@runuai/host 0.9.131 → 0.9.133

package/db/migrations/0023_project_env_org.sql

@@ -0,0 +1,4 @@
+-- ADR-133: the project's org, so the mirrored parameter can carry the `org`
+-- tag the task-machine lease policy conditions on. Null until the cloud sends
+-- it (env.var.set / env.var.list with orgId) or a stored value carries it.
+ALTER TABLE `host_project_env` ADD `org_id` text;

package/db/migrations/meta/_journal.json

@@ -162,6 +162,13 @@
       "when": 1788900000004,
       "tag": "0022_task_project_ids",
       "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "6",
+      "when": 1788900000005,
+      "tag": "0023_project_env_org",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -188,6 +188,11 @@ export const hostProjectEnv = sqliteTable(
       .default(sql`(unixepoch() * 1000)`),
     // ADR-134 slice 3: the credential-store parameter this row mirrors to.
     storeRef: text("store_ref"),
+    // The project's org, learned from an env.var.set/list frame that carries
+    // it (cloud from 2026-09-10) or from a stored value that does. It tags the
+    // mirrored parameter (`org`, `project`) so a task machine's tag-scoped
+    // lease can read it (ADR-133). Null until the cloud has said.
+    orgId: text("org_id"),
   },
   (t) => ({
     pk: primaryKey({ columns: [t.projectId, t.key] }),

package/lib/browser-testing.ts

@@ -1035,9 +1035,13 @@ console.log(
  */
 const VIEWER_STEPS: string[] = [
   // Xvfb — one-shot; the X lockfile is the truth (also set when an agent
-  // started the display itself). If it dies the lock clears and the next
-  // session ensure relaunches it.
-  `[ -x /usr/bin/Xvfb ] || exit 0; [ -e ${X_LOCK} ] || /usr/bin/nohup /usr/bin/${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &`,
+  // started the display itself). If it dies cleanly the lock clears and the
+  // next session ensure relaunches it. A lock whose pid is DEAD is the
+  // leftover of a SIGKILLed server — a sidecar restart kills its whole
+  // cgroup (live 2026-09-10, smoke 10: Xvfb gone, lock present, x11vnc
+  // looping on a display that never came back) — so clear it and the
+  // socket first, then launch as usual.
+  `[ -x /usr/bin/Xvfb ] || exit 0; if [ -e ${X_LOCK} ] && ! /usr/bin/kill -0 "$(/usr/bin/tr -d ' \\n' < ${X_LOCK})" 2>/dev/null; then /bin/rm -f ${X_LOCK} /tmp/.X11-unix/X${SERVER_DISPLAY.slice(1)}; fi; [ -e ${X_LOCK} ] || /usr/bin/nohup /usr/bin/${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &`,
   // x11vnc under a restart loop (it exits whenever the X server isn't up
   // yet). Pidfile-guarded.
   `[ -x /usr/bin/x11vnc ] || exit 0; [ -f /tmp/uai-x11vnc.pid ] && /usr/bin/kill -0 "$(/usr/bin/cat /tmp/uai-x11vnc.pid)" 2>/dev/null && exit 0; /usr/bin/pkill -A -f 'x11vnc -display' 2>/dev/null; /usr/bin/nohup /bin/sh -c 'echo $$ > /tmp/uai-x11vnc.pid; while true; do /usr/bin/x11vnc -display ${SERVER_DISPLAY} -forever -shared -nopw -quiet >>/tmp/uai-x11vnc.log 2>&1; /bin/sleep 2; done' >/dev/null 2>&1 &`,

package/lib/credential-store-scope.ts

@@ -73,13 +73,40 @@ export function userCredentialListPath(prefix: string): string | null {
   return `${prefix}/users/${scope.userId}`;
 }
 
