@runuai/host 0.9.138 → 0.9.140

package/lib/engine-accounts.ts

@@ -352,6 +352,19 @@ function resolveExtras(
         execEnv: { [d.selectVar]: containerDir },
         configDir: { hostDir: row.configDir, containerDir },
       });
+    } else if (row.authKind === "config-dir" && isStoreHeldRow(row)) {
+      // ADR-136 sign-in box: the material lives in the store, not here. The
+      // row is listed (label, scope — what the capabilities frame carries)
+      // and never provisioned: the box runs no task.
+      out.push({
+        id: row.id,
+        kind,
+        label: row.label,
+        isDefault: false,
+        authKind: "config-dir",
+        scope,
+        execEnv: {},
+      });
     }
   }
   return out;
@@ -822,14 +835,22 @@ export interface AddAccountResult {
  * Claude accepts a `setup-token` token or an `sk-ant-…` key; Codex accepts an
  * OpenAI API key (written into an isolated `~/.codex-acct-<id>/auth.json`).
  */
-export function addEngineAccount(
+/** What a labeled account will hold once persisted — the validated shape
+ *  shared by the local writer (owned and shared hosts) and the store-only
+ *  writer (the ADR-136 sign-in box), so both refuse the same inputs with the
+ *  same words. Never logged. */
+type LabeledAccountPlan =
+  | { authKind: "env"; label: string; env: Record<string, string>; message: string }
+  | { authKind: "config-dir"; label: string; files: Record<string, string>; message: string };
+
+type PlannedAccount = { ok: false; message: string } | { ok: true; plan: LabeledAccountPlan };
+
+function planLabeledAccount(
   kind: string,
   label: string,
   creds: { apiKey?: string; token?: string },
-  seams: Partial<AccountSeams> = {},
-  scope: string = HOST_ACCOUNT_SCOPE,
-): AddAccountResult {
-  const s = withDefaults(seams);
+  scope: string,
+): PlannedAccount {
   if (!isEngineAccountScope(scope)) {
     return { ok: false, message: "The account scope is invalid." };
   }
@@ -840,72 +861,106 @@ export function addEngineAccount(
   if (/\s/.test(secret) || secret.length < 12) {
     return { ok: false, message: "That doesn't look like a token. Paste just the value." };
   }
-
-  const id = newId();
-  const now = Date.now();
-
   if (kind === "claude") {
     const envVar = secret.startsWith("sk-ant-api")
       ? "ANTHROPIC_API_KEY"
       : "CLAUDE_CODE_OAUTH_TOKEN";
-    getDb()
-      .insert(schema.engineAccounts)
-      .values({
-        id,
-        kind,
-        label: trimmedLabel,
+    return {
+      ok: true,
+      plan: {
         authKind: "env",
-        secretEnc: packSecret(JSON.stringify({ [envVar]: secret })),
-        configDir: null,
-        createdAt: now,
-        scope,
-        position: nextPosition(kind, scope),
-      })
-      .run();
-    mirrorEngineAccount(id);
-    return { ok: true, message: `Added Claude account "${trimmedLabel}".`, id };
+        label: trimmedLabel,
+        env: { [envVar]: secret },
+        message: `Added Claude account "${trimmedLabel}".`,
+      },
+    };
   }
-
   const envKeyVar = API_KEY_ENV_VARS[kind];
   if (envKeyVar) {
-    getDb()
-      .insert(schema.engineAccounts)
-      .values({
-        id,
-        kind,
-        label: trimmedLabel,
+    return {
+      ok: true,
+      plan: {
         authKind: "env",
-        secretEnc: packSecret(JSON.stringify({ [envKeyVar]: secret })),
-        configDir: null,
-        createdAt: now,
-        scope,
-        position: nextPosition(kind, scope),
-      })
-      .run();
-    mirrorEngineAccount(id);
+        label: trimmedLabel,
+        env: { [envKeyVar]: secret },
