@runuai/host 0.9.138 → 0.9.139

package/lib/credential-store.ts

@@ -61,6 +61,13 @@ export interface CredentialStore {
    *  with Overwrite cannot carry tags). Throws on failure — including when
    *  the identity lacks `ssm:AddTagsToResource`, which older host policies do. */
   tag(name: string, tags: Record<string, string>): Promise<void>;
+  /** The tags on one parameter. Metadata only: `ssm:ListTagsForResource`
+   *  reveals no value and needs no KMS grant — the sign-in box (ADR-136)
+   *  rebuilds an account's label from here without ever reading the secret. */
+  listTags(name: string): Promise<Record<string, string>>;
+  /** Every parameter NAME under `path` (recursive), no values — the
+   *  `describe-parameters` listing that is allowed on `*` and never decrypts. */
+  describeNames(path: string): Promise<string[]>;
   /** Names and versions under `path` (recursive), NO decryption — the cheap
    *  poll a Uai-operated host runs to notice a broker refresh. */
   listVersions(path: string): Promise<Array<{ name: string; version: number }>>;
@@ -284,7 +291,7 @@ export class AwsSsmCredentialStore implements CredentialStore {
     return out;
   }
 
-  async listByName(path: string): Promise<StoredParameter[]> {
+  async describeNames(path: string): Promise<string[]> {
     if (!isParameterName(path)) throw new Error(`invalid parameter path: ${path}`);
     const described = await this.run([
       "ssm",
@@ -296,9 +303,34 @@ export class AwsSsmCredentialStore implements CredentialStore {
     ]);
     if (described.status !== 0) throw failure("describe-parameters", described);
     const parsed: unknown = JSON.parse(described.stdout || "[]");
-    const names = (Array.isArray(parsed) ? parsed : []).filter(
+    return (Array.isArray(parsed) ? parsed : []).filter(
       (name): name is string => typeof name === "string" && name.startsWith(`${path}/`),
     );
+  }
+
+  async listTags(name: string): Promise<Record<string, string>> {
+    if (!isParameterName(name)) throw new Error(`invalid parameter name: ${name}`);
+    const result = await this.run([
+      "ssm",
+      "list-tags-for-resource",
+      "--resource-type",
+      "Parameter",
+      "--resource-id",
+      name,
+    ]);
+    if (result.status !== 0) throw failure("list-tags-for-resource", result);
+    const parsed = JSON.parse(result.stdout || "{}") as {
+      TagList?: Array<{ Key?: unknown; Value?: unknown }> | null;
+    };
+    const out: Record<string, string> = {};
+    for (const tag of parsed.TagList ?? []) {
+      if (typeof tag.Key === "string" && typeof tag.Value === "string") out[tag.Key] = tag.Value;
+    }
+    return out;
+  }
+
+  async listByName(path: string): Promise<StoredParameter[]> {
+    const names = await this.describeNames(path);
     const out: StoredParameter[] = [];
     for (const name of names) {
       const result = await this.run(["ssm", "get-parameter", "--name", name, "--with-decryption"]);

package/lib/engine-accounts.ts

@@ -352,6 +352,19 @@ function resolveExtras(
         execEnv: { [d.selectVar]: containerDir },
         configDir: { hostDir: row.configDir, containerDir },
       });
+    } else if (row.authKind === "config-dir" && isStoreHeldRow(row)) {
+      // ADR-136 sign-in box: the material lives in the store, not here. The
+      // row is listed (label, scope — what the capabilities frame carries)
+      // and never provisioned: the box runs no task.
+      out.push({
+        id: row.id,
+        kind,
+        label: row.label,
+        isDefault: false,
+        authKind: "config-dir",
+        scope,
+        execEnv: {},
+      });
     }
   }
   return out;
@@ -822,14 +835,22 @@ export interface AddAccountResult {
  * Claude accepts a `setup-token` token or an `sk-ant-…` key; Codex accepts an
  * OpenAI API key (written into an isolated `~/.codex-acct-<id>/auth.json`).
  */
-export function addEngineAccount(
+/** What a labeled account will hold once persisted — the validated shape
+ *  shared by the local writer (owned and shared hosts) and the store-only
+ *  writer (the ADR-136 sign-in box), so both refuse the same inputs with the
+ *  same words. Never logged. */
+type LabeledAccountPlan =
+  | { authKind: "env"; label: string; env: Record<string, string>; message: string }
+  | { authKind: "config-dir"; label: string; files: Record<string, string>; message: string };
+
+type PlannedAccount = { ok: false; message: string } | { ok: true; plan: LabeledAccountPlan };
+
+function planLabeledAccount(
   kind: string,
   label: string,
   creds: { apiKey?: string; token?: string },
-  seams: Partial<AccountSeams> = {},
-  scope: string = HOST_ACCOUNT_SCOPE,
-): AddAccountResult {
-  const s = withDefaults(seams);
+  scope: string,
+): PlannedAccount {
   if (!isEngineAccountScope(scope)) {
     return { ok: false, message: "The account scope is invalid." };
   }
@@ -840,72 +861,106 @@ export function addEngineAccount(
   if (/\s/.test(secret) || secret.length < 12) {
     return { ok: false, message: "That doesn't look like a token. Paste just the value." };
   }
-
-  const id = newId();
-  const now = Date.now();
-
   if (kind === "claude") {
     const envVar = secret.startsWith("sk-ant-api")
       ? "ANTHROPIC_API_KEY"
       : "CLAUDE_CODE_OAUTH_TOKEN";
-    getDb()
-      .insert(schema.engineAccounts)
-      .values({
-        id,
-        kind,
-        label: trimmedLabel,
+    return {
+      ok: true,
+      plan: {
         authKind: "env",
-        secretEnc: packSecret(JSON.stringify({ [envVar]: secret })),
-        configDir: null,
-        createdAt: now,
-        scope,
-        position: nextPosition(kind, scope),
-      })
-      .run();
-    mirrorEngineAccount(id);
-    return { ok: true, message: `Added Claude account "${trimmedLabel}".`, id };
+        label: trimmedLabel,
+        env: { [envVar]: secret },
+        message: `Added Claude account "${trimmedLabel}".`,
+      },
+    };
   }
-
   const envKeyVar = API_KEY_ENV_VARS[kind];
   if (envKeyVar) {
-    getDb()
-      .insert(schema.engineAccounts)
-      .values({
-        id,
-        kind,
-        label: trimmedLabel,
+    return {
+      ok: true,
+      plan: {
         authKind: "env",
-        secretEnc: packSecret(JSON.stringify({ [envKeyVar]: secret })),
-        configDir: null,
-        createdAt: now,
-        scope,
-        position: nextPosition(kind, scope),
-      })
-      .run();
-    mirrorEngineAccount(id);
+        label: trimmedLabel,
+        env: { [envKeyVar]: secret },
+        message: `Added ${API_KEY_ENGINE_LABELS[kind] ?? kind} account "${trimmedLabel}".`,
+      },
+    };
+  }
+  if (kind === "codex") {
     return {
       ok: true,
-      message: `Added ${API_KEY_ENGINE_LABELS[kind] ?? kind} account "${trimmedLabel}".`,
-      id,
+      plan: {
+        authKind: "config-dir",
+        label: trimmedLabel,
+        files: { "auth.json": `${JSON.stringify({ OPENAI_API_KEY: secret }, null, 2)}\n` },
+        message: `Added Codex account "${trimmedLabel}".`,
+      },
     };
   }
+  return {
+    ok: false,
+    message: `Adding a second ${kind} account isn't supported yet — connect the primary account from the Engines panel.`,
+  };
+}
 
