@runuai/host 0.9.130 → 0.9.132

package/lib/browser-testing.ts

@@ -1035,9 +1035,13 @@ console.log(
  */
 const VIEWER_STEPS: string[] = [
   // Xvfb — one-shot; the X lockfile is the truth (also set when an agent
-  // started the display itself). If it dies the lock clears and the next
-  // session ensure relaunches it.
-  `[ -x /usr/bin/Xvfb ] || exit 0; [ -e ${X_LOCK} ] || /usr/bin/nohup /usr/bin/${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &`,
+  // started the display itself). If it dies cleanly the lock clears and the
+  // next session ensure relaunches it. A lock whose pid is DEAD is the
+  // leftover of a SIGKILLed server — a sidecar restart kills its whole
+  // cgroup (live 2026-09-10, smoke 10: Xvfb gone, lock present, x11vnc
+  // looping on a display that never came back) — so clear it and the
+  // socket first, then launch as usual.
+  `[ -x /usr/bin/Xvfb ] || exit 0; if [ -e ${X_LOCK} ] && ! /usr/bin/kill -0 "$(/usr/bin/tr -d ' \\n' < ${X_LOCK})" 2>/dev/null; then /bin/rm -f ${X_LOCK} /tmp/.X11-unix/X${SERVER_DISPLAY.slice(1)}; fi; [ -e ${X_LOCK} ] || /usr/bin/nohup /usr/bin/${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &`,
   // x11vnc under a restart loop (it exits whenever the X server isn't up
   // yet). Pidfile-guarded.
   `[ -x /usr/bin/x11vnc ] || exit 0; [ -f /tmp/uai-x11vnc.pid ] && /usr/bin/kill -0 "$(/usr/bin/cat /tmp/uai-x11vnc.pid)" 2>/dev/null && exit 0; /usr/bin/pkill -A -f 'x11vnc -display' 2>/dev/null; /usr/bin/nohup /bin/sh -c 'echo $$ > /tmp/uai-x11vnc.pid; while true; do /usr/bin/x11vnc -display ${SERVER_DISPLAY} -forever -shared -nopw -quiet >>/tmp/uai-x11vnc.log 2>&1; /bin/sleep 2; done' >/dev/null 2>&1 &`,

package/lib/shared-files-s3.ts

@@ -145,8 +145,15 @@ export async function mountSharedFilesFromLease(
       argv: [
         "/bin/sh",
         "-c",
-        // Idempotent: an already-mounted directory is left alone.
-        'mkdir -p "$1" && chown "$2:$3" "$1"; if mountpoint -q "$1"; then exit 0; fi; shift 3; exec "$@"',
+        // Idempotent: a healthy mount is left alone. A mount whose daemon is
+        // gone still shows as mounted but every access fails with "Transport
+        // endpoint is not connected" (a sidecar restart SIGKILLs mount-s3 —
+        // live 2026-09-10, smoke 10); it is lazily unmounted and mounted
+        // again. The mkdir/chown tolerate the broken mount too.
+        'mkdir -p "$1" 2>/dev/null; chown "$2:$3" "$1" 2>/dev/null; ' +
+          'if mountpoint -q "$1" 2>/dev/null; then if ls "$1" >/dev/null 2>&1; then exit 0; fi; ' +
+          'umount -l "$1" 2>/dev/null || true; chown "$2:$3" "$1" 2>/dev/null; fi; ' +
+          'shift 3; exec "$@"',
         "mount",
         plan.directory,
         String(owner.uid),
@@ -168,9 +175,11 @@ export async function mountSharedFilesFromLease(
   }
   if (mountedAny) {
     // The same marker the container and machine paths write: it gates the
-    // "## Shared files" briefing in every agent's preamble.
+    // "## Shared files" briefing in every agent's preamble. The sidecar
+    // writes the MODE into it so a restart can mount again the same way
+    // (lib/sidecar-resume.ts); readers only test for the file.
     await handle
-      .writeWorkspaceFile(`${workspacePath}/.uai/files-mounted`, Buffer.from(""))
+      .writeWorkspaceFile(`${workspacePath}/.uai/files-mounted`, Buffer.from(mode))
       .catch(() => {});
   }
   return warnings.length > 0 ? warnings.join("\n") : null;