-/** The path a project-env listing walks, or null to skip. */
-export function projectEnvListPath(prefix: string): string | null {
+/**
+ * The paths a project-env listing walks, or null to skip. An owned or shared
+ * host walks the whole tree. A task machine's lease reads
+ * `/uai/projects/<id>/…` only for parameters tagged with its org (the policy
+ * conditions on `ssm:ResourceTag/org`), and only the task's own projects are
+ * worth asking for — their ids arrive with task-up, not with the first grant,
+ * so a listing without ids on a task machine is simply "nothing yet".
+ */
+export function projectEnvListPaths(
+  prefix: string,
+  projectIds?: readonly string[],
+): string[] | null {
   const scope = storeListScope();
-  if (scope.kind === "host") return `${prefix}/projects`;
-  warnOnce(
-    "project-env",
-    "not read on a task machine — the lease policy grants no project parameters (they carry no org tag)",
-  );
-  return null;
+  if (scope.kind === "host") return [`${prefix}/projects`];
+  if (scope.kind === "none") {
+    warnOnce("project-env", `not read: ${scope.reason}`);
+    return null;
+  }
+  if (!scope.orgId) {
+    warnOnce("project-env", "not read on a task machine whose lease carries no org");
+    return null;
+  }
+  if (!projectIds) return null;
+  return projectIds
+    .filter((id) => isParameterPathSegment(id))
+    .map((id) => `${prefix}/projects/${id}`);
+}
+
+/**
+ * Whether project env is read by name (describe + get-parameter) instead of
+ * by path: true under a lease, whose policy conditions on each parameter's
+ * `org` tag and therefore denies the path listing itself (see
+ * `CredentialStore.listByName`).
+ */
+export function projectEnvListsByName(): boolean {
+  return storeListScope().kind === "lease";
 }

package/lib/credential-store.ts

@@ -46,6 +46,21 @@ export interface CredentialStore {
   delete(name: string): Promise<void>;
   /** Every credential under `path` (recursive), decrypted. Throws on failure. */
   list(path: string): Promise<StoredParameter[]>;
+  /**
+   * Every credential under `path` read by NAME: names from
+   * `describe-parameters` (allowed on `*`, never returns values), then one
+   * `get-parameter` each, decrypted; a name the identity may not read is
+   * skipped. This is how a task machine's lease reads `/uai/projects/<id>`:
+   * its policy conditions on the parameter's `org` tag, and
+   * `get-parameters-by-path` is authorised against the PATH resource, which
+   * carries no tags, so it is denied even when every parameter under it is
+   * tagged (live 2026-09-10, smoke 12).
+   */
+  listByName(path: string): Promise<StoredParameter[]>;
+  /** Set tags on an existing parameter (a second call, because put-parameter
+   *  with Overwrite cannot carry tags). Throws on failure — including when
+   *  the identity lacks `ssm:AddTagsToResource`, which older host policies do. */
+  tag(name: string, tags: Record<string, string>): Promise<void>;
   /** Names and versions under `path` (recursive), NO decryption — the cheap
    *  poll a Uai-operated host runs to notice a broker refresh. */
   listVersions(path: string): Promise<Array<{ name: string; version: number }>>;
@@ -136,6 +151,10 @@ function isNotFound(result: CliResult): boolean {
   return /ParameterNotFound/.test(result.stderr);
 }
 
+function isAccessDenied(result: CliResult): boolean {
+  return /AccessDenied/.test(result.stderr);
+}
+
 /** Summarize a CLI failure WITHOUT echoing stdout (which could carry a value). */
 function failure(op: string, result: CliResult): Error {
   const line =
@@ -181,6 +200,28 @@ export class AwsSsmCredentialStore implements CredentialStore {
     if (result.status !== 0) throw failure("put-parameter", result);
   }
 
+  async tag(name: string, tags: Record<string, string>): Promise<void> {
+    if (!isParameterName(name)) throw new Error(`invalid parameter name: ${name}`);
+    const entries = Object.entries(tags);
+    if (entries.length === 0) return;
+    for (const [key, value] of entries) {
+      if (!/^[A-Za-z0-9_.:/=+@-]{1,128}$/.test(key) || !/^[A-Za-z0-9_.:/=+@ -]{0,256}$/.test(value)) {
+        throw new Error(`invalid tag ${key}`);
+      }
+    }
+    const result = await this.run([
+      "ssm",
+      "add-tags-to-resource",
+      "--resource-type",
+      "Parameter",
+      "--resource-id",
+      name,
+      "--tags",
+      ...entries.map(([key, value]) => `Key=${key},Value=${value}`),
+    ]);
+    if (result.status !== 0) throw failure("add-tags-to-resource", result);
+  }
+
   async get(name: string): Promise<string | null> {
     if (!isParameterName(name)) throw new Error(`invalid parameter name: ${name}`);
     const result = await this.run([
@@ -243,6 +284,36 @@ export class AwsSsmCredentialStore implements CredentialStore {
     return out;
   }
 
