_ISSUER;
+      if (issuer.replace(/\/$/, "") !== XAI_ISSUER) {
+        return { ok: false, terminal: true, reason: "unexpected issuer" };
+      }
+      const clientId = entry.doc.oidc_client_id;
+      if (typeof clientId !== "string" || !clientId) {
+        return { ok: false, terminal: true, reason: "entry has no client id" };
+      }
+      let res;
+      try {
+        res = await http.postForm(XAI_TOKEN_ENDPOINT, {
+          grant_type: "refresh_token",
+          refresh_token: current,
+          client_id: clientId,
+        });
+      } catch (err) {
+        return {
+          ok: false,
+          terminal: false,
+          reason: `request failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+      }
+      if (res.status < 200 || res.status >= 300) {
+        return {
+          ok: false,
+          terminal: isTerminalOAuthError(res.status, res.json),
+          reason: `HTTP ${res.status}`,
+        };
+      }
+      const body =
+        res.json && typeof res.json === "object" && !Array.isArray(res.json)
+          ? (res.json as Record<string, unknown>)
+          : null;
+      const access = body?.access_token;
+      if (typeof access !== "string" || !access) {
+        return { ok: false, terminal: false, reason: "response missing access_token" };
+      }
+      entry.doc.key = access;
+      if (typeof body?.refresh_token === "string" && body.refresh_token) {
+        entry.doc.refresh_token = body.refresh_token;
+      }
+      const expiresIn = body?.expires_in;
+      if (typeof expiresIn === "number" && Number.isFinite(expiresIn)) {
+        const at = now + expiresIn * 1000;
+        entry.doc.expires_at = new Date(at).toISOString();
+        expiresAt = expiresAt === null ? at : Math.min(expiresAt, at);
+      }
+      refreshed += 1;
+    }
+    if (refreshed === 0) return { ok: false, terminal: true, reason: "no refresh token to use" };
+    return {
+      ok: true,
+      files: { ...files, "auth.json": `${JSON.stringify(parsed.doc, null, 2)}\n` },
+      expiresAt,
+    };
+  },
+};

package/lib/user-credentials-store.ts

@@ -0,0 +1,310 @@
+/**
+ * ADR-134 slice 2 — per-user credentials on a Uai-operated host reconcile
+ * with the credential store at start, the same way engine accounts do
+ * (`reconcileEngineAccountsFromStore`):
+ *
+ *   <prefix>/users/<userId>/github         GitHub App user token
+ *   <prefix>/users/<userId>/ssh            the user's host-minted keypair
+ *   <prefix>/users/<userId>/mcp/<connId>   an MCP connection
+ *
+ *  - a parameter with no local row is imported (a replacement host inherits
+ *    every user's credentials without anyone reconnecting);
+ *  - a local row with no `store_ref` is uploaded (first start with the flag);
+ *  - a local row whose `store_ref` is under the listed path but absent from
+ *    it was removed elsewhere — it goes locally too.
+ * The write-through mirrors live next to each table's writes (ssh.ts,
+ * github-tokens.ts, mcp-connections.ts). Owned hosts: `configuredCredentialStore()`
+ * is null and nothing here runs.
