@runuai/host 0.9.138 → 0.9.140

package/lib/browser-testing.ts

@@ -734,7 +734,12 @@ function runCodex(home, args) {
     encoding: "utf8",
     env: Object.assign({}, process.env, { CODEX_HOME: home }),
     maxBuffer: 1024 * 1024,
-    timeout: 5000,
+    // Codex's FIRST run on a fresh machine initialises its state (sqlite)
+    // before answering; 5 s timed out on every hostless task machine
+    // (smoke 10, 2026-09-10: ETIMEDOUT for both homes) and the direct
+    // config.toml fallback did the work with an error in the log. A minute
+    // is generous for a probe that normally answers in well under a second.
+    timeout: 60000,
     killSignal: "SIGKILL",
   });
 }

package/lib/credential-store.ts

@@ -61,6 +61,13 @@ export interface CredentialStore {
    *  with Overwrite cannot carry tags). Throws on failure — including when
    *  the identity lacks `ssm:AddTagsToResource`, which older host policies do. */
   tag(name: string, tags: Record<string, string>): Promise<void>;
+  /** The tags on one parameter. Metadata only: `ssm:ListTagsForResource`
+   *  reveals no value and needs no KMS grant — the sign-in box (ADR-136)
+   *  rebuilds an account's label from here without ever reading the secret. */
+  listTags(name: string): Promise<Record<string, string>>;
+  /** Every parameter NAME under `path` (recursive), no values — the
+   *  `describe-parameters` listing that is allowed on `*` and never decrypts. */
+  describeNames(path: string): Promise<string[]>;
   /** Names and versions under `path` (recursive), NO decryption — the cheap
    *  poll a Uai-operated host runs to notice a broker refresh. */
   listVersions(path: string): Promise<Array<{ name: string; version: number }>>;
@@ -284,7 +291,7 @@ export class AwsSsmCredentialStore implements CredentialStore {
     return out;
   }
 
-  async listByName(path: string): Promise<StoredParameter[]> {
+  async describeNames(path: string): Promise<string[]> {
     if (!isParameterName(path)) throw new Error(`invalid parameter path: ${path}`);
     const described = await this.run([
       "ssm",
@@ -296,9 +303,34 @@ export class AwsSsmCredentialStore implements CredentialStore {
     ]);
     if (described.status !== 0) throw failure("describe-parameters", described);
     const parsed: unknown = JSON.parse(described.stdout || "[]");
-    const names = (Array.isArray(parsed) ? parsed : []).filter(
+    return (Array.isArray(parsed) ? parsed : []).filter(
       (name): name is string => typeof name === "string" && name.startsWith(`${path}/`),
     );
+  }
+
+  async listTags(name: string): Promise<Record<string, string>> {
+    if (!isParameterName(name)) throw new Error(`invalid parameter name: ${name}`);
+    const result = await this.run([
+      "ssm",
+      "list-tags-for-resource",
+      "--resource-type",
+      "Parameter",
+      "--resource-id",
+      name,
+    ]);
+    if (result.status !== 0) throw failure("list-tags-for-resource", result);
+    const parsed = JSON.parse(result.stdout || "{}") as {
+      TagList?: Array<{ Key?: unknown; Value?: unknown }> | null;
+    };
+    const out: Record<string, string> = {};
+    for (const tag of parsed.TagList ?? []) {
+      if (typeof tag.Key === "string" && typeof tag.Value === "string") out[tag.Key] = tag.Value;
+    }
+    return out;
+  }
+
+  async listByName(path: string): Promise<StoredParameter[]> {
+    const names = await this.describeNames(path);
     const out: StoredParameter[] = [];
     for (const name of names) {
       const result = await this.run(["ssm", "get-parameter", "--name", name, "--with-decryption"]);