@runuai/host 0.9.138 → 0.9.140

package/lib/ssh.ts

@@ -23,10 +23,11 @@ import { join, resolve } from "node:path";
 
 import { eq } from "drizzle-orm";
 
-import { queueStoreWrite, userParameterName } from "./credential-store";
+import { configuredCredentialStore, queueStoreWrite, userParameterName } from "./credential-store";
 import { getDb, schema } from "./db";
 import { env } from "./env";
 import { sealAesGcm, openAesGcm } from "./secrets";
+import { signInBoxMode } from "./signin-box";
 import { assertSafeHostTaskId } from "./task-identity";
 
 const withNewline = (s: string): string => (s.endsWith("\n") ? s : `${s}\n`);
@@ -137,14 +138,15 @@ export function sshKeyParameterName(userId: string): string {
   return userParameterName(userId, "ssh");
 }
 
-/** The row as it is mirrored (private key decrypted). Never logged. */
+/** The row as it is mirrored (private key decrypted). Never logged. Null
+ *  for a store-held row (sign-in box): nothing here to mirror. */
 export function sshKeyStoreValue(userId: string): StoredSshKey | null {
   const row = getDb()
     .select()
     .from(schema.sshKeys)
     .where(eq(schema.sshKeys.userId, userId))
     .get();
-  if (!row) return null;
+  if (!row || isStoreHeldSshRow(row)) return null;
   return {
     v: 1,
     kind: "ssh",
@@ -175,6 +177,8 @@ export function listSshKeyStoreRows(): Array<{ userId: string; storeRef: string
 }
 
 export function mirrorSshKeyToStore(userId: string): void {
+  // ADR-136 sign-in box: rows hold no material; the store was written first.
+  if (signInBoxMode()) return;
   queueStoreWrite(`mirror ssh key ${userId}`, async (store) => {
     const value = sshKeyStoreValue(userId);
     if (!value) return;
@@ -203,14 +207,15 @@ export function importSshKeyFromStore(value: StoredSshKey, storeRef: string): bo
   return result.changes > 0;
 }
 
-/** Decrypt + return the user's private key, or null if they have none. */
+/** Decrypt + return the user's private key, or null if they have none (or
+ *  the row is store-held — the sign-in box never holds one). */
 export function privateKeyForUser(userId: string): string | null {
   const row = getDb()
     .select()
     .from(schema.sshKeys)
     .where(eq(schema.sshKeys.userId, userId))
     .get();
-  if (!row) return null;
+  if (!row || isStoreHeldSshRow(row)) return null;
   return openAesGcm(
     Buffer.from(row.privateKeyCt as Uint8Array),
     Buffer.from(row.privateKeyNonce as Uint8Array),
@@ -226,7 +231,7 @@ export function keyPairForUser(
     .from(schema.sshKeys)
     .where(eq(schema.sshKeys.userId, userId))
     .get();
-  if (!row) return null;
+  if (!row || isStoreHeldSshRow(row)) return null;
   return {
     privateKey: openAesGcm(
       Buffer.from(row.privateKeyCt as Uint8Array),
@@ -236,6 +241,104 @@ export function keyPairForUser(
   };
 }
 
