@runuai/host 0.9.13 → 0.9.42

package/lib/git-identity.ts

@@ -17,6 +17,16 @@ import { eq } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
 import { dockerCli } from "./docker-exec";
+import {
+  removeTaskAppContainer,
+  taskAppContainerName,
+  taskAppContainerState,
+  taskContainerCli,
+} from "./task-container-cli";
+import { runtimeAuthorityDockerExecArgs } from "./runtime-authority";
+import { RUNTIME_AUTHORITY_ENV } from "./runtime-authority";
+import { assertSafeHostTaskId } from "./task-identity";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
 import {
   deleteKey,
   getPublicKey,
@@ -33,22 +43,38 @@ export type DockerExec = (
 ) => Promise<{ status: number | null; stdout?: string; stderr: string }>;
 
 const defaultExec: DockerExec = async (args) => {
-  const res = await dockerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
+  const res = await taskContainerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
   return { status: res.status, stdout: res.stdout, stderr: res.stderr };
 };
 
+function managedTaskExecArgs(
+  user: "node" | "root",
+  container: string,
+  command: string[],
+): string[] {
+  return [
+    "exec",
+    "-u",
+    user,
+    ...runtimeAuthorityDockerExecArgs(),
+    container,
+    ...command,
+  ];
+}
+
 export async function setupTaskGitIdentity(
   taskId: string,
   name: string | null,
   email: string | null,
   exec: DockerExec = defaultExec,
+  environment?: Pick<TaskEnvironmentHandle, "exec">,
 ): Promise<boolean> {
   if (!email) {
     console.log(`[git] task ${taskId}: no owner email — leaving git identity`);
     return false;
   }
   const displayName = name && name.trim() ? name.trim() : email;
-  const container = `task-${taskId}-app-1`;
+  const container = taskAppContainerName(taskId);
   // Values are passed as argv (never interpolated into a shell string), so a
   // name/email can't shell-inject.
   const entries: ReadonlyArray<readonly [string, string]> = [
@@ -56,17 +82,22 @@ export async function setupTaskGitIdentity(
     ["user.email", email],
   ];
   for (const [key, value] of entries) {
-    const res = await exec([
-      "exec",
-      "-u",
-      "node",
-      container,
-      "/usr/bin/git",
-      "config",
-      "--global",
-      key,
-      value,
-    ]);
+    const command = ["/usr/bin/git", "config", "--global", key, value] as [
+      string,
+      ...string[],
+    ];
+    const res = environment
+      ? await environment.exec({
+          argv: command,
+          user: "node",
+          env: RUNTIME_AUTHORITY_ENV,
+          timeoutMs: EXEC_TIMEOUT_MS,
+          maxOutputBytes: 64 * 1024,
+        }).then((result) => ({
+          status: result.exitCode,
+          stderr: Buffer.from(result.stderr).toString("utf8"),
+        }))
+      : await exec(managedTaskExecArgs("node", container, command));
     if (res.status !== 0) {
       console.warn(
         `[git] task ${taskId}: git config ${key} failed: ${res.stderr.trim()}`,
@@ -97,15 +128,11 @@ export async function configureTaskSshTransport(
   taskId: string,
   exec: DockerExec = defaultExec,
 ): Promise<boolean> {
-  const res = await exec([
-    "exec",
-    "-u",
-    "node",
-    `task-${taskId}-app-1`,
+  const res = await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), [
     "/bin/sh",
     "-c",
     SSH_TRANSPORT_CONFIG,
-  ]);
+  ]));
   if (res.status !== 0) {
     console.warn(
       `[ssh] task ${taskId}: SSH transport fallback setup failed: ${res.stderr.trim()}`,
@@ -127,19 +154,33 @@ export async function injectSshIdentity(
   keyPath: string,
   exec: DockerExec = defaultExec,
 ): Promise<boolean> {
-  const container = `task-${taskId}-app-1`;
+  const container = taskAppContainerName(taskId);
   const steps: ReadonlyArray<readonly [string, string[]]> = [
-    ["mkdir ~/.ssh", ["exec", "-u", "root", container, "/bin/mkdir", "-p", "/home/node/.ssh"]],
+    [
+      "mkdir ~/.ssh",
+      managedTaskExecArgs("root", container, [
+        "/bin/mkdir",
+        "-p",
+        "/home/node/.ssh",
+      ]),
+    ],
     ["copy key", ["cp", keyPath, `${container}:/home/node/.ssh/id_ed25519`]],
     ["copy pubkey", ["cp", `${keyPath}.pub`, `${container}:/home/node/.ssh/id_ed25519.pub`]],
     [
       "own + chmod",
-      [
-        "exec", "-u", "root", container, "/bin/sh", "-c",
+      managedTaskExecArgs("root", container, [
+        "/bin/sh", "-c",
         "/bin/chown -R node:node /home/node/.ssh && /bin/chmod 700 /home/node/.ssh && /bin/chmod 600 /home/node/.ssh/id_ed25519",
-      ],
+      ]),
+    ],
+    [
+      "SSH signing config",
+      managedTaskExecArgs("node", container, [
+        "/bin/sh",
+        "-c",
+        SSH_SIGNING_CONFIG,
+      ]),
     ],
-    ["SSH signing config", ["exec", "-u", "node", container, "/bin/sh", "-c", SSH_SIGNING_CONFIG]],
   ];
   for (const [label, args] of steps) {
     const res = await exec(args);
@@ -167,6 +208,34 @@ interface SshEnsureInFlight {
 }
 