+ */
+
+import {
+  configuredCredentialStore,
+  credentialStorePrefix,
+  isParameterPathSegment,
+  type CredentialStore,
+} from "./credential-store";
+import {
+  deleteToken as deleteGithubTokenLocal,
+  githubTokenParameterName,
+  githubTokenStoreValue,
+  importGithubTokenFromStore,
+  listGithubTokenStoreRows,
+  setGithubTokenStoreRef,
+  type StoredGithubToken,
+} from "./github-tokens";
+import {
+  deleteMcpConnectionLocal,
+  importMcpConnectionFromStore,
+  listMcpConnectionStoreRows,
+  mcpConnectionParameterName,
+  mcpConnectionStoreValue,
+  setMcpConnectionStoreRef,
+  type StoredMcpConnection,
+} from "./mcp-connections";
+import {
+  deleteKey as deleteSshKeyLocal,
+  importSshKeyFromStore,
+  listSshKeyStoreRows,
+  setSshKeyStoreRef,
+  sshKeyParameterName,
+  sshKeyStoreValue,
+  type StoredSshKey,
+} from "./ssh";
+
+export interface ReconcileUserCredentialsResult {
+  skipped: boolean;
+  imported: number;
+  uploaded: number;
+  removed: number;
+  errors: number;
+}
+
+type ParsedName =
+  | { kind: "github"; userId: string }
+  | { kind: "ssh"; userId: string }
+  | { kind: "mcp"; userId: string; id: string };
+
+/** `<prefix>/users/<u>/github|ssh|mcp/<id>`; null for anything else. */
+export function parseUserParameterName(
+  name: string,
+  prefix: string = credentialStorePrefix(),
+): ParsedName | null {
+  if (!name.startsWith(`${prefix}/users/`)) return null;
+  const parts = name.slice(prefix.length + 1).split("/");
+  if (!parts.every((p) => isParameterPathSegment(p))) return null;
+  const [, userId, what, id] = parts;
+  if (!userId || !what) return null;
+  if (parts.length === 3 && what === "github") return { kind: "github", userId };
+  if (parts.length === 3 && what === "ssh") return { kind: "ssh", userId };
+  if (parts.length === 4 && what === "mcp" && id) return { kind: "mcp", userId, id };
+  return null;
+}
+
+function obj(value: string): Record<string, unknown> {
+  const parsed: unknown = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("not an object");
+  }
+  const o = parsed as Record<string, unknown>;
+  if (o.v !== 1) throw new Error(`unsupported version ${String(o.v)}`);
+  return o;
+}
+function str(o: Record<string, unknown>, key: string): string {
+  const v = o[key];
+  if (typeof v !== "string") throw new Error(`bad ${key}`);
+  return v;
+}
+function strOrNull(o: Record<string, unknown>, key: string): string | null {
+  const v = o[key];
+  if (v === null || v === undefined) return null;
+  if (typeof v !== "string") throw new Error(`bad ${key}`);
+  return v;
+}
+function num(o: Record<string, unknown>, key: string): number {
+  const v = o[key];
+  if (typeof v !== "number" || !Number.isFinite(v)) throw new Error(`bad ${key}`);
+  return v;
+}
+function numOrNull(o: Record<string, unknown>, key: string): number | null {
+  const v = o[key];
+  if (v === null || v === undefined) return null;
+  if (typeof v !== "number" || !Number.isFinite(v)) throw new Error(`bad ${key}`);
+  return v;
+}
+
+export function parseStoredGithubToken(value: string): StoredGithubToken {
+  const o = obj(value);
+  if (o.kind !== "github") throw new Error("not a github token");
+  const generation = num(o, "generation");
+  if (!Number.isSafeInteger(generation) || generation < 0) throw new Error("bad generation");
+  return {
+    v: 1,
+    kind: "github",
+    userId: str(o, "userId"),
+    installationId: num(o, "installationId"),
+    generation,
+    tokenKind: str(o, "tokenKind"),
+    token: str(o, "token"),
+    expiresAt: numOrNull(o, "expiresAt"),
+    updatedAt: num(o, "updatedAt"),
+  };
+}
+
+export function parseStoredSshKey(value: string): StoredSshKey {
+  const o = obj(value);
+  if (o.kind !== "ssh") throw new Error("not an ssh key");
+  return {
+    v: 1,
+    kind: "ssh",
+    userId: str(o, "userId"),
+    publicKey: str(o, "publicKey"),
+    privateKey: str(o, "privateKey"),
+    createdAt: num(o, "createdAt"),