+// ---------------------------------------------------------------------------
+// ADR-136 sign-in box: a key row here holds NO private key (`private_key_ct`
+// empty — "store-held"); the keypair goes to the store first and only the
+// public half stays, which is all the box ever answers (`ssh.key.get`). The
+// public key also rides as a tag so a replacement box lists it without
+// reading the value.
+// ---------------------------------------------------------------------------
+
+export const SSH_KEY_TAGS = { publicKey: "uai_public_key", createdAt: "uai_created_at" } as const;
+
+export function isStoreHeldSshRow(row: { privateKeyCt: unknown }): boolean {
+  const ct = row.privateKeyCt;
+  if (ct === null || ct === undefined) return true;
+  if (ct instanceof Uint8Array) return ct.byteLength === 0;
+  return false;
+}
+
+export function sshKeyMetadataTags(value: { publicKey: string; createdAt: number }): Record<string, string> {
+  return {
+    [SSH_KEY_TAGS.publicKey]: value.publicKey,
+    [SSH_KEY_TAGS.createdAt]: String(value.createdAt),
+  };
+}
+
+/** A key row with no private half (sign-in box). Existing rows win. */
+export function insertStoreHeldSshKeyRow(args: {
+  userId: string;
+  publicKey: string;
+  createdAt: number;
+  updatedAt: number;
+  storeRef: string;
+}): boolean {
+  const result = getDb()
+    .insert(schema.sshKeys)
+    .values({
+      userId: args.userId,
+      publicKey: args.publicKey,
+      privateKeyCt: Buffer.alloc(0),
+      privateKeyNonce: Buffer.alloc(0),
+      createdAt: args.createdAt,
+      updatedAt: args.updatedAt,
+      storeRef: args.storeRef,
+    })
+    .onConflictDoNothing({ target: schema.sshKeys.userId })
+    .run();
+  return result.changes > 0;
+}
+
+/** Delete the row only (no store call). */
+export function deleteSshKeyRowLocal(userId: string): void {
+  getDb().delete(schema.sshKeys).where(eq(schema.sshKeys.userId, userId)).run();
+}
+
+/**
+ * `ensureKeyForUser` for the sign-in box: generate, write the keypair to the
+ * store FIRST (awaited — a refused put is the operation's failure and leaves
+ * nothing), tag the public key, then keep a store-held row. A row whose
+ * public key this box could not learn (a legacy parameter it may not read)
+ * is refused rather than silently regenerated over the user's real key.
+ */
+export async function ensureSshKeyStoreFirst(userId: string): Promise<string> {
+  const existing = getDb()
+    .select({ publicKey: schema.sshKeys.publicKey })
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  if (existing) {
+    if (existing.publicKey) return existing.publicKey;
+    throw new Error(
+      "this user's SSH key exists in the credential store but its public half is not tagged yet; re-run the sign-in box bootstrap with the transitional read",
+    );
+  }
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold the key");
+  const { publicKey, privateKey } = generateEd25519(`uai-${userId}`);
+  const now = Date.now();
+  const name = sshKeyParameterName(userId);
+  const value: StoredSshKey = {
+    v: 1,
+    kind: "ssh",
+    userId,
+    publicKey,
+    privateKey,
+    createdAt: now,
+    updatedAt: now,
+  };
+  await store.put(name, JSON.stringify(value));
+  try {
+    await store.tag(name, sshKeyMetadataTags(value));
+  } catch (err) {
+    console.warn(
+      `[ssh] user ${userId}: tagging ${name} failed (${err instanceof Error ? err.message : String(err)}) — a replacement box needs the transitional read to list this key`,
+    );
+  }
+  insertStoreHeldSshKeyRow({ userId, publicKey, createdAt: now, updatedAt: now, storeRef: name });
+  return getPublicKey(userId) ?? publicKey;
+}
+
 // --- per-task on-disk identity (optional SSH fallback + signing, ADR-029) -----
 //
 // task-up.sh uses the creator's key for host Git only when GitHub is not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.138",
+  "version": "0.9.140",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cli.ts

@@ -204,6 +204,10 @@ async function cmdRun(rest: string[] = []): Promise<void> {
   // (lib/sidecar.ts) — set before main.ts loads, since its boot reads it.
   const sidecarTask = flagValue(rest, "--task");
   if (sidecarTask) process.env.UAI_SIDECAR_TASK = sidecarTask;
+  // ADR-136 sign-in box: `uai-host run --signin-box` on the small always-on
+  // machine behind the "Uai Cloud" row. Same package, one flag
+  // (lib/signin-box.ts); set before main.ts loads for the same reason.
+  if (rest.includes("--signin-box")) process.env.UAI_SIGNIN_BOX = "1";
   // Timestamped service logs: the ADR-106 live smoke burned an hour dating
   // undated scrollback. Applies to the service process only, not one-shot CLI
   // commands.
@@ -1581,12 +1585,21 @@ async function cmdSetup(rest: string[]): Promise<void> {
     process.exitCode = 1;
     return;
   }
+  // ADR-136 step 4: a replace-machine enrollment answers with the EXISTING
+  // row's id — this machine adopts it instead of its own proposal, so the
+  // runner keeps its identity (and every task created against it).
+  const outcome =
+    success && typeof success === "object" && !Array.isArray(success)
+      ? (success as Record<string, unknown>)
+      : null;
+  const replacedHostId =
+    outcome?.replaced === true && typeof outcome.hostId === "string" && outcome.hostId.length > 0
+      ? outcome.hostId
+      : null;
   if (
-    !success ||
-    typeof success !== "object" ||
-    Array.isArray(success) ||
-    (success as Record<string, unknown>).ok !== true ||
-    (success as Record<string, unknown>).hostId !== pending.hostId
+    !outcome ||
+    outcome.ok !== true ||
+    (replacedHostId === null && outcome.hostId !== pending.hostId)
   ) {
     console.error(red("enrollment outcome did not match the proposed host identity"));
     console.error(dim("the proposed identity is saved locally; retry this exact command."));
@@ -1610,7 +1623,27 @@ async function cmdSetup(rest: string[]): Promise<void> {
     process.exitCode = 1;
     return;
   }
-  console.log(green("✓ enrolled") + dim(` — config written to ${envLocalPath()}`));
+  if (replacedHostId !== null) {
+    // The pending commit wrote the proposed id; the row this machine now
+    // answers as is the replaced one. Same secret, so the bridge admits it.
+    try {
+      writeEnvValuesAtomic(envLocalPath(), { UAI_HOST_ID: replacedHostId });
+    } catch (err) {
+      console.error(
+        red(
+          `replaced, but could not record the runner id in ${envLocalPath()}: ${err instanceof Error ? err.message : String(err)}`,
+        ),
+      );
+      console.error(dim(`set UAI_HOST_ID=${replacedHostId} there by hand before starting.`));
+      process.exitCode = 1;
+      return;
+    }
+    console.log(
+      green("✓ replaced") + dim(` — this machine now answers as runner ${replacedHostId}; config written to ${envLocalPath()}`),
+    );
+  } else {
+    console.log(green("✓ enrolled") + dim(` — config written to ${envLocalPath()}`));
+  }
   printTelemetryNotice();
   console.log("");
   console.log("Start the host:");

