@runuai/host 0.9.139 → 0.9.141

package/lib/signin-box-credentials.ts

@@ -0,0 +1,465 @@
+/**
+ * ADR-136 sign-in box, the user and project credentials (host release 3b).
+ *
+ * The shared "Uai Cloud" row is where the cloud sends every workspace's
+ * GitHub connects, SSH key requests, MCP connection probes and project env
+ * writes for hostless tasks — the box is the writer for all of them. Same
+ * contract as engine accounts (lib/engine-accounts.ts, store-only accounts):
+ *
+ *  - GitHub tokens: the store first, a row with no ciphertext, the token in
+ *    a bounded in-memory cache only while the box needs it (the repo picker's
+ *    installation listing reads it back under a policy scoped to
+ *    `/uai/users/*\/github`). lib/github-tokens.ts.
+ *  - SSH keys: the keypair to the store first, only the public half stays
+ *    (tagged, so a replacement box lists it without a read). lib/ssh.ts.
+ *  - MCP connections: header / OAuth tokens to the store first, a row with
+ *    every secret column null; a half-finished OAuth flow lives in memory.
+ *    lib/mcp-connections.ts.
+ *  - Project env: no rows at all — set/delete/list are store calls
+ *    (put + org tag, delete, describe names).
+ *
+ * This module owns what cuts across them: the start-time purge of whatever a
+ * previous release left, the names-and-tags reconcile that rebuilds the
+ * metadata rows (reading a value only where the policy allows it — GitHub
+ * always, SSH and MCP only during the transitional window that lets the box
+ * tag legacy parameters once), and the project env passthrough.
+ */
+
+import { eq } from "drizzle-orm";
+
+import {
+  configuredCredentialStore,
+  credentialStorePrefix,
+  isParameterPathSegment,
+} from "./credential-store";
+import { getDb, schema } from "./db";
+import {
+  claimGithubCredentialGeneration,
+  deleteGithubTokenRowLocal,
+  GITHUB_TOKEN_TAGS,
+  githubTokenMetadataTags,
+  insertStoreHeldGithubTokenRow,
+  isStoreHeldGithubRow,
+} from "./github-tokens";
+import {
+  projectEnvParameterName,
+  projectEnvTags,
+  type StoredProjectEnv,
+} from "./host-env";
+import {
+  deleteMcpConnectionRowLocal,
+  MCP_CONNECTION_TAGS,
+  mcpConnectionMetadataTags,
+  upsertStoreHeldMcpConnectionRow,
+} from "./mcp-connections";
+import {
+  deleteSshKeyRowLocal,
+  insertStoreHeldSshKeyRow,
+  isStoreHeldSshRow,
+  SSH_KEY_TAGS,
+  sshKeyMetadataTags,
+} from "./ssh";
+import {
+  parseStoredGithubToken,
+  parseStoredMcpConnection,
+  parseStoredSshKey,
+  parseUserParameterName,
+} from "./user-credentials-store";
+
+function warn(line: string): void {
+  console.warn(`[signin-box] ${line}`);
+}
+
+function fromB64url(value: string | undefined): string | null {
+  if (!value) return null;
+  try {
+    return Buffer.from(value, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+
+function intTag(tags: Record<string, string>, key: string): number | null {
+  const raw = tags[key];
+  if (raw === undefined || raw === "") return null;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) ? n : null;
+}
+
+// ---------------------------------------------------------------------------
+// Project env: a store passthrough.
+// ---------------------------------------------------------------------------
+
+export async function setProjectEnvStoreOnly(
+  projectId: string,
+  key: string,
+  value: string,
+  orgId?: string,
+): Promise<void> {
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold project env");
+  const name = projectEnvParameterName(projectId, key);
+  if (!name) throw new Error("this key cannot be stored (not a legal parameter name)");
+  const stored: StoredProjectEnv = {
+    v: 1,
+    kind: "project-env",
+    projectId,
+    key,
+    value,
+    updatedAt: Date.now(),
+    ...(orgId ? { orgId } : {}),
+  };
+  await store.put(name, JSON.stringify(stored));
+  // The tag is what lets a task machine's lease read the value (ADR-133);
+  // without it the value is stored but unreachable, so this failure is the
+  // caller's.