+    updatedAt: num(o, "updatedAt"),
+  };
+}
+
+export function parseStoredMcpConnection(value: string): StoredMcpConnection {
+  const o = obj(value);
+  if (o.kind !== "mcp") throw new Error("not an mcp connection");
+  return {
+    v: 1,
+    kind: "mcp",
+    id: str(o, "id"),
+    userId: str(o, "userId"),
+    url: str(o, "url"),
+    authKind: str(o, "authKind"),
+    tokenEndpoint: strOrNull(o, "tokenEndpoint"),
+    redirectUri: strOrNull(o, "redirectUri"),
+    clientId: strOrNull(o, "clientId"),
+    clientSecret: strOrNull(o, "clientSecret"),
+    pkceVerifier: strOrNull(o, "pkceVerifier"),
+    secret: strOrNull(o, "secret"),
+    status: str(o, "status"),
+    scopes: strOrNull(o, "scopes"),
+    updatedAt: num(o, "updatedAt"),
+  };
+}
+
+async function upload(
+  store: CredentialStore,
+  name: string,
+  value: unknown,
+  setRef: (ref: string) => void,
+): Promise<void> {
+  await store.put(name, JSON.stringify(value));
+  setRef(name);
+}
+
+export async function reconcileUserCredentialsFromStore(): Promise<ReconcileUserCredentialsResult> {
+  const result: ReconcileUserCredentialsResult = {
+    skipped: false,
+    imported: 0,
+    uploaded: 0,
+    removed: 0,
+    errors: 0,
+  };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  const path = `${prefix}/users`;
+  const warn = (line: string): void =>
+    console.warn(`[user-credentials] credential store: ${line}`);
+
+  let listed: Array<{ name: string; value: string }>;
+  try {
+    listed = await store.list(path);
+  } catch (err) {
+    result.errors++;
+    warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
+    // Nothing else is safe to decide without the inventory.
+    return result;
+  }
+
+  const github = new Map(listGithubTokenStoreRows().map((r) => [r.userId, r.storeRef]));
+  const ssh = new Map(listSshKeyStoreRows().map((r) => [r.userId, r.storeRef]));
+  const mcp = new Map(listMcpConnectionStoreRows().map((r) => [r.id, r]));
+  const seen = new Set<string>();
+
+  for (const param of listed) {
+    const at = parseUserParameterName(param.name, prefix);
+    if (!at) continue; // a neighbour from a later slice
+    seen.add(param.name);
+    try {
+      if (at.kind === "github") {
+        const value = parseStoredGithubToken(param.value);
+        if (value.userId !== at.userId) throw new Error("payload names another user");
+        if (github.has(at.userId)) {
+          if (github.get(at.userId) !== param.name) setGithubTokenStoreRef(at.userId, param.name);
+        } else if (importGithubTokenFromStore(value, param.name)) {
+          result.imported++;
+        }
+      } else if (at.kind === "ssh") {
+        const value = parseStoredSshKey(param.value);
+        if (value.userId !== at.userId) throw new Error("payload names another user");
+        if (ssh.has(at.userId)) {
+          if (ssh.get(at.userId) !== param.name) setSshKeyStoreRef(at.userId, param.name);
+        } else if (importSshKeyFromStore(value, param.name)) {
+          result.imported++;
+        }
+      } else {
+        const value = parseStoredMcpConnection(param.value);
+        if (value.userId !== at.userId || value.id !== at.id) {
+          throw new Error("payload does not describe the connection its path names");
+        }
+        const local = mcp.get(at.id);
+        if (local) {
+          if (local.storeRef !== param.name) setMcpConnectionStoreRef(at.id, param.name);
+        } else if (importMcpConnectionFromStore(value, param.name)) {
+          result.imported++;
+        }
+      }
+    } catch (err) {
+      result.errors++;
+      warn(`${param.name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  const under = (ref: string): boolean => ref.startsWith(`${path}/`);
+  for (const [userId, storeRef] of github) {
+    try {
+      if (storeRef) {
+        if (under(storeRef) && !seen.has(storeRef)) {
+          deleteGithubTokenLocal(userId);
+          result.removed++;
+        }
+        continue;