package/src/main.ts

@@ -10,6 +10,7 @@ import {
   type OutgoingHttpHeaders,
 } from "node:http";
 import { Socket } from "node:net";
+import { homedir } from "node:os";
 import { join } from "node:path";
 
 import WebSocket, { type RawData } from "ws";
@@ -159,9 +160,13 @@ import {
   type HostConfigResult,
 } from "../lib/host-config";
 import {
+  addCapturedConfigDirAccountToStore,
+  addEngineAccountToStore,
   configureEngineAccountStore,
   hasStoredEngineAccounts,
   listEngineAccountsAllScopes,
+  purgeLocalEngineAccountSecrets,
+  reconcileEngineAccountMetadataFromStore,
   reconcileEngineAccountsFromStore,
 } from "../lib/engine-accounts";
 import {
@@ -253,6 +258,21 @@ import {
 import { isEnvironmentTransportProvider } from "../lib/task-environment/types";
 import { LeaseManager } from "../lib/lease";
 import { markSidecarReady, sidecarMode, sidecarTaskId } from "../lib/sidecar";
+import {
+  purgeDefaultEngineSlots,
+  SIGN_IN_BOX_TASK_REFUSAL,
+  signInBoxAllowsCommand,
+  signInBoxMode,
+} from "../lib/signin-box";
+import {
+  deleteProjectEnvStoreOnly,
+  listProjectEnvKeysStoreOnly,
+  purgeLocalUserCredentialSecrets,
+  reconcileUserCredentialMetadataFromStore,
+  setProjectEnvStoreOnly,
+} from "../lib/signin-box-credentials";
+import { loadGithubTokenIntoCache } from "../lib/github-tokens";
+import { ensureSshKeyStoreFirst } from "../lib/ssh";
 import { resumeSidecarTask } from "../lib/sidecar-resume";
 import { declareAgentClisReady } from "../lib/standard-image";
 
