@runuai/host 0.9.128 → 0.9.130

package/lib/git-identity.ts

@@ -11,6 +11,7 @@
  */
 
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
 import { eq } from "drizzle-orm";
@@ -62,6 +63,30 @@ function managedTaskExecArgs(
   ];
 }
 
+/** A task environment we can exec in (machine or sidecar): the ssh steps run
+ * there as `node` under the runtime authority, key material over stdin. */
+type EnvironmentExec = Pick<TaskEnvironmentHandle, "exec">;
+
+async function environmentStep(
+  environment: EnvironmentExec,
+  argv: [string, ...string[]],
+  stdin?: Uint8Array,
+): Promise<{ status: number | null; stdout: string; stderr: string }> {
+  const result = await environment.exec({
+    argv,
+    user: "node",
+    env: RUNTIME_AUTHORITY_ENV,
+    ...(stdin ? { stdin } : {}),
+    timeoutMs: EXEC_TIMEOUT_MS,
+    maxOutputBytes: 64 * 1024,
+  });
+  return {
+    status: result.exitCode,
+    stdout: Buffer.from(result.stdout).toString("utf8"),
+    stderr: Buffer.from(result.stderr).toString("utf8"),
+  };
+}
+
 export async function setupTaskGitIdentity(
   taskId: string,
   name: string | null,
@@ -164,7 +189,35 @@ export async function injectSshIdentity(
   taskId: string,
   keyPath: string,
   exec: DockerExec = defaultExec,
+  environment?: EnvironmentExec,
 ): Promise<boolean> {
+  if (environment) {
+    // ADR-121/133: no container and no `docker cp` on a machine — the key
+    // pair rides stdin into files node owns from the start, so there is no
+    // chown race and nothing for the machine's other users to read. Before
+    // this branch every task machine logged `mkdir ~/.ssh failed: spawn
+    // docker ENOENT` on session start and signed nothing (2026-09-10).
+    const privateKey = readFileSync(keyPath);
+    const publicKey = readFileSync(`${keyPath}.pub`);
+    const steps: ReadonlyArray<readonly [string, [string, ...string[]], Uint8Array?]> = [
+      ["mkdir ~/.ssh", ["/bin/sh", "-c", "/bin/mkdir -p /home/node/.ssh && /bin/chmod 700 /home/node/.ssh"]],
+      ["copy key", ["/bin/sh", "-c", "umask 077 && /bin/cat > /home/node/.ssh/id_ed25519"], privateKey],
+      ["copy pubkey", ["/bin/sh", "-c", "umask 022 && /bin/cat > /home/node/.ssh/id_ed25519.pub"], publicKey],
+      ["own + chmod", ["/bin/sh", "-c", "/bin/chmod 700 /home/node/.ssh && /bin/chmod 600 /home/node/.ssh/id_ed25519"]],
+      ["SSH signing config", ["/bin/sh", "-c", SSH_SIGNING_CONFIG]],
+    ];
+    for (const [label, argv, stdin] of steps) {
+      const res = await environmentStep(environment, argv, stdin);
+      if (res.status !== 0) {
+        console.warn(
+          `[ssh] task ${taskId}: ${label} failed: ${res.stderr.trim() || `exit ${res.status}`}`,
+        );
+        return false;
+      }
+    }
+    console.log(`[ssh] task ${taskId}: signing identity + git signing config asserted`);
+    return true;
+  }
   const container = taskAppContainerName(taskId);
   const steps: ReadonlyArray<readonly [string, string[]]> = [
     [
@@ -269,12 +322,16 @@ async function sshKeyHealthy(
   taskId: string,
   expectedPublicKey: string,
   exec: DockerExec,
+  environment?: EnvironmentExec,
 ): Promise<boolean> {
-  const res = await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), [
+  const probe: [string, ...string[]] = [
     "/bin/sh",
     "-c",
     "test -r /home/node/.ssh/id_ed25519 && /bin/cat /home/node/.ssh/id_ed25519.pub",
-  ]));
+  ];
+  const res = environment
+    ? await environmentStep(environment, probe)
+    : await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), probe));
   const expectedFingerprint = sshPublicKeyFingerprint(expectedPublicKey);
   const actualFingerprint = sshPublicKeyFingerprint(res.stdout ?? "");
   return (
@@ -287,6 +344,9 @@ async function sshKeyHealthy(
 interface EnsureTaskSshIdentityDeps {
   publicKeyForUser?: (userId: string) => string | null;
   writeIdentity?: typeof writeTaskIdentity;
+  /** The task's environment when it is a machine or sidecar (no container to
+   * exec into or `docker cp` to). Null/undefined = the container path. */
+  environment?: () => EnvironmentExec | null | undefined;
 }
 