+      }
+      const value = githubTokenStoreValue(userId);
+      if (!value) continue;
+      await upload(store, githubTokenParameterName(userId), value, (ref) =>
+        setGithubTokenStoreRef(userId, ref),
+      );
+      result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`github token ${userId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const [userId, storeRef] of ssh) {
+    try {
+      if (storeRef) {
+        if (under(storeRef) && !seen.has(storeRef)) {
+          deleteSshKeyLocal(userId);
+          result.removed++;
+        }
+        continue;
+      }
+      const value = sshKeyStoreValue(userId);
+      if (!value) continue;
+      await upload(store, sshKeyParameterName(userId), value, (ref) =>
+        setSshKeyStoreRef(userId, ref),
+      );
+      result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`ssh key ${userId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const [id, row] of mcp) {
+    try {
+      if (row.storeRef) {
+        if (under(row.storeRef) && !seen.has(row.storeRef)) {
+          deleteMcpConnectionLocal(id);
+          result.removed++;
+        }
+        continue;
+      }
+      const value = mcpConnectionStoreValue(id);
+      if (!value) continue;
+      await upload(store, mcpConnectionParameterName(row.userId, id), value, (ref) =>
+        setMcpConnectionStoreRef(id, ref),
+      );
+      result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`mcp connection ${id}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.112",
+  "version": "0.9.114",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",
@@ -76,10 +76,12 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
+    "@aws-sdk/client-ssm": "3.899.0",
     "@types/node": "^22.9.0",
     "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^8.59.4",
     "@typescript-eslint/parser": "^8.59.4",
+    "esbuild": "0.25.8",
     "eslint": "^9.14.0",
     "typescript": "^5.6.3",
     "vitest": "^2.1.4"

package/scripts/agent/task-up.sh

@@ -2828,6 +2828,22 @@ if crt exec -u root "${managed_exec_env[@]}" "$app_container" \
     /usr/bin/mkdir -p /home/node/.codex >/dev/null; then
   for codex_item in auth.json config.toml AGENTS.md version.json installation_id rules; do
     if [ -e "$UAI_OWNER_HOME/.codex/$codex_item" ]; then
+      # ADR-135: the task's copy must not carry the rotating refresh token —
+      # N copies racing to refresh it revoke the whole family. Replace it with
+      # the broker placeholder (the field must exist; codex refuses a missing
+      # one). The host is the only refresher and re-pushes on refresh.
+      if [ "$codex_item" = auth.json ] && command -v jq >/dev/null 2>&1; then
+        brokered_auth="$(mktemp "${TMPDIR:-/tmp}/uai-codex-auth.XXXXXX")"
+        if jq 'if (.tokens|type) == "object" and (.tokens.refresh_token|type) == "string" then .tokens.refresh_token = "uai-broker-managed-no-refresh" else . end' \
+            "$UAI_OWNER_HOME/.codex/auth.json" > "$brokered_auth" 2>/dev/null && [ -s "$brokered_auth" ]; then
+          crt cp "$brokered_auth" "$app_container":/home/node/.codex/auth.json >/dev/null \
+            || log "ERROR: crt cp of brokered .codex/auth.json failed; Codex in this task may not authenticate"
+          rm -f "$brokered_auth"
+          continue
+        fi
+        rm -f "$brokered_auth"
+        log "warning: could not broker .codex/auth.json; copying it verbatim"
+      fi
       crt cp "$UAI_OWNER_HOME/.codex/$codex_item" \
         "$app_container":/home/node/.codex/ >/dev/null \
         || log "ERROR: crt cp of .codex/$codex_item failed; Codex in this task may not authenticate"
@@ -2865,11 +2881,25 @@ crt exec -u root "${managed_exec_env[@]}" "$app_container" \
 
 # Copy Grok subscription/config into a task-private /home/node/.grok. The Linux
 # `grok` binary is baked into the image; here we copy the arch-independent
-# auth + config (auth.json is an OIDC token the CLI refreshes in-container).