package/lib/sidecar-resume.ts

@@ -0,0 +1,108 @@
+/**
+ * ADR-133: what a sidecar re-asserts when it starts on a machine whose task
+ * is ALREADY up — a restart of the unit, not a fresh launch.
+ *
+ * Task-up mounts the shared files and launches the editor once; nothing ran
+ * them again when the runner came back, so an operator's restart (smoke 10,
+ * 2026-09-10) left /workspace/files as two dead endpoints and the Editor tab
+ * empty for the rest of the task. The unit now keeps those processes alive
+ * across a stop (KillMode=process), and this pass covers what that cannot:
+ * a crash, an older unit, a SIGKILL. Both steps are idempotent — a healthy
+ * mount and a live code-server are left alone — so running it on every
+ * lease-ready costs one stat each.
+ */
+
+import { eq } from "drizzle-orm";
+
+import * as schema from "../db/schema";
+import { getDb } from "./db";
+import { mountSharedFilesFromLease } from "./shared-files-s3";
+import { sidecarTaskId } from "./sidecar";
+import { reconstructPersistedTaskEnvironment } from "./task-environment";
+import { ensureCodeServer } from "./task-environment/machine-task-up";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
+
+type PersistedTask = typeof schema.hostTasks.$inferSelect;
+
+export interface SidecarResumeDeps {
+  taskId?: () => string | null;
+  persistedTask?: (taskId: string) => PersistedTask | undefined;
+  reconstruct?: (task: PersistedTask) => Promise<TaskEnvironmentHandle<unknown> | null>;
+  mount?: (
+    handle: TaskEnvironmentHandle<unknown>,
+    workspacePath: string,
+    task: { sharedFiles?: string },
+  ) => Promise<string | null>;
+  editor?: (handle: TaskEnvironmentHandle<unknown>, workspacePath: string) => Promise<void>;
+}
+
+export interface SidecarResumeResult {
+  /** `no-task`: not a sidecar. `not-up`: the task has not been provisioned on
+   * this machine yet (a fresh launch — task-up does the work). `resumed`: the
+   * task was up before this runner started; its mounts and editor were
+   * re-asserted, with any per-step warning listed. */
+  outcome: "no-task" | "not-up" | "resumed";
+  warnings: string[];
+}
+
+/** The mode task-up mounted with, recorded in the files-mounted marker; null
+ *  when the files were never mounted (mode off, or the mount failed then). */
+function mountedModeFromMarker(bytes: Uint8Array | null): "ro" | "rw" | null {
+  if (bytes === null) return null;
+  return Buffer.from(bytes).toString("utf8").trim() === "rw" ? "rw" : "ro";
+}
+
+export async function resumeSidecarTask(
+  deps: SidecarResumeDeps = {},
+): Promise<SidecarResumeResult> {
+  const taskId = (deps.taskId ?? sidecarTaskId)();
+  if (!taskId) return { outcome: "no-task", warnings: [] };
+  const task = (deps.persistedTask ?? defaultPersistedTask)(taskId);
+  if (!task?.environmentLocator) return { outcome: "not-up", warnings: [] };
+  const handle = await (deps.reconstruct ?? reconstructPersistedTaskEnvironment)(task);
+  if (!handle) return { outcome: "not-up", warnings: [] };
+  const workspacePath = handle.descriptor.workspacePath;
+  const warnings: string[] = [];
+
+  const marker = await handle
+    .readWorkspaceFile(`${workspacePath}/.uai/files-mounted`)
+    .catch(() => null);
+  const mode = mountedModeFromMarker(marker);
+  if (mode) {
+    try {
+      const warning = await (deps.mount ?? mountSharedFilesFromLease)(handle, workspacePath, {
+        sharedFiles: mode,
+      });
+      if (warning) warnings.push(warning);
+    } catch (error) {
+      warnings.push(
+        `shared files: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  try {
+    await (deps.editor ?? defaultEditor)(handle, workspacePath);
+  } catch (error) {
+    warnings.push(`editor: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { outcome: "resumed", warnings };
+}
+
+function defaultPersistedTask(taskId: string): PersistedTask | undefined {
+  return getDb()
+    .select()
+    .from(schema.hostTasks)
+    .where(eq(schema.hostTasks.taskId, taskId))
+    .get();
+}
+
+function defaultEditor(
+  handle: TaskEnvironmentHandle<unknown>,
+  workspacePath: string,
+): Promise<void> {
+  // The theme rode task-up's preview env and is not persisted; the settings
+  // seed is skipped when the file already exists, so an existing task keeps
+  // the theme it started with.
+  return ensureCodeServer(handle, workspacePath, undefined);
+}

