@runuai/host 0.9.125 → 0.9.128

package/lib/credential-store-pickup.ts

@@ -10,6 +10,7 @@
  */
 
 import { configuredCredentialStore, credentialStorePrefix } from "./credential-store";
+import { engineAccountListPaths } from "./credential-store-scope";
 import {
   applyStoredEngineAccount,
   engineAccountHostId,
@@ -45,8 +46,8 @@ export async function pickupChangedCredentials(): Promise<PickupSummary> {
   const summary: PickupSummary = { skipped: false, listed: 0, changed: 0, applied: 0, errors: 0 };
   if (!store) return { ...summary, skipped: true };
   const prefix = credentialStorePrefix();
-  const hostId = engineAccountHostId();
-  const paths = [`${prefix}/orgs`, ...(hostId ? [`${prefix}/hosts/${hostId}`] : [])];
+  const paths = engineAccountListPaths(prefix, engineAccountHostId());
+  if (paths === null) return { ...summary, skipped: true };
   const current = new Map<string, number>();
   for (const path of paths) {
     try {

package/lib/credential-store-scope.ts

@@ -0,0 +1,85 @@
+/**
+ * Which credential store paths this runner may list.
+ *
+ * An owned or shared host reads whole trees (`/uai/orgs`, `/uai/users`,
+ * `/uai/projects`, its own `/uai/hosts/<id>`). A sidecar (ADR-133) holds a
+ * task lease whose IAM policy is scoped by session tag — it may list exactly
+ * `/uai/orgs/<org>` and `/uai/users/<user>` and nothing above them, so the
+ * tree listings answer AccessDenied on every path (2026-09-10, smoke 6: zero
+ * engine accounts and no GitHub token on the first live task machine). The
+ * lease carries the two ids; a lease without them (an older cloud) means the
+ * store is not read at all rather than listed where it cannot be.
+ *
+ * Project env stays unread on a task machine: the policy grants project
+ * parameters by an `org` tag the mirror never writes (put-parameter's
+ * Overwrite excludes tags), so no listing shape can reach them until the
+ * store layout or the mirror changes (hostless-implementation.md).
+ */
+import { isParameterPathSegment } from "./credential-store";
+import { leaseScope } from "./lease";
+import { sidecarMode } from "./sidecar";
+
+export type StoreListScope =
+  | { kind: "host" }
+  | { kind: "lease"; orgId: string | null; userId: string }
+  | { kind: "none"; reason: string };
+
+export function storeListScope(): StoreListScope {
+  if (!sidecarMode()) return { kind: "host" };
+  const scope = leaseScope();
+  if (!scope) return { kind: "none", reason: "the lease carries no org/user scope" };
+  return { kind: "lease", orgId: scope.orgId, userId: scope.userId };
+}
+
+const warned = new Set<string>();
+function warnOnce(tag: string, line: string): void {
+  if (warned.has(tag)) return;
+  warned.add(tag);
+  console.warn(`[${tag}] credential store: ${line}`);
+}
+/** Test seam. */
+export function resetStoreScopeWarningsForTesting(): void {
+  warned.clear();
+}
+
+/** The paths an engine-account listing walks, or null when this runner
+ * must not list at all (a sidecar without a scoped lease). */
+export function engineAccountListPaths(prefix: string, hostId: string | null): string[] | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") {
+    const paths = [`${prefix}/orgs`];
+    if (hostId && isParameterPathSegment(hostId)) paths.push(`${prefix}/hosts/${hostId}`);
+    return paths;
+  }
+  if (scope.kind === "none") {
+    warnOnce("engine-accounts", `${scope.reason} — not listed on this task machine`);
+    return null;
+  }
+  // No host path: a task machine's host row owns no accounts, and the policy
+  // denies the path anyway.
+  if (scope.orgId === null || !isParameterPathSegment(scope.orgId)) return [];
+  return [`${prefix}/orgs/${scope.orgId}`];
+}
+
+/** The path a user-credential listing walks, or null to skip. */
+export function userCredentialListPath(prefix: string): string | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") return `${prefix}/users`;
+  if (scope.kind === "none") {
+    warnOnce("user-credentials", `${scope.reason} — not listed on this task machine`);
+    return null;
+  }
+  if (!isParameterPathSegment(scope.userId)) return null;
+  return `${prefix}/users/${scope.userId}`;
+}
+
+/** The path a project-env listing walks, or null to skip. */
+export function projectEnvListPath(prefix: string): string | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") return `${prefix}/projects`;
+  warnOnce(
+    "project-env",
+    "not read on a task machine — the lease policy grants no project parameters (they carry no org tag)",
+  );
+  return null;
+}