+# auth + config. auth.json is an OIDC token: the task's copy gets the broker
+# placeholder in every entry's refresh_token (ADR-135) so it can never rotate
+# the family; the host is the only refresher.
 crt exec -u root "${managed_exec_env[@]}" "$app_container" \
   /usr/bin/mkdir -p /home/node/.grok >/dev/null 2>&1 || true
 for grok_item in auth.json config.toml models_cache.json agent_id; do
   if [ -e "$UAI_OWNER_HOME/.grok/$grok_item" ]; then
+    if [ "$grok_item" = auth.json ] && command -v jq >/dev/null 2>&1; then
+      brokered_auth="$(mktemp "${TMPDIR:-/tmp}/uai-grok-auth.XXXXXX")"
+      if jq 'with_entries(if (.value|type) == "object" and (.value.refresh_token|type) == "string" then .value.refresh_token = "uai-broker-managed-no-refresh" else . end)' \
+          "$UAI_OWNER_HOME/.grok/auth.json" > "$brokered_auth" 2>/dev/null && [ -s "$brokered_auth" ]; then
+        crt cp "$brokered_auth" "$app_container":/home/node/.grok/auth.json >/dev/null 2>&1 \
+          || log "warning: crt cp of brokered .grok/auth.json failed; grok may need re-login"
+        rm -f "$brokered_auth"
+        continue
+      fi
+      rm -f "$brokered_auth"
+      log "warning: could not broker .grok/auth.json; copying it verbatim"
+    fi
     crt cp "$UAI_OWNER_HOME/.grok/$grok_item" \
       "$app_container":/home/node/.grok/ >/dev/null 2>&1 \
       || log "warning: crt cp of .grok/$grok_item failed; grok may need re-login"

package/src/main.ts

@@ -57,7 +57,13 @@ import {
   deleteUserSshIdentity,
   removeTaskSshIdentityFromContainer,
 } from "../lib/git-identity";
-import { reinjectCodexRunningTasks, watchCodexAuth } from "../lib/codex-auth";
+import {
+  reinjectCodexRunningTasks,
+  reinjectGrokRunningTasks,
+  watchCodexAuth,
+} from "../lib/codex-auth";
+import { startCredentialStorePickup } from "../lib/credential-store-pickup";
+import { configureTokenBroker, startTokenBrokerLoop } from "../lib/token-broker-local";
 import {
   ensureKeyForUser as ensureSshKeyForUser,
   getPublicKey as getSshPublicKey,
@@ -157,6 +163,7 @@ import {
   listEngineAccountsAllScopes,
   reconcileEngineAccountsFromStore,
 } from "../lib/engine-accounts";
+import { reconcileUserCredentialsFromStore } from "../lib/user-credentials-store";
 import { createEngineConnectManager } from "../lib/engine-connect";
 import { createEngineLoginManager } from "../lib/engine-login";
 import {
@@ -458,6 +465,29 @@ void reconcileEngineAccountsFromStore({ hostId })
       `[engine-accounts] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
     );
   });
+// ADR-135: one refresher per rotating credential. Owned host → the in-process
+// loop refreshes and re-pushes; Uai-operated host → the broker Lambda
+// refreshes and this host picks up changed parameter versions.
+const repushBrokeredCopies = async (kind: string): Promise<void> => {
+  if (kind === "codex") await reinjectCodexRunningTasks();
+  if (kind === "grok") await reinjectGrokRunningTasks();
+  await getOrchestrator().refreshEngineAccountCopies(kind);
+};
+configureTokenBroker({ repush: repushBrokeredCopies });
+startTokenBrokerLoop();
+startCredentialStorePickup({ repush: repushBrokeredCopies });
+void reconcileUserCredentialsFromStore()
+  .then((r) => {
+    if (r.skipped) return;
+    console.log(
+      `[user-credentials] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
+    );
+  })
+  .catch((error: unknown) => {
+    console.warn(
+      `[user-credentials] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  });
 // Reconcile a durable retention-off setting before recovery/connect can make
 // crash-left owner-facing terminal history observable again. Correctness
 // tombstones remain intact inside applyTerminalHistoryRetention.