+  async listByName(path: string): Promise<StoredParameter[]> {
+    if (!isParameterName(path)) throw new Error(`invalid parameter path: ${path}`);
+    const described = await this.run([
+      "ssm",
+      "describe-parameters",
+      "--parameter-filters",
+      `Key=Path,Option=Recursive,Values=${path}`,
+      "--query",
+      "Parameters[].Name",
+    ]);
+    if (described.status !== 0) throw failure("describe-parameters", described);
+    const parsed: unknown = JSON.parse(described.stdout || "[]");
+    const names = (Array.isArray(parsed) ? parsed : []).filter(
+      (name): name is string => typeof name === "string" && name.startsWith(`${path}/`),
+    );
+    const out: StoredParameter[] = [];
+    for (const name of names) {
+      const result = await this.run(["ssm", "get-parameter", "--name", name, "--with-decryption"]);
+      if (result.status !== 0) {
+        // Not tagged for this identity (or gone between the two calls):
+        // invisible, not an error — the listing is what the lease may read.
+        if (isAccessDenied(result) || isNotFound(result)) continue;
+        throw failure("get-parameter", result);
+      }
+      const value = (JSON.parse(result.stdout) as { Parameter?: { Value?: unknown } }).Parameter?.Value;
+      if (typeof value === "string") out.push({ name, value });
+    }
+    return out;
+  }
+
   async listVersions(path: string): Promise<Array<{ name: string; version: number }>> {
     if (!isParameterName(path)) throw new Error(`invalid parameter path: ${path}`);
     const out: Array<{ name: string; version: number }> = [];

package/lib/host-env.ts

@@ -14,13 +14,14 @@
  * sealed value as "<ct-base64>.<nonce-base64>".
  */
 
-import { and, eq } from "drizzle-orm";
+import { and, eq, isNotNull } from "drizzle-orm";
 
 import {
   credentialStorePrefix,
   isParameterPathSegment,
   parameterName,
   queueStoreWrite,
+  type CredentialStore,
 } from "./credential-store";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
@@ -40,23 +41,111 @@ function unpackValue(valueEnc: string): string {
   return openAesGcm(ct, nonce);
 }
 
-/** Set (insert or overwrite) a project env var, encrypting the value at rest. */
+/** Set (insert or overwrite) a project env var, encrypting the value at rest.
+ *  `orgId` is the project's org when the cloud sent it (see `noteProjectOrg`). */
 export function setProjectEnvVar(
   projectId: string,
   key: string,
   value: string,
+  orgId?: string,
 ): void {
+  const now = Date.now();
   getDb()
     .insert(schema.hostProjectEnv)
-    .values({ projectId, key, valueEnc: packValue(value), updatedAt: Date.now() })
+    .values({
+      projectId,
+      key,
+      valueEnc: packValue(value),
+      updatedAt: now,
+      ...(orgId ? { orgId } : {}),
+    })
     .onConflictDoUpdate({
       target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key],
-      set: { valueEnc: packValue(value), updatedAt: Date.now() },
+      set: { valueEnc: packValue(value), updatedAt: now, ...(orgId ? { orgId } : {}) },
     })
     .run();
+  if (orgId) noteProjectOrg(projectId, orgId, { except: key });
   mirrorProjectEnvToStore(projectId, key);
 }
 
+/**
+ * The cloud told us which org owns `projectId` (an env.var.set/list frame
+ * carrying `orgId`). Every row of that project mirrored before the org was
+ * known gets the org and is re-tagged in the store, so a task machine's
+ * tag-scoped lease can read it (ADR-133). Returns the rows updated.
+ */
+export function noteProjectOrg(
+  projectId: string,
+  orgId: string,
+  opts: { except?: string } = {},
+): number {
+  const rows = getDb()
+    .select({ key: schema.hostProjectEnv.key, orgId: schema.hostProjectEnv.orgId, storeRef: schema.hostProjectEnv.storeRef })
+    .from(schema.hostProjectEnv)
+    .where(eq(schema.hostProjectEnv.projectId, projectId))
+    .all()
+    .filter((row) => row.key !== opts.except && row.orgId !== orgId);
+  for (const row of rows) {
+    getDb()
+      .update(schema.hostProjectEnv)
+      .set({ orgId })
+      .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, row.key)))
+      .run();
+    if (row.storeRef) {
+      const name = row.storeRef;
+      queueStoreWrite(`tag project env ${projectId}/${row.key}`, async (store) => {
+        await tagProjectEnvParameter(store, name, projectId, orgId);
+      });
+    }
+  }
+  return rows.length;
+}
+
+/** The org recorded for a project, or null while the cloud has not said. */
+export function projectEnvOrgId(projectId: string): string | null {
+  const row = getDb()
+    .select({ orgId: schema.hostProjectEnv.orgId })
+    .from(schema.hostProjectEnv)
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), isNotNull(schema.hostProjectEnv.orgId)))
+    .get();
+  return row?.orgId ?? null;
+}
+
+/** The tags a project env parameter carries: the lease policy's `org`, plus
+ *  `project` for operators reading the store. */
+export function projectEnvTags(projectId: string, orgId: string): Record<string, string> {
+  return { org: orgId, project: projectId };
+}
+
+const tagWarned = new Set<string>();
+/**
+ * Tag a mirrored parameter for the task-machine lease. Best-effort: the
+ * value is already in the store, and a host whose policy predates
+ * `ssm:AddTagsToResource` (host-agent/scripts/credential-store/
+ * bootstrap-aws.sh) must keep mirroring; it warns once per parameter and a
+ * later set/list retries.
+ */
+export async function tagProjectEnvParameter(
+  store: Pick<CredentialStore, "tag">,
+  name: string,
+  projectId: string,
+  orgId: string,
+): Promise<boolean> {
+  try {
+    await store.tag(name, projectEnvTags(projectId, orgId));
+    tagWarned.delete(name);
+    return true;
+  } catch (err) {
+    if (!tagWarned.has(name)) {
+      tagWarned.add(name);
+      console.warn(
+        `[project-env] credential store: tagging ${name} failed (${err instanceof Error ? err.message : String(err)}) — a task machine cannot read it until it carries org=${orgId}; re-run bootstrap-aws.sh for ssm:AddTagsToResource`,
+      );
+    }
+    return false;
+  }
+}
+
 /** Remove a project env var (idempotent). */
 export function deleteProjectEnvVar(projectId: string, key: string): void {
   const result = getDb()
@@ -87,6 +176,9 @@ export interface StoredProjectEnv {
   key: string;
   value: string;
   updatedAt: number;
+  /** The project's org once the cloud has said (ADR-133 tag scope); a
+   *  replacement host inherits it with the value. */
+  orgId?: string;
 }
 