package/lib/engine-accounts.ts

@@ -53,6 +53,7 @@ import {
   settleStoreWrites,
   type CredentialStore,
 } from "./credential-store";
+import { engineAccountListPaths } from "./credential-store-scope";
 import { getDb, schema } from "./db";
 import { brokeredFilesFor } from "./token-broker";
 import {
@@ -1452,8 +1453,8 @@ export async function reconcileEngineAccountsFromStore(
   const prefix = credentialStorePrefix();
   const warn = (line: string): void => console.warn(`[engine-accounts] credential store: ${line}`);
 
-  const paths = [`${prefix}/orgs`];
-  if (hostId && isParameterPathSegment(hostId)) paths.push(`${prefix}/hosts/${hostId}`);
+  const paths = engineAccountListPaths(prefix, hostId);
+  if (paths === null) return { ...result, skipped: true };
   const listed: Array<{ name: string; value: string }> = [];
   const listedPrefixes: string[] = [];
   for (const path of paths) {

package/lib/github-tokens.ts

@@ -33,6 +33,7 @@ import {
   ensureTaskSshIdentity,
 } from "./git-identity";
 import type { TaskEnvironmentHandle } from "./task-environment/types";
+import { sidecarMode } from "./sidecar";
 import {
   MAX_GITHUB_INSTALLATIONS,
   MAX_GITHUB_REPOSITORIES_PER_INSTALLATION,
@@ -1940,6 +1941,13 @@ export async function removeGithubFromContainer(
   run: DockerCommand = taskContainerCli,
   admitContainerWork: () => void = requireContainerRuntimeOperational,
 ): Promise<boolean> {
+  // ADR-133: a task machine has no container runtime and no app container —
+  // the credential lives in the machine's own gh config, installed over the
+  // environment at task-up (`machineTaskGithubAuth`). Inspecting Docker here
+  // threw `spawn docker ENOENT` on every session start, so no agent ever
+  // came up on the first live hostless run (2026-09-10, smoke 6). Same answer
+  // a Docker host gives for a machine task: no container, nothing to scrub.
+  if (sidecarMode()) return false;
   const container = taskAppContainerName(taskId);
   admitContainerWork();
   const observed = await taskAppContainerState(container, run as never);

package/lib/lease.ts

@@ -30,13 +30,21 @@ export const LEASE_RETRY_MS = 30_000;
 /** The cloud must answer within this window or the request is retried. */
 export const LEASE_REQUEST_TIMEOUT_MS = 20_000;
 
-/** Where the `credential_process` helper reads the live session. Root-only:
+/** Where the `credential_process` command reads the live session. Root-only:
  * the agents run as `node` and never see it. */
 export const LEASE_CREDENTIALS_FILE = "/run/uai/lease-credentials.json";
 /** The AWS config Mountpoint is pointed at (`AWS_CONFIG_FILE`). */
 export const LEASE_AWS_CONFIG_FILE = "/run/uai/aws-config";
-/** The helper itself — a shell script so it needs nothing but `cat`. */
-export const LEASE_CREDENTIAL_PROCESS = "/run/uai/lease-credential-process";
+/**
+ * The `credential_process` line: `cat` of the JSON, run by the AWS CLI and
+ * by Mountpoint's CRT profile provider through `/bin/sh -c`. NOT a script
+ * under /run — Debian mounts /run `noexec`, so a helper there fails with
+ * EACCES even for root and both clients fall through to the instance
+ * profile, which has no S3 rights (live 2026-09-10, hostless smoke 6: every
+ * mount answered "assumed-role/uai-task-machine-instance … is not
+ * authorized to perform: s3:ListBucket").
+ */
+export const LEASE_CREDENTIAL_PROCESS = `/bin/cat ${LEASE_CREDENTIALS_FILE}`;
 
 export interface LeaseSender {
   (frame: { kind: "lease.request"; opId: string; taskId: string }): boolean;
@@ -95,21 +103,28 @@ export function credentialProcessOutput(lease: TaskLease): string {
   });
 }
 
