@runuai/host 0.9.120 → 0.9.122

package/src/main.ts

@@ -248,6 +248,10 @@ import {
   isEngineAccountLabel,
   isEngineConnectKind,
 } from "./protocol";
+import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
+import { LeaseManager } from "../lib/lease";
+import { markSidecarReady, sidecarMode, sidecarTaskId } from "../lib/sidecar";
+import { declareAgentClisReady } from "../lib/standard-image";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
 
@@ -457,24 +461,54 @@ migrateHostDb();
 // credential store. Import what this host lacks and upload what was never
 // mirrored, off the startup path — task-up resolves locally either way.
 configureEngineAccountStore({ hostId });
-void reconcileEngineAccountsFromStore({ hostId })
-  .then((r) => {
-    if (r.skipped) return;
-    console.log(
-      `[engine-accounts] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
-    );
-  })
-  .catch((error: unknown) => {
-    console.warn(
-      `[engine-accounts] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  });
+/** The credential-store reconciles. At boot on a host with its own AWS
+ * identity; after the first lease on a sidecar (ADR-133), which has no
+ * credentials before that. */
+function reconcileStores(): Promise<void> {
+  const engineAccounts = reconcileEngineAccountsFromStore({ hostId })
+    .then((r) => {
+      if (r.skipped) return;
+      console.log(
+        `[engine-accounts] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
+      );
+    })
+    .catch((error: unknown) => {
+      console.warn(
+        `[engine-accounts] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    });
+  const userCredentials = reconcileUserCredentialsFromStore()
+    .then((r) => {
+      if (r.skipped) return;
+      console.log(
+        `[user-credentials] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
+      );
+    })
+    .catch((error: unknown) => {
+      console.warn(
+        `[user-credentials] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    });
+  const projectEnv = reconcileProjectEnvFromStore()
+    .then((r) => {
+      if (r.skipped) return;
+      console.log(
+        `[project-env] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
+      );
+    })
+    .catch((error: unknown) => {
+      console.warn(
+        `[project-env] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    });
+  return Promise.all([engineAccounts, userCredentials, projectEnv]).then(() => undefined);
+}
 // Image + agent-CLI maintenance runs where the compute is owned: an owned
 // host keeps its own image current on an hourly schedule (a task-up reuses
 // the last pass instead of blocking on one); a Uai-operated host sets
 // UAI_IMAGE_MAINTENANCE=external — a cloud job keeps the payload AMI fresh —
-// and reconciles only once, at start.
-if (env.UAI_IMAGE_MAINTENANCE === "host") {
+// and reconciles only once, at start. A sidecar (ADR-133) has no image.
+if (env.UAI_IMAGE_MAINTENANCE === "host" && !sidecarMode()) {
   const maintenanceTimer = setInterval(() => {
     void ensureStandardImage().catch(() => undefined);
   }, MAINTENANCE_INTERVAL_MS);
@@ -489,38 +523,55 @@ const repushBrokeredCopies = async (kind: string): Promise<void> => {
   await getOrchestrator().refreshEngineAccountCopies(kind);
 };
 configureTokenBroker({ repush: repushBrokeredCopies });
-startTokenBrokerLoop();
-startCredentialStorePickup({ repush: repushBrokeredCopies });
-void reconcileUserCredentialsFromStore()
-  .then((r) => {
-    if (r.skipped) return;
-    console.log(
-      `[user-credentials] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
-    );
-  })
-  .catch((error: unknown) => {
-    console.warn(
-      `[user-credentials] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  });
-void reconcileProjectEnvFromStore()
-  .then((r) => {
-    if (r.skipped) return;
-    console.log(
-      `[project-env] credential store reconciled: ${r.imported} imported, ${r.uploaded} uploaded, ${r.removed} removed, ${r.errors} errors`,
-    );
-  })
-  .catch((error: unknown) => {
-    console.warn(
-      `[project-env] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  });
+// ADR-133: a sidecar never refreshes sign-ins (the broker Lambda does), and
+// reads the store only once it holds a lease — see leaseManager below.
+if (!sidecarMode()) {
+  startTokenBrokerLoop();
+  startCredentialStorePickup({ repush: repushBrokeredCopies });
+  void reconcileStores();