package/lib/skills.ts

@@ -203,6 +203,34 @@ const dockerExec: SkillExec = async (container, cmd, cwd) => {
   return { status: res.status, stderr: res.stderr };
 };
 
+/**
+ * A `skills add …` install command (github.com/vercel-labs/skills, the CLI
+ * behind the skills marketplace) asks which agents to install for and for a
+ * confirmation unless an agent is detected or `-y`/`--agent` are given. The
+ * install runs at task-up with no TTY and, on a fresh machine, before any
+ * agent has left its footprint, so the CLI refused: "Interactive prompt
+ * required but stdin is not a TTY … Use --agent <name> and -y" (every task
+ * start since the Marketing persona gained the skill; live 2026-09-10).
+ * Insert the two flags right after `skills add` when the author left them
+ * out — after the subcommand, so a trailing `&& …` or a leading `cd …`
+ * keeps working. Any other install command is returned as written.
+ */
+export function nonInteractiveInstallCommand(command: string): string {
+  const add = /\bskills\s+add\b/;
+  const found = add.exec(command);
+  if (!found) return command;
+  // Only the flags AFTER the subcommand count: `npx -y skills add …` is npx's
+  // own -y, not the CLI's.
+  const rest = command.slice(found.index + found[0].length);
+  const flags: string[] = [];
+  if (!/(^|\s)(-y|--yes)(\s|$)/.test(rest)) flags.push("-y");
+  if (!/(^|\s)(-a|--agent)(\s|=)/.test(rest)) flags.push("--agent claude-code");
+  if (flags.length === 0) return command;
+  return (
+    command.slice(0, found.index + found[0].length) + ` ${flags.join(" ")}` + rest
+  );
+}
+
 /**
  * Install a roster's package skills into the task container (ADR-047). Runs at
  * task-up (after the container is running), mirroring the git-identity/github
@@ -266,7 +294,11 @@ export async function installPackageSkills(
           continue;
         }
         // The author's CLI drops files into .claude/skills; run it in the repo.
-        const c = await exec(container, ["bash", "-lc", s.value], "/workspace");
+        const c = await exec(
+          container,
+          ["bash", "-lc", nonInteractiveInstallCommand(s.value)],
+          "/workspace",
+        );
         if (c.status !== 0) {
           console.warn(`[skills] ${taskId}: install cmd for ${s.name} failed: ${c.stderr.trim()}`);
           continue;

package/lib/task-environment/machine-task-up.ts

@@ -388,7 +388,7 @@ async function copySharedFiles(
 /** Launch code-server for the Editor pane, exactly once. The pgrep guard
  * makes re-provision and resume idempotent; the exec chain leaves only
  * code-server holding the detached job. */
-async function ensureCodeServer(
+export async function ensureCodeServer(
   handle: TaskEnvironmentHandle<unknown>,
   workspacePath: string,
   editorTheme: string | undefined,