-  if (kind === "codex") {
-    const d = KINDS.codex as KindDescriptor;
-    const hostDir = (d.extraHostDir as (o: string, i: string) => string)(
-      s.ownerHome(),
-      id,
-    );
+function planCapturedConfigDirAccount(
+  kind: "codex" | "grok",
+  label: string,
+  authJson: string,
+  scope: string,
+): PlannedAccount {
+  const engineLabel = kind === "codex" ? "Codex" : "Grok";
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  try {
+    const parsed: unknown = JSON.parse(authJson);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("not an object");
+    }
+  } catch {
+    return { ok: false, message: `The captured ${engineLabel} credential is not valid.` };
+  }
+  return {
+    ok: true,
+    plan: {
+      authKind: "config-dir",
+      label: trimmedLabel,
+      files: { "auth.json": authJson.endsWith("\n") ? authJson : `${authJson}\n` },
+      message: `Added ${engineLabel} account "${trimmedLabel}".`,
+    },
+  };
+}
+
+/** Persist a plan on THIS host — a sealed env row or an isolated config dir
+ *  under the owner's home — and mirror it to the store when one is configured. */
+function persistPlannedAccountLocally(
+  kind: string,
+  scope: string,
+  plan: LabeledAccountPlan,
+  s: AccountSeams,
+): AddAccountResult {
+  const id = newId();
+  let configDir: string | null = null;
+  if (plan.authKind === "config-dir") {
+    const d = KINDS[kind];
+    if (!d?.extraHostDir) {
+      return { ok: false, message: `${kind} has no config-dir layout.` };
+    }
+    const hostDir = d.extraHostDir(s.ownerHome(), id);
     try {
-      const file = join(hostDir, "auth.json");
       mkdirSync(hostDir, { recursive: true });
-      writeFileSync(file, `${JSON.stringify({ OPENAI_API_KEY: secret }, null, 2)}\n`, {
-        mode: 0o600,
-      });
-      try {
-        chmodSync(file, 0o600);
-      } catch {
-        /* best effort */
+      for (const [basename, content] of Object.entries(plan.files)) {
+        const file = join(hostDir, basename);
+        writeFileSync(file, content, { mode: 0o600 });
+        try {
+          chmodSync(file, 0o600);
+        } catch {
+          /* best effort */
+        }
       }
     } catch (err) {
       return {
@@ -915,28 +970,36 @@ export function addEngineAccount(
         }`,
       };
     }
-    getDb()
-      .insert(schema.engineAccounts)
-      .values({
-        id,
-        kind,
-        label: trimmedLabel,
-        authKind: "config-dir",
-        secretEnc: null,
-        configDir: hostDir,
-        createdAt: now,
-        scope,
-        position: nextPosition(kind, scope),
-      })
-      .run();
-    mirrorEngineAccount(id);
-    return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
+    configDir = hostDir;
   }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind,
+      label: plan.label,
+      authKind: plan.authKind,
+      secretEnc: plan.authKind === "env" ? packSecret(JSON.stringify(plan.env)) : null,
+      configDir,
+      createdAt: Date.now(),
+      scope,
+      position: nextPosition(kind, scope),
+    })
+    .run();
+  mirrorEngineAccount(id);
+  return { ok: true, message: plan.message, id };
+}
 
-  return {
-    ok: false,
-    message: `Adding a second ${kind} account isn't supported yet — connect the primary account from the Engines panel.`,
-  };
+export function addEngineAccount(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): AddAccountResult {
+  const planned = planLabeledAccount(kind, label, creds, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountLocally(kind, scope, planned.plan, withDefaults(seams));
 }
 
 /**
@@ -972,63 +1035,9 @@ function addConfigDirAccountFromAuthJson(
   seams: Partial<AccountSeams>,
   scope: string,
 ): AddAccountResult {
-  const engineLabel = kind === "codex" ? "Codex" : "Grok";
-  if (!isEngineAccountScope(scope)) {
-    return { ok: false, message: "The account scope is invalid." };
-  }
-  const s = withDefaults(seams);
-  const trimmedLabel = label.trim();
-  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
-  try {
-    const parsed: unknown = JSON.parse(authJson);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("not an object");
-    }
-  } catch {
-    return { ok: false, message: `The captured ${engineLabel} credential is not valid.` };
-  }
-
-  const id = newId();
-  const d = KINDS[kind] as KindDescriptor;
-  const hostDir = (d.extraHostDir as (o: string, i: string) => string)(
-    s.ownerHome(),
-    id,
-  );
-  try {
-    const file = join(hostDir, "auth.json");
-    mkdirSync(hostDir, { recursive: true });
-    writeFileSync(file, authJson.endsWith("\n") ? authJson : `${authJson}\n`, {
-      mode: 0o600,
-    });
-    try {
-      chmodSync(file, 0o600);
-    } catch {
-      /* best effort */
-    }
-  } catch (err) {
-    return {
-      ok: false,
-      message: `Could not write the account config: ${
-        err instanceof Error ? err.message : String(err)
-      }`,
-    };
-  }
-  getDb()
-    .insert(schema.engineAccounts)
-    .values({
-      id,
-      kind,
-      label: trimmedLabel,
-      authKind: "config-dir",
-      secretEnc: null,
-      configDir: hostDir,
-      createdAt: Date.now(),
-      scope,
-      position: nextPosition(kind, scope),
-    })
-    .run();
-  mirrorEngineAccount(id);
-  return { ok: true, message: `Added ${engineLabel} account "${trimmedLabel}".`, id };
+  const planned = planCapturedConfigDirAccount(kind, label, authJson, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountLocally(kind, scope, planned.plan, withDefaults(seams));
 }
 