+}
+/**
+ * ADR-133 sidecar: the task-scoped AWS lease. Requested when the bridge is
+ * ready, refreshed before expiry; the first grant is what lets the store
+ * reconciles and the S3 file mounts run. A denial means the task is no
+ * longer ours to run — exit 3 and let the cloud's sweep reclaim the machine.
+ */
+const leaseManager: LeaseManager | null = sidecarMode()
+  ? new LeaseManager({
+      taskId: sidecarTaskId()!,
+      send: (frame) => {
+        if (!ws || ws.readyState !== WebSocket.OPEN) return false;
+        send(ws, frame);
+        return true;
+      },
+      onFirstGrant: () => {
+        console.log("[lease] granted — reconciling the credential store");
+        void reconcileStores().finally(() => {
+          // Task-up waits for this: only now are engine accounts, GitHub
+          // tokens, and project env on the machine (lib/sidecar.ts).
+          markSidecarReady();
+          console.log("[lease] credential store reconciled — the task may start");
+        });
+        startCredentialStorePickup({ repush: repushBrokeredCopies });
+      },
+      onGrant: (lease) => {
+        console.log(
+          `[lease] holds until ${new Date(lease.expiresAt).toISOString()}`,
+        );
+      },
+      onDenied: (error) => {
+        console.error(`[lease] denied: ${error} — this machine no longer runs its task`);
+        process.exit(3);
+      },
+    })
+  : null;
+if (sidecarMode()) declareAgentClisReady();
 // Reconcile a durable retention-off setting before recovery/connect can make
 // crash-left owner-facing terminal history observable again. Correctness
 // tombstones remain intact inside applyTerminalHistoryRetention.
 applyTerminalHistoryRetention();
 try {
-  await configureBundledContainerRuntime();
+  if (!sidecarMode()) await configureBundledContainerRuntime();
 } catch {
   // A malformed/tampered active generation must never fall back to PATH or an
   // inferred asset layout. Keep Docker-first operation available and surface
@@ -529,7 +580,17 @@ try {
     "[host-agent] signed bundled runtime validation failed; the bundled runtime is disabled",
   );
 }
-const initialRuntime = await initializeContainerRuntime();
+const initialRuntime: Awaited<ReturnType<typeof initializeContainerRuntime>> =
+  sidecarMode()
+    ? // ADR-133: a task machine runs its agents directly; nothing here ever
+      // dials a container runtime.
+      {
+        status: "no-runtime",
+        preference: "auto",
+        message: "sidecar mode — no container runtime on a task machine",
+        action: "none: a task machine runs its agents directly",
+      }
+    : await initializeContainerRuntime();
 // Do not touch the selected daemon merely because detection succeeded. The
 // activation gate below must first prove that every durable TaskEnvironment
 // belongs to this exact provider/endpoint. The manager's first admitted login
@@ -612,12 +673,16 @@ const stopAgentClisReadySubscription = onAgentClisReady(() =>
 void connect();
 // Local browser UI (ADR-028) — same single process, alongside the WSS client.
 // Best-effort: a UI bind failure must not take the host service down.
-void startLocalUi();
+// A task machine has no operator sitting at it (ADR-133): no local UI, no
+// Mac vnode watch.
+if (!sidecarMode()) void startLocalUi();
 // ADR-118 follow-up: vnode-pressure observability (macOS/apple-container
 // hosts). Logs only on band transitions; the sensor caches its sysctl read.
-const vnodePressureTimer = setInterval(() => void logVnodePressure(), 60_000);
-vnodePressureTimer.unref?.();
-void logVnodePressure();
+if (!sidecarMode()) {
+  const vnodePressureTimer = setInterval(() => void logVnodePressure(), 60_000);
+  vnodePressureTimer.unref?.();
+  void logVnodePressure();
+}
 
 async function startLocalUi(): Promise<void> {
   try {
@@ -717,6 +782,7 @@ function buildCapabilities(): HostCapabilities {
           },
         }
       : {}),
+    ...(sidecarTaskId() ? { sidecar: { taskId: sidecarTaskId()! } } : {}),
     maintenanceReady: areAgentClisReady(),
     mcpGateway: mcpGateway.state(),
     engineLogins: engineLoginManager.capabilities(),
@@ -1206,6 +1272,7 @@ async function connect(): Promise<void> {
     reconnectAttempt = 0;
     markConnected();
     console.log(`[host-agent] connected as ${hostId}`);
+    leaseManager?.reconnected();
     setHostObsTag(hostId);
     addHostBreadcrumb("bridge", "connected");
 
