@runuai/host 0.9.132 → 0.9.133

package/db/migrations/0023_project_env_org.sql

@@ -0,0 +1,4 @@
+-- ADR-133: the project's org, so the mirrored parameter can carry the `org`
+-- tag the task-machine lease policy conditions on. Null until the cloud sends
+-- it (env.var.set / env.var.list with orgId) or a stored value carries it.
+ALTER TABLE `host_project_env` ADD `org_id` text;

package/db/migrations/meta/_journal.json

@@ -162,6 +162,13 @@
       "when": 1788900000004,
       "tag": "0022_task_project_ids",
       "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "6",
+      "when": 1788900000005,
+      "tag": "0023_project_env_org",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -188,6 +188,11 @@ export const hostProjectEnv = sqliteTable(
       .default(sql`(unixepoch() * 1000)`),
     // ADR-134 slice 3: the credential-store parameter this row mirrors to.
     storeRef: text("store_ref"),
+    // The project's org, learned from an env.var.set/list frame that carries
+    // it (cloud from 2026-09-10) or from a stored value that does. It tags the
+    // mirrored parameter (`org`, `project`) so a task machine's tag-scoped
+    // lease can read it (ADR-133). Null until the cloud has said.
+    orgId: text("org_id"),
   },
   (t) => ({
     pk: primaryKey({ columns: [t.projectId, t.key] }),

package/lib/credential-store-scope.ts

@@ -73,13 +73,40 @@ export function userCredentialListPath(prefix: string): string | null {
   return `${prefix}/users/${scope.userId}`;
 }
 
-/** The path a project-env listing walks, or null to skip. */
-export function projectEnvListPath(prefix: string): string | null {
+/**
+ * The paths a project-env listing walks, or null to skip. An owned or shared
+ * host walks the whole tree. A task machine's lease reads
+ * `/uai/projects/<id>/…` only for parameters tagged with its org (the policy
+ * conditions on `ssm:ResourceTag/org`), and only the task's own projects are
+ * worth asking for — their ids arrive with task-up, not with the first grant,
+ * so a listing without ids on a task machine is simply "nothing yet".
+ */
+export function projectEnvListPaths(
+  prefix: string,
+  projectIds?: readonly string[],
+): string[] | null {
   const scope = storeListScope();
-  if (scope.kind === "host") return `${prefix}/projects`;
-  warnOnce(
-    "project-env",
-    "not read on a task machine — the lease policy grants no project parameters (they carry no org tag)",
-  );
-  return null;
+  if (scope.kind === "host") return [`${prefix}/projects`];
+  if (scope.kind === "none") {
+    warnOnce("project-env", `not read: ${scope.reason}`);
+    return null;
+  }
+  if (!scope.orgId) {
+    warnOnce("project-env", "not read on a task machine whose lease carries no org");
+    return null;
+  }
+  if (!projectIds) return null;
+  return projectIds
+    .filter((id) => isParameterPathSegment(id))
+    .map((id) => `${prefix}/projects/${id}`);
+}
+
+/**
+ * Whether project env is read by name (describe + get-parameter) instead of
+ * by path: true under a lease, whose policy conditions on each parameter's
+ * `org` tag and therefore denies the path listing itself (see
+ * `CredentialStore.listByName`).
+ */
+export function projectEnvListsByName(): boolean {
+  return storeListScope().kind === "lease";
 }

package/lib/credential-store.ts

@@ -46,6 +46,21 @@ export interface CredentialStore {
   delete(name: string): Promise<void>;
   /** Every credential under `path` (recursive), decrypted. Throws on failure. */
   list(path: string): Promise<StoredParameter[]>;
+  /**
+   * Every credential under `path` read by NAME: names from
+   * `describe-parameters` (allowed on `*`, never returns values), then one
+   * `get-parameter` each, decrypted; a name the identity may not read is
+   * skipped. This is how a task machine's lease reads `/uai/projects/<id>`:
+   * its policy conditions on the parameter's `org` tag, and
+   * `get-parameters-by-path` is authorised against the PATH resource, which
+   * carries no tags, so it is denied even when every parameter under it is
+   * tagged (live 2026-09-10, smoke 12).
+   */
+  listByName(path: string): Promise<StoredParameter[]>;
+  /** Set tags on an existing parameter (a second call, because put-parameter
+   *  with Overwrite cannot carry tags). Throws on failure — including when
+   *  the identity lacks `ssm:AddTagsToResource`, which older host policies do. */
+  tag(name: string, tags: Record<string, string>): Promise<void>;
   /** Names and versions under `path` (recursive), NO decryption — the cheap
    *  poll a Uai-operated host runs to notice a broker refresh. */
   listVersions(path: string): Promise<Array<{ name: string; version: number }>>;
@@ -136,6 +151,10 @@ function isNotFound(result: CliResult): boolean {
   return /ParameterNotFound/.test(result.stderr);
 }
 
