@runuai/host 0.9.118 → 0.9.120

package/db/migrations/0022_task_project_ids.sql

@@ -0,0 +1,5 @@
+-- Machine tasks (ADR-121) have no compose env, so per-project env values
+-- (ADR-015) must ride each agent session's env instead — and the host only
+-- knew a task's project SLUGS while env is keyed by project id. Lead project
+-- first. Older rows stay '[]' (Docker tasks never read it).
+ALTER TABLE `uai_host_tasks` ADD `project_ids` text NOT NULL DEFAULT '[]';

package/db/migrations/meta/_journal.json

@@ -155,6 +155,13 @@
       "when": 1788900000003,
       "tag": "0021_project_env_store_ref",
       "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "6",
+      "when": 1788900000004,
+      "tag": "0022_task_project_ids",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -37,6 +37,9 @@ export const hostTasks = sqliteTable(
     ownerEmail: text("owner_email"),
     ownerName: text("owner_name"),
     projectSlugs: text("project_slugs").notNull().default("[]"),
+    // Lead project first. Machine tasks resolve per-project env through these
+    // ids at every agent spawn (Docker tasks take env from compose instead).
+    projectIds: text("project_ids").notNull().default("[]"),
     // ADR-131 D3: which engine-account scope this task resolves credentials
     // from ("org:<orgId>" on a shared host; null = "host"). Persisted so a
     // host restart re-provisions the same scope before the cloud re-sends it.

package/lib/host-env.ts

@@ -209,3 +209,49 @@ export function getDecryptedForProject(projectId: string): Record<string, string
   }
   return out;
 }
+
+/**
+ * Names a project may declare but a task must never receive from project env —
+ * the same list task-up.sh's `is_reserved_task_env_name` enforces for
+ * container tasks: git/gh plumbing, loader and shell hooks, toolchain config,
+ * the host's own `UAI_*` namespace, engine credentials, and the browser path.
+ */
+const RESERVED_TASK_ENV_EXACT = new Set([
+  "GH_TOKEN", "GITHUB_TOKEN", "GH_CONFIG_DIR", "GH_HOST",
+  "GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_OBJECT_DIRECTORY",
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_INDEX_FILE", "GIT_EXEC_PATH",
+  "GIT_ASKPASS", "SSH_ASKPASS", "GIT_SSH", "GIT_SSH_COMMAND",
+  "HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME",
+  "PATH", "LD_PRELOAD", "LD_AUDIT", "LD_LIBRARY_PATH", "NODE_OPTIONS",
+  "NODE_PATH", "SHELLOPTS", "BASHOPTS", "PS4", "BASH_ENV", "ENV",
+  "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN",
+  "XAI_API_KEY", "PLAYWRIGHT_BROWSERS_PATH",
+]);
+const RESERVED_TASK_ENV_NPM = /^npm_config_(prefix|cache|logs[_-]dir|umask)$/i;
+
+export function isReservedTaskEnvName(name: string): boolean {
+  if (RESERVED_TASK_ENV_EXACT.has(name)) return true;
+  if (name.startsWith("GIT_CONFIG") || name.startsWith("ASDF_")) return true;
+  if (name.startsWith("COREPACK_") || name.startsWith("UAI_")) return true;
+  return RESERVED_TASK_ENV_NPM.test(name);
+}
+
+/**
+ * Project env for a task that has no container env to carry it (ADR-121
+ * machine tasks): every project's decrypted values, lead project winning a
+ * key collision, minus the reserved names above — exactly what task-up hands
+ * Compose for a Docker task. Live 2026-09-09: a machine task on Uai Cloud
+ * had the Infisical identity in the store and the host, and the agent never
+ * saw it, because only the compose path injected project env.
+ */
+export function projectEnvForTask(projectIds: readonly string[]): Record<string, string> {
+  const merged: Record<string, string> = {};
+  for (const projectId of [...projectIds].reverse()) {
+    Object.assign(merged, getDecryptedForProject(projectId));
+  }
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(merged)) {
+    if (!isReservedTaskEnvName(key)) out[key] = value;
+  }
+  return out;
+}