@@ -438,6 +458,11 @@ interface PausableSource {
 }
 
 console.log(`[host-agent] starting host ${hostId}`);
+if (signInBoxMode() && sidecarMode()) {
+  console.error("[host-agent] --signin-box and --task are exclusive; refusing to start");
+  process.exit(2);
+}
+if (signInBoxMode()) console.log("[host-agent] sign-in box mode (ADR-136): no tasks, no credential at rest");
 // Self-heal the recurring silent admission gate BEFORE anything can refuse
 // work: an uninstall/update helper that died at phase "checking" (live
 // 2026-08-11 + twice 2026-08-18) left every taskUp/channelEnsure bouncing
@@ -526,9 +551,83 @@ const repushBrokeredCopies = async (kind: string): Promise<void> => {
   await getOrchestrator().refreshEngineAccountCopies(kind);
 };
 configureTokenBroker({ repush: repushBrokeredCopies });
+/**
+ * ADR-136 sign-in box start. Strip every credential a previous release or an
+ * operator left on this machine, then rebuild the workspace account LIST from
+ * parameter names and tags — never a value — before the first capability
+ * frame is built, so a replacement box does not advertise an empty list and
+ * overwrite the cloud's snapshot with it. Bounded: a store outage must not
+ * keep the box offline, only empty until the next start.
+ */
+const SIGN_IN_BOX_RECONCILE_TIMEOUT_MS = 30_000;
+async function startSignInBox(): Promise<void> {
+  const secrets = purgeLocalEngineAccountSecrets();
+  const slots = purgeDefaultEngineSlots({
+    ownerHome: process.env.UAI_OWNER_HOME?.trim() || homedir(),
+    envFile: join(env.uaiHome, ".env.local"),
+  });
+  const users = purgeLocalUserCredentialSecrets();
+  const purged =
+    secrets.stripped +
+    secrets.removed +
+    slots.files.length +
+    slots.dirs.length +
+    slots.envKeys.length +
+    users.githubStripped +
+    users.sshStripped +
+    users.mcpStripped +
+    users.projectEnvRemoved +
+    users.unmirroredRemoved;
+  if (purged > 0 || secrets.errors > 0) {
+    console.warn(
+      `[signin-box] purged local credentials: ${secrets.stripped} account rows stripped, ${secrets.removed} removed, ` +
+        `${slots.files.length} default-slot files, ${slots.dirs.length} stray dirs, ${slots.envKeys.length} env keys, ` +
+        `${users.githubStripped} github, ${users.sshStripped} ssh, ${users.mcpStripped} mcp rows stripped, ` +
+        `${users.projectEnvRemoved} project env rows and ${users.unmirroredRemoved} unmirrored rows removed` +
+        (secrets.errors > 0 ? `, ${secrets.errors} errors` : ""),
+    );
+  }
+  let timer: NodeJS.Timeout | null = null;
+  const deadline = new Promise<"timeout">((resolve) => {
+    timer = setTimeout(() => resolve("timeout"), SIGN_IN_BOX_RECONCILE_TIMEOUT_MS);
+    timer.unref?.();
+  });
+  try {
+    const outcome = await Promise.race([
+      Promise.all([reconcileEngineAccountMetadataFromStore(), reconcileUserCredentialMetadataFromStore()]),
+      deadline,
+    ]);
+    if (outcome === "timeout") {
+      console.warn("[signin-box] metadata reconcile did not finish in time; the lists fill on the next start");
+    } else {
+      const [accounts, users] = outcome;
+      if (!accounts.skipped) {
+        console.log(
+          `[signin-box] account metadata reconciled: ${accounts.imported} imported, ${accounts.removed} removed, ${accounts.errors} errors`,
+        );
+      }
+      if (!users.skipped) {
+        console.log(
+          `[signin-box] user credential metadata reconciled: ${users.imported} imported, ${users.removed} removed, ` +
+            `${users.tagged} legacy parameters tagged, ${users.unreadable} unreadable, ${users.errors} errors`,
+        );
+      }
+    }
+  } catch (error) {
+    console.warn(
+      `[signin-box] account metadata reconcile failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 // ADR-133: a sidecar never refreshes sign-ins (the broker Lambda does), and
 // reads the store only once it holds a lease — see leaseManager below.
-if (!sidecarMode()) {
+// ADR-136: the sign-in box imports nothing and runs no pickup — it holds no
+// copy for a refresh to update.
+if (signInBoxMode()) {
+  await startSignInBox();
+} else if (!sidecarMode()) {
   startTokenBrokerLoop();
   startCredentialStorePickup({ repush: repushBrokeredCopies });
   void reconcileStores();
@@ -621,6 +720,21 @@ const engineLoginManager = createEngineLoginManager({
   // A grok sign-in may be the first grok configuration on this host: the
   // standard image needs the CLI before its tasks can run (host 0.9.105).
   ensureStandardImage: () => ensureStandardImage(),
+  // ADR-136 sign-in box: workspace accounts only, written to the store first
+  // and never sealed here.
+  workspaceOnly: signInBoxMode(),
+  ...(signInBoxMode()
+    ? {
+        seams: {
+          addClaudeAccount: (label, token, scope) =>
+            addEngineAccountToStore("claude", label, { token }, scope),
+          addCodexAccount: (label, authJson, scope) =>
+            addCapturedConfigDirAccountToStore("codex", label, authJson, scope),
+          addGrokAccount: (label, authJson, scope) =>
+            addCapturedConfigDirAccountToStore("grok", label, authJson, scope),
+        },
+      }
+    : {}),
 });
 // ADR-117: one-shot connect (pasted key / OpenCode re-detect) over the bridge.
 const engineConnectManager = createEngineConnectManager({
@@ -628,6 +742,13 @@ const engineConnectManager = createEngineConnectManager({
   refreshEngineAccountAgents: (engine) =>
     getOrchestrator().refreshEngineAccountAgents(engine),
   ensureStandardImage: () => ensureStandardImage(),
+  workspaceOnly: signInBoxMode(),
+  ...(signInBoxMode()
+    ? {
+        addLabeledAccount: (kind, label, secret, scope) =>
+          addEngineAccountToStore(kind, label, { token: secret }, scope),
+      }
+    : {}),
 });
 if (initialRuntime.status === "ready") {
   console.log(
@@ -693,10 +814,10 @@ void connect();
 // Best-effort: a UI bind failure must not take the host service down.
 // A task machine has no operator sitting at it (ADR-133): no local UI, no
 // Mac vnode watch.
-if (!sidecarMode()) void startLocalUi();
+if (!sidecarMode() && !signInBoxMode()) void startLocalUi();
 // ADR-118 follow-up: vnode-pressure observability (macOS/apple-container
 // hosts). Logs only on band transitions; the sensor caches its sysctl read.
-if (!sidecarMode()) {
+if (!sidecarMode() && !signInBoxMode()) {
   const vnodePressureTimer = setInterval(() => void logVnodePressure(), 60_000);
   vnodePressureTimer.unref?.();
   void logVnodePressure();
@@ -1334,6 +1455,7 @@ async function connect(): Promise<void> {
     const frame = parseCloudFrame(data);
     if (!frame) return;
     if (stopping && rejectFrameDuringShutdown(socket, frame)) return;
+    if (signInBoxMode() && rejectFrameOnSignInBox(socket, frame)) return;
 