+function isAccessDenied(result: CliResult): boolean {
+  return /AccessDenied/.test(result.stderr);
+}
+
 /** Summarize a CLI failure WITHOUT echoing stdout (which could carry a value). */
 function failure(op: string, result: CliResult): Error {
   const line =
@@ -181,6 +200,28 @@ export class AwsSsmCredentialStore implements CredentialStore {
     if (result.status !== 0) throw failure("put-parameter", result);
   }
 
+  async tag(name: string, tags: Record<string, string>): Promise<void> {
+    if (!isParameterName(name)) throw new Error(`invalid parameter name: ${name}`);
+    const entries = Object.entries(tags);
+    if (entries.length === 0) return;
+    for (const [key, value] of entries) {
+      if (!/^[A-Za-z0-9_.:/=+@-]{1,128}$/.test(key) || !/^[A-Za-z0-9_.:/=+@ -]{0,256}$/.test(value)) {
+        throw new Error(`invalid tag ${key}`);
+      }
+    }
+    const result = await this.run([
+      "ssm",
+      "add-tags-to-resource",
+      "--resource-type",
+      "Parameter",
+      "--resource-id",
+      name,
+      "--tags",
+      ...entries.map(([key, value]) => `Key=${key},Value=${value}`),
+    ]);
+    if (result.status !== 0) throw failure("add-tags-to-resource", result);
+  }
+
   async get(name: string): Promise<string | null> {
     if (!isParameterName(name)) throw new Error(`invalid parameter name: ${name}`);
     const result = await this.run([
@@ -243,6 +284,36 @@ export class AwsSsmCredentialStore implements CredentialStore {
     return out;
   }
 
+  async listByName(path: string): Promise<StoredParameter[]> {
+    if (!isParameterName(path)) throw new Error(`invalid parameter path: ${path}`);
+    const described = await this.run([
+      "ssm",
+      "describe-parameters",
+      "--parameter-filters",
+      `Key=Path,Option=Recursive,Values=${path}`,
+      "--query",
+      "Parameters[].Name",
+    ]);
+    if (described.status !== 0) throw failure("describe-parameters", described);
+    const parsed: unknown = JSON.parse(described.stdout || "[]");
+    const names = (Array.isArray(parsed) ? parsed : []).filter(
+      (name): name is string => typeof name === "string" && name.startsWith(`${path}/`),
+    );
+    const out: StoredParameter[] = [];
+    for (const name of names) {
+      const result = await this.run(["ssm", "get-parameter", "--name", name, "--with-decryption"]);
+      if (result.status !== 0) {
+        // Not tagged for this identity (or gone between the two calls):
+        // invisible, not an error — the listing is what the lease may read.
+        if (isAccessDenied(result) || isNotFound(result)) continue;
+        throw failure("get-parameter", result);
+      }
+      const value = (JSON.parse(result.stdout) as { Parameter?: { Value?: unknown } }).Parameter?.Value;
+      if (typeof value === "string") out.push({ name, value });
+    }
+    return out;
+  }
+
   async listVersions(path: string): Promise<Array<{ name: string; version: number }>> {
     if (!isParameterName(path)) throw new Error(`invalid parameter path: ${path}`);
     const out: Array<{ name: string; version: number }> = [];

package/lib/host-env.ts

@@ -14,13 +14,14 @@
  * sealed value as "<ct-base64>.<nonce-base64>".
  */
 
-import { and, eq } from "drizzle-orm";
+import { and, eq, isNotNull } from "drizzle-orm";
 
 import {
   credentialStorePrefix,
   isParameterPathSegment,
   parameterName,
   queueStoreWrite,
+  type CredentialStore,
 } from "./credential-store";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
@@ -40,23 +41,111 @@ function unpackValue(valueEnc: string): string {
   return openAesGcm(ct, nonce);
 }
 