+        message: `Added ${API_KEY_ENGINE_LABELS[kind] ?? kind} account "${trimmedLabel}".`,
+      },
+    };
+  }
+  if (kind === "codex") {
     return {
       ok: true,
-      message: `Added ${API_KEY_ENGINE_LABELS[kind] ?? kind} account "${trimmedLabel}".`,
-      id,
+      plan: {
+        authKind: "config-dir",
+        label: trimmedLabel,
+        files: { "auth.json": `${JSON.stringify({ OPENAI_API_KEY: secret }, null, 2)}\n` },
+        message: `Added Codex account "${trimmedLabel}".`,
+      },
     };
   }
+  return {
+    ok: false,
+    message: `Adding a second ${kind} account isn't supported yet — connect the primary account from the Engines panel.`,
+  };
+}
 
-  if (kind === "codex") {
-    const d = KINDS.codex as KindDescriptor;
-    const hostDir = (d.extraHostDir as (o: string, i: string) => string)(
-      s.ownerHome(),
-      id,
-    );
+function planCapturedConfigDirAccount(
+  kind: "codex" | "grok",
+  label: string,
+  authJson: string,
+  scope: string,
+): PlannedAccount {
+  const engineLabel = kind === "codex" ? "Codex" : "Grok";
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  try {
+    const parsed: unknown = JSON.parse(authJson);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("not an object");
+    }
+  } catch {
+    return { ok: false, message: `The captured ${engineLabel} credential is not valid.` };
+  }
+  return {
+    ok: true,
+    plan: {
+      authKind: "config-dir",
+      label: trimmedLabel,
+      files: { "auth.json": authJson.endsWith("\n") ? authJson : `${authJson}\n` },
+      message: `Added ${engineLabel} account "${trimmedLabel}".`,
+    },
+  };
+}
+
+/** Persist a plan on THIS host — a sealed env row or an isolated config dir
+ *  under the owner's home — and mirror it to the store when one is configured. */
+function persistPlannedAccountLocally(
+  kind: string,
+  scope: string,
+  plan: LabeledAccountPlan,
+  s: AccountSeams,
+): AddAccountResult {
+  const id = newId();
+  let configDir: string | null = null;
+  if (plan.authKind === "config-dir") {
+    const d = KINDS[kind];
+    if (!d?.extraHostDir) {
+      return { ok: false, message: `${kind} has no config-dir layout.` };
+    }
+    const hostDir = d.extraHostDir(s.ownerHome(), id);
     try {
-      const file = join(hostDir, "auth.json");
       mkdirSync(hostDir, { recursive: true });
-      writeFileSync(file, `${JSON.stringify({ OPENAI_API_KEY: secret }, null, 2)}\n`, {
-        mode: 0o600,
-      });
-      try {
-        chmodSync(file, 0o600);
-      } catch {
-        /* best effort */
+      for (const [basename, content] of Object.entries(plan.files)) {
+        const file = join(hostDir, basename);
+        writeFileSync(file, content, { mode: 0o600 });
+        try {
+          chmodSync(file, 0o600);
+        } catch {
+          /* best effort */
+        }
       }
     } catch (err) {
       return {
@@ -915,28 +970,36 @@ export function addEngineAccount(
         }`,
       };
     }
-    getDb()
-      .insert(schema.engineAccounts)
-      .values({
-        id,
-        kind,
-        label: trimmedLabel,
-        authKind: "config-dir",
-        secretEnc: null,
-        configDir: hostDir,
-        createdAt: now,
-        scope,
-        position: nextPosition(kind, scope),
-      })
-      .run();
-    mirrorEngineAccount(id);
-    return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
+    configDir = hostDir;
   }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind,
+      label: plan.label,
+      authKind: plan.authKind,
+      secretEnc: plan.authKind === "env" ? packSecret(JSON.stringify(plan.env)) : null,