 /**
@@ -342,6 +402,7 @@ export async function ensureTaskSshIdentity(
     expectedPublicKey,
     exec,
     deps.writeIdentity ?? writeTaskIdentity,
+    deps.environment?.() ?? undefined,
   );
   const entry = { fingerprint: expectedFingerprint, promise: pending };
   sshEnsureInFlight.set(taskId, entry);
@@ -365,19 +426,15 @@ async function ensureTaskSshIdentityOnce(
   expectedPublicKey: string,
   exec: DockerExec,
   writeIdentity: typeof writeTaskIdentity,
+  environment?: EnvironmentExec,
 ): Promise<boolean> {
   // Fast path: the DB-authoritative key is already good → re-assert only the
   // cheap signing config and skip docker cp churn.
-  if (await sshKeyHealthy(taskId, expectedPublicKey, exec)) {
-    const configured = await exec(managedTaskExecArgs(
-      "node",
-      taskAppContainerName(taskId),
-      [
-        "/bin/sh",
-        "-c",
-        SSH_SIGNING_CONFIG,
-      ],
-    ));
+  if (await sshKeyHealthy(taskId, expectedPublicKey, exec, environment)) {
+    const config: [string, ...string[]] = ["/bin/sh", "-c", SSH_SIGNING_CONFIG];
+    const configured = environment
+      ? await environmentStep(environment, config)
+      : await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), config));
     return configured.status === 0;
   }
 
@@ -388,7 +445,7 @@ async function ensureTaskSshIdentityOnce(
   }
   const keyPath = resolve(dir, "id_ed25519");
   try {
-    return await injectSshIdentity(taskId, keyPath, exec);
+    return await injectSshIdentity(taskId, keyPath, exec, environment);
   } finally {
     // Host hygiene (same as task-up): the materialized private key never
     // outlives the injection.

package/lib/github-tokens.ts

@@ -2094,9 +2094,12 @@ function enqueueTaskGitAuth(
       // ensuring the identity also keeps commit/tag signing available. Never
       // select SSH transport unless a usable identity was actually asserted.
       admitContainerWork();
-      const hasSshIdentity = await (
-        deps.ensureSsh ?? ensureTaskSshIdentity
-      )(taskId, userId);
+      const hasSshIdentity = deps.ensureSsh
+        ? await deps.ensureSsh(taskId, userId)
+        : await ensureTaskSshIdentity(taskId, userId, undefined, {
+            // Machine/sidecar tasks install the key over the environment.
+            environment: () => invocation.setupDeps?.environment?.() ?? null,
+          });
       if (!isCurrent()) return false;
       admitContainerWork();
       if (hasSshIdentity) {

package/lib/orchestrator.ts

@@ -293,6 +293,12 @@ interface Channel {
   /** Agents with a reconcile-spawn in flight (ADR-049 mid-task adds) — guards
    *  against a concurrent ensure double-spawning the same new agent. */
   spawning: Set<string>;
+  /** Roster agents that have bound at least once on this channel. The launch
+   *  screen's `ready` counts these, not the live `sessions` map: a one-shot
+   *  engine (grok, cursor) exits seconds after its bind, so "every roster
+   *  agent bound at this instant" was never true for a mixed roster after a
+   *  wake — live 2026-09-10, task machine, 4 agents, screen up for good. */
+  everBound: Set<string>;
   /** Factory creates are externally side-effecting before they bind. Teardown
    *  drains them so an old channel cannot resume against a reused container
    *  name and overwrite the replacement generation's durable transport. */
@@ -400,6 +406,25 @@ export function isClaudeAuthRevoked(message: string): boolean {
   return CLAUDE_AUTH_REVOKED_PATTERNS.some((re) => re.test(message));
 }
 
+/**
+ * ADR-121/133: on a machine or sidecar task the SSH signing identity is
+ * installed over the task environment (no container to exec into or
+ * `docker cp` to); a container task gets no environment and keeps the docker
+ * path. Recovery and resume have only the persisted task, so the environment
+ * is reconstructed here.
+ */
+async function sshIdentityDepsFor(task: {
+  taskId: string;
+  environmentProvider: string | null;
+}): Promise<{ environment: () => Pick<TaskEnvironmentHandle<unknown>, "exec"> | null }> {
+  if (!isEnvironmentTransportProvider(task.environmentProvider)) {
+    return { environment: () => null };
+  }
+  const persisted = getHostTask(task.taskId);
+  const environment = persisted ? await reconstructPersistedTaskEnvironment(persisted) : null;
+  return { environment: () => environment };
+}
+
 export class Orchestrator {
   private readonly channels = new Map<string, Channel>();
   private readonly channelSpecs = new Map<string, ChannelEnsureInput>();
@@ -698,6 +723,7 @@ export class Orchestrator {
       mcpConfigAppliedEpoch: 0,
       configGeneration: 0,
       spawning: new Set(),
+      everBound: new Set(),
       factoryOperations: new Set(),
       eventOperations: new Set(),
       accountByAgent: new Map(),
@@ -1605,24 +1631,37 @@ export class Orchestrator {
     environmentProvider: string | null;
     projectIds?: string | null;
   }): Record<string, string> {
-    if (task.environmentProvider !== "machine") return {};
+    // Machine OR sidecar (ADR-133): neither has a compose env to ride.
+    if (!isEnvironmentTransportProvider(task.environmentProvider)) return {};
     return projectEnvForTask(hostTaskProjectIds(task));
   }
 