 const sshEnsureInFlight = new Map<string, SshEnsureInFlight>();
+const sshDeleteInFlight = new Map<string, Promise<void>>();
+/** Durable for this host process: an orphan id is immutable/non-reused, and
+ * no later channel/recovery continuation may materialize its private key. */
+const retiredTaskSshEnsures = new Set<string>();
+
+/** Fence future task SSH ensures and join the exact older materialization, if
+ * any. This is stronger than deleting the directory once: channel startup and
+ * runtime recovery intentionally launch SSH reconciliation in the background,
+ * and an older health probe can otherwise resume by writing the key after GC
+ * has already checked absence. Never rejects; strict removal is the final
+ * filesystem authority and will surface any cleanup failure to the cloud. */
+export async function retireTaskSshIdentityEnsures(
+  taskId: string,
+): Promise<void> {
+  assertSafeHostTaskId(taskId);
+  retiredTaskSshEnsures.add(taskId);
+  for (;;) {
+    const current = sshEnsureInFlight.get(taskId);
+    if (!current) return;
+    await current.promise.catch(() => false);
+    // The tracked promise includes write/copy/finally-remove. Its outer caller
+    // performs only authority bookkeeping after this point, so clearing the
+    // matching entry is safe and avoids depending on microtask ordering.
+    if (sshEnsureInFlight.get(taskId) === current) {
+      sshEnsureInFlight.delete(taskId);
+    }
+  }
+}
 