 /** Null when the project id or key cannot be a parameter path segment (a
@@ -111,6 +203,7 @@ export function projectEnvStoreValue(projectId: string, key: string): StoredProj
     key,
     value: unpackValue(row.valueEnc),
     updatedAt: row.updatedAt,
+    ...(row.orgId ? { orgId: row.orgId } : {}),
   };
 }
 
@@ -141,6 +234,7 @@ export function mirrorProjectEnvToStore(projectId: string, key: string): void {
     if (!value) return;
     await store.put(name, JSON.stringify(value));
     setProjectEnvStoreRef(projectId, key, name);
+    if (value.orgId) await tagProjectEnvParameter(store, name, projectId, value.orgId);
   });
 }
 
@@ -154,6 +248,7 @@ export function importProjectEnvFromStore(value: StoredProjectEnv, storeRef: str
       valueEnc: packValue(value.value),
       updatedAt: value.updatedAt,
       storeRef,
+      ...(value.orgId ? { orgId: value.orgId } : {}),
     })
     .onConflictDoNothing({ target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key] })
     .run();

package/lib/shared-files-s3.ts

@@ -145,8 +145,15 @@ export async function mountSharedFilesFromLease(
       argv: [
         "/bin/sh",
         "-c",
-        // Idempotent: an already-mounted directory is left alone.
-        'mkdir -p "$1" && chown "$2:$3" "$1"; if mountpoint -q "$1"; then exit 0; fi; shift 3; exec "$@"',
+        // Idempotent: a healthy mount is left alone. A mount whose daemon is
+        // gone still shows as mounted but every access fails with "Transport
+        // endpoint is not connected" (a sidecar restart SIGKILLs mount-s3 —
+        // live 2026-09-10, smoke 10); it is lazily unmounted and mounted
+        // again. The mkdir/chown tolerate the broken mount too.
+        'mkdir -p "$1" 2>/dev/null; chown "$2:$3" "$1" 2>/dev/null; ' +
+          'if mountpoint -q "$1" 2>/dev/null; then if ls "$1" >/dev/null 2>&1; then exit 0; fi; ' +
+          'umount -l "$1" 2>/dev/null || true; chown "$2:$3" "$1" 2>/dev/null; fi; ' +
+          'shift 3; exec "$@"',
         "mount",
         plan.directory,
         String(owner.uid),
@@ -168,9 +175,11 @@ export async function mountSharedFilesFromLease(
   }
   if (mountedAny) {
     // The same marker the container and machine paths write: it gates the
-    // "## Shared files" briefing in every agent's preamble.
+    // "## Shared files" briefing in every agent's preamble. The sidecar
+    // writes the MODE into it so a restart can mount again the same way
+    // (lib/sidecar-resume.ts); readers only test for the file.
     await handle
-      .writeWorkspaceFile(`${workspacePath}/.uai/files-mounted`, Buffer.from(""))
+      .writeWorkspaceFile(`${workspacePath}/.uai/files-mounted`, Buffer.from(mode))
       .catch(() => {});
   }
   return warnings.length > 0 ? warnings.join("\n") : null;