+/** The AWS config file content for a lease: default profile, region, and
+ * the `credential_process` that serves the live session. Exported for the
+ * test that pins it. */
+export function leaseAwsConfig(lease: Pick<TaskLease, "region">): string {
+  return `[default]\nregion = ${lease.region}\ncredential_process = ${LEASE_CREDENTIAL_PROCESS}\n`;
+}
+
+/** The org and user a lease was issued for — the credential store paths a
+ * sidecar may list (`/uai/orgs/<org>`, `/uai/users/<user>`; the task-machine
+ * policy grants nothing above them). Null on an owned host or before the
+ * first grant; `orgId` is null for a lease with no org scope. Absent from
+ * the lease when the cloud predates the field. */
+export function leaseScope(): { orgId: string | null; userId: string } | null {
+  if (!current || typeof current.userId !== "string") return null;
+  return { orgId: current.orgId ?? null, userId: current.userId };
+}
+
 function writeLeaseFiles(lease: TaskLease): void {
   mkdirSync(dirname(LEASE_CREDENTIALS_FILE), { recursive: true, mode: 0o700 });
   writeFileSync(LEASE_CREDENTIALS_FILE, credentialProcessOutput(lease), { mode: 0o600 });
   chmodSync(LEASE_CREDENTIALS_FILE, 0o600);
-  writeFileSync(
-    LEASE_CREDENTIAL_PROCESS,
-    `#!/bin/sh\nexec cat ${LEASE_CREDENTIALS_FILE}\n`,
-    { mode: 0o700 },
-  );
-  chmodSync(LEASE_CREDENTIAL_PROCESS, 0o700);
-  writeFileSync(
-    LEASE_AWS_CONFIG_FILE,
-    `[default]\nregion = ${lease.region}\ncredential_process = ${LEASE_CREDENTIAL_PROCESS}\n`,
-    { mode: 0o600 },
-  );
+  writeFileSync(LEASE_AWS_CONFIG_FILE, leaseAwsConfig(lease), { mode: 0o600 });
   chmodSync(LEASE_AWS_CONFIG_FILE, 0o600);
 }
 

package/lib/shared-files-s3.ts

@@ -17,8 +17,46 @@ import type { TaskEnvironmentHandle } from "./task-environment/types";
 import { LEASE_AWS_CONFIG_FILE, currentLease } from "./lease";
 
 export const MOUNT_S3_BIN = "/usr/bin/mount-s3";
-export const SHARED_FILES_UID = 1000;
-export const SHARED_FILES_GID = 1000;
+/** The task user the mounts are owned by. Its ids are looked up on the
+ * machine, never assumed: the Debian cloud image the payload AMI is built
+ * from ships an `admin` user at uid 1000, so `node` lands on 1001 there
+ * and a hard-coded 1000 handed every mount to the wrong user (2026-09-10,
+ * smoke 6). */
+export const SHARED_FILES_USER = "node";
+/** What the lookup falls back to (the standard container image's ids). */
+export const SHARED_FILES_FALLBACK_UID = 1000;
+export const SHARED_FILES_FALLBACK_GID = 1000;
+
+export interface TaskUserIds {
+  uid: number;
+  gid: number;
+}
+
+/** `id -u`/`id -g` of the task user on this machine, through the root exec. */
+export async function resolveTaskUserIds(
+  handle: Pick<TaskEnvironmentHandle, "exec">,
+  user: string = SHARED_FILES_USER,
+): Promise<TaskUserIds> {
+  const fallback = { uid: SHARED_FILES_FALLBACK_UID, gid: SHARED_FILES_FALLBACK_GID };
+  try {
+    const result = await handle.exec({
+      argv: ["/bin/sh", "-c", 'id -u "$1" && id -g "$1"', "ids", user],
+      user: "root",
+      timeoutMs: 10_000,
+      maxOutputBytes: 1024,
+    });
+    if (result.exitCode !== 0) return fallback;
+    const [uid, gid] = Buffer.from(result.stdout)
+      .toString("utf8")
+      .trim()
+      .split(/\s+/)
+      .map((part) => Number.parseInt(part, 10));
+    if (!Number.isInteger(uid) || !Number.isInteger(gid) || uid! < 0 || gid! < 0) return fallback;
+    return { uid: uid!, gid: gid! };
+  } catch {
+    return fallback;
+  }
+}
 
 export type SharedFilesMode = "off" | "ro" | "rw";
 
