@runuai/host 0.9.114 → 0.9.115

package/db/migrations/0021_project_env_store_ref.sql

@@ -0,0 +1,3 @@
+-- ADR-134 slice 3 (host 0.9.115): project env values mirror to the credential
+-- store on Uai-operated hosts. Null on owned hosts and before the first mirror.
+ALTER TABLE `host_project_env` ADD `store_ref` text;

package/db/migrations/meta/_journal.json

@@ -148,6 +148,13 @@
       "when": 1788900000002,
       "tag": "0020_user_credential_store_ref",
       "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "6",
+      "when": 1788900000003,
+      "tag": "0021_project_env_store_ref",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -183,6 +183,8 @@ export const hostProjectEnv = sqliteTable(
     updatedAt: integer("updated_at", { mode: "number" })
       .notNull()
       .default(sql`(unixepoch() * 1000)`),
+    // ADR-134 slice 3: the credential-store parameter this row mirrors to.
+    storeRef: text("store_ref"),
   },
   (t) => ({
     pk: primaryKey({ columns: [t.projectId, t.key] }),

package/lib/host-env.ts

@@ -16,6 +16,12 @@
 
 import { and, eq } from "drizzle-orm";
 
+import {
+  credentialStorePrefix,
+  isParameterPathSegment,
+  parameterName,
+  queueStoreWrite,
+} from "./credential-store";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 
@@ -48,11 +54,12 @@ export function setProjectEnvVar(
       set: { valueEnc: packValue(value), updatedAt: Date.now() },
     })
     .run();
+  mirrorProjectEnvToStore(projectId, key);
 }
 
 /** Remove a project env var (idempotent). */
 export function deleteProjectEnvVar(projectId: string, key: string): void {
-  getDb()
+  const result = getDb()
     .delete(schema.hostProjectEnv)
     .where(
       and(
@@ -61,6 +68,104 @@ export function deleteProjectEnvVar(projectId: string, key: string): void {
       ),
     )
     .run();
+  if (result.changes > 0) {
+    const name = projectEnvParameterName(projectId, key);
+    if (name) queueStoreWrite(`delete project env ${projectId}/${key}`, (store) => store.delete(name));
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Credential store mirror (ADR-134 slice 3): `<prefix>/projects/<projectId>/env/<KEY>`.
+// The set/delete frames carry no org, and a project id is org-bound in the
+// cloud, so the project is the owner segment. Owned hosts: no-ops.
+// ---------------------------------------------------------------------------
+
+export interface StoredProjectEnv {
+  v: 1;
+  kind: "project-env";
+  projectId: string;
+  key: string;
+  value: string;
+  updatedAt: number;
+}
+
+/** Null when the project id or key cannot be a parameter path segment (a
+ *  key with a character SSM refuses is kept local and logged once). */
+export function projectEnvParameterName(projectId: string, key: string): string | null {
+  if (!isParameterPathSegment(projectId) || !isParameterPathSegment(key)) return null;
+  return parameterName(credentialStorePrefix(), "projects", projectId, "env", key);
+}
+
+/** The row as it is mirrored (value decrypted). Never logged. */
+export function projectEnvStoreValue(projectId: string, key: string): StoredProjectEnv | null {
+  const row = getDb()
+    .select()
+    .from(schema.hostProjectEnv)
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, key)))
+    .get();
+  if (!row) return null;
+  return {
+    v: 1,
+    kind: "project-env",
+    projectId,
+    key,
+    value: unpackValue(row.valueEnc),
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function setProjectEnvStoreRef(projectId: string, key: string, storeRef: string): void {
+  getDb()
+    .update(schema.hostProjectEnv)
+    .set({ storeRef })
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, key)))
+    .run();
+}
+
+export function listProjectEnvStoreRows(): Array<{ projectId: string; key: string; storeRef: string | null }> {
+  return getDb()
+    .select({
+      projectId: schema.hostProjectEnv.projectId,
+      key: schema.hostProjectEnv.key,
+      storeRef: schema.hostProjectEnv.storeRef,
+    })
+    .from(schema.hostProjectEnv)
+    .all();
+}
+
+export function mirrorProjectEnvToStore(projectId: string, key: string): void {
+  const name = projectEnvParameterName(projectId, key);
+  if (!name) return;
+  queueStoreWrite(`mirror project env ${projectId}/${key}`, async (store) => {
+    const value = projectEnvStoreValue(projectId, key);
+    if (!value) return;
+    await store.put(name, JSON.stringify(value));
+    setProjectEnvStoreRef(projectId, key, name);
+  });
+}
+
+/** Reconcile import: a value this host lacks. Existing rows win. */
+export function importProjectEnvFromStore(value: StoredProjectEnv, storeRef: string): boolean {
+  const result = getDb()
+    .insert(schema.hostProjectEnv)
+    .values({
+      projectId: value.projectId,
+      key: value.key,
+      valueEnc: packValue(value.value),
+      updatedAt: value.updatedAt,
+      storeRef,
+    })
+    .onConflictDoNothing({ target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key] })
+    .run();
+  return result.changes > 0;
+}
+
+/** Reconcile: the row's parameter vanished elsewhere; drop the row only. */
+export function deleteProjectEnvLocal(projectId: string, key: string): void {
+  getDb()
+    .delete(schema.hostProjectEnv)
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, key)))
+    .run();
 }
 