package/lib/sidecar-resume.ts

@@ -0,0 +1,108 @@
+/**
+ * ADR-133: what a sidecar re-asserts when it starts on a machine whose task
+ * is ALREADY up — a restart of the unit, not a fresh launch.
+ *
+ * Task-up mounts the shared files and launches the editor once; nothing ran
+ * them again when the runner came back, so an operator's restart (smoke 10,
+ * 2026-09-10) left /workspace/files as two dead endpoints and the Editor tab
+ * empty for the rest of the task. The unit now keeps those processes alive
+ * across a stop (KillMode=process), and this pass covers what that cannot:
+ * a crash, an older unit, a SIGKILL. Both steps are idempotent — a healthy
+ * mount and a live code-server are left alone — so running it on every
+ * lease-ready costs one stat each.
+ */
+
+import { eq } from "drizzle-orm";
+
+import * as schema from "../db/schema";
+import { getDb } from "./db";
+import { mountSharedFilesFromLease } from "./shared-files-s3";
+import { sidecarTaskId } from "./sidecar";
+import { reconstructPersistedTaskEnvironment } from "./task-environment";
+import { ensureCodeServer } from "./task-environment/machine-task-up";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
+
+type PersistedTask = typeof schema.hostTasks.$inferSelect;
+
+export interface SidecarResumeDeps {
+  taskId?: () => string | null;
+  persistedTask?: (taskId: string) => PersistedTask | undefined;
+  reconstruct?: (task: PersistedTask) => Promise<TaskEnvironmentHandle<unknown> | null>;
+  mount?: (
+    handle: TaskEnvironmentHandle<unknown>,
+    workspacePath: string,
+    task: { sharedFiles?: string },
+  ) => Promise<string | null>;
+  editor?: (handle: TaskEnvironmentHandle<unknown>, workspacePath: string) => Promise<void>;
+}
+
+export interface SidecarResumeResult {
+  /** `no-task`: not a sidecar. `not-up`: the task has not been provisioned on
+   * this machine yet (a fresh launch — task-up does the work). `resumed`: the
+   * task was up before this runner started; its mounts and editor were
+   * re-asserted, with any per-step warning listed. */
+  outcome: "no-task" | "not-up" | "resumed";
+  warnings: string[];
+}
+
+/** The mode task-up mounted with, recorded in the files-mounted marker; null
+ *  when the files were never mounted (mode off, or the mount failed then). */
+function mountedModeFromMarker(bytes: Uint8Array | null): "ro" | "rw" | null {
+  if (bytes === null) return null;
+  return Buffer.from(bytes).toString("utf8").trim() === "rw" ? "rw" : "ro";
+}
+
+export async function resumeSidecarTask(
+  deps: SidecarResumeDeps = {},
+): Promise<SidecarResumeResult> {
+  const taskId = (deps.taskId ?? sidecarTaskId)();
+  if (!taskId) return { outcome: "no-task", warnings: [] };
+  const task = (deps.persistedTask ?? defaultPersistedTask)(taskId);
+  if (!task?.environmentLocator) return { outcome: "not-up", warnings: [] };
+  const handle = await (deps.reconstruct ?? reconstructPersistedTaskEnvironment)(task);
+  if (!handle) return { outcome: "not-up", warnings: [] };
+  const workspacePath = handle.descriptor.workspacePath;
+  const warnings: string[] = [];
+
+  const marker = await handle
+    .readWorkspaceFile(`${workspacePath}/.uai/files-mounted`)
+    .catch(() => null);
+  const mode = mountedModeFromMarker(marker);
+  if (mode) {
+    try {
+      const warning = await (deps.mount ?? mountSharedFilesFromLease)(handle, workspacePath, {
+        sharedFiles: mode,
+      });
+      if (warning) warnings.push(warning);
+    } catch (error) {
+      warnings.push(
+        `shared files: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  try {
+    await (deps.editor ?? defaultEditor)(handle, workspacePath);
+  } catch (error) {
+    warnings.push(`editor: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { outcome: "resumed", warnings };
+}
+
+function defaultPersistedTask(taskId: string): PersistedTask | undefined {
+  return getDb()
+    .select()
+    .from(schema.hostTasks)
+    .where(eq(schema.hostTasks.taskId, taskId))
+    .get();
+}
+
+function defaultEditor(
+  handle: TaskEnvironmentHandle<unknown>,
+  workspacePath: string,
+): Promise<void> {
+  // The theme rode task-up's preview env and is not persisted; the settings
+  // seed is skipped when the file already exists, so an existing task keeps
+  // the theme it started with.
+  return ensureCodeServer(handle, workspacePath, undefined);
+}

package/lib/skills.ts

@@ -203,6 +203,34 @@ const dockerExec: SkillExec = async (container, cmd, cwd) => {
   return { status: res.status, stderr: res.stderr };
 };
 