@@ -31,7 +69,7 @@ export interface SharedFilesMountPlan {
 }
 
 /** The mount-s3 argv for one prefix. Exported for the test that pins it. */
-export function mountS3Argv(plan: SharedFilesMountPlan): [string, ...string[]] {
+export function mountS3Argv(plan: SharedFilesMountPlan, owner: TaskUserIds): [string, ...string[]] {
   return [
     MOUNT_S3_BIN,
     "--prefix",
@@ -42,9 +80,9 @@ export function mountS3Argv(plan: SharedFilesMountPlan): [string, ...string[]] {
     // is performed by the root sidecar.
     "--allow-other",
     "--uid",
-    String(SHARED_FILES_UID),
+    String(owner.uid),
     "--gid",
-    String(SHARED_FILES_GID),
+    String(owner.gid),
     "--dir-mode",
     "0755",
     "--file-mode",
@@ -101,16 +139,19 @@ export async function mountSharedFilesFromLease(
   }
   const warnings: string[] = [];
   let mountedAny = false;
+  const owner = await resolveTaskUserIds(handle);
   for (const plan of sharedFilesMountPlans(workspacePath, mode, lease)) {
     const result = await handle.exec({
       argv: [
         "/bin/sh",
         "-c",
         // Idempotent: an already-mounted directory is left alone.
-        'mkdir -p "$1" && chown 1000:1000 "$1"; if mountpoint -q "$1"; then exit 0; fi; shift; exec "$@"',
+        'mkdir -p "$1" && chown "$2:$3" "$1"; if mountpoint -q "$1"; then exit 0; fi; shift 3; exec "$@"',
         "mount",
         plan.directory,
-        ...mountS3Argv(plan),
+        String(owner.uid),
+        String(owner.gid),
+        ...mountS3Argv(plan, owner),
       ],
       user: "root",
       env: { AWS_CONFIG_FILE: LEASE_AWS_CONFIG_FILE },

package/lib/task-environment/self.ts

@@ -15,7 +15,7 @@
  * terminating the instance this process lives on.
  */
 import { spawn as nodeSpawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 
 import { buildRemoteCommand } from "../machine-exec";
@@ -63,6 +63,51 @@ export interface SelfTaskEnvironmentDeps {
   /** Whether this process may drop privileges with setpriv (root). Tests and
    * a non-root dev run keep everything as the current user. */
   privileged?: () => boolean;
+  /** The machine-wide environment every request runs under (beneath its own
+   * `env`). Defaults to /etc/environment — see `readEtcEnvironment`. */
+  etcEnvironment?: () => Readonly<Record<string, string>>;
+}
+
+/**
+ * /etc/environment, as pam_env reads it: `KEY=value` lines, optional
+ * `export`, optional single or double quotes, `#` comments. The machine
+ * provider gets these for free — sshd applies pam_env to every session — but
+ * a local `setpriv --reset-env … sh -lc` sees neither pam nor the file, so
+ * `PLAYWRIGHT_BROWSERS_PATH` from the payload image never reached an agent
+ * on the sidecar and every task re-downloaded Chromium (2026-09-10, smoke 6).
+ */
+export function parseEtcEnvironment(text: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!match) continue;
+    let value = match[2]!.trim();
+    if (
+      value.length >= 2 &&
+      ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'")))
+    ) {
+      value = value.slice(1, -1);
+    }
+    out[match[1]!] = value;
+  }
+  return out;
+}
+
+export const ETC_ENVIRONMENT_PATH = "/etc/environment";
+let etcEnvironmentCache: Record<string, string> | null = null;
+/** The parsed /etc/environment, read once per process (the image writes it
+ * at bake time; nothing edits it on a task machine). Empty when absent. */
+export function readEtcEnvironment(): Record<string, string> {
+  if (etcEnvironmentCache) return etcEnvironmentCache;
+  try {
+    etcEnvironmentCache = parseEtcEnvironment(readFileSync(ETC_ENVIRONMENT_PATH, "utf8"));
+  } catch {
+    etcEnvironmentCache = {};
+  }
+  return etcEnvironmentCache;
 }
 
 export function selfTaskEnvironmentLocator(
@@ -143,12 +188,14 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
   readonly #value: SelfTaskEnvironmentLocatorValue;
   readonly #spawn: typeof nodeSpawn;
   readonly #privileged: () => boolean;
+  readonly #etcEnvironment: () => Readonly<Record<string, string>>;
 