     switch (frame.kind) {
       case "pong":
@@ -1539,6 +1661,11 @@ async function connect(): Promise<void> {
                   });
                 },
               };
+              // ADR-136 sign-in box: the prior grant is not on disk; read it
+              // into the cache so an account switch still revokes it remotely.
+              if (signInBoxMode()) {
+                await loadGithubTokenIntoCache(frame.userId).catch(() => false);
+              }
               let result: Awaited<ReturnType<typeof onConnectSet>>;
               try {
                 result = await onConnectSet(
@@ -1704,6 +1831,11 @@ async function connect(): Promise<void> {
                   error: "stale GitHub credential generation",
                 };
               }
+              // ADR-136 sign-in box: the grant is not on disk; read it into
+              // the cache so the disconnect still revokes it remotely.
+              if (signInBoxMode()) {
+                await loadGithubTokenIntoCache(frame.userId).catch(() => false);
+              }
               await onConnectClear(frame.userId, {
                 invalidateCredentials: invalidateTaskGithubGitCredentials,
                 reconcile: (taskId, userId) => {
@@ -1789,6 +1921,24 @@ async function connect(): Promise<void> {
           );
           break;
         }
+        if (frame.kind === "ssh.key.ensure" && signInBoxMode()) {
+          // ADR-136 sign-in box: the keypair goes to the store first; only
+          // the public half stays here.
+          void managedMutationDrain.track(() =>
+            ensureSshKeyStoreFirst(frame.userId).then(
+              (publicKey) =>
+                send(socket, { kind: "ssh.key.ack", userId: frame.userId, ok: true, publicKey }),
+              (err) =>
+                send(socket, {
+                  kind: "ssh.key.ack",
+                  userId: frame.userId,
+                  ok: false,
+                  error: err instanceof Error ? err.message : "ssh key op failed",
+                }),
+            ),
+          );
+          break;
+        }
         try {
           const publicKey =
             frame.kind === "ssh.key.ensure"
@@ -1831,6 +1981,30 @@ async function connect(): Promise<void> {
       case "env.var.list":
       case "env.var.set":
       case "env.var.delete": {
+        if (signInBoxMode()) {
+          // ADR-136 sign-in box: no local rows — every op is a store call,
+          // and the ack lists names from the store.
+          void managedMutationDrain.track(() =>
+            (frame.kind === "env.var.set"
+              ? setProjectEnvStoreOnly(frame.projectId, frame.key, frame.value, frame.orgId)
+              : frame.kind === "env.var.delete"
+                ? deleteProjectEnvStoreOnly(frame.projectId, frame.key)
+                : Promise.resolve()
+            )
+              .then(() => listProjectEnvKeysStoreOnly(frame.projectId))
+              .then(
+                (keys) => send(socket, { kind: "env.var.ack", opId: frame.opId, ok: true, keys }),
+                (err) =>
+                  send(socket, {
+                    kind: "env.var.ack",
+                    opId: frame.opId,
+                    ok: false,
+                    error: err instanceof Error ? err.message : "env var op failed",
+                  }),
+              ),
+          );
+          break;
+        }
         try {
           if (frame.kind === "env.var.set") {
             setProjectEnvVar(frame.projectId, frame.key, frame.value, frame.orgId);
@@ -3260,6 +3434,39 @@ function rejectFrameDuringShutdown(
   }
 }
 