-/** Set (insert or overwrite) a project env var, encrypting the value at rest. */
+/** Set (insert or overwrite) a project env var, encrypting the value at rest.
+ *  `orgId` is the project's org when the cloud sent it (see `noteProjectOrg`). */
 export function setProjectEnvVar(
   projectId: string,
   key: string,
   value: string,
+  orgId?: string,
 ): void {
+  const now = Date.now();
   getDb()
     .insert(schema.hostProjectEnv)
-    .values({ projectId, key, valueEnc: packValue(value), updatedAt: Date.now() })
+    .values({
+      projectId,
+      key,
+      valueEnc: packValue(value),
+      updatedAt: now,
+      ...(orgId ? { orgId } : {}),
+    })
     .onConflictDoUpdate({
       target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key],
-      set: { valueEnc: packValue(value), updatedAt: Date.now() },
+      set: { valueEnc: packValue(value), updatedAt: now, ...(orgId ? { orgId } : {}) },
     })
     .run();
+  if (orgId) noteProjectOrg(projectId, orgId, { except: key });
   mirrorProjectEnvToStore(projectId, key);
 }
 
+/**
+ * The cloud told us which org owns `projectId` (an env.var.set/list frame
+ * carrying `orgId`). Every row of that project mirrored before the org was
+ * known gets the org and is re-tagged in the store, so a task machine's
+ * tag-scoped lease can read it (ADR-133). Returns the rows updated.
+ */
+export function noteProjectOrg(
+  projectId: string,
+  orgId: string,
+  opts: { except?: string } = {},
+): number {
+  const rows = getDb()
+    .select({ key: schema.hostProjectEnv.key, orgId: schema.hostProjectEnv.orgId, storeRef: schema.hostProjectEnv.storeRef })
+    .from(schema.hostProjectEnv)
+    .where(eq(schema.hostProjectEnv.projectId, projectId))
+    .all()
+    .filter((row) => row.key !== opts.except && row.orgId !== orgId);
+  for (const row of rows) {
+    getDb()
+      .update(schema.hostProjectEnv)
+      .set({ orgId })
+      .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, row.key)))
+      .run();
+    if (row.storeRef) {
+      const name = row.storeRef;
+      queueStoreWrite(`tag project env ${projectId}/${row.key}`, async (store) => {
+        await tagProjectEnvParameter(store, name, projectId, orgId);
+      });
+    }
+  }
+  return rows.length;
+}
+
+/** The org recorded for a project, or null while the cloud has not said. */
+export function projectEnvOrgId(projectId: string): string | null {
+  const row = getDb()
+    .select({ orgId: schema.hostProjectEnv.orgId })
+    .from(schema.hostProjectEnv)
+    .where(and(eq(schema.hostProjectEnv.projectId, projectId), isNotNull(schema.hostProjectEnv.orgId)))
+    .get();
+  return row?.orgId ?? null;
+}
+
+/** The tags a project env parameter carries: the lease policy's `org`, plus
+ *  `project` for operators reading the store. */
+export function projectEnvTags(projectId: string, orgId: string): Record<string, string> {
+  return { org: orgId, project: projectId };
+}
+
+const tagWarned = new Set<string>();
+/**
+ * Tag a mirrored parameter for the task-machine lease. Best-effort: the
+ * value is already in the store, and a host whose policy predates
+ * `ssm:AddTagsToResource` (host-agent/scripts/credential-store/
+ * bootstrap-aws.sh) must keep mirroring; it warns once per parameter and a
+ * later set/list retries.
+ */
+export async function tagProjectEnvParameter(
+  store: Pick<CredentialStore, "tag">,
+  name: string,
+  projectId: string,
+  orgId: string,
+): Promise<boolean> {
+  try {
+    await store.tag(name, projectEnvTags(projectId, orgId));
+    tagWarned.delete(name);
+    return true;
+  } catch (err) {
+    if (!tagWarned.has(name)) {
+      tagWarned.add(name);
+      console.warn(
+        `[project-env] credential store: tagging ${name} failed (${err instanceof Error ? err.message : String(err)}) — a task machine cannot read it until it carries org=${orgId}; re-run bootstrap-aws.sh for ssm:AddTagsToResource`,
+      );
+    }
+    return false;
+  }
+}
+
 /** Remove a project env var (idempotent). */
 export function deleteProjectEnvVar(projectId: string, key: string): void {
   const result = getDb()
@@ -87,6 +176,9 @@ export interface StoredProjectEnv {
   key: string;
   value: string;
   updatedAt: number;
+  /** The project's org once the cloud has said (ADR-133 tag scope); a
+   *  replacement host inherits it with the value. */
+  orgId?: string;
 }
 