 /** Remove an EXTRA account (idempotent). The synthesized default can't be
@@ -1346,6 +1355,11 @@ function setStoreRef(id: string, storeRef: string): void {
 }
 
 async function putRow(store: CredentialStore, row: StoreRow, hostId: string | null): Promise<boolean> {
+  if (isStoreHeldRow(row)) {
+    // ADR-136: nothing here to mirror — an empty env put would overwrite the
+    // only copy of the credential.
+    throw new Error(`account ${row.id} is store-held; this runner holds no material to mirror`);
+  }
   const name = engineAccountParameterName(row, hostId);
   if (!name) {
     if (!warnedNoHostId) {
@@ -1368,6 +1382,13 @@ export function mirrorEngineAccount(id: string): void {
   queueStoreWrite(`mirror ${id}`, async (store) => {
     const row = selectRow(id);
     if (!row) return;
+    if (isStoreHeldRow(row)) {
+      // ADR-136 sign-in box: a rename or reorder rides as metadata tags —
+      // the secret is not here to re-put, and tags are what a replacement
+      // box reads back.
+      await store.tag(row.storeRef!, engineAccountMetadataTags(row));
+      return;
+    }
     await putRow(store, row, storeHostId);
   });
 }
@@ -1565,4 +1586,288 @@ export function applyStoredEngineAccount(
     throw new Error("stored auth kind does not match the local row");
   }
   return { kind: stored.kind, id: stored.id, imported: false };
-}
+}
+
+// ---------------------------------------------------------------------------
+// Store-only accounts (ADR-136 sign-in box, docs/shared-host-retirement.md).
+//
+// The small always-on machine behind the "Uai Cloud" row writes every capture
+// STRAIGHT into the credential store and keeps only a metadata row — id, kind,
+// label, scope, position, store_ref — with no sealed secret and no config dir.
+// Its store identity is write-only (put, tag, delete, describe names; never
+// get, never decrypt), so a compromised box can break sign-ins but cannot read
+// one. Labels therefore also ride as parameter TAGS, which
+// `ssm:ListTagsForResource` returns without a KMS grant: a replacement box
+// rebuilds its list from names + tags alone (`reconcileEngineAccountMetadataFromStore`).
+// ---------------------------------------------------------------------------
+
+export const ACCOUNT_LABEL_TAG = "uai_label_b64";
+export const ACCOUNT_POSITION_TAG = "uai_position";
+export const ACCOUNT_CREATED_AT_TAG = "uai_created_at";
+export const ACCOUNT_AUTH_KIND_TAG = "uai_auth_kind";
+/** SSM tag values: 256 chars of `[A-Za-z0-9_.:/=+@ -]`; base64url fits. */
+const MAX_TAG_VALUE_CHARS = 256;
+
+/** A row whose material lives ONLY in the store: a store_ref and no secret. */
+export function isStoreHeldRow(row: {
+  authKind: string;
+  secretEnc: string | null;
+  configDir: string | null;
+  storeRef?: string | null;
+}): boolean {
+  if (!row.storeRef) return false;
+  return row.authKind === "env" ? row.secretEnc === null : row.configDir === null;
+}
+
+/** The secret-free metadata a parameter carries as tags. The label is
+ *  base64url so any label character survives SSM's tag charset; a label too
+ *  long to fit is shortened (the store value keeps the full one). */
+export function engineAccountMetadataTags(row: {
+  label: string;
+  authKind: string;
+  position?: number | null;
+  createdAt: number;
+}): Record<string, string> {
+  let label = row.label;
+  let encoded = Buffer.from(label, "utf8").toString("base64url");
+  while (encoded.length > MAX_TAG_VALUE_CHARS && label.length > 1) {
+    label = label.slice(0, -1);
+    encoded = Buffer.from(label, "utf8").toString("base64url");
+  }
+  return {
+    [ACCOUNT_LABEL_TAG]: encoded,
+    [ACCOUNT_POSITION_TAG]: String(row.position ?? 0),
+    [ACCOUNT_CREATED_AT_TAG]: String(row.createdAt),
+    [ACCOUNT_AUTH_KIND_TAG]: row.authKind,
+  };
+}
+
+function derivedAccountLabel(kind: string, id: string): string {
+  const engine = kind.charAt(0).toUpperCase() + kind.slice(1);
+  return `${engine} ${id.slice(-6)}`;
+}
+
+function labelFromTags(tags: Record<string, string>, kind: string, id: string): string {
+  const encoded = tags[ACCOUNT_LABEL_TAG];
+  if (encoded) {
+    try {
+      const label = Buffer.from(encoded, "base64url").toString("utf8").trim();
+      if (isEngineAccountLabel(label)) return label;
+    } catch {
+      /* fall through */
+    }
+  }
+  return derivedAccountLabel(kind, id);
+}
+
+async function persistPlannedAccountToStore(
+  kind: string,
+  scope: string,
+  plan: LabeledAccountPlan,
+): Promise<AddAccountResult> {
+  const store = configuredCredentialStore();
+  if (!store) {
+    return { ok: false, message: "This runner has no credential store to hold the account." };
+  }
+  if (scope === HOST_ACCOUNT_SCOPE) {
+    return { ok: false, message: "Store-only accounts belong to a workspace, not the runner." };
+  }
+  const id = newId();
+  const now = Date.now();
+  const position = nextPosition(kind, scope);
+  const row = { id, kind, label: plan.label, authKind: plan.authKind, scope, position, createdAt: now };
+  const name = engineAccountParameterName(row);
+  if (!name) {
+    return { ok: false, message: "Store-only accounts belong to a workspace, not the runner." };
+  }
+  const stored: StoredEngineAccount = {
+    v: 1,
+    ...row,
+    ...(plan.authKind === "env" ? { env: plan.env } : { files: plan.files }),
+  };
+  try {
+    await store.put(name, JSON.stringify(stored));
+  } catch (err) {
+    console.warn(
+      `[engine-accounts] store-only ${kind}/${id}: put failed (${err instanceof Error ? err.message : String(err)})`,
+    );
+    return {
+      ok: false,
+      message: "The credential store refused the write; nothing was kept on this runner.",
+    };
+  }
+  try {
+    await store.tag(name, engineAccountMetadataTags(row));
+  } catch (err) {
+    console.warn(
+      `[engine-accounts] store-only ${kind}/${id}: tagging failed (${err instanceof Error ? err.message : String(err)}) — a replacement sign-in box lists it as "${derivedAccountLabel(kind, id)}"`,