+  if (orgId) await store.tag(name, projectEnvTags(projectId, orgId));
+}
+
+export async function deleteProjectEnvStoreOnly(projectId: string, key: string): Promise<void> {
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold project env");
+  const name = projectEnvParameterName(projectId, key);
+  if (!name) return;
+  await store.delete(name);
+}
+
+/** The project's KEY NAMES from the store — names only, never a value. */
+export async function listProjectEnvKeysStoreOnly(projectId: string): Promise<string[]> {
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold project env");
+  if (!isParameterPathSegment(projectId)) return [];
+  const base = `${credentialStorePrefix()}/projects/${projectId}/env`;
+  const names = await store.describeNames(base);
+  return names
+    .map((name) => name.slice(base.length + 1))
+    .filter((key) => key.length > 0 && !key.includes("/"))
+    .sort();
+}
+
+// ---------------------------------------------------------------------------
+// Start-time purge.
+// ---------------------------------------------------------------------------
+
+export interface PurgeLocalUserCredentialSecretsResult {
+  githubStripped: number;
+  sshStripped: number;
+  mcpStripped: number;
+  projectEnvRemoved: number;
+  /** Rows deleted outright: never mirrored, so the store has no copy and a
+   *  secret with no copy elsewhere still may not live here. */
+  unmirroredRemoved: number;
+}
+
+/**
+ * Nothing a previous release left on this machine may hold a credential.
+ * Rows keep their metadata and lose their material; rows the store never
+ * received are deleted; project env rows go entirely (the store is listed
+ * by name instead).
+ */
+export function purgeLocalUserCredentialSecrets(): PurgeLocalUserCredentialSecretsResult {
+  const result: PurgeLocalUserCredentialSecretsResult = {
+    githubStripped: 0,
+    sshStripped: 0,
+    mcpStripped: 0,
+    projectEnvRemoved: 0,
+    unmirroredRemoved: 0,
+  };
+  const db = getDb();
+  const empty = { ct: Buffer.alloc(0), nonce: Buffer.alloc(0) };
+
+  for (const row of db.select().from(schema.githubTokens).all()) {
+    if (!row.storeRef) {
+      deleteGithubTokenRowLocal(row.userId);
+      result.unmirroredRemoved++;
+      continue;
+    }
+    if (isStoreHeldGithubRow(row)) continue;
+    db.update(schema.githubTokens)
+      .set({ refreshTokenCt: empty.ct, refreshTokenNonce: empty.nonce })
+      .where(eq(schema.githubTokens.userId, row.userId))
+      .run();
+    result.githubStripped++;
+  }
+  for (const row of db.select().from(schema.sshKeys).all()) {
+    if (!row.storeRef) {
+      deleteSshKeyRowLocal(row.userId);
+      result.unmirroredRemoved++;
+      continue;
+    }
+    if (isStoreHeldSshRow(row)) continue;
+    db.update(schema.sshKeys)
+      .set({ privateKeyCt: empty.ct, privateKeyNonce: empty.nonce })
+      .where(eq(schema.sshKeys.userId, row.userId))
+      .run();
+    result.sshStripped++;
+  }
+  for (const row of db.select().from(schema.mcpConnections).all()) {
+    if (!row.storeRef) {
+      deleteMcpConnectionRowLocal(row.id);
+      result.unmirroredRemoved++;
+      continue;
+    }
+    if (row.secretEnc === null && row.clientSecretEnc === null && row.pkceVerifierEnc === null) {
+      continue;
+    }
+    db.update(schema.mcpConnections)
+      .set({ secretEnc: null, clientSecretEnc: null, pkceVerifierEnc: null })
+      .where(eq(schema.mcpConnections.id, row.id))
+      .run();
+    result.mcpStripped++;
+  }
+  result.projectEnvRemoved = db.delete(schema.hostProjectEnv).run().changes;
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Start-time metadata reconcile: names + tags, a value only where allowed.
+// ---------------------------------------------------------------------------
+
+export interface ReconcileUserCredentialMetadataResult {
+  skipped: boolean;
+  imported: number;
+  removed: number;
+  /** Legacy parameters the box could read and has now tagged. */
+  tagged: number;
+  /** Parameters neither tagged nor readable — listed nowhere until an
