@runuai/host 0.9.124 → 0.9.127

package/lib/standard-image.ts

@@ -45,6 +45,7 @@ import {
   standardImagePullCommands,
   standardImagePullDigest,
 } from "./standard-image-pin";
+import { sidecarMode } from "./sidecar";
 
 /** Pinned, host-wide constants (must match task-up.sh and the compose gen). */
 export const STANDARD_IMAGE_TAG = "uai-standard:dev";
@@ -1138,6 +1139,14 @@ function markAgentClisReady(): void {
 export function ensureStandardImage(
   opts: { maxAgeMs?: number } = {},
 ): Promise<StandardImageResult> {
+  // ADR-133 sidecar mode: a task machine has no container image to keep —
+  // its agent CLIs are baked into the machine image. Live 2026-09-10
+  // (hostless smoke 4): task-up refused with "could not prepare the host
+  // base image uai-standard:dev … Docker is not available".
+  if (sidecarMode()) {
+    markAgentClisReady();
+    return Promise.resolve({ ok: true });
+  }
   // A task-up passes maxAgeMs: a pass that succeeded recently for the same
   // engine configuration is reused instead of spending ~15 s spinning a
   // maintenance container per task (live 2026-09-09: 16 s of every task

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.124",
+  "version": "0.9.127",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -243,6 +243,7 @@ import {
   type TaskDiffInput,
   type TaskDownInput,
   type TaskLaunchInput,
+  type TaskLease,
   type FilesOpInput,
   engineAccountScopeFromWire,
   isEngineAccountLabel,
@@ -1272,7 +1273,6 @@ async function connect(): Promise<void> {
     reconnectAttempt = 0;
     markConnected();
     console.log(`[host-agent] connected as ${hostId}`);
-    leaseManager?.reconnected();
     setHostObsTag(hostId);
     addHostBreadcrumb("bridge", "connected");
 
@@ -1322,6 +1322,12 @@ async function connect(): Promise<void> {
       case "pong":
         break;
       case "event.resume":
+        // ADR-133: the cloud's first frame after a verified auth. A lease
+        // request sent any earlier lands in the bridge's pre-verdict window,
+        // where only auth/ping/result frames survive (live 2026-09-10,
+        // hostless smoke 5: the first request vanished, the machine sat
+        // three minutes without credentials).
+        leaseManager?.reconnected();
         // ADR-103: the cloud named its watermark — rewind the transmit
         // cursor to it (null = no state, replay nothing) and start draining.
         if (resumeFallbackTimer) {
@@ -2704,6 +2710,24 @@ function expectNumberArg(args: unknown[], index: number): number {
   return value;
 }
 
+function isTaskLease(value: unknown): value is TaskLease {
+  if (!value || typeof value !== "object") return false;
+  const lease = value as Record<string, unknown>;
+  const files = lease.files as Record<string, unknown> | undefined;
+  return (
+    typeof lease.accessKeyId === "string" &&
+    typeof lease.secretAccessKey === "string" &&
+    typeof lease.sessionToken === "string" &&
+    typeof lease.expiresAt === "number" &&
+    typeof lease.region === "string" &&
+    !!files &&
+    typeof files === "object" &&
+    typeof files.bucket === "string" &&
+    (files.orgPrefix === null || typeof files.orgPrefix === "string") &&
+    typeof files.userPrefix === "string"
+  );
+}
+
 function parseCloudFrame(data: RawData): CloudToHost | null {
   let parsed: unknown;
   try {
@@ -2931,6 +2955,23 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
   ) {
     return { kind: "mcp.op", opId: frame.opId, op: frame.op };
   }
+  // ADR-133: the cloud's answers to a sidecar's lease request. Without these
+  // two clauses the sidecar logs "dropping unknown frame kind=lease.grant"
+  // and the task dies after the 3-minute credentials gate.
+  if (
+    frame.kind === "lease.grant" &&
+    typeof frame.opId === "string" &&
+    isTaskLease(frame.lease)
+  ) {
+    return { kind: "lease.grant", opId: frame.opId, lease: frame.lease };
+  }
+  if (
+    frame.kind === "lease.deny" &&
+    typeof frame.opId === "string" &&
+    typeof frame.error === "string"
+  ) {
+    return { kind: "lease.deny", opId: frame.opId, error: frame.error };
+  }
   // Names only — never payloads (frames can carry tokens).
   console.warn(
     `[host-agent] dropping unknown frame kind=${String(frame.kind)}` +