@runuai/host 0.9.122 → 0.9.124

package/lib/container-runtime.ts

@@ -24,6 +24,7 @@ import {
   runtimeProviderStatePath,
   type RuntimeProviderStateStore,
 } from "./runtime-provider-state";
+import { sidecarMode } from "./sidecar";
 
 export type RuntimePreference = "auto" | "docker" | "apple-container";
 
@@ -282,6 +283,8 @@ export function pinnedContainerRuntimeMachineIdentity(): {
 /** Failure message for TEARDOWN admission: only a truly absent/unpinned
  * runtime refuses teardown. `checking` with a pin admits it. */
 export function containerRuntimeTeardownProblem(): string | null {
+  // ADR-133 sidecar mode: teardown is the cloud terminating this machine.
+  if (sidecarMode()) return null;
   if (state.status === "no-runtime") return state.message;
   if (pinnedContainerRuntimeMachineIdentity() === null) {
     return (
@@ -1347,6 +1350,11 @@ export function resetContainerRuntimeSelectionForTests(): void {
 
 /** Human-facing task failure, or null while the host can attempt Docker work. */
 export function containerRuntimeProblem(): string | null {
+  // ADR-133 sidecar mode: the task runs on this machine, not in a container;
+  // there is no runtime to be ready. Live 2026-09-10: the first hostless
+  // task-up reached its machine and was refused with the Docker-context
+  // message below, because this gate never knew the machine had no Docker.
+  if (sidecarMode()) return null;
   if (state.status === "no-runtime") return state.message;
   if (state.status !== "ready" || !operational) {
     return (

package/lib/machine-provider-aws.ts

@@ -38,6 +38,11 @@ export const AWS_MACHINE_TAG = "com.uai.machine";
  * UAI_MACHINE_IMAGE resolves the newest published payload in its region. */
 export const PAYLOAD_AMI_OWNER = "277057415208";
 export const PAYLOAD_AMI_NAME_PREFIX = "uai-machine-payload";
+/** Regions the payload AMI is published to (build-ami.sh bakes in the first
+ * and copies to the rest). A BYO-AWS runner elsewhere would find no image
+ * and fail every launch, so setup refuses other regions up front (owner,
+ * 2026-09-10: "only show the available ones for now"). */
+export const PAYLOAD_AMI_REGIONS: readonly string[] = ["us-west-2", "us-east-1"];
 /** Name of the security group auto-created in the default VPC when the host
  * config names none. Inbound: all TCP from the HOST's egress /32 only —
  * code-server runs auth-none and preview ports are plain HTTP, so exposure

package/lib/task-environment/index.ts

@@ -230,7 +230,15 @@ export function reconstructTaskEnvironment(
 export async function reconstructPersistedTaskEnvironment(
   task: HostTask,
 ): Promise<TaskEnvironmentHandle<TaskDownResult> | null> {
-  const locator = persistedTaskEnvironmentLocator(task, requireMachineIdentity());
+  // ADR-133: a machine or sidecar row carries its own locator and never
+  // needs the container runtime's identity — on a task machine there is
+  // none, and demanding it here would strand every session after task-up.
+  const locator = persistedTaskEnvironmentLocator(
+    task,
+    isEnvironmentTransportProvider(task.environmentProvider)
+      ? null
+      : requireMachineIdentity(),
+  );
   if (locator === null) return null;
   const handle = await registry.reconstruct(locator);
   if (handle.descriptor.taskId !== task.taskId) {
@@ -255,7 +263,9 @@ export function persistedTaskEnvironmentLocator(
     | "codeServerPort"
     | "previewPorts"
   >,
-  machine: HostMachineIdentity,
+  /** Null only for rows whose provider is reached over the environment
+   *  transport (machine, self): their locator is self-contained. */
+  machine: HostMachineIdentity | null,
 ): TaskEnvironmentLocator | null {
   const provider = task.environmentProvider;
   const raw = task.environmentLocator;
@@ -273,6 +283,9 @@ export function persistedTaskEnvironmentLocator(
   if (task.composeProject === null || task.worktreePath === null) {
     throw new Error("legacy task runtime persistence is incomplete");
   }
+  if (machine === null) {
+    throw new Error("legacy task runtime cannot be adopted on a task machine");
+  }
   throw new Error(
     machine.backend === "docker"
       ? "legacy Docker resources have not passed safe adoption"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.122",
+  "version": "0.9.124",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cli.ts

@@ -109,6 +109,7 @@ import {
   TasksResponse,
 } from "./ui/types";
 import type { InstallContext, Installer } from "../scripts/install/types";
+import { PAYLOAD_AMI_REGIONS } from "../lib/machine-provider-aws";
 
 // --- tiny ANSI (no chalk) ---------------------------------------------------
 
@@ -636,6 +637,14 @@ async function cmdAwsSetup(rest: string[]): Promise<void> {
     process.exitCode = 1;
     return;
   }
+  if (!PAYLOAD_AMI_REGIONS.includes(region)) {
+    console.error(
+      red(`task machines are not available in ${region} yet — Uai's machine image is published in ${PAYLOAD_AMI_REGIONS.join(", ")}`),
+    );
+    console.error(dim("pass --region with one of those; more regions are coming."));
+    process.exitCode = 1;
+    return;
+  }
 
   const identity = awsAdmin(["sts", "get-caller-identity"], region);
   if (identity.status !== 0) {

package/src/index.ts

@@ -185,7 +185,7 @@ export type {
   PreviewPortRuntime,
 } from "../lib/preview-ports";
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
-import { awaitSidecarReady } from "../lib/sidecar";
+import { awaitSidecarReady, sidecarMode } from "../lib/sidecar";
 
 export const hostEvents: HostEventStream = {
   subscribe(handler) {
@@ -1638,6 +1638,10 @@ const RUNTIME_TASK_ADMISSION_WAIT_MS = 3_000;
 async function prepareContainerRuntimeForTask(): Promise<
   HostCommandResult<never> | null
 > {
+  // ADR-133 sidecar mode: the task runs on this machine; there is no
+  // container runtime to prepare (live 2026-09-10, hostless smoke 3: this
+  // step answered with the no-runtime message before the gated check ran).
+  if (sidecarMode()) return null;
   let prepared:
     | Awaited<ReturnType<typeof ensureContainerRuntimeForTask>>
     | null;