+   *  operator runs the bootstrap with the transitional read once. */
+  unreadable: number;
+  errors: number;
+}
+
+export async function reconcileUserCredentialMetadataFromStore(): Promise<ReconcileUserCredentialMetadataResult> {
+  const result: ReconcileUserCredentialMetadataResult = {
+    skipped: false,
+    imported: 0,
+    removed: 0,
+    tagged: 0,
+    unreadable: 0,
+    errors: 0,
+  };
+  const store = configuredCredentialStore();
+  if (!store) return { ...result, skipped: true };
+  const prefix = credentialStorePrefix();
+  let names: string[];
+  try {
+    names = await store.describeNames(`${prefix}/users`);
+  } catch (err) {
+    warn(`listing ${prefix}/users failed: ${err instanceof Error ? err.message : String(err)}`);
+    return { ...result, errors: 1 };
+  }
+  const db = getDb();
+  const github = new Map(db.select().from(schema.githubTokens).all().map((r) => [r.storeRef, r]));
+  const ssh = new Map(db.select().from(schema.sshKeys).all().map((r) => [r.storeRef, r]));
+  const mcp = new Map(db.select().from(schema.mcpConnections).all().map((r) => [r.storeRef, r]));
+  const seen = new Set<string>();
+
+  for (const name of names) {
+    const at = parseUserParameterName(name, prefix);
+    if (!at) continue;
+    seen.add(name);
+    const known =
+      at.kind === "github" ? github.has(name) : at.kind === "ssh" ? ssh.has(name) : mcp.has(name);
+    if (known) continue;
+    let tags: Record<string, string> = {};
+    try {
+      tags = await store.listTags(name);
+    } catch (err) {
+      result.errors++;
+      warn(`tags of ${name} unreadable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+      if (at.kind === "github") {
+        await importGithubMetadata(store, name, at.userId, tags, result);
+      } else if (at.kind === "ssh") {
+        await importSshMetadata(store, name, at.userId, tags, result);
+      } else {
+        await importMcpMetadata(store, name, at.userId, at.id, tags, result);
+      }
+    } catch (err) {
+      result.errors++;
+      warn(`${name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  for (const [ref, row] of github) {
+    if (ref && seen.has(ref)) continue;
+    deleteGithubTokenRowLocal(row.userId);
+    result.removed++;
+  }
+  for (const [ref, row] of ssh) {
+    if (ref && seen.has(ref)) continue;
+    deleteSshKeyRowLocal(row.userId);
+    result.removed++;
+  }
+  for (const [ref, row] of mcp) {
+    if (ref && seen.has(ref)) continue;
+    // A pending OAuth row this box created has no ref yet; keep it.
+    if (!ref && row.status === "pending") continue;
+    deleteMcpConnectionRowLocal(row.id);
+    result.removed++;
+  }
+  return result;
+}
+
+type Store = NonNullable<ReturnType<typeof configuredCredentialStore>>;
+
+/** Read a legacy (untagged) parameter where the policy allows it; null when
+ *  it does not (AccessDenied or absent) — never thrown. */
+async function readIfAllowed(store: Store, name: string): Promise<string | null> {
+  try {
+    return await store.get(name);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/AccessDenied/i.test(message)) return null;
+    throw err;
+  }
+}
+
+async function importGithubMetadata(
+  store: Store,
+  name: string,
+  userId: string,
+  tags: Record<string, string>,
+  result: ReconcileUserCredentialMetadataResult,
+): Promise<void> {
+  let meta: {
+    installationId: number;
+    generation: number;
+    tokenKind: string;
+    expiresAt: number | null;
+    updatedAt: number;
+  } | null = null;
+  const installationId = intTag(tags, GITHUB_TOKEN_TAGS.installationId);
+  const generation = intTag(tags, GITHUB_TOKEN_TAGS.generation);
+  const tokenKind = tags[GITHUB_TOKEN_TAGS.tokenKind];
+  if (installationId !== null && generation !== null && tokenKind) {
+    meta = {
+      installationId,
+      generation,
+      tokenKind,
+      expiresAt: intTag(tags, GITHUB_TOKEN_TAGS.expiresAt),
+      updatedAt: intTag(tags, GITHUB_TOKEN_TAGS.updatedAt) ?? Date.now(),
+    };
+  } else {
+    // The box may read GitHub tokens (the repo picker needs them anyway):