 function sshPublicKeyFingerprint(publicKey: string): string | null {
   const [, encoded] = publicKey.trim().split(/\s+/, 3);
@@ -190,15 +259,11 @@ async function sshKeyHealthy(
   expectedPublicKey: string,
   exec: DockerExec,
 ): Promise<boolean> {
-  const res = await exec([
-    "exec",
-    "-u",
-    "node",
-    `task-${taskId}-app-1`,
+  const res = await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), [
     "/bin/sh",
     "-c",
     "test -r /home/node/.ssh/id_ed25519 && /bin/cat /home/node/.ssh/id_ed25519.pub",
-  ]);
+  ]));
   const expectedFingerprint = sshPublicKeyFingerprint(expectedPublicKey);
   const actualFingerprint = sshPublicKeyFingerprint(res.stdout ?? "");
   return (
@@ -226,6 +291,14 @@ export async function ensureTaskSshIdentity(
   exec: DockerExec = defaultExec,
   deps: EnsureTaskSshIdentityDeps = {},
 ): Promise<boolean> {
+  if (retiredTaskSshEnsures.has(taskId)) return false;
+  if (ownerUserId) {
+    const deleting = sshDeleteInFlight.get(ownerUserId);
+    if (deleting) {
+      await deleting.catch(() => {});
+      return ensureTaskSshIdentity(taskId, ownerUserId, exec, deps);
+    }
+  }
   const publicKeyForUser = deps.publicKeyForUser ?? getPublicKey;
   const expectedPublicKey = ownerUserId
     ? publicKeyForUser(ownerUserId)
@@ -285,15 +358,15 @@ async function ensureTaskSshIdentityOnce(
   // Fast path: the DB-authoritative key is already good → re-assert only the
   // cheap signing config and skip docker cp churn.
   if (await sshKeyHealthy(taskId, expectedPublicKey, exec)) {
-    const configured = await exec([
-        "exec",
-        "-u",
-        "node",
-        `task-${taskId}-app-1`,
+    const configured = await exec(managedTaskExecArgs(
+      "node",
+      taskAppContainerName(taskId),
+      [
         "/bin/sh",
         "-c",
         SSH_SIGNING_CONFIG,
-      ]);
+      ],
+    ));
     return configured.status === 0;
   }
 
@@ -378,43 +451,64 @@ export async function removeTaskSshIdentityFromContainer(
   taskId: string,
   exec: DockerExec = defaultExec,
 ): Promise<void> {
-  const container = `task-${taskId}-app-1`;
-  const inspectArgs = [
-    "ps",
-    "--all",
-    "--filter",
-    `name=^/${container}$`,
-    "--format",
-    "{{.State}}",
-  ];
-  const listed = await checkedSshDocker(
-    exec,
-    inspectArgs,
-    `inspect ${container}`,
-  );
-  const states = (listed.stdout ?? "")
-    .split(/\r?\n/)
-    .map((state) => state.trim())
-    .filter(Boolean);
-  if (states.length === 0) return;
-  if (states.length !== 1) {
-    throw new Error(`inspect ${container} returned ${states.length} containers`);
-  }
-  if (states[0] !== "running") {
-    await checkedSshDocker(
-      exec,
-      ["rm", "--force", container],
-      `remove SSH credential-bearing ${container}`,
-    );
-    const remaining = await checkedSshDocker(
+  const container = taskAppContainerName(taskId);
+  if (exec === defaultExec) {
+    // Backend-aware state/removal: the Apple CLI has no `ps`/`rm` verbs
+    // (review 2026-08-18 round 3, verified live: "Plugin 'container-ps' not
+    // found"), so the shared helpers own the per-backend translation and
+    // the whole-line absence proofs. The injected-exec seam below keeps
+    // scripting docker-shaped answers for tests.
+    const state = await taskAppContainerState(container);
+    if (state.kind === "absent") return;
+    if (state.kind === "unknown") {
+      throw new Error(`inspect ${container} failed: ${state.detail}`);
+    }
+    if (state.kind === "stopped") {
+      // Non-running credential-bearing containers are removed without
+      // executing their filesystem; removal is absence-verified inside.
+      await removeTaskAppContainer(container);
+      return;
+    }
+  } else {
+    const inspectArgs = [
+      "ps",
+      "--all",
+      "--filter",
+      `name=^/${container}$`,
+      "--format",
+      "{{.State}}",
+    ];
+    const listed = await checkedSshDocker(
       exec,
       inspectArgs,
-      `verify removal of ${container}`,
+      `inspect ${container}`,
     );
-    if ((remaining.stdout ?? "").trim()) {
-      throw new Error(`remove ${container} was not verified`);
+    const states = (listed.stdout ?? "")
+      .split(/\r?\n/)
+      .map((state) => state.trim())
+      .filter(Boolean);
+    if (states.length === 0) return;
+    if (states.length !== 1) {
+      throw new Error(
+        `inspect ${container} returned ${states.length} containers`,
+      );
+    }
+    if (states[0] !== "running") {
+      await checkedSshDocker(
+        exec,
+        ["rm", "--force", container],
+        `remove SSH credential-bearing ${container}`,
+      );
+      const remaining = await checkedSshDocker(
+        exec,
+        inspectArgs,
+        `verify removal of ${container}`,
+      );
+      if ((remaining.stdout ?? "").trim()) {
+        throw new Error(`remove ${container} was not verified`);
+      }
+      return;
     }
-    return;
   }
 