   constructor(locator: TaskEnvironmentLocator, deps: SelfTaskEnvironmentDeps) {
     this.#value = parseSelfTaskEnvironmentLocator(locator);
     this.#spawn = deps.spawn ?? nodeSpawn;
     this.#privileged =
       deps.privileged ?? (() => typeof process.getuid === "function" && process.getuid() === 0);
+    this.#etcEnvironment = deps.etcEnvironment ?? readEtcEnvironment;
     this.durableIdentity = `self:${this.#value.taskId}`;
     this.descriptor = {
       taskId: this.#value.taskId,
@@ -184,21 +231,34 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     }
   }
 
+  /** The request with the machine-wide environment beneath its own: what an
+   * ssh session on a machine task gets from pam_env, applied here by hand. */
+  #withMachineEnv<T extends { env?: Readonly<Record<string, string>> }>(request: T): T {
+    const base = this.#etcEnvironment();
+    if (Object.keys(base).length === 0) return request;
+    return { ...request, env: { ...base, ...request.env } };
+  }
+
   async exec(request: TaskEnvironmentExecRequest): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentProcessRequest(request);
-    const { command, args } = selfCommand(request, "interactive", this.#privileged());
-    return capturedCliExec(this.#spawn, command, args, request);
+    const scoped = this.#withMachineEnv(request);
+    const { command, args } = selfCommand(scoped, "interactive", this.#privileged());
+    return capturedCliExec(this.#spawn, command, args, scoped);
   }
 
   async spawn(request: TaskEnvironmentSpawnRequest): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentProcessRequest(request);
-    const { command, args } = selfCommand(request, "interactive", this.#privileged());
-    return streamingCliExec(this.#spawn, command, args, request);
+    const scoped = this.#withMachineEnv(request);
+    const { command, args } = selfCommand(scoped, "interactive", this.#privileged());
+    return streamingCliExec(this.#spawn, command, args, scoped);
   }
 
   async spawnSession(request: TaskEnvironmentSessionRequest): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentSessionRequest(request);
-    const session = { ...request, cwd: request.cwd ?? this.#value.workspacePath };
+    const session = this.#withMachineEnv({
+      ...request,
+      cwd: request.cwd ?? this.#value.workspacePath,
+    });
     const { command, args } = selfCommand(session, "interactive", this.#privileged());
     return streamingCliExec(this.#spawn, command, args, session);
   }
@@ -207,7 +267,10 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     request: TaskEnvironmentDetachedSessionRequest,
   ): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentSessionRequest(request);
-    const session = { ...request, cwd: request.cwd ?? this.#value.workspacePath };
+    const session = this.#withMachineEnv({
+      ...request,
+      cwd: request.cwd ?? this.#value.workspacePath,
+    });
     const { command, args } = selfCommand(session, "detached", this.#privileged());
     return capturedCliExec(this.#spawn, command, args, {
       ...session,

package/lib/user-credentials-store.ts

@@ -23,6 +23,7 @@ import {
   isParameterPathSegment,
   type CredentialStore,
 } from "./credential-store";
+import { projectEnvListPath, userCredentialListPath } from "./credential-store-scope";
 import {
   deleteToken as deleteGithubTokenLocal,
   githubTokenParameterName,
@@ -196,7 +197,8 @@ export async function reconcileUserCredentialsFromStore(): Promise<ReconcileUser
   const store = configuredCredentialStore();
   if (!store) return { ...result, skipped: true };
   const prefix = credentialStorePrefix();
-  const path = `${prefix}/users`;
+  const path = userCredentialListPath(prefix);
+  if (path === null) return { ...result, skipped: true };
   const warn = (line: string): void =>
     console.warn(`[user-credentials] credential store: ${line}`);
 
@@ -359,7 +361,8 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
   const store = configuredCredentialStore();
   if (!store) return { ...result, skipped: true };
   const prefix = credentialStorePrefix();
-  const path = `${prefix}/projects`;
+  const path = projectEnvListPath(prefix);
+  if (path === null) return { ...result, skipped: true };
   const warn = (line: string): void => console.warn(`[project-env] credential store: ${line}`);
   let listed: Array<{ name: string; value: string }>;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.125",
+  "version": "0.9.128",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cli.ts