+      configDir,
+      createdAt: Date.now(),
+      scope,
+      position: nextPosition(kind, scope),
+    })
+    .run();
+  mirrorEngineAccount(id);
+  return { ok: true, message: plan.message, id };
+}
 
-  return {
-    ok: false,
-    message: `Adding a second ${kind} account isn't supported yet — connect the primary account from the Engines panel.`,
-  };
+export function addEngineAccount(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
+): AddAccountResult {
+  const planned = planLabeledAccount(kind, label, creds, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountLocally(kind, scope, planned.plan, withDefaults(seams));
 }
 
 /**
@@ -972,63 +1035,9 @@ function addConfigDirAccountFromAuthJson(
   seams: Partial<AccountSeams>,
   scope: string,
 ): AddAccountResult {
-  const engineLabel = kind === "codex" ? "Codex" : "Grok";
-  if (!isEngineAccountScope(scope)) {
-    return { ok: false, message: "The account scope is invalid." };
-  }
-  const s = withDefaults(seams);
-  const trimmedLabel = label.trim();
-  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
-  try {
-    const parsed: unknown = JSON.parse(authJson);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("not an object");
-    }
-  } catch {
-    return { ok: false, message: `The captured ${engineLabel} credential is not valid.` };
-  }
-
-  const id = newId();
-  const d = KINDS[kind] as KindDescriptor;
-  const hostDir = (d.extraHostDir as (o: string, i: string) => string)(
-    s.ownerHome(),
-    id,
-  );
-  try {
-    const file = join(hostDir, "auth.json");
-    mkdirSync(hostDir, { recursive: true });
-    writeFileSync(file, authJson.endsWith("\n") ? authJson : `${authJson}\n`, {
-      mode: 0o600,
-    });
-    try {
-      chmodSync(file, 0o600);
-    } catch {
-      /* best effort */
-    }
-  } catch (err) {
-    return {
-      ok: false,
-      message: `Could not write the account config: ${
-        err instanceof Error ? err.message : String(err)
-      }`,
-    };
-  }
-  getDb()
-    .insert(schema.engineAccounts)
-    .values({
-      id,
-      kind,
-      label: trimmedLabel,
-      authKind: "config-dir",
-      secretEnc: null,
-      configDir: hostDir,
-      createdAt: Date.now(),
-      scope,
-      position: nextPosition(kind, scope),
-    })
-    .run();
-  mirrorEngineAccount(id);
-  return { ok: true, message: `Added ${engineLabel} account "${trimmedLabel}".`, id };
+  const planned = planCapturedConfigDirAccount(kind, label, authJson, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountLocally(kind, scope, planned.plan, withDefaults(seams));
 }
 
 /** Remove an EXTRA account (idempotent). The synthesized default can't be
@@ -1346,6 +1355,11 @@ function setStoreRef(id: string, storeRef: string): void {
 }
 
 async function putRow(store: CredentialStore, row: StoreRow, hostId: string | null): Promise<boolean> {
+  if (isStoreHeldRow(row)) {
+    // ADR-136: nothing here to mirror — an empty env put would overwrite the
+    // only copy of the credential.
+    throw new Error(`account ${row.id} is store-held; this runner holds no material to mirror`);
+  }
   const name = engineAccountParameterName(row, hostId);
   if (!name) {
     if (!warnedNoHostId) {
@@ -1368,6 +1382,13 @@ export function mirrorEngineAccount(id: string): void {
   queueStoreWrite(`mirror ${id}`, async (store) => {
     const row = selectRow(id);
     if (!row) return;
+    if (isStoreHeldRow(row)) {
+      // ADR-136 sign-in box: a rename or reorder rides as metadata tags —
+      // the secret is not here to re-put, and tags are what a replacement
+      // box reads back.