+    );
+  }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind,
+      label: plan.label,
+      authKind: plan.authKind,
+      secretEnc: null,
+      configDir: null,
+      createdAt: now,
+      scope,
+      position,
+      storeRef: name,
+    })
+    .run();
+  return { ok: true, message: plan.message, id };
+}
+
+/** `addEngineAccount` for the sign-in box: the same validation, the store
+ *  written FIRST and awaited, then a metadata-only row. A store failure is the
+ *  caller's failure and leaves nothing behind. */
+export async function addEngineAccountToStore(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  scope: string,
+): Promise<AddAccountResult> {
+  const planned = planLabeledAccount(kind, label, creds, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountToStore(kind, scope, planned.plan);
+}
+
+/** `addCodexAccountFromAuthJson` / `addGrokAccountFromAuthJson` for the
+ *  sign-in box: the captured auth.json goes to the store, never to a dir. */
+export async function addCapturedConfigDirAccountToStore(
+  kind: "codex" | "grok",
+  label: string,
+  authJson: string,
+  scope: string,
+): Promise<AddAccountResult> {
+  const planned = planCapturedConfigDirAccount(kind, label, authJson, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountToStore(kind, scope, planned.plan);
+}
+
+export interface PurgeLocalEngineAccountSecretsResult {
+  /** Workspace rows whose sealed secret or config dir was removed. */
+  stripped: number;
+  /** Rows deleted outright: host-scope accounts and rows never mirrored. */
+  removed: number;
+  errors: number;
+}
+
+/**
+ * Sign-in box start: nothing the previous release (or an operator) left on
+ * this machine may hold a credential. Workspace rows keep their metadata and
+ * lose their material; host-scope rows and rows the store never received are
+ * deleted — the box holds workspace accounts only, and a secret with no copy
+ * in the store still may not live here.
+ */
+export function purgeLocalEngineAccountSecrets(): PurgeLocalEngineAccountSecretsResult {
+  const result: PurgeLocalEngineAccountSecretsResult = { stripped: 0, removed: 0, errors: 0 };
+  const rows = getDb().select().from(schema.engineAccounts).all() as StoreRow[];
+  for (const row of rows) {
+    const scope = row.scope ?? HOST_ACCOUNT_SCOPE;
+    if (scope === HOST_ACCOUNT_SCOPE || !row.storeRef) {
+      removeLocalAccountRow(row);
+      result.removed++;
+      continue;
+    }
+    if (isStoreHeldRow(row)) continue;
+    if (row.configDir) {
+      try {
+        rmSync(row.configDir, { recursive: true, force: true });
+      } catch {
+        result.errors++;
+      }
+    }
+    getDb()
+      .update(schema.engineAccounts)
+      .set({ secretEnc: null, configDir: null })
+      .where(eq(schema.engineAccounts.id, row.id))
+      .run();
+    result.stripped++;
+  }
+  return result;
+}
+
+export interface ReconcileEngineAccountMetadataResult {
+  skipped: boolean;
+  imported: number;
+  removed: number;
+  errors: number;
+}
+
+/**
+ * Sign-in box start: make the metadata rows agree with the store WITHOUT
+ * reading a value. Names come from `describe-parameters` (allowed on `*`),
+ * labels and order from each new parameter's tags. A workspace parameter this
+ * box lacks becomes a metadata row; a row whose parameter is gone is dropped;
+ * host-scope rows are dropped (the box has none). A failed listing touches
+ * nothing.
+ */
+export async function reconcileEngineAccountMetadataFromStore(): Promise<ReconcileEngineAccountMetadataResult> {
+  const result: ReconcileEngineAccountMetadataResult = { skipped: false, imported: 0, removed: 0, errors: 0 };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  const warn = (line: string): void => console.warn(`[engine-accounts] metadata reconcile: ${line}`);
+  let names: string[];
+  try {
+    names = await store.describeNames(`${prefix}/orgs`);
+  } catch (err) {
+    warn(`listing ${prefix}/orgs failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { ...result, errors: 1 };
+  }
+  const rows = getDb().select().from(schema.engineAccounts).all() as StoreRow[];
+  const byRef = new Set(rows.map((r) => r.storeRef).filter((ref): ref is string => Boolean(ref)));
+  const seen = new Set<string>();
+  for (const name of names) {
+    const at = parseEngineAccountParameterName(name, prefix);
+    if (!at || at.scope === HOST_ACCOUNT_SCOPE) continue;
+    seen.add(name);
+    if (byRef.has(name)) continue;
+    let tags: Record<string, string> = {};
+    try {
+      tags = await store.listTags(name);
+    } catch (err) {
+      result.errors++;
+      warn(`tags of ${name} unreadable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const taggedAuthKind = tags[ACCOUNT_AUTH_KIND_TAG];
+    const authKind: AccountAuthKind =
+      taggedAuthKind === "env" || taggedAuthKind === "config-dir"
+        ? taggedAuthKind
+        : (KINDS[at.kind]?.authKind ?? "env");
+    const position = Number.parseInt(tags[ACCOUNT_POSITION_TAG] ?? "", 10);
+    const createdAt = Number.parseInt(tags[ACCOUNT_CREATED_AT_TAG] ?? "", 10);
+    try {
+      getDb()
+        .insert(schema.engineAccounts)
+        .values({
+          id: at.id,
+          kind: at.kind,
+          label: labelFromTags(tags, at.kind, at.id),
+          authKind,
+          secretEnc: null,
+          configDir: null,
+          scope: at.scope,
+          position: Number.isFinite(position) ? position : 0,
+          storeRef: name,
+          createdAt: Number.isFinite(createdAt) ? createdAt : Date.now(),
+        })
+        .run();
+      result.imported++;
+    } catch (err) {
+      result.errors++;
+      warn(`importing ${name} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const row of rows) {
+    const scope = row.scope ?? HOST_ACCOUNT_SCOPE;
+    if (scope !== HOST_ACCOUNT_SCOPE && row.storeRef && seen.has(row.storeRef)) continue;
+    removeLocalAccountRow(row);
+    result.removed++;
+  }
+  return result;
+}