@@ -1405,6 +1472,10 @@ async function connect(): Promise<void> {
       case "tunnel.close":
         closeTunnel(socket, frame.tunnelId, frame.reason);
         break;
+      case "lease.grant":
+      case "lease.deny":
+        leaseManager?.handle(frame);
+        break;
       case "gh.connect.set": {
         const runtimeProblem = containerRuntimeProblem();
         if (runtimeProblem) {
@@ -2141,7 +2212,7 @@ async function resolveTunnelTarget(
   // operational. After a daemon restart an unrelated local process could bind
   // a stale port before recovery refreshes the task's mappings.
   const machineTask = getHostTask(frame.taskId);
-  if (machineTask?.environmentProvider === "machine") {
+  if (machineTask && isEnvironmentTransportProvider(machineTask.environmentProvider)) {
     // ADR-121: a machine's address is orchestrator-routable (bridge IP on
     // the Linux guinea pig, VPC-private on EC2) — editor and previews dial
     // it straight via the handle's ownership-proven route, independent of
@@ -3100,6 +3171,9 @@ function rejectFrameDuringShutdown(
     case "tunnel.data":
     case "tunnel.requestEnd":
     case "tunnel.close":
+    // A lease answer is housekeeping the sidecar still wants during a drain.
+    case "lease.grant":
+    case "lease.deny":
       return false;
   }
 }

package/src/protocol.ts

@@ -1074,6 +1074,9 @@ export interface HostCapabilities {
    * Present when the host is configured for them; the cloud shows the
    * provider/region on the host page and, eventually, per-task backing
    * choice keys off it. */
+  /** ADR-133 sidecar mode: this host IS the task's machine — exactly one
+   *  task, no container runtime, tunnels on loopback. */
+  sidecar?: { taskId: string };
   machineTasks?: {
     provider: string;
     region?: string;
@@ -1695,9 +1698,32 @@ export type CloudToHost =
   // only entries it never transmitted, replaying nothing.
   | { kind: "event.resume"; afterSeq: number | null }
   // ADR-103: cumulative — the host trims outbox entries with seq <= seq.
-  | { kind: "event.ack"; seq: number };
+  | { kind: "event.ack"; seq: number }
+  // ADR-133 leases: the cloud's answer to a sidecar's `lease.request`.
+  | { kind: "lease.grant"; opId: string; lease: TaskLease }
+  | { kind: "lease.deny"; opId: string; error: string };
 
 /** One MCP-connection operation (ADR-057), executed by the host. */
+/**
+ * ADR-133: the short-lived AWS credentials a task machine runs on — an STS
+ * session tagged with the task's workspace and owner, issued by the cloud
+ * over the bridge and held in the sidecar's memory only. `expiresAt` is the
+ * session expiry (epoch ms); the sidecar re-requests before it.
+ */
+export interface TaskLease {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken: string;
+  expiresAt: number;
+  region: string;
+  /** Files bucket and this task's prefixes inside it (S3 shared files). */
+  files: {
+    bucket: string;
+    orgPrefix: string | null;
+    userPrefix: string;
+  };
+}
+
 export type McpOp =
   // Probe `url` (MCP initialize). No auth → connected. 401 → walk the OAuth
   // discovery chain (RFC 9728 → 8414 → 7591), prepare PKCE, and ack
@@ -1751,6 +1777,8 @@ export type HostToCloud =
   // a task's containers, so the cloud mirrors the status (currently "stopped").
   | { kind: "task.status"; taskId: string; status: string }
   | { kind: "ping"; ts: number }
+  // ADR-133: a sidecar asks for (or refreshes) its task-scoped AWS lease.
+  | { kind: "lease.request"; opId: string; taskId: string }
   | {
       kind: "tunnel.ack";
       tunnelId: string;