 /** Sorted list of a project's env var KEY NAMES (never the values). */

package/lib/user-credentials-store.ts

@@ -41,6 +41,15 @@ import {
   setMcpConnectionStoreRef,
   type StoredMcpConnection,
 } from "./mcp-connections";
+import {
+  deleteProjectEnvLocal,
+  importProjectEnvFromStore,
+  listProjectEnvStoreRows,
+  projectEnvParameterName,
+  projectEnvStoreValue,
+  setProjectEnvStoreRef,
+  type StoredProjectEnv,
+} from "./host-env";
 import {
   deleteKey as deleteSshKeyLocal,
   importSshKeyFromStore,
@@ -308,3 +317,98 @@ export async function reconcileUserCredentialsFromStore(): Promise<ReconcileUser
   }
   return result;
 }
+
+// ---------------------------------------------------------------------------
+// Slice 3: project env values, `<prefix>/projects/<projectId>/env/<KEY>`.
+// Same three moves as above, own listing.
+// ---------------------------------------------------------------------------
+
+export function parseProjectEnvParameterName(
+  name: string,
+  prefix: string = credentialStorePrefix(),
+): { projectId: string; key: string } | null {
+  if (!name.startsWith(`${prefix}/projects/`)) return null;
+  const parts = name.slice(prefix.length + 1).split("/");
+  if (parts.length !== 4 || parts[2] !== "env") return null;
+  if (!parts.every((p) => isParameterPathSegment(p))) return null;
+  const [, projectId, , key] = parts as [string, string, string, string];
+  return { projectId, key };
+}
+
+export function parseStoredProjectEnv(value: string): StoredProjectEnv {
+  const o = obj(value);
+  if (o.kind !== "project-env") throw new Error("not a project env value");
+  return {
+    v: 1,
+    kind: "project-env",
+    projectId: str(o, "projectId"),
+    key: str(o, "key"),
+    value: str(o, "value"),
+    updatedAt: num(o, "updatedAt"),
+  };
+}
+
+export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCredentialsResult> {
+  const result: ReconcileUserCredentialsResult = {
+    skipped: false,
+    imported: 0,
+    uploaded: 0,
+    removed: 0,
+    errors: 0,
+  };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  const path = `${prefix}/projects`;
+  const warn = (line: string): void => console.warn(`[project-env] credential store: ${line}`);
+  let listed: Array<{ name: string; value: string }>;
+  try {
+    listed = await store.list(path);
+  } catch (err) {
+    result.errors++;
+    warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
+    return result;
+  }
+  const local = new Map(listProjectEnvStoreRows().map((r) => [`${r.projectId}/${r.key}`, r]));
+  const seen = new Set<string>();
+  for (const param of listed) {
+    const at = parseProjectEnvParameterName(param.name, prefix);
+    if (!at) continue;
+    seen.add(param.name);
+    try {
+      const value = parseStoredProjectEnv(param.value);
+      if (value.projectId !== at.projectId || value.key !== at.key) {
+        throw new Error("payload does not describe the value its path names");
+      }
+      const row = local.get(`${at.projectId}/${at.key}`);
+      if (row) {
+        if (row.storeRef !== param.name) setProjectEnvStoreRef(at.projectId, at.key, param.name);
+      } else if (importProjectEnvFromStore(value, param.name)) {
+        result.imported++;
+      }
+    } catch (err) {
+      result.errors++;
+      warn(`${param.name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const row of local.values()) {
+    try {
+      if (row.storeRef) {
+        if (row.storeRef.startsWith(`${path}/`) && !seen.has(row.storeRef)) {
+          deleteProjectEnvLocal(row.projectId, row.key);
+          result.removed++;
+        }
+        continue;
+      }
+      const name = projectEnvParameterName(row.projectId, row.key);
+      const value = projectEnvStoreValue(row.projectId, row.key);
+      if (!name || !value) continue;
+      await upload(store, name, value, (ref) => setProjectEnvStoreRef(row.projectId, row.key, ref));
+      result.uploaded++;
+    } catch (err) {
+      result.errors++;
+      warn(`${row.projectId}/${row.key}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.114",
+  "version": "0.9.115",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -163,7 +163,10 @@ import {
   listEngineAccountsAllScopes,
   reconcileEngineAccountsFromStore,
 } from "../lib/engine-accounts";
-import { reconcileUserCredentialsFromStore } from "../lib/user-credentials-store";
+import {
+  reconcileProjectEnvFromStore,
+  reconcileUserCredentialsFromStore,
+} from "../lib/user-credentials-store";
 import { createEngineConnectManager } from "../lib/engine-connect";
 import { createEngineLoginManager } from "../lib/engine-login";
 import {
@@ -488,6 +491,18 @@ void reconcileUserCredentialsFromStore()
       `[user-credentials] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
     );
   });
+void reconcileProjectEnvFromStore()
+  .then((r) => {
+    if (r.skipped) return;
+    console.log(
+      `[project-env] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
+    );
+  })
+  .catch((error: unknown) => {
+    console.warn(
+      `[project-env] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  });
 // Reconcile a durable retention-off setting before recovery/connect can make
 // crash-left owner-facing terminal history observable again. Correctness
 // tombstones remain intact inside applyTerminalHistoryRetention.