package/lib/engine-connect.ts

@@ -27,6 +27,12 @@ const MAX_CONCURRENT_CONNECTS = 1;
 
 export type EmitEngineConnectEvent = (frame: EngineConnectEventFrame) => void;
 
+export interface AddAccountOutcome {
+  ok: boolean;
+  message: string;
+  id?: string;
+}
+
 export interface EngineConnectManagerOptions {
   /** Re-advertise capabilities after a successful mutation (main.ts). */
   readvertise(): void;
@@ -34,6 +40,17 @@ export interface EngineConnectManagerOptions {
   refreshEngineAccountAgents(kind: string): Promise<void>;
   /** Best-effort post-connect image maintenance (optional engines bake in). */
   ensureStandardImage(): Promise<unknown>;
+  /** ADR-136 sign-in box: only labeled, workspace-scoped connects are
+   *  admitted — nothing here may write the host's default slot. */
+  workspaceOnly?: boolean;
+  /** The labeled-account sink. Defaults to the local `addEngineAccount`; the
+   *  sign-in box supplies the store-first one and awaits its write. */
+  addLabeledAccount?: (
+    kind: EngineConnectKind,
+    label: string,
+    secret: string,
+    scope: string,
+  ) => AddAccountOutcome | Promise<AddAccountOutcome>;
   timers?: {
     setTimeout(handler: () => void, ms: number): NodeJS.Timeout;
     clearTimeout(timer: NodeJS.Timeout): void;
@@ -156,15 +173,26 @@ export class EngineConnectManager {
       return;
     }
 
+    // ADR-136 sign-in box: a workspace account or nothing.
+    if (
+      this.options.workspaceOnly &&
+      (label === undefined || scope === undefined || scope === HOST_ACCOUNT_SCOPE)
+    ) {
+      this.finish(
+        operation,
+        false,
+        "The Uai Cloud sign-in box connects workspace accounts only.",
+      );
+      return;
+    }
     // ADR-116 labeled extra account — the sink validates kind support.
     if (label !== undefined && secret !== undefined) {
-      const added = addEngineAccount(
-        engine,
-        label,
-        { token: secret },
-        {},
-        scope ?? HOST_ACCOUNT_SCOPE,
-      );
+      const sink =
+        this.options.addLabeledAccount ??
+        ((kind, accountLabel, value, accountScope) =>
+          addEngineAccount(kind, accountLabel, { token: value }, {}, accountScope));
+      const added = await sink(engine, label, secret, scope ?? HOST_ACCOUNT_SCOPE);
+      if (operation.done) return;
       if (added.ok) this.afterMutation(engine, false);
       this.finish(operation, added.ok, added.message, added.id);
       return;

package/lib/engine-login.ts

@@ -136,6 +136,12 @@ export interface EngineLoginTimers {
   clearTimeout(timer: unknown): void;
 }
 
+export interface AccountAddOutcome {
+  ok: boolean;
+  message: string;
+  id?: string;
+}
+
 export interface EngineLoginSeams {
   createTempDir(): Promise<string>;
   removeTempDir(path: string): Promise<void>;
@@ -158,22 +164,24 @@ export interface EngineLoginSeams {
   readTranscript(tempDir: string): Promise<string | null>;
   persistClaudeToken(token: string): Promise<void>;
   persistCodexAuth(sourceFile: string): Promise<void>;
-  /** ADR-116: labeled extra-account captures (never the default slots). */
+  /** ADR-116: labeled extra-account captures (never the default slots).
+   *  Sync on a host that seals the capture locally; a promise on the ADR-136
+   *  sign-in box, whose sink awaits the credential store's write. */
   addClaudeAccount(
     label: string,
     token: string,
     scope: string,
-  ): { ok: boolean; message: string; id?: string };
+  ): AccountAddOutcome | Promise<AccountAddOutcome>;
   addCodexAccount(
     label: string,
     authJson: string,
     scope: string,
-  ): { ok: boolean; message: string; id?: string };
+  ): AccountAddOutcome | Promise<AccountAddOutcome>;
   addGrokAccount(
     label: string,
     authJson: string,
     scope: string,
-  ): { ok: boolean; message: string; id?: string };
+  ): AccountAddOutcome | Promise<AccountAddOutcome>;
   persistGrokAuth(sourceFile: string): Promise<void>;
   /** Optional engines ride the standard image only when configured; a fresh
    * account may be the first configuration → rebuild (queue-deduped). */
@@ -197,6 +205,9 @@ export interface EngineLoginManagerOptions {
   tempRoot?: string;
   /** Defer Docker inventory until the first start when no runtime is selected. */
   reconcileOnCreate?: boolean;
+  /** ADR-136 sign-in box: only labeled, workspace-scoped sign-ins are
+   *  admitted — the default slots are the host owner's and the box has none. */
+  workspaceOnly?: boolean;
   seams?: Partial<EngineLoginSeams>;
   /** Rebuild the standard image after a successful capture (optional engines). */
   ensureStandardImage?: () => Promise<unknown>;
@@ -389,12 +400,14 @@ function withDefaults(options: EngineLoginManagerOptions): EngineLoginSeams {
  */
 export class EngineLoginManager {
   private readonly seams: EngineLoginSeams;
+  private readonly workspaceOnly: boolean;
   private readonly operations = new Map<string, LoginOperation>();
   private readonly engineOperations = new Map<EngineLoginKind, LoginOperation>();
   private reconciliation: Promise<boolean>;
 