+      await store.tag(row.storeRef!, engineAccountMetadataTags(row));
+      return;
+    }
     await putRow(store, row, storeHostId);
   });
 }
@@ -1565,4 +1586,288 @@ export function applyStoredEngineAccount(
     throw new Error("stored auth kind does not match the local row");
   }
   return { kind: stored.kind, id: stored.id, imported: false };
-}
+}
+
+// ---------------------------------------------------------------------------
+// Store-only accounts (ADR-136 sign-in box, docs/shared-host-retirement.md).
+//
+// The small always-on machine behind the "Uai Cloud" row writes every capture
+// STRAIGHT into the credential store and keeps only a metadata row — id, kind,
+// label, scope, position, store_ref — with no sealed secret and no config dir.
+// Its store identity is write-only (put, tag, delete, describe names; never
+// get, never decrypt), so a compromised box can break sign-ins but cannot read
+// one. Labels therefore also ride as parameter TAGS, which
+// `ssm:ListTagsForResource` returns without a KMS grant: a replacement box
+// rebuilds its list from names + tags alone (`reconcileEngineAccountMetadataFromStore`).
+// ---------------------------------------------------------------------------
+
+export const ACCOUNT_LABEL_TAG = "uai_label_b64";
+export const ACCOUNT_POSITION_TAG = "uai_position";
+export const ACCOUNT_CREATED_AT_TAG = "uai_created_at";
+export const ACCOUNT_AUTH_KIND_TAG = "uai_auth_kind";
+/** SSM tag values: 256 chars of `[A-Za-z0-9_.:/=+@ -]`; base64url fits. */
+const MAX_TAG_VALUE_CHARS = 256;
+
+/** A row whose material lives ONLY in the store: a store_ref and no secret. */
+export function isStoreHeldRow(row: {
+  authKind: string;
+  secretEnc: string | null;
+  configDir: string | null;
+  storeRef?: string | null;
+}): boolean {
+  if (!row.storeRef) return false;
+  return row.authKind === "env" ? row.secretEnc === null : row.configDir === null;
+}
+
+/** The secret-free metadata a parameter carries as tags. The label is
+ *  base64url so any label character survives SSM's tag charset; a label too
+ *  long to fit is shortened (the store value keeps the full one). */
+export function engineAccountMetadataTags(row: {
+  label: string;
+  authKind: string;
+  position?: number | null;
+  createdAt: number;
+}): Record<string, string> {
+  let label = row.label;
+  let encoded = Buffer.from(label, "utf8").toString("base64url");
+  while (encoded.length > MAX_TAG_VALUE_CHARS && label.length > 1) {
+    label = label.slice(0, -1);
+    encoded = Buffer.from(label, "utf8").toString("base64url");
+  }
+  return {
+    [ACCOUNT_LABEL_TAG]: encoded,
+    [ACCOUNT_POSITION_TAG]: String(row.position ?? 0),
+    [ACCOUNT_CREATED_AT_TAG]: String(row.createdAt),
+    [ACCOUNT_AUTH_KIND_TAG]: row.authKind,
+  };
+}
+
+function derivedAccountLabel(kind: string, id: string): string {
+  const engine = kind.charAt(0).toUpperCase() + kind.slice(1);
+  return `${engine} ${id.slice(-6)}`;
+}
+
+function labelFromTags(tags: Record<string, string>, kind: string, id: string): string {
+  const encoded = tags[ACCOUNT_LABEL_TAG];
+  if (encoded) {
+    try {
+      const label = Buffer.from(encoded, "base64url").toString("utf8").trim();
+      if (isEngineAccountLabel(label)) return label;
+    } catch {
+      /* fall through */
+    }
+  }
+  return derivedAccountLabel(kind, id);
+}
+
+async function persistPlannedAccountToStore(
+  kind: string,
+  scope: string,
+  plan: LabeledAccountPlan,
+): Promise<AddAccountResult> {