+/**
+ * A `skills add …` install command (github.com/vercel-labs/skills, the CLI
+ * behind the skills marketplace) asks which agents to install for and for a
+ * confirmation unless an agent is detected or `-y`/`--agent` are given. The
+ * install runs at task-up with no TTY and, on a fresh machine, before any
+ * agent has left its footprint, so the CLI refused: "Interactive prompt
+ * required but stdin is not a TTY … Use --agent <name> and -y" (every task
+ * start since the Marketing persona gained the skill; live 2026-09-10).
+ * Insert the two flags right after `skills add` when the author left them
+ * out — after the subcommand, so a trailing `&& …` or a leading `cd …`
+ * keeps working. Any other install command is returned as written.
+ */
+export function nonInteractiveInstallCommand(command: string): string {
+  const add = /\bskills\s+add\b/;
+  const found = add.exec(command);
+  if (!found) return command;
+  // Only the flags AFTER the subcommand count: `npx -y skills add …` is npx's
+  // own -y, not the CLI's.
+  const rest = command.slice(found.index + found[0].length);
+  const flags: string[] = [];
+  if (!/(^|\s)(-y|--yes)(\s|$)/.test(rest)) flags.push("-y");
+  if (!/(^|\s)(-a|--agent)(\s|=)/.test(rest)) flags.push("--agent claude-code");
+  if (flags.length === 0) return command;
+  return (
+    command.slice(0, found.index + found[0].length) + ` ${flags.join(" ")}` + rest
+  );
+}
+
 /**
  * Install a roster's package skills into the task container (ADR-047). Runs at
  * task-up (after the container is running), mirroring the git-identity/github
@@ -266,7 +294,11 @@ export async function installPackageSkills(
           continue;
         }
         // The author's CLI drops files into .claude/skills; run it in the repo.
-        const c = await exec(container, ["bash", "-lc", s.value], "/workspace");
+        const c = await exec(
+          container,
+          ["bash", "-lc", nonInteractiveInstallCommand(s.value)],
+          "/workspace",
+        );
         if (c.status !== 0) {
           console.warn(`[skills] ${taskId}: install cmd for ${s.name} failed: ${c.stderr.trim()}`);
           continue;

package/lib/task-environment/machine-task-up.ts

@@ -388,7 +388,7 @@ async function copySharedFiles(
 /** Launch code-server for the Editor pane, exactly once. The pgrep guard
  * makes re-provision and resume idempotent; the exec chain leaves only
  * code-server holding the detached job. */
-async function ensureCodeServer(
+export async function ensureCodeServer(
   handle: TaskEnvironmentHandle<unknown>,
   workspacePath: string,
   editorTheme: string | undefined,

package/lib/user-credentials-store.ts

@@ -23,7 +23,8 @@ import {
   isParameterPathSegment,
   type CredentialStore,
 } from "./credential-store";
-import { projectEnvListPath, userCredentialListPath } from "./credential-store-scope";
+import { projectEnvListPaths,
+  projectEnvListsByName, userCredentialListPath } from "./credential-store-scope";
 import {
   deleteToken as deleteGithubTokenLocal,
   githubTokenParameterName,
@@ -49,6 +50,8 @@ import {
   projectEnvParameterName,
   projectEnvStoreValue,
   setProjectEnvStoreRef,
+  noteProjectOrg,
+  tagProjectEnvParameter,
   type StoredProjectEnv,
 } from "./host-env";
 import {
@@ -347,10 +350,18 @@ export function parseStoredProjectEnv(value: string): StoredProjectEnv {
     key: str(o, "key"),
     value: str(o, "value"),
     updatedAt: num(o, "updatedAt"),
+    ...(typeof o.orgId === "string" && o.orgId.length > 0 ? { orgId: o.orgId } : {}),
   };
 }
 