   constructor(options: EngineLoginManagerOptions) {
     this.seams = withDefaults(options);
+    this.workspaceOnly = options.workspaceOnly === true;
     this.reconciliation =
       options.reconcileOnCreate === false
         ? Promise.resolve(false)
@@ -449,6 +462,23 @@ export class EngineLoginManager {
       );
       return false;
     }
+    // ADR-136 sign-in box: nothing here may write a default slot, and a
+    // host-scope account would belong to a runner that owns no credential.
+    if (
+      this.workspaceOnly &&
+      (scope === undefined || scope === HOST_ACCOUNT_SCOPE || label === undefined)
+    ) {
+      safeEmit(
+        emit,
+        failedEvent(
+          opId,
+          engine,
+          "start_failed",
+          "The Uai Cloud sign-in box signs in workspace accounts only.",
+        ),
+      );
+      return false;
+    }
     // A workspace's sign-in is always a labeled account: the default slot is
     // the host owner's and must never be written on a tenant's behalf.
     if (scope !== undefined && scope !== HOST_ACCOUNT_SCOPE && label === undefined) {
@@ -1043,7 +1073,7 @@ export class EngineLoginManager {
       // ADR-116: labeled capture — an extra account, not the default slot.
       // Extras are picked up at the next agent spawn / rotation, so no
       // running-agent refresh is needed (mirrors the local accounts API).
-      const added = this.seams.addClaudeAccount(
+      const added = await this.seams.addClaudeAccount(
         operation.accountLabel,
         token,
         operation.accountScope,
@@ -1118,10 +1148,10 @@ export class EngineLoginManager {
     if (operation.accountLabel !== null) {
       // ADR-116: labeled capture — the auth.json this login produced becomes
       // an isolated extra account instead of overwriting ~/.codex.
-      let added: { ok: boolean; message: string; id?: string };
+      let added: AccountAddOutcome;
       try {
         const contents = await readFile(authFile, "utf8");
-        added = grok
+        added = await (grok
           ? this.seams.addGrokAccount(
               operation.accountLabel,
               contents,
@@ -1131,7 +1161,7 @@ export class EngineLoginManager {
               operation.accountLabel,
               contents,
               operation.accountScope,
-            );
+            ));
       } catch {
         added = {
           ok: false,

package/lib/env-file.ts

@@ -79,6 +79,36 @@ export function writeEnvValuesAtomic(
   replaceEnvFileAtomic(file, `${kept.join("\n")}\n`);
 }
 
+/**
+ * Atomically drop `keys` from a dotenv file (a missing file or key is fine).
+ * The sign-in box (ADR-136) strips engine credentials from `.env.local` at
+ * start so no default-slot secret survives on that machine.
+ */
+export function removeEnvValuesAtomic(
+  file: string,
+  keys: readonly string[],
+): string[] {
+  if (keys.length === 0 || !existsSync(file)) return [];
+  for (const key of keys) {
+    if (!ENV_KEY.test(key)) throw new Error(`invalid environment key: ${key}`);
+  }
+  const drop = new Set(keys);
+  const removed: string[] = [];
+  const current = readFileSync(file, "utf8");
+  const kept = current.split(/\r?\n/).filter((line, index, lines) => {
+    if (index === lines.length - 1 && line === "") return false;
+    const equals = line.indexOf("=");
+    if (equals <= 0) return true;
+    const key = line.slice(0, equals);
+    if (!drop.has(key)) return true;
+    removed.push(key);
+    return false;
+  });
+  if (removed.length === 0) return [];
+  replaceEnvFileAtomic(file, kept.length === 0 ? "" : `${kept.join("\n")}\n`);
+  return [...new Set(removed)];
+}
+
 /** Capture the exact bytes needed to roll back a multi-store config write. */
 export function readEnvFileSnapshot(file: string): EnvFileSnapshot {
   return existsSync(file)