+  const store = configuredCredentialStore();
+  if (!store) {
+    return { ok: false, message: "This runner has no credential store to hold the account." };
+  }
+  if (scope === HOST_ACCOUNT_SCOPE) {
+    return { ok: false, message: "Store-only accounts belong to a workspace, not the runner." };
+  }
+  const id = newId();
+  const now = Date.now();
+  const position = nextPosition(kind, scope);
+  const row = { id, kind, label: plan.label, authKind: plan.authKind, scope, position, createdAt: now };
+  const name = engineAccountParameterName(row);
+  if (!name) {
+    return { ok: false, message: "Store-only accounts belong to a workspace, not the runner." };
+  }
+  const stored: StoredEngineAccount = {
+    v: 1,
+    ...row,
+    ...(plan.authKind === "env" ? { env: plan.env } : { files: plan.files }),
+  };
+  try {
+    await store.put(name, JSON.stringify(stored));
+  } catch (err) {
+    console.warn(
+      `[engine-accounts] store-only ${kind}/${id}: put failed (${err instanceof Error ? err.message : String(err)})`,
+    );
+    return {
+      ok: false,
+      message: "The credential store refused the write; nothing was kept on this runner.",
+    };
+  }
+  try {
+    await store.tag(name, engineAccountMetadataTags(row));
+  } catch (err) {
+    console.warn(
+      `[engine-accounts] store-only ${kind}/${id}: tagging failed (${err instanceof Error ? err.message : String(err)}) — a replacement sign-in box lists it as "${derivedAccountLabel(kind, id)}"`,
+    );
+  }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind,
+      label: plan.label,
+      authKind: plan.authKind,
+      secretEnc: null,
+      configDir: null,
+      createdAt: now,
+      scope,
+      position,
+      storeRef: name,
+    })
+    .run();
+  return { ok: true, message: plan.message, id };
+}
+
+/** `addEngineAccount` for the sign-in box: the same validation, the store
+ *  written FIRST and awaited, then a metadata-only row. A store failure is the
+ *  caller's failure and leaves nothing behind. */
+export async function addEngineAccountToStore(
+  kind: string,
+  label: string,
+  creds: { apiKey?: string; token?: string },
+  scope: string,
+): Promise<AddAccountResult> {
+  const planned = planLabeledAccount(kind, label, creds, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountToStore(kind, scope, planned.plan);
+}
+
+/** `addCodexAccountFromAuthJson` / `addGrokAccountFromAuthJson` for the
+ *  sign-in box: the captured auth.json goes to the store, never to a dir. */
+export async function addCapturedConfigDirAccountToStore(
+  kind: "codex" | "grok",
+  label: string,
+  authJson: string,
+  scope: string,
+): Promise<AddAccountResult> {
+  const planned = planCapturedConfigDirAccount(kind, label, authJson, scope);
+  if (!planned.ok) return planned;
+  return persistPlannedAccountToStore(kind, scope, planned.plan);
+}
+
+export interface PurgeLocalEngineAccountSecretsResult {
+  /** Workspace rows whose sealed secret or config dir was removed. */
+  stripped: number;
+  /** Rows deleted outright: host-scope accounts and rows never mirrored. */
+  removed: number;
+  errors: number;
+}
+
+/**
+ * Sign-in box start: nothing the previous release (or an operator) left on
+ * this machine may hold a credential. Workspace rows keep their metadata and
+ * lose their material; host-scope rows and rows the store never received are
+ * deleted — the box holds workspace accounts only, and a secret with no copy
+ * in the store still may not live here.