-export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCredentialsResult> {
+/**
+ * Host start (whole tree) or, on a task machine, task-up with the task's
+ * project ids (ADR-133: the lease reads `/uai/projects/<id>` only for
+ * parameters tagged with its org, and only the task's projects matter).
+ */
+export async function reconcileProjectEnvFromStore(
+  opts: { projectIds?: readonly string[] } = {},
+): Promise<ReconcileUserCredentialsResult> {
   const result: ReconcileUserCredentialsResult = {
     skipped: false,
     imported: 0,
@@ -361,16 +372,20 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
   const store = configuredCredentialStore();
   if (!store) return { ...result, skipped: true };
   const prefix = credentialStorePrefix();
-  const path = projectEnvListPath(prefix);
-  if (path === null) return { ...result, skipped: true };
+  const paths = projectEnvListPaths(prefix, opts.projectIds);
+  if (paths === null) return { ...result, skipped: true };
   const warn = (line: string): void => console.warn(`[project-env] credential store: ${line}`);
-  let listed: Array<{ name: string; value: string }>;
-  try {
-    listed = await store.list(path);
-  } catch (err) {
-    result.errors++;
-    warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
-    return result;
+  const listed: Array<{ name: string; value: string }> = [];
+  const listedPrefixes: string[] = [];
+  const byName = projectEnvListsByName();
+  for (const path of paths) {
+    try {
+      listed.push(...(byName ? await store.listByName(path) : await store.list(path)));
+      listedPrefixes.push(`${path}/`);
+    } catch (err) {
+      result.errors++;
+      warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   const local = new Map(listProjectEnvStoreRows().map((r) => [`${r.projectId}/${r.key}`, r]));
   const seen = new Set<string>();
@@ -386,6 +401,7 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
       const row = local.get(`${at.projectId}/${at.key}`);
       if (row) {
         if (row.storeRef !== param.name) setProjectEnvStoreRef(at.projectId, at.key, param.name);
+        if (value.orgId) noteProjectOrg(at.projectId, value.orgId);
       } else if (importProjectEnvFromStore(value, param.name)) {
         result.imported++;
       }
@@ -397,7 +413,8 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
   for (const row of local.values()) {
     try {
       if (row.storeRef) {
-        if (row.storeRef.startsWith(`${path}/`) && !seen.has(row.storeRef)) {
+        const ref = row.storeRef;
+        if (listedPrefixes.some((p) => ref.startsWith(p)) && !seen.has(ref)) {
           deleteProjectEnvLocal(row.projectId, row.key);
           result.removed++;
         }
@@ -408,6 +425,7 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
       if (!name || !value) continue;
       await upload(store, name, value, (ref) => setProjectEnvStoreRef(row.projectId, row.key, ref));
       result.uploaded++;
+      if (value.orgId) await tagProjectEnvParameter(store, name, row.projectId, value.orgId);
     } catch (err) {
       result.errors++;
       warn(`${row.projectId}/${row.key}: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.131",
+  "version": "0.9.133",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -201,11 +201,32 @@ export function setManagedHostRestartHook(hook: () => void): void {
   managedHostRestartHook = hook;
 }
 
+/**
+ * ADR-133: a task machine's runner is pinned by the cloud at launch and its
+ * unit's cgroup holds the task itself — the S3 mounts, the display, the
+ * editor, the agent sessions. An in-place update or restart replaces
+ * nothing (the prepare step reinstalls the pin) and killed all of those
+ * (live 2026-09-10, smoke 10). Both verbs are refused here; a new task gets
+ * a fresh machine with the current runner.
+ */
+function sidecarRunnerIsPinned(): HostCommandResult<never> | null {
+  if (!sidecarMode()) return null;
+  return {
+    ok: false,
+    code: HostErrorCode.Internal,
+    message:
+      "a task machine's runner is pinned for the task's life — it neither updates nor restarts in place; close the task and start another for the current runner",
+    retryable: false,
+  };
+}
+
 export const hostCommands: HostCommands = {
   // The hostId argument is cloud-side routing (host-scoped commands carry
   // their target in args, like filesOp); this process IS the target.
   async hostUpdate(ctx, _hostId) {
     logCommand(ctx, "hostUpdate");
+    const pinned = sidecarRunnerIsPinned();
+    if (pinned) return pinned;
     try {
       const { updateManagedRuntime } = await import("../lib/managed-runtime");
       const outcome = await updateManagedRuntime();
@@ -244,6 +265,8 @@ export const hostCommands: HostCommands = {
   },
   async hostRestart(ctx, _hostId) {
     logCommand(ctx, "hostRestart");
+    const pinned = sidecarRunnerIsPinned();
+    if (pinned) return pinned;
     if (!managedHostRestartHook) {
       return {
         ok: false,
@@ -828,6 +851,25 @@ export const hostCommands: HostCommands = {
         // ADR-133 sidecar: nothing to clone or spawn with until the lease
         // has landed and the store is reconciled under it.
         await awaitSidecarReady();
+        if (sidecarMode()) {
+          // ADR-133: project env lives under /uai/projects/<id>, readable by
+          // the lease only for parameters tagged with this org, and only the
+          // task's own projects are worth listing — their ids are known here,
+          // not at the first grant (docs/credential-store.md).
+          const { reconcileProjectEnvFromStore } = await import("../lib/user-credentials-store");
+          const projectIds = input.projects.map((project) => project.id);
+          const env = await reconcileProjectEnvFromStore({ projectIds }).catch((error: unknown) => {
+            console.warn(
+              `[project-env] task ${input.task.id}: credential store read failed: ${error instanceof Error ? error.message : String(error)}`,
+            );
+            return null;
+          });
+          if (env && !env.skipped) {
+            console.log(
+              `[project-env] task ${input.task.id}: credential store reconciled for ${projectIds.length} project(s): ${env.imported} imported, ${env.removed} removed, ${env.errors} errors`,
+            );
+          }
+        }
         // Launch screen: the first stage boundary. A machine-backed task
         // spends the next minute launching an EC2 instance; a container
         // task goes straight to preparing its workspace.