   await checkedSshDocker(
@@ -424,6 +518,7 @@ export async function removeTaskSshIdentityFromContainer(
       "-u",
       "node",
       ...SANITIZED_SSH_EXEC_ENV,
+      ...runtimeAuthorityDockerExecArgs(),
       container,
       "/usr/bin/env",
       "-i",
@@ -458,30 +553,47 @@ function sshCredentialTaskIdsForUser(userId: string): string[] {
 }
 
 export interface DeleteUserSshIdentityDeps {
+  /** Synchronous fail-closed check that must pass before authority changes. */
+  preflight?: () => void;
   deleteStored?: (userId: string) => void;
   taskIds?: (userId: string) => string[];
   removeFromContainer?: (taskId: string) => Promise<void>;
 }
 
-/** Delete authority first, then drain any older ensure and remove all copied
- * material before acknowledging ssh.key.delete. */
+/** Serialize deletion against new ensures, drain every older ensure, scrub all
+ * copied material, and only then delete authority. A failed scrub leaves the
+ * key authoritative and retryable instead of creating an unrecoverable split
+ * where host authority is gone but a valid private key remains in a container. */
 export async function deleteUserSshIdentity(
   userId: string,
   deps: DeleteUserSshIdentityDeps = {},
 ): Promise<void> {
-  (deps.deleteStored ?? deleteKey)(userId);
-  const taskIds = (deps.taskIds ?? sshCredentialTaskIdsForUser)(userId);
-  const removeFromContainer =
-    deps.removeFromContainer ?? removeTaskSshIdentityFromContainer;
-  const settled = await Promise.allSettled(
-    taskIds.map(async (taskId) => {
-      await sshEnsureInFlight.get(taskId)?.promise.catch(() => {});
-      removeTaskIdentity(taskId);
-      await removeFromContainer(taskId);
-    }),
-  );
-  const failed = settled.find(
-    (result): result is PromiseRejectedResult => result.status === "rejected",
-  );
-  if (failed) throw failed.reason;
+  const existing = sshDeleteInFlight.get(userId);
+  if (existing) return existing;
+  const run = async (): Promise<void> => {
+    deps.preflight?.();
+    const taskIds = (deps.taskIds ?? sshCredentialTaskIdsForUser)(userId);
+    const removeFromContainer =
+      deps.removeFromContainer ?? removeTaskSshIdentityFromContainer;
+    const settled = await Promise.allSettled(
+      taskIds.map(async (taskId) => {
+        await sshEnsureInFlight.get(taskId)?.promise.catch(() => {});
+        removeTaskIdentity(taskId);
+        await removeFromContainer(taskId);
+      }),
+    );
+    const failed = settled.find(
+      (result): result is PromiseRejectedResult => result.status === "rejected",
+    );
+    if (failed) throw failed.reason;
+    (deps.deleteStored ?? deleteKey)(userId);
+  };
+  let tracked!: Promise<void>;
+  tracked = run().finally(() => {
+    if (sshDeleteInFlight.get(userId) === tracked) {
+      sshDeleteInFlight.delete(userId);
+    }
+  });
+  sshDeleteInFlight.set(userId, tracked);
+  return tracked;
 }