+    // read once, tag, and keep only the metadata.
+    const raw = await readIfAllowed(store, name);
+    if (raw === null) {
+      result.unreadable++;
+      warn(`${name}: no tags and not readable — the user shows as disconnected on this box`);
+      return;
+    }
+    const value = parseStoredGithubToken(raw);
+    if (value.userId !== userId) throw new Error("payload names another user");
+    meta = {
+      installationId: value.installationId,
+      generation: value.generation,
+      tokenKind: value.tokenKind,
+      expiresAt: value.expiresAt,
+      updatedAt: value.updatedAt,
+    };
+    try {
+      await store.tag(name, githubTokenMetadataTags(meta));
+      result.tagged++;
+    } catch (err) {
+      warn(`${name}: tagging failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  // The same fence an import claims on any host: a generation this box has
+  // already moved past (a later clear) is not resurrected.
+  if (!claimGithubCredentialGeneration(userId, meta.generation, "set")) return;
+  insertStoreHeldGithubTokenRow(userId, {
+    installationId: meta.installationId,
+    generation: meta.generation,
+    refreshTokenExpiresAt: meta.expiresAt,
+    kind: meta.tokenKind,
+    updatedAt: meta.updatedAt,
+    storeRef: name,
+  });
+  result.imported++;
+}
+
+async function importSshMetadata(
+  store: Store,
+  name: string,
+  userId: string,
+  tags: Record<string, string>,
+  result: ReconcileUserCredentialMetadataResult,
+): Promise<void> {
+  let publicKey = tags[SSH_KEY_TAGS.publicKey] ?? "";
+  let createdAt = intTag(tags, SSH_KEY_TAGS.createdAt);
+  if (!publicKey) {
+    const raw = await readIfAllowed(store, name);
+    if (raw === null) {
+      result.unreadable++;
+      warn(`${name}: no public-key tag and not readable — kept as a row with an unknown public key`);
+      insertStoreHeldSshKeyRow({ userId, publicKey: "", createdAt: Date.now(), updatedAt: Date.now(), storeRef: name });
+      return;
+    }
+    const value = parseStoredSshKey(raw);
+    if (value.userId !== userId) throw new Error("payload names another user");
+    publicKey = value.publicKey;
+    createdAt = value.createdAt;
+    try {
+      await store.tag(name, sshKeyMetadataTags({ publicKey, createdAt }));
+      result.tagged++;
+    } catch (err) {
+      warn(`${name}: tagging failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const now = Date.now();
+  if (insertStoreHeldSshKeyRow({ userId, publicKey, createdAt: createdAt ?? now, updatedAt: now, storeRef: name })) {
+    result.imported++;
+  }
+}
+
+async function importMcpMetadata(
+  store: Store,
+  name: string,
+  userId: string,
+  id: string,
+  tags: Record<string, string>,
+  result: ReconcileUserCredentialMetadataResult,
+): Promise<void> {
+  const url = fromB64url(tags[MCP_CONNECTION_TAGS.urlB64]);
+  const authKind = tags[MCP_CONNECTION_TAGS.authKind];
+  const status = tags[MCP_CONNECTION_TAGS.status];
+  if (url && authKind && status) {
+    upsertStoreHeldMcpConnectionRow(
+      {
+        id,
+        userId,
+        url,
+        authKind,
+        tokenEndpoint: null,
+        redirectUri: null,
+        clientId: null,
+        status,
+        scopes: fromB64url(tags[MCP_CONNECTION_TAGS.scopesB64]) || null,
+        updatedAt: intTag(tags, MCP_CONNECTION_TAGS.updatedAt) ?? Date.now(),
+      },
+      name,
+    );
+    result.imported++;
+    return;
+  }
+  const raw = await readIfAllowed(store, name);
+  if (raw === null) {
+    result.unreadable++;
+    warn(`${name}: no tags and not readable — not listed on this box`);
+    return;
+  }
+  const value = parseStoredMcpConnection(raw);
+  if (value.userId !== userId || value.id !== id) {
+    throw new Error("payload does not describe the connection its path names");
+  }
+  try {
+    await store.tag(name, mcpConnectionMetadataTags(value));
+    result.tagged++;
+  } catch (err) {
+    warn(`${name}: tagging failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  upsertStoreHeldMcpConnectionRow(value, name);
+  result.imported++;
+}