package/src/main.ts

@@ -72,6 +72,7 @@ import {
   deleteProjectEnvVar,
   listProjectEnvKeys,
   setProjectEnvVar,
+  noteProjectOrg,
 } from "../lib/host-env";
 import { handleMcpOp } from "../lib/mcp-connections";
 import { startMcpGateway } from "../lib/mcp-gateway";
@@ -252,6 +253,7 @@ import {
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
 import { LeaseManager } from "../lib/lease";
 import { markSidecarReady, sidecarMode, sidecarTaskId } from "../lib/sidecar";
+import { resumeSidecarTask } from "../lib/sidecar-resume";
 import { declareAgentClisReady } from "../lib/standard-image";
 
 setContainerRuntimeOperationalCheck(() => containerRuntimeProblem() === null);
@@ -552,6 +554,21 @@ const leaseManager: LeaseManager | null = sidecarMode()
           // tokens, and project env on the machine (lib/sidecar.ts).
           markSidecarReady();
           console.log("[lease] credential store reconciled — the task may start");
+          // A runner that came back on a machine whose task is already up
+          // re-asserts the mounts and the editor (lib/sidecar-resume.ts).
+          void resumeSidecarTask()
+            .then((resumed) => {
+              if (resumed.outcome !== "resumed") return;
+              console.log(
+                `[sidecar] task ${sidecarTaskId()} resumed after a runner restart: shared files and editor re-asserted` +
+                  (resumed.warnings.length > 0 ? ` (${resumed.warnings.join("; ")})` : ""),
+              );
+            })
+            .catch((error: unknown) => {
+              console.warn(
+                `[sidecar] resume failed: ${error instanceof Error ? error.message : String(error)}`,
+              );
+            });
         });
         startCredentialStorePickup({ repush: repushBrokeredCopies });
       },
@@ -1816,9 +1833,16 @@ async function connect(): Promise<void> {
       case "env.var.delete": {
         try {
           if (frame.kind === "env.var.set") {
-            setProjectEnvVar(frame.projectId, frame.key, frame.value);
+            setProjectEnvVar(frame.projectId, frame.key, frame.value, frame.orgId);
           } else if (frame.kind === "env.var.delete") {
             deleteProjectEnvVar(frame.projectId, frame.key);
+          } else if (frame.orgId) {
+            // A list that names the org backfills rows mirrored before the
+            // cloud sent it, and re-tags them for the task-machine lease.
+            const updated = noteProjectOrg(frame.projectId, frame.orgId);
+            if (updated > 0) {
+              console.log(`[project-env] ${frame.projectId}: org recorded on ${updated} row(s); re-tagging`);
+            }
           }
           // The ack carries the project's KEY NAMES only — values never cross
           // the bridge.

package/src/protocol.ts

@@ -1657,13 +1657,18 @@ export type CloudToHost =
   // (env.var.ack) — the value on `env.var.set` is write-only (never echoed
   // back). `opId` correlates request↔ack; the ack's `keys` are that project's
   // keys.
-  | { kind: "env.var.list"; opId: string; projectId: string }
+  // `orgId` (cloud from 2026-09-10): the project's org, so the host tags the
+  // mirrored parameter for the tag-scoped task-machine lease policy (ADR-133,
+  // docs/credential-store.md). A list carrying it also backfills rows that
+  // were mirrored before the org was known. Absent from an older cloud.
+  | { kind: "env.var.list"; opId: string; projectId: string; orgId?: string }
   | {
       kind: "env.var.set";
       opId: string;
       projectId: string;
       key: string;
       value: string;
+      orgId?: string;
     }
   | { kind: "env.var.delete"; opId: string; projectId: string; key: string }
   // User-authed MCP connections (ADR-057). Ops run entirely host-side —