package/lib/orchestrator.ts

@@ -43,7 +43,8 @@ import {
 } from "./agents/types";
 import { ACTIVE_STATUSES, isActive, isOnDashboard } from "./task-status";
 import { isSafeHostTaskId } from "./task-identity";
-import { getHostTask, upsertHostTask } from "./runtime-state";
+import { projectEnvForTask } from "./host-env";
+import { getHostTask, hostTaskProjectIds, upsertHostTask } from "./runtime-state";
 import { clearRefresh, reconcileTaskGitAuth } from "./github-tokens";
 import { ensureTaskSshIdentity, setupTaskGitIdentity } from "./git-identity";
 import { dockerCli } from "./docker-exec";
@@ -1505,6 +1506,7 @@ export class Orchestrator {
                   cliSecret,
                   this.isPromptLevelSecretary(channel, agent.id),
                 ),
+                this.machineProjectEnv(task),
               ),
             },
           );
@@ -1575,17 +1577,35 @@ export class Orchestrator {
     channel: Channel,
     agent: RosterAgent,
     base: Record<string, string>,
+    /** Lowest precedence: project env for tasks whose environment has no
+     *  container env to carry it. The account's env and the uai base win. */
+    floor: Record<string, string> = {},
   ): Record<string, string> {
     const account = pickEngineAccount(agent.kind, {
       scope: channel.engineAccountScope,
     });
     if (!account) {
       channel.accountByAgent.delete(agent.id);
-      return base;
+      return { ...floor, ...base };
     }
     channel.accountByAgent.set(agent.id, account.id);
     noteEngineAccountUsed(account.id);
-    return { ...account.execEnv, ...base };
+    return { ...floor, ...account.execEnv, ...base };
+  }
+
+  /**
+   * ADR-015 project env for a machine task (ADR-121): Docker tasks receive it
+   * from the compose env task-up renders, but a machine has no container, so
+   * it rides every agent session's env instead. Read at each spawn, so a
+   * respawn picks up values set since the task started. Empty for container
+   * tasks — their env already carries it and must not be doubled into argv.
+   */
+  private machineProjectEnv(task: {
+    environmentProvider: string | null;
+    projectIds?: string | null;
+  }): Record<string, string> {
+    if (task.environmentProvider !== "machine") return {};
+    return projectEnvForTask(hostTaskProjectIds(task));
   }
 
   /** Install a session with an event handler scoped to this exact generation. */
@@ -1939,7 +1959,13 @@ export class Orchestrator {
       return false;
     }
 
-    this.emitTaskStage(channel.taskId, "agents");
+    // Live 2026-09-10 (Mac Studio, host 0.9.119): a reconcile pass had
+    // already spawned the whole roster, bindSession had emitted `ready`, and
+    // this unconditional `agents` then overwrote it — the page stayed
+    // covered for good. Only announce the wake-up when there is one to do.
+    const allBound = (): boolean =>
+      initialRoster.every((agent) => channel.sessions.has(agent.id));
+    if (!allBound()) this.emitTaskStage(channel.taskId, "agents");
     for (const agent of initialRoster) {
       if (!this.isActiveChannel(channel)) return false;
       // A prior partial start or an independently guarded recovery may already
@@ -1972,6 +1998,7 @@ export class Orchestrator {
                 cliSecret,
                 this.isPromptLevelSecretary(channel, agent.id),
               ),
+              this.machineProjectEnv(task),
             ),
           },
         );
@@ -1997,8 +2024,12 @@ export class Orchestrator {
     // so it both duplicated the opening turn AND re-injected it on a host
     // restart, making agents redo the first turn mid-task. The persona/mission
     // an agent needs live in the always-on system preamble, so nothing is lost.
-    // `ready` itself was emitted by bindSession as the last roster agent
-    // bound (or above, when one could not).
+    // `ready` is emitted by bindSession as the last roster agent binds (or
+    // above, when one could not). Re-assert it here for the roster that was
+    // already bound when this loop began — every bind then predates this
+    // pass and could have been overwritten by an `agents` from a start
+    // that lost the race.
+    if (allBound()) this.emitTaskStage(channel.taskId, "ready");
     return true;
   }
 

package/lib/runtime-state.ts

@@ -232,16 +232,32 @@ export function recordTaskOwner(
   ownerName: string | null,
   projectSlugs: string[],
   engineAccountScope: string | null = null,
+  /** Lead project first — the order project env merges in. */
+  projectIds: string[] = [],
 ): void {
   upsertHostTask(taskId, {
     ownerUserId,
     ownerEmail,
     ownerName,
     projectSlugs: JSON.stringify(projectSlugs),
+    projectIds: JSON.stringify(projectIds),
     engineAccountScope,
   });
 }
 
+/** The task's project ids, lead project first; `[]` for rows that predate
+ *  the column or carry an unreadable value. */
+export function hostTaskProjectIds(task: { projectIds?: string | null }): string[] {
+  try {
+    const parsed: unknown = JSON.parse(task.projectIds ?? "[]");
+    return Array.isArray(parsed)
+      ? parsed.filter((id): id is string => typeof id === "string" && id.length > 0)
+      : [];
+  } catch {
+    return [];
+  }
+}
+
 /** Append a task lifecycle event to the host event log (local `/api/events`). */
 export function recordHostEvent(
   taskId: string,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.118",
+  "version": "0.9.120",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -776,6 +776,10 @@ export const hostCommands: HostCommands = {
         input.projects.map((p) => p.slug),
         // ADR-131 D3: persisted so recovery re-provisions the same scope.
         input.task.engineAccountScope ?? null,
+        // Lead project first (position 0 wins env collisions, as in task-up).
+        [...input.projects]
+          .sort((a, b) => a.position - b.position)
+          .map((p) => p.id),
       );
       // ADR-048: persist the cloud-issued per-task cli secret (host-private) so the
       // `uai` CLI's per-agent tokens can be minted now + after a host restart.