 /** Null when the project id or key cannot be a parameter path segment (a
@@ -111,6 +203,7 @@ export function projectEnvStoreValue(projectId: string, key: string): StoredProj
     key,
     value: unpackValue(row.valueEnc),
     updatedAt: row.updatedAt,
+    ...(row.orgId ? { orgId: row.orgId } : {}),
   };
 }
 
@@ -141,6 +234,7 @@ export function mirrorProjectEnvToStore(projectId: string, key: string): void {
     if (!value) return;
     await store.put(name, JSON.stringify(value));
     setProjectEnvStoreRef(projectId, key, name);
+    if (value.orgId) await tagProjectEnvParameter(store, name, projectId, value.orgId);
   });
 }
 
@@ -154,6 +248,7 @@ export function importProjectEnvFromStore(value: StoredProjectEnv, storeRef: str
       valueEnc: packValue(value.value),
       updatedAt: value.updatedAt,
       storeRef,
+      ...(value.orgId ? { orgId: value.orgId } : {}),
     })
     .onConflictDoNothing({ target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key] })
     .run();

package/lib/user-credentials-store.ts

@@ -23,7 +23,8 @@ import {
   isParameterPathSegment,
   type CredentialStore,
 } from "./credential-store";
-import { projectEnvListPath, userCredentialListPath } from "./credential-store-scope";
+import { projectEnvListPaths,
+  projectEnvListsByName, userCredentialListPath } from "./credential-store-scope";
 import {
   deleteToken as deleteGithubTokenLocal,
   githubTokenParameterName,
@@ -49,6 +50,8 @@ import {
   projectEnvParameterName,
   projectEnvStoreValue,
   setProjectEnvStoreRef,
+  noteProjectOrg,
+  tagProjectEnvParameter,
   type StoredProjectEnv,
 } from "./host-env";
 import {
@@ -347,10 +350,18 @@ export function parseStoredProjectEnv(value: string): StoredProjectEnv {
     key: str(o, "key"),
     value: str(o, "value"),
     updatedAt: num(o, "updatedAt"),
+    ...(typeof o.orgId === "string" && o.orgId.length > 0 ? { orgId: o.orgId } : {}),
   };
 }
 
-export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCredentialsResult> {
+/**
+ * Host start (whole tree) or, on a task machine, task-up with the task's
+ * project ids (ADR-133: the lease reads `/uai/projects/<id>` only for
+ * parameters tagged with its org, and only the task's projects matter).
+ */
+export async function reconcileProjectEnvFromStore(
+  opts: { projectIds?: readonly string[] } = {},
+): Promise<ReconcileUserCredentialsResult> {
   const result: ReconcileUserCredentialsResult = {
     skipped: false,
     imported: 0,
@@ -361,16 +372,20 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
   const store = configuredCredentialStore();
   if (!store) return { ...result, skipped: true };
   const prefix = credentialStorePrefix();
-  const path = projectEnvListPath(prefix);
-  if (path === null) return { ...result, skipped: true };
+  const paths = projectEnvListPaths(prefix, opts.projectIds);
+  if (paths === null) return { ...result, skipped: true };
   const warn = (line: string): void => console.warn(`[project-env] credential store: ${line}`);
-  let listed: Array<{ name: string; value: string }>;
-  try {
-    listed = await store.list(path);
-  } catch (err) {
-    result.errors++;
-    warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
-    return result;
+  const listed: Array<{ name: string; value: string }> = [];
+  const listedPrefixes: string[] = [];
+  const byName = projectEnvListsByName();
+  for (const path of paths) {
+    try {
+      listed.push(...(byName ? await store.listByName(path) : await store.list(path)));
+      listedPrefixes.push(`${path}/`);
+    } catch (err) {
+      result.errors++;
+      warn(`listing ${path} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   const local = new Map(listProjectEnvStoreRows().map((r) => [`${r.projectId}/${r.key}`, r]));
   const seen = new Set<string>();
@@ -386,6 +401,7 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
       const row = local.get(`${at.projectId}/${at.key}`);
       if (row) {
         if (row.storeRef !== param.name) setProjectEnvStoreRef(at.projectId, at.key, param.name);
+        if (value.orgId) noteProjectOrg(at.projectId, value.orgId);
       } else if (importProjectEnvFromStore(value, param.name)) {
         result.imported++;
       }
@@ -397,7 +413,8 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
   for (const row of local.values()) {
     try {
       if (row.storeRef) {
-        if (row.storeRef.startsWith(`${path}/`) && !seen.has(row.storeRef)) {
+        const ref = row.storeRef;
+        if (listedPrefixes.some((p) => ref.startsWith(p)) && !seen.has(ref)) {
           deleteProjectEnvLocal(row.projectId, row.key);
           result.removed++;
         }
@@ -408,6 +425,7 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
       if (!name || !value) continue;
       await upload(store, name, value, (ref) => setProjectEnvStoreRef(row.projectId, row.key, ref));
       result.uploaded++;
+      if (value.orgId) await tagProjectEnvParameter(store, name, row.projectId, value.orgId);
     } catch (err) {
       result.errors++;
       warn(`${row.projectId}/${row.key}: ${err instanceof Error ? err.message : String(err)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.132",
+  "version": "0.9.133",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -851,6 +851,25 @@ export const hostCommands: HostCommands = {
         // ADR-133 sidecar: nothing to clone or spawn with until the lease
         // has landed and the store is reconciled under it.
         await awaitSidecarReady();
+        if (sidecarMode()) {
+          // ADR-133: project env lives under /uai/projects/<id>, readable by
+          // the lease only for parameters tagged with this org, and only the
+          // task's own projects are worth listing — their ids are known here,
+          // not at the first grant (docs/credential-store.md).
+          const { reconcileProjectEnvFromStore } = await import("../lib/user-credentials-store");
+          const projectIds = input.projects.map((project) => project.id);
+          const env = await reconcileProjectEnvFromStore({ projectIds }).catch((error: unknown) => {
+            console.warn(
+              `[project-env] task ${input.task.id}: credential store read failed: ${error instanceof Error ? error.message : String(error)}`,
+            );
+            return null;
+          });
+          if (env && !env.skipped) {
+            console.log(
+              `[project-env] task ${input.task.id}: credential store reconciled for ${projectIds.length} project(s): ${env.imported} imported, ${env.removed} removed, ${env.errors} errors`,
+            );
+          }
+        }
         // Launch screen: the first stage boundary. A machine-backed task
         // spends the next minute launching an EC2 instance; a container
         // task goes straight to preparing its workspace.

