@runuai/host 0.9.121 → 0.9.122

package/lib/sidecar.ts

@@ -16,3 +16,43 @@ export function sidecarTaskId(): string | null {
 export function sidecarMode(): boolean {
   return sidecarTaskId() !== null;
 }
+
+/**
+ * A sidecar is ready to run its task only once it holds a lease AND the
+ * credential store has been reconciled under it — before that there is no
+ * engine account, GitHub token, or project env on the machine, and a task-up
+ * that raced the first grant would clone without credentials and spawn
+ * agents that cannot sign in (the dispatch arrives the moment the bridge
+ * connects; the lease answer is one round trip behind it). Resolved by
+ * main.ts after the first grant's reconciles settle; never on an owned host.
+ */
+let markReady: (() => void) | null = null;
+let ready = false;
+export const sidecarReady: Promise<void> = new Promise<void>((resolve) => {
+  markReady = resolve;
+});
+export function markSidecarReady(): void {
+  if (ready) return;
+  ready = true;
+  markReady?.();
+  markReady = null;
+}
+export function isSidecarReady(): boolean {
+  return ready;
+}
+/** How long a task-up waits for the lease before giving up. */
+export const SIDECAR_READY_TIMEOUT_MS = 3 * 60_000;
+export function awaitSidecarReady(timeoutMs = SIDECAR_READY_TIMEOUT_MS): Promise<void> {
+  if (!sidecarMode() || ready) return Promise.resolve();
+  return new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(
+      () => reject(new Error("the task's machine has no credentials yet (no lease granted)")),
+      timeoutMs,
+    );
+    timer.unref?.();
+    void sidecarReady.then(() => {
+      clearTimeout(timer);
+      resolve();
+    });
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.121",
+  "version": "0.9.122",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -185,6 +185,7 @@ export type {
   PreviewPortRuntime,
 } from "../lib/preview-ports";
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
+import { awaitSidecarReady } from "../lib/sidecar";
 
 export const hostEvents: HostEventStream = {
   subscribe(handler) {
@@ -824,6 +825,9 @@ export const hostCommands: HostCommands = {
             "GitHub is connected on this host, but Uai could not prepare its credential for Git. Retry the task; if it persists, reconnect GitHub on this host.",
           );
         }
+        // ADR-133 sidecar: nothing to clone or spawn with until the lease
+        // has landed and the store is reconciled under it.
+        await awaitSidecarReady();
         // Launch screen: the first stage boundary. A machine-backed task
         // spends the next minute launching an EC2 instance; a container
         // task goes straight to preparing its workspace.

package/src/main.ts

@@ -250,7 +250,7 @@ import {
 } from "./protocol";
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
 import { LeaseManager } from "../lib/lease";
-import { sidecarMode, sidecarTaskId } from "../lib/sidecar";
+import { markSidecarReady, sidecarMode, sidecarTaskId } from "../lib/sidecar";
 import { declareAgentClisReady } from "../lib/standard-image";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -464,8 +464,8 @@ configureEngineAccountStore({ hostId });
 /** The credential-store reconciles. At boot on a host with its own AWS
  * identity; after the first lease on a sidecar (ADR-133), which has no
  * credentials before that. */
-function reconcileStores(): void {
-  void reconcileEngineAccountsFromStore({ hostId })
+function reconcileStores(): Promise<void> {
+  const engineAccounts = reconcileEngineAccountsFromStore({ hostId })
     .then((r) => {
       if (r.skipped) return;
       console.log(
@@ -477,7 +477,7 @@ function reconcileStores(): void {
         `[engine-accounts] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
       );
     });
-  void reconcileUserCredentialsFromStore()
+  const userCredentials = reconcileUserCredentialsFromStore()
     .then((r) => {
       if (r.skipped) return;
       console.log(
@@ -489,7 +489,7 @@ function reconcileStores(): void {
         `[user-credentials] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
       );
     });
-  void reconcileProjectEnvFromStore()
+  const projectEnv = reconcileProjectEnvFromStore()
     .then((r) => {
       if (r.skipped) return;
       console.log(
@@ -501,6 +501,7 @@ function reconcileStores(): void {
         `[project-env] credential store reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
       );
     });
+  return Promise.all([engineAccounts, userCredentials, projectEnv]).then(() => undefined);
 }
 // Image + agent-CLI maintenance runs where the compute is owned: an owned
 // host keeps its own image current on an hourly schedule (a task-up reuses
@@ -527,7 +528,7 @@ configureTokenBroker({ repush: repushBrokeredCopies });
 if (!sidecarMode()) {
   startTokenBrokerLoop();
   startCredentialStorePickup({ repush: repushBrokeredCopies });
-  reconcileStores();
+  void reconcileStores();
 }
 /**
  * ADR-133 sidecar: the task-scoped AWS lease. Requested when the bridge is
@@ -545,7 +546,12 @@ const leaseManager: LeaseManager | null = sidecarMode()
       },
       onFirstGrant: () => {
         console.log("[lease] granted — reconciling the credential store");
-        reconcileStores();
+        void reconcileStores().finally(() => {
+          // Task-up waits for this: only now are engine accounts, GitHub
+          // tokens, and project env on the machine (lib/sidecar.ts).
+          markSidecarReady();
+          console.log("[lease] credential store reconciled — the task may start");
+        });
         startCredentialStorePickup({ repush: repushBrokeredCopies });
       },
       onGrant: (lease) => {