@@ -169,6 +169,13 @@ async function main(): Promise<void> {
       return cmdInstaller(cmd, dryRun);
     case "uninstall":
       return cmdUninstall(rest);
+    case "version":
+    case "-v":
+    case "--version":
+      // A bare version line: the sidecar's prepare step compares it with the
+      // pinned runner version, and any other flag prints the usage instead.
+      console.log(packageVersion());
+      return;
     case undefined:
     case "help":
     case "-h":

package/src/main.ts

@@ -243,6 +243,7 @@ import {
   type TaskDiffInput,
   type TaskDownInput,
   type TaskLaunchInput,
+  type TaskLease,
   type FilesOpInput,
   engineAccountScopeFromWire,
   isEngineAccountLabel,
@@ -1272,7 +1273,6 @@ async function connect(): Promise<void> {
     reconnectAttempt = 0;
     markConnected();
     console.log(`[host-agent] connected as ${hostId}`);
-    leaseManager?.reconnected();
     setHostObsTag(hostId);
     addHostBreadcrumb("bridge", "connected");
 
@@ -1322,6 +1322,12 @@ async function connect(): Promise<void> {
       case "pong":
         break;
       case "event.resume":
+        // ADR-133: the cloud's first frame after a verified auth. A lease
+        // request sent any earlier lands in the bridge's pre-verdict window,
+        // where only auth/ping/result frames survive (live 2026-09-10,
+        // hostless smoke 5: the first request vanished, the machine sat
+        // three minutes without credentials).
+        leaseManager?.reconnected();
         // ADR-103: the cloud named its watermark — rewind the transmit
         // cursor to it (null = no state, replay nothing) and start draining.
         if (resumeFallbackTimer) {
@@ -2704,6 +2710,26 @@ function expectNumberArg(args: unknown[], index: number): number {
   return value;
 }
 
+function isTaskLease(value: unknown): value is TaskLease {
+  if (!value || typeof value !== "object") return false;
+  const lease = value as Record<string, unknown>;
+  const files = lease.files as Record<string, unknown> | undefined;
+  return (
+    typeof lease.accessKeyId === "string" &&
+    typeof lease.secretAccessKey === "string" &&
+    typeof lease.sessionToken === "string" &&
+    typeof lease.expiresAt === "number" &&
+    typeof lease.region === "string" &&
+    !!files &&
+    typeof files === "object" &&
+    typeof files.bucket === "string" &&
+    (files.orgPrefix === null || typeof files.orgPrefix === "string") &&
+    typeof files.userPrefix === "string" &&
+    (lease.orgId === undefined || lease.orgId === null || typeof lease.orgId === "string") &&
+    (lease.userId === undefined || typeof lease.userId === "string")
+  );
+}
+
 function parseCloudFrame(data: RawData): CloudToHost | null {
   let parsed: unknown;
   try {
@@ -2931,6 +2957,23 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
   ) {
     return { kind: "mcp.op", opId: frame.opId, op: frame.op };
   }
+  // ADR-133: the cloud's answers to a sidecar's lease request. Without these
+  // two clauses the sidecar logs "dropping unknown frame kind=lease.grant"
+  // and the task dies after the 3-minute credentials gate.
+  if (
+    frame.kind === "lease.grant" &&
+    typeof frame.opId === "string" &&
+    isTaskLease(frame.lease)
+  ) {
+    return { kind: "lease.grant", opId: frame.opId, lease: frame.lease };
+  }
+  if (
+    frame.kind === "lease.deny" &&
+    typeof frame.opId === "string" &&
+    typeof frame.error === "string"
+  ) {
+    return { kind: "lease.deny", opId: frame.opId, error: frame.error };
+  }
   // Names only — never payloads (frames can carry tokens).
   console.warn(
     `[host-agent] dropping unknown frame kind=${String(frame.kind)}` +

package/src/protocol.ts

@@ -1722,6 +1722,13 @@ export interface TaskLease {
     orgPrefix: string | null;
     userPrefix: string;
   };
+  /** The org and user the session is tagged with — the only credential
+   * store paths the sidecar may list (`/uai/orgs/<org>`, `/uai/users/<user>`).
+   * Optional on the wire: a cloud that predates the field sends neither, and
+   * the sidecar then skips the store instead of listing paths the policy
+   * denies. */
+  orgId?: string | null;
+  userId?: string;
 }
 
 export type McpOp =