package/lib/signin-box.ts

@@ -0,0 +1,114 @@
+/**
+ * ADR-136 sign-in box: the small always-on machine behind the "Uai Cloud"
+ * runner row (docs/shared-host-retirement.md). Selected by
+ * `uai-host run --signin-box` (env `UAI_SIGNIN_BOX=1`), which cli.ts sets
+ * before main.ts loads. Same package as every runner, one flag.
+ *
+ * The box has exactly one job — run engine sign-ins and connects for
+ * workspaces and write the result into the credential store — and holds no
+ * credential at rest: captures go to the store first and only a metadata row
+ * stays (lib/engine-accounts.ts, store-only accounts), nothing is imported
+ * from the store at start, the default engine slots are scrubbed on every
+ * start, and its store identity is write-only. Everything else a runner does
+ * is refused here: task commands and tunnels get a definite non-retryable
+ * answer, the local UI and the pickup/broker loops never start.
+ */
+
+import { existsSync, readdirSync, rmSync, type Dirent } from "node:fs";
+import { join } from "node:path";
+
+import { removeEnvValuesAtomic } from "./env-file";
+
+export function signInBoxMode(): boolean {
+  return process.env.UAI_SIGNIN_BOX === "1";
+}
+
+export const SIGN_IN_BOX_TASK_REFUSAL =
+  "This runner is the Uai Cloud sign-in box; tasks run on their own machines.";
+
+/** Host commands the box still serves: its own managed lifecycle and the
+ *  account management the engines pane drives. Every task-shaped command
+ *  (taskUp, channels, files, previews, attachments) is refused. */
+const ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+  "hostUpdate",
+  "hostRestart",
+  "engineAccountRemove",
+  "engineAccountRename",
+  "engineAccountReorder",
+  "engineDisconnect",
+]);
+
+export function signInBoxAllowsCommand(command: string): boolean {
+  return ALLOWED_COMMANDS.has(command);
+}
+
+/** The env keys the adapters read as the host's OWN engine credential
+ *  (lib/engines.ts `detect`). None may survive on the box. */
+export const ENGINE_CREDENTIAL_ENV_KEYS = [
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "OPENAI_API_KEY",
+  "XAI_API_KEY",
+  "CURSOR_API_KEY",
+] as const;
+
+/** Default-slot credential files under the owner's home (engine-accounts
+ *  KINDS `defaultHostDir`), and the isolated per-account dirs
+ *  (`extraHostDir`) — swept as strays in case no row references them. */
+const DEFAULT_SLOT_FILES: readonly (readonly string[])[] = [
+  [".codex", "auth.json"],
+  [".grok", "auth.json"],
+  [".local", "share", "opencode", "auth.json"],
+];
+const ACCOUNT_DIR_PREFIXES: readonly { parent: readonly string[]; prefix: string }[] = [
+  { parent: [], prefix: ".codex-acct-" },
+  { parent: [], prefix: ".grok-acct-" },
+  { parent: [".local", "share"], prefix: "opencode-acct-" },
+];
+
+export interface PurgeDefaultEngineSlotsResult {
+  files: string[];
+  dirs: string[];
+  envKeys: string[];
+}
+
+/**
+ * Remove every host-level engine credential from this machine: the default
+ * slot files, stray isolated account dirs, and the credential keys in
+ * `.env.local` plus the live process env. Idempotent; a fresh box removes
+ * nothing.
+ */
+export function purgeDefaultEngineSlots(opts: {
+  ownerHome: string;
+  envFile: string;
+  procEnv?: NodeJS.ProcessEnv;
+}): PurgeDefaultEngineSlotsResult {
+  const files: string[] = [];
+  const dirs: string[] = [];
+  for (const parts of DEFAULT_SLOT_FILES) {
+    const file = join(opts.ownerHome, ...parts);
+    if (!existsSync(file)) continue;
+    rmSync(file, { force: true });
+    files.push(file);
+  }
+  for (const { parent, prefix } of ACCOUNT_DIR_PREFIXES) {
+    const dir = join(opts.ownerHome, ...parent);
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
+      const path = join(dir, entry.name);
+      rmSync(path, { recursive: true, force: true });
+      dirs.push(path);
+    }
+  }
+  const envKeys = removeEnvValuesAtomic(opts.envFile, ENGINE_CREDENTIAL_ENV_KEYS);
+  const procEnv = opts.procEnv ?? process.env;
+  for (const key of ENGINE_CREDENTIAL_ENV_KEYS) delete procEnv[key];
+  return { files, dirs, envKeys };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.138",
+  "version": "0.9.139",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cli.ts

@@ -204,6 +204,10 @@ async function cmdRun(rest: string[] = []): Promise<void> {
   // (lib/sidecar.ts) — set before main.ts loads, since its boot reads it.
   const sidecarTask = flagValue(rest, "--task");
   if (sidecarTask) process.env.UAI_SIDECAR_TASK = sidecarTask;
+  // ADR-136 sign-in box: `uai-host run --signin-box` on the small always-on
+  // machine behind the "Uai Cloud" row. Same package, one flag
+  // (lib/signin-box.ts); set before main.ts loads for the same reason.
+  if (rest.includes("--signin-box")) process.env.UAI_SIGNIN_BOX = "1";
   // Timestamped service logs: the ADR-106 live smoke burned an hour dating
   // undated scrollback. Applies to the service process only, not one-shot CLI
   // commands.

package/src/main.ts

@@ -10,6 +10,7 @@ import {
   type OutgoingHttpHeaders,
 } from "node:http";
 import { Socket } from "node:net";
+import { homedir } from "node:os";
 import { join } from "node:path";
 
 import WebSocket, { type RawData } from "ws";
@@ -159,9 +160,13 @@ import {
   type HostConfigResult,
 } from "../lib/host-config";
 import {
+  addCapturedConfigDirAccountToStore,
+  addEngineAccountToStore,
   configureEngineAccountStore,
   hasStoredEngineAccounts,
   listEngineAccountsAllScopes,
+  purgeLocalEngineAccountSecrets,
+  reconcileEngineAccountMetadataFromStore,
   reconcileEngineAccountsFromStore,
 } from "../lib/engine-accounts";
 import {
@@ -253,6 +258,12 @@ import {
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
 import { LeaseManager } from "../lib/lease";
 import { markSidecarReady, sidecarMode, sidecarTaskId } from "../lib/sidecar";
+import {
+  purgeDefaultEngineSlots,
+  SIGN_IN_BOX_TASK_REFUSAL,
+  signInBoxAllowsCommand,
+  signInBoxMode,
+} from "../lib/signin-box";
 import { resumeSidecarTask } from "../lib/sidecar-resume";
 import { declareAgentClisReady } from "../lib/standard-image";
 