+
   /** Install a session with an event handler scoped to this exact generation. */
+  /** Every roster agent has bound at least once — the launch screen lifts. */
+  private rosterReady(channel: Channel): boolean {
+    return channel.roster.every(
+      (agent) => channel.sessions.has(agent.id) || channel.everBound.has(agent.id),
+    );
+  }
+
   private bindSession(
     channel: Channel,
     agentId: string,
     session: AgentSession,
   ): void {
     channel.sessions.set(agentId, session);
+    channel.everBound.add(agentId);
     // The launch screen's `ready` rides the bind, not the tail of the start
     // loop: whichever path brings the last roster agent up — the initial
     // start, a reconcile that won the race with it, a respawn after Resume —
     // is the moment the task can take a message. Live 2026-09-09: `agents`
     // was stored, Jonah was up and idle, and no `ready` ever followed, so
     // the page stayed covered for minutes. Idempotent on the cloud side.
-    if (channel.roster.every((agent) => channel.sessions.has(agent.id))) {
+    // Counted on `everBound`, not `sessions`: an agent whose engine exits
+    // after each turn leaves the map seconds after binding and must not hold
+    // the screen up for the rest of the roster (live 2026-09-10).
+    if (this.rosterReady(channel)) {
       this.emitTaskStage(channel.taskId, "ready");
     }
     // Adapters may synchronously emit `error` followed by `turn_complete` (or
@@ -1898,7 +1937,11 @@ export class Orchestrator {
     // SSH signing identity, re-asserted independently of transport. Connected
     // users still push through gh over HTTPS; disconnected users select the
     // SSH transport fallback inside the reconcile above.
-    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId).catch((err) =>
+    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId, undefined, {
+      // A machine or sidecar task installs the key over its environment; a
+      // container task keeps the docker path (a null handle).
+      environment: () => channel.agentHandle,
+    }).catch((err) =>
       console.warn(
         `[ssh] task ${channel.taskId}: signing identity reconciliation failed: ${
           err instanceof Error ? err.message : String(err)
@@ -1965,7 +2008,9 @@ export class Orchestrator {
     // this unconditional `agents` then overwrote it — the page stayed
     // covered for good. Only announce the wake-up when there is one to do.
     const allBound = (): boolean =>
-      initialRoster.every((agent) => channel.sessions.has(agent.id));
+      initialRoster.every(
+        (agent) => channel.sessions.has(agent.id) || channel.everBound.has(agent.id),
+      );
     if (!allBound()) this.emitTaskStage(channel.taskId, "agents");
     for (const agent of initialRoster) {
       if (!this.isActiveChannel(channel)) return false;
@@ -2030,7 +2075,11 @@ export class Orchestrator {
     // already bound when this loop began — every bind then predates this
     // pass and could have been overwritten by an `agents` from a start
     // that lost the race.
-    if (allBound()) this.emitTaskStage(channel.taskId, "ready");
+    // Every roster agent was attempted above; if anything is up the task can
+    // take a message, whether or not a one-shot engine has already exited.
+    if (allBound() || channel.sessions.size > 0) {
+      this.emitTaskStage(channel.taskId, "ready");
+    }
     return true;
   }
 
@@ -6820,7 +6869,9 @@ async function recoverOneDockerTask(
         ),
       );
     }
-    void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+    void sshIdentityDepsFor(task)
+      .then((deps) => ensureTaskSshIdentity(task.taskId, task.ownerUserId, undefined, deps))
+      .catch((err) =>
       console.warn(
         `[ssh] task ${task.taskId}: running recovery reconciliation failed: ${
           err instanceof Error ? err.message : String(err)
@@ -7087,7 +7138,9 @@ async function recoverOneDockerTask(
   db_setRuntime(task.taskId, {
     codeServerPort: port,
   });
-  void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+  void sshIdentityDepsFor(task)
+    .then((deps) => ensureTaskSshIdentity(task.taskId, task.ownerUserId, undefined, deps))
+    .catch((err) =>
     console.warn(
       `[ssh] task ${task.taskId}: resumed signing identity reconciliation failed: ${
         err instanceof Error ? err.message : String(err)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.128",
+  "version": "0.9.130",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",