+/**
+ * ADR-136 sign-in box: the runner behind the "Uai Cloud" row runs no task.
+ * Task commands and tunnel opens get a definite, non-retryable refusal —
+ * nothing here will ever accept them — while the managed lifecycle, engine
+ * sign-ins and account management pass through untouched.
+ */
+function rejectFrameOnSignInBox(socket: WebSocket, frame: CloudToHost): boolean {
+  switch (frame.kind) {
+    case "command":
+      if (signInBoxAllowsCommand(frame.command)) return false;
+      send(socket, {
+        kind: "result",
+        commandId: frame.commandId,
+        result: {
+          ok: false,
+          code: HostErrorCode.HostUnavailable,
+          message: SIGN_IN_BOX_TASK_REFUSAL,
+          retryable: false,
+        },
+      });
+      return true;
+    case "tunnel.open":
+      send(socket, {
+        kind: "tunnel.close",
+        tunnelId: frame.tunnelId,
+        reason: SIGN_IN_BOX_TASK_REFUSAL,
+      });
+      return true;
+    default:
+      return false;
+  }
+}
+
 function rawDataToBuffer(data: RawData): Buffer {
   if (Buffer.isBuffer(data)) return data;
   if (data instanceof ArrayBuffer) return Buffer.from(data);

package/src/protocol.ts

@@ -1489,27 +1489,33 @@ export interface HostCommands {
    * exactly like the local API; re-advertises capabilities on success. */
   engineAccountRemove(
     ctx: CommandContext,
-    input: { id: string; scope?: string },
+    input: { id: string; scope?: string; hostId?: string },
   ): Promise<HostCommandResult<{ removed: boolean; message?: string }>>;
   /** Manage-v1: relabel an extra account (never `default:*`); a scope may
    * rename only its own accounts. Re-advertises on success. */
   engineAccountRename(
     ctx: CommandContext,
-    input: { id: string; label: string; scope?: string },
+    input: { id: string; label: string; scope?: string; hostId?: string },
   ): Promise<HostCommandResult<{ renamed: boolean; message?: string }>>;
   /** Manage-v1: set the priority order of a kind's extra accounts within a
    * scope — `ids` must be exactly that set. Tasks pick the first healthy
    * account in this order. Re-advertises on success. */
   engineAccountReorder(
     ctx: CommandContext,
-    input: { kind: string; ids: string[]; scope?: string },
+    input: { kind: string; ids: string[]; scope?: string; hostId?: string },
   ): Promise<HostCommandResult<{ reordered: boolean; message?: string }>>;
   /** Disconnect-v1: forget the host's DEFAULT credential for an engine — the
    * .env.local key and/or the login file the adapter detects. Extras are
-   * untouched (remove them by id). Re-advertises on success. */
+   * untouched (remove them by id). Re-advertises on success.
+   *
+   * `hostId` on the four account commands above: the runner the account lives
+   * on. The cloud's bridge routes by it (2026-09-14: without it these fell to
+   * the any-open-host fallback and landed on whichever runner connected
+   * first — the label step after a sign-in answered "That account no longer
+   * exists" and Disconnect did nothing). The host ignores the field. */
   engineDisconnect(
     ctx: CommandContext,
-    input: { engine: EngineConnectKind },
+    input: { engine: EngineConnectKind; hostId?: string },
   ): Promise<HostCommandResult<{ disconnected: boolean; message?: string }>>;
   cloneRepo(
     ctx: CommandContext,