package/lib/ssh.ts

@@ -23,10 +23,11 @@ import { join, resolve } from "node:path";
 
 import { eq } from "drizzle-orm";
 
-import { queueStoreWrite, userParameterName } from "./credential-store";
+import { configuredCredentialStore, queueStoreWrite, userParameterName } from "./credential-store";
 import { getDb, schema } from "./db";
 import { env } from "./env";
 import { sealAesGcm, openAesGcm } from "./secrets";
+import { signInBoxMode } from "./signin-box";
 import { assertSafeHostTaskId } from "./task-identity";
 
 const withNewline = (s: string): string => (s.endsWith("\n") ? s : `${s}\n`);
@@ -137,14 +138,15 @@ export function sshKeyParameterName(userId: string): string {
   return userParameterName(userId, "ssh");
 }
 
-/** The row as it is mirrored (private key decrypted). Never logged. */
+/** The row as it is mirrored (private key decrypted). Never logged. Null
+ *  for a store-held row (sign-in box): nothing here to mirror. */
 export function sshKeyStoreValue(userId: string): StoredSshKey | null {
   const row = getDb()
     .select()
     .from(schema.sshKeys)
     .where(eq(schema.sshKeys.userId, userId))
     .get();
-  if (!row) return null;
+  if (!row || isStoreHeldSshRow(row)) return null;
   return {
     v: 1,
     kind: "ssh",
@@ -175,6 +177,8 @@ export function listSshKeyStoreRows(): Array<{ userId: string; storeRef: string
 }
 
 export function mirrorSshKeyToStore(userId: string): void {
+  // ADR-136 sign-in box: rows hold no material; the store was written first.
+  if (signInBoxMode()) return;
   queueStoreWrite(`mirror ssh key ${userId}`, async (store) => {
     const value = sshKeyStoreValue(userId);
     if (!value) return;
@@ -203,14 +207,15 @@ export function importSshKeyFromStore(value: StoredSshKey, storeRef: string): bo
   return result.changes > 0;
 }
 
-/** Decrypt + return the user's private key, or null if they have none. */
+/** Decrypt + return the user's private key, or null if they have none (or
+ *  the row is store-held — the sign-in box never holds one). */
 export function privateKeyForUser(userId: string): string | null {
   const row = getDb()
     .select()
     .from(schema.sshKeys)
     .where(eq(schema.sshKeys.userId, userId))
     .get();
-  if (!row) return null;
+  if (!row || isStoreHeldSshRow(row)) return null;
   return openAesGcm(
     Buffer.from(row.privateKeyCt as Uint8Array),
     Buffer.from(row.privateKeyNonce as Uint8Array),
@@ -226,7 +231,7 @@ export function keyPairForUser(
     .from(schema.sshKeys)
     .where(eq(schema.sshKeys.userId, userId))
     .get();
-  if (!row) return null;
+  if (!row || isStoreHeldSshRow(row)) return null;
   return {
     privateKey: openAesGcm(
       Buffer.from(row.privateKeyCt as Uint8Array),
@@ -236,6 +241,104 @@ export function keyPairForUser(
   };
 }
 