@@ -438,6 +449,11 @@ interface PausableSource {
 }
 
 console.log(`[host-agent] starting host ${hostId}`);
+if (signInBoxMode() && sidecarMode()) {
+  console.error("[host-agent] --signin-box and --task are exclusive; refusing to start");
+  process.exit(2);
+}
+if (signInBoxMode()) console.log("[host-agent] sign-in box mode (ADR-136): no tasks, no credential at rest");
 // Self-heal the recurring silent admission gate BEFORE anything can refuse
 // work: an uninstall/update helper that died at phase "checking" (live
 // 2026-08-11 + twice 2026-08-18) left every taskUp/channelEnsure bouncing
@@ -526,9 +542,59 @@ const repushBrokeredCopies = async (kind: string): Promise<void> => {
   await getOrchestrator().refreshEngineAccountCopies(kind);
 };
 configureTokenBroker({ repush: repushBrokeredCopies });
+/**
+ * ADR-136 sign-in box start. Strip every credential a previous release or an
+ * operator left on this machine, then rebuild the workspace account LIST from
+ * parameter names and tags — never a value — before the first capability
+ * frame is built, so a replacement box does not advertise an empty list and
+ * overwrite the cloud's snapshot with it. Bounded: a store outage must not
+ * keep the box offline, only empty until the next start.
+ */
+const SIGN_IN_BOX_RECONCILE_TIMEOUT_MS = 30_000;
+async function startSignInBox(): Promise<void> {
+  const secrets = purgeLocalEngineAccountSecrets();
+  const slots = purgeDefaultEngineSlots({
+    ownerHome: process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    envFile: join(env.uaiHome, ".env.local"),
+  });
+  const purged =
+    secrets.stripped + secrets.removed + slots.files.length + slots.dirs.length + slots.envKeys.length;
+  if (purged > 0 || secrets.errors > 0) {
+    console.warn(
+      `[signin-box] purged local credentials: ${secrets.stripped} account rows stripped, ${secrets.removed} removed, ` +
+        `${slots.files.length} default-slot files, ${slots.dirs.length} stray dirs, ${slots.envKeys.length} env keys` +
+        (secrets.errors > 0 ? `, ${secrets.errors} errors` : ""),
+    );
+  }
+  let timer: NodeJS.Timeout | null = null;
+  const deadline = new Promise<"timeout">((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), SIGN_IN_BOX_RECONCILE_TIMEOUT_MS);
+    timer.unref?.();
+  });
+  try {
+    const outcome = await Promise.race([reconcileEngineAccountMetadataFromStore(), deadline]);
+    if (outcome === "timeout") {
+      console.warn("[signin-box] account metadata reconcile did not finish in time; the list fills on the next start");
+    } else if (!outcome.skipped) {
+      console.log(
+        `[signin-box] account metadata reconciled: ${outcome.imported} imported, ${outcome.removed} removed, ${outcome.errors} errors`,
+      );
+    }
+  } catch (error) {
+    console.warn(
+      `[signin-box] account metadata reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 // ADR-133: a sidecar never refreshes sign-ins (the broker Lambda does), and
 // reads the store only once it holds a lease — see leaseManager below.
-if (!sidecarMode()) {
+// ADR-136: the sign-in box imports nothing and runs no pickup — it holds no
+// copy for a refresh to update.
+if (signInBoxMode()) {
+  await startSignInBox();
+} else if (!sidecarMode()) {
   startTokenBrokerLoop();
   startCredentialStorePickup({ repush: repushBrokeredCopies });
   void reconcileStores();
@@ -621,6 +687,21 @@ const engineLoginManager = createEngineLoginManager({
   // A grok sign-in may be the first grok configuration on this host: the
   // standard image needs the CLI before its tasks can run (host 0.9.105).
   ensureStandardImage: () => ensureStandardImage(),
+  // ADR-136 sign-in box: workspace accounts only, written to the store first
+  // and never sealed here.
+  workspaceOnly: signInBoxMode(),
+  ...(signInBoxMode()
+    ? {
+        seams: {
+          addClaudeAccount: (label, token, scope) =>
+            addEngineAccountToStore("claude", label, { token }, scope),
+          addCodexAccount: (label, authJson, scope) =>
+            addCapturedConfigDirAccountToStore("codex", label, authJson, scope),
+          addGrokAccount: (label, authJson, scope) =>
+            addCapturedConfigDirAccountToStore("grok", label, authJson, scope),
+        },
+      }
+    : {}),
 });
 // ADR-117: one-shot connect (pasted key / OpenCode re-detect) over the bridge.
 const engineConnectManager = createEngineConnectManager({
@@ -628,6 +709,13 @@ const engineConnectManager = createEngineConnectManager({
   refreshEngineAccountAgents: (engine) =>
     getOrchestrator().refreshEngineAccountAgents(engine),
   ensureStandardImage: () => ensureStandardImage(),
+  workspaceOnly: signInBoxMode(),
+  ...(signInBoxMode()
+    ? {
+        addLabeledAccount: (kind, label, secret, scope) =>
+          addEngineAccountToStore(kind, label, { token: secret }, scope),
+      }
+    : {}),
 });
 if (initialRuntime.status === "ready") {
   console.log(
@@ -693,10 +781,10 @@ void connect();
 // Best-effort: a UI bind failure must not take the host service down.
 // A task machine has no operator sitting at it (ADR-133): no local UI, no
 // Mac vnode watch.
-if (!sidecarMode()) void startLocalUi();
+if (!sidecarMode() && !signInBoxMode()) void startLocalUi();
 // ADR-118 follow-up: vnode-pressure observability (macOS/apple-container
 // hosts). Logs only on band transitions; the sensor caches its sysctl read.
-if (!sidecarMode()) {
+if (!sidecarMode() && !signInBoxMode()) {
   const vnodePressureTimer = setInterval(() => void logVnodePressure(), 60_000);
   vnodePressureTimer.unref?.();
   void logVnodePressure();
@@ -1334,6 +1422,7 @@ async function connect(): Promise<void> {
     const frame = parseCloudFrame(data);
     if (!frame) return;
     if (stopping && rejectFrameDuringShutdown(socket, frame)) return;
+    if (signInBoxMode() && rejectFrameOnSignInBox(socket, frame)) return;
 
     switch (frame.kind) {
       case "pong":
@@ -3260,6 +3349,39 @@ function rejectFrameDuringShutdown(
   }
 }
 
+/**
+ * ADR-136 sign-in box: the runner behind the "Uai Cloud" row runs no task.
+ * Task commands and tunnel opens get a definite, non-retryable refusal —
+ * nothing here will ever accept them — while the managed lifecycle, engine
+ * sign-ins and account management pass through untouched.
+ */
+function rejectFrameOnSignInBox(socket: WebSocket, frame: CloudToHost): boolean {
+  switch (frame.kind) {
+    case "command":
+      if (signInBoxAllowsCommand(frame.command)) return false;
+      send(socket, {
+        kind: "result",
+        commandId: frame.commandId,
+        result: {
+          ok: false,
+          code: HostErrorCode.HostUnavailable,
+          message: SIGN_IN_BOX_TASK_REFUSAL,
+          retryable: false,
+        },
+      });
+      return true;
+    case "tunnel.open":
+      send(socket, {
+        kind: "tunnel.close",
+        tunnelId: frame.tunnelId,
+        reason: SIGN_IN_BOX_TASK_REFUSAL,
+      });
+      return true;
+    default:
+      return false;
+  }
+}
+
 function rawDataToBuffer(data: RawData): Buffer {
   if (Buffer.isBuffer(data)) return data;
   if (data instanceof ArrayBuffer) return Buffer.from(data);