package/lib/task-environment/self.ts

@@ -287,13 +287,22 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     ) {
       throw new Error("self copy paths must be absolute and NUL-free");
     }
-    // Both sides are this machine. `cp -a` keeps directory trees intact
-    // (engine-account homes), and the result is chowned to the task user so
-    // the agents can read what was copied in for them.
+    // Both sides are this machine. A directory source lands as the
+    // destination's CONTENTS, the way the machine provider's tar stream
+    // does: engine-account provisioning pre-creates the destination, and a
+    // plain `cp -a dir dest` into an existing dest nests `dest/dir/…`, so
+    // CODEX_HOME / GROK_HOME pointed at a dir without auth.json and both
+    // engines ran signed out and silent (live 2026-09-10, first codex + grok
+    // agents on a task machine). A file source copies as before. The result
+    // is chowned to the task user when this process is root, so the agents
+    // can read what was copied in for them.
+    const copy =
+      'if [ -d "$1" ]; then mkdir -p "$2" && cp -a "$1/." "$2/"; ' +
+      'else mkdir -p "$(dirname "$2")" && cp -a "$1" "$2"; fi';
     const script =
-      request.direction === "into"
-        ? 'mkdir -p "$(dirname "$2")" && cp -a "$1" "$2" && chown -R node:node "$2"'
-        : 'mkdir -p "$(dirname "$2")" && cp -a "$1" "$2"';
+      request.direction === "into" && this.#privileged()
+        ? `${copy} && chown -R ${SELF_TASK_USER}:${SELF_TASK_USER} "$2"`
+        : copy;
     const result = await this.exec({
       argv: ["/bin/sh", "-c", script, "copy", request.source, request.destination],
       user: "root",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.130",
+  "version": "0.9.132",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -201,11 +201,32 @@ export function setManagedHostRestartHook(hook: () => void): void {
   managedHostRestartHook = hook;
 }
 
+/**
+ * ADR-133: a task machine's runner is pinned by the cloud at launch and its
+ * unit's cgroup holds the task itself — the S3 mounts, the display, the
+ * editor, the agent sessions. An in-place update or restart replaces
+ * nothing (the prepare step reinstalls the pin) and killed all of those
+ * (live 2026-09-10, smoke 10). Both verbs are refused here; a new task gets
+ * a fresh machine with the current runner.
+ */
+function sidecarRunnerIsPinned(): HostCommandResult<never> | null {
+  if (!sidecarMode()) return null;
+  return {
+    ok: false,
+    code: HostErrorCode.Internal,
+    message:
+      "a task machine's runner is pinned for the task's life — it neither updates nor restarts in place; close the task and start another for the current runner",
+    retryable: false,
+  };
+}
+
 export const hostCommands: HostCommands = {
   // The hostId argument is cloud-side routing (host-scoped commands carry
   // their target in args, like filesOp); this process IS the target.
   async hostUpdate(ctx, _hostId) {
     logCommand(ctx, "hostUpdate");
+    const pinned = sidecarRunnerIsPinned();
+    if (pinned) return pinned;
     try {
       const { updateManagedRuntime } = await import("../lib/managed-runtime");
       const outcome = await updateManagedRuntime();
@@ -244,6 +265,8 @@ export const hostCommands: HostCommands = {
   },
   async hostRestart(ctx, _hostId) {
     logCommand(ctx, "hostRestart");
+    const pinned = sidecarRunnerIsPinned();
+    if (pinned) return pinned;
     if (!managedHostRestartHook) {
       return {
         ok: false,

package/src/main.ts

@@ -252,6 +252,7 @@ import {
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
 import { LeaseManager } from "../lib/lease";
 import { markSidecarReady, sidecarMode, sidecarTaskId } from "../lib/sidecar";
+import { resumeSidecarTask } from "../lib/sidecar-resume";
 import { declareAgentClisReady } from "../lib/standard-image";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -552,6 +553,21 @@ const leaseManager: LeaseManager | null = sidecarMode()
           // tokens, and project env on the machine (lib/sidecar.ts).
           markSidecarReady();
           console.log("[lease] credential store reconciled — the task may start");
+          // A runner that came back on a machine whose task is already up
+          // re-asserts the mounts and the editor (lib/sidecar-resume.ts).
+          void resumeSidecarTask()
+            .then((resumed) => {
+              if (resumed.outcome !== "resumed") return;
+              console.log(
+                `[sidecar] task ${sidecarTaskId()} resumed after a runner restart: shared files and editor re-asserted` +
+                  (resumed.warnings.length > 0 ? ` (${resumed.warnings.join("; ")})` : ""),
+              );
+            })
+            .catch((error: unknown) => {
+              console.warn(
+                `[sidecar] resume failed: ${error instanceof Error ? error.message : String(error)}`,
+              );
+            });
         });
         startCredentialStorePickup({ repush: repushBrokeredCopies });
       },