+ */
+export function purgeLocalEngineAccountSecrets(): PurgeLocalEngineAccountSecretsResult {
+  const result: PurgeLocalEngineAccountSecretsResult = { stripped: 0, removed: 0, errors: 0 };
+  const rows = getDb().select().from(schema.engineAccounts).all() as StoreRow[];
+  for (const row of rows) {
+    const scope = row.scope ?? HOST_ACCOUNT_SCOPE;
+    if (scope === HOST_ACCOUNT_SCOPE || !row.storeRef) {
+      removeLocalAccountRow(row);
+      result.removed++;
+      continue;
+    }
+    if (isStoreHeldRow(row)) continue;
+    if (row.configDir) {
+      try {
+        rmSync(row.configDir, { recursive: true, force: true });
+      } catch {
+        result.errors++;
+      }
+    }
+    getDb()
+      .update(schema.engineAccounts)
+      .set({ secretEnc: null, configDir: null })
+      .where(eq(schema.engineAccounts.id, row.id))
+      .run();
+    result.stripped++;
+  }
+  return result;
+}
+
+export interface ReconcileEngineAccountMetadataResult {
+  skipped: boolean;
+  imported: number;
+  removed: number;
+  errors: number;
+}
+
+/**
+ * Sign-in box start: make the metadata rows agree with the store WITHOUT
+ * reading a value. Names come from `describe-parameters` (allowed on `*`),
+ * labels and order from each new parameter's tags. A workspace parameter this
+ * box lacks becomes a metadata row; a row whose parameter is gone is dropped;
+ * host-scope rows are dropped (the box has none). A failed listing touches
+ * nothing.
+ */
+export async function reconcileEngineAccountMetadataFromStore(): Promise<ReconcileEngineAccountMetadataResult> {
+  const result: ReconcileEngineAccountMetadataResult = { skipped: false, imported: 0, removed: 0, errors: 0 };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  const warn = (line: string): void => console.warn(`[engine-accounts] metadata reconcile: ${line}`);
+  let names: string[];
+  try {
+    names = await store.describeNames(`${prefix}/orgs`);
+  } catch (err) {
+    warn(`listing ${prefix}/orgs failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { ...result, errors: 1 };
+  }
+  const rows = getDb().select().from(schema.engineAccounts).all() as StoreRow[];
+  const byRef = new Set(rows.map((r) => r.storeRef).filter((ref): ref is string => Boolean(ref)));
+  const seen = new Set<string>();
+  for (const name of names) {
+    const at = parseEngineAccountParameterName(name, prefix);
+    if (!at || at.scope === HOST_ACCOUNT_SCOPE) continue;
+    seen.add(name);
+    if (byRef.has(name)) continue;
+    let tags: Record<string, string> = {};
+    try {
+      tags = await store.listTags(name);
+    } catch (err) {
+      result.errors++;
+      warn(`tags of ${name} unreadable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const taggedAuthKind = tags[ACCOUNT_AUTH_KIND_TAG];
+    const authKind: AccountAuthKind =
+      taggedAuthKind === "env" || taggedAuthKind === "config-dir"
+        ? taggedAuthKind
+        : (KINDS[at.kind]?.authKind ?? "env");
+    const position = Number.parseInt(tags[ACCOUNT_POSITION_TAG] ?? "", 10);
+    const createdAt = Number.parseInt(tags[ACCOUNT_CREATED_AT_TAG] ?? "", 10);
+    try {
+      getDb()
+        .insert(schema.engineAccounts)
+        .values({
+          id: at.id,
+          kind: at.kind,
+          label: labelFromTags(tags, at.kind, at.id),
+          authKind,
+          secretEnc: null,
+          configDir: null,
+          scope: at.scope,
+          position: Number.isFinite(position) ? position : 0,
+          storeRef: name,
+          createdAt: Number.isFinite(createdAt) ? createdAt : Date.now(),
+        })
+        .run();
+      result.imported++;
+    } catch (err) {
+      result.errors++;
+      warn(`importing ${name} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  for (const row of rows) {
+    const scope = row.scope ?? HOST_ACCOUNT_SCOPE;
+    if (scope !== HOST_ACCOUNT_SCOPE && row.storeRef && seen.has(row.storeRef)) continue;
+    removeLocalAccountRow(row);
+    result.removed++;
+  }
+  return result;
+}