package/src/main.ts

@@ -72,6 +72,7 @@ import {
   deleteProjectEnvVar,
   listProjectEnvKeys,
   setProjectEnvVar,
+  noteProjectOrg,
 } from "../lib/host-env";
 import { handleMcpOp } from "../lib/mcp-connections";
 import { startMcpGateway } from "../lib/mcp-gateway";
@@ -1832,9 +1833,16 @@ async function connect(): Promise<void> {
       case "env.var.delete": {
         try {
           if (frame.kind === "env.var.set") {
-            setProjectEnvVar(frame.projectId, frame.key, frame.value);
+            setProjectEnvVar(frame.projectId, frame.key, frame.value, frame.orgId);
           } else if (frame.kind === "env.var.delete") {
             deleteProjectEnvVar(frame.projectId, frame.key);
+          } else if (frame.orgId) {
+            // A list that names the org backfills rows mirrored before the
+            // cloud sent it, and re-tags them for the task-machine lease.
+            const updated = noteProjectOrg(frame.projectId, frame.orgId);
+            if (updated > 0) {
+              console.log(`[project-env] ${frame.projectId}: org recorded on ${updated} row(s); re-tagging`);
+            }
           }
           // The ack carries the project's KEY NAMES only — values never cross
           // the bridge.

package/src/protocol.ts

@@ -1657,13 +1657,18 @@ export type CloudToHost =
   // (env.var.ack) — the value on `env.var.set` is write-only (never echoed
   // back). `opId` correlates request↔ack; the ack's `keys` are that project's
   // keys.
-  | { kind: "env.var.list"; opId: string; projectId: string }
+  // `orgId` (cloud from 2026-09-10): the project's org, so the host tags the
+  // mirrored parameter for the tag-scoped task-machine lease policy (ADR-133,
+  // docs/credential-store.md). A list carrying it also backfills rows that
+  // were mirrored before the org was known. Absent from an older cloud.
+  | { kind: "env.var.list"; opId: string; projectId: string; orgId?: string }
   | {
       kind: "env.var.set";
       opId: string;
       projectId: string;
       key: string;
       value: string;
+      orgId?: string;
     }
   | { kind: "env.var.delete"; opId: string; projectId: string; key: string }
   // User-authed MCP connections (ADR-057). Ops run entirely host-side —