+// ---------------------------------------------------------------------------
+// ADR-136 sign-in box: a key row here holds NO private key (`private_key_ct`
+// empty — "store-held"); the keypair goes to the store first and only the
+// public half stays, which is all the box ever answers (`ssh.key.get`). The
+// public key also rides as a tag so a replacement box lists it without
+// reading the value.
+// ---------------------------------------------------------------------------
+
+export const SSH_KEY_TAGS = { publicKey: "uai_public_key", createdAt: "uai_created_at" } as const;
+
+export function isStoreHeldSshRow(row: { privateKeyCt: unknown }): boolean {
+  const ct = row.privateKeyCt;
+  if (ct === null || ct === undefined) return true;
+  if (ct instanceof Uint8Array) return ct.byteLength === 0;
+  return false;
+}
+
+export function sshKeyMetadataTags(value: { publicKey: string; createdAt: number }): Record<string, string> {
+  return {
+    [SSH_KEY_TAGS.publicKey]: value.publicKey,
+    [SSH_KEY_TAGS.createdAt]: String(value.createdAt),
+  };
+}
+
+/** A key row with no private half (sign-in box). Existing rows win. */
+export function insertStoreHeldSshKeyRow(args: {
+  userId: string;
+  publicKey: string;
+  createdAt: number;
+  updatedAt: number;
+  storeRef: string;
+}): boolean {
+  const result = getDb()
+    .insert(schema.sshKeys)
+    .values({
+      userId: args.userId,
+      publicKey: args.publicKey,
+      privateKeyCt: Buffer.alloc(0),
+      privateKeyNonce: Buffer.alloc(0),
+      createdAt: args.createdAt,
+      updatedAt: args.updatedAt,
+      storeRef: args.storeRef,
+    })
+    .onConflictDoNothing({ target: schema.sshKeys.userId })
+    .run();
+  return result.changes > 0;
+}
+
+/** Delete the row only (no store call). */
+export function deleteSshKeyRowLocal(userId: string): void {
+  getDb().delete(schema.sshKeys).where(eq(schema.sshKeys.userId, userId)).run();
+}
+
+/**
+ * `ensureKeyForUser` for the sign-in box: generate, write the keypair to the
+ * store FIRST (awaited — a refused put is the operation's failure and leaves
+ * nothing), tag the public key, then keep a store-held row. A row whose
+ * public key this box could not learn (a legacy parameter it may not read)
+ * is refused rather than silently regenerated over the user's real key.
+ */
+export async function ensureSshKeyStoreFirst(userId: string): Promise<string> {
+  const existing = getDb()
+    .select({ publicKey: schema.sshKeys.publicKey })
+    .from(schema.sshKeys)
+    .where(eq(schema.sshKeys.userId, userId))
+    .get();
+  if (existing) {
+    if (existing.publicKey) return existing.publicKey;
+    throw new Error(
+      "this user's SSH key exists in the credential store but its public half is not tagged yet; re-run the sign-in box bootstrap with the transitional read",
+    );
+  }
+  const store = configuredCredentialStore();
+  if (!store) throw new Error("the sign-in box has no credential store to hold the key");
+  const { publicKey, privateKey } = generateEd25519(`uai-${userId}`);
+  const now = Date.now();
+  const name = sshKeyParameterName(userId);
+  const value: StoredSshKey = {
+    v: 1,
+    kind: "ssh",
+    userId,
+    publicKey,
+    privateKey,
+    createdAt: now,
+    updatedAt: now,
+  };
+  await store.put(name, JSON.stringify(value));
+  try {
+    await store.tag(name, sshKeyMetadataTags(value));
+  } catch (err) {
+    console.warn(
+      `[ssh] user ${userId}: tagging ${name} failed (${err instanceof Error ? err.message : String(err)}) — a replacement box needs the transitional read to list this key`,
+    );
+  }
+  insertStoreHeldSshKeyRow({ userId, publicKey, createdAt: now, updatedAt: now, storeRef: name });
+  return getPublicKey(userId) ?? publicKey;
+}
+
 // --- per-task on-disk identity (optional SSH fallback + signing, ADR-029) -----
 //
 // task-up.sh uses the creator's key for host Git only when GitHub is not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.139",
+  "version": "0.9.141",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -141,6 +141,42 @@ reject_workspace_runtime_shadow() {
   fi
 }
 
+# The first check of a task-up used to be the refusal above. A fresh task
+# never trips it (the workspace is empty), but a RESUMED one can: the
+# workspace persists across an idle park, agents' shells start in /workspace,
+# and `asdf local nodejs 22` from there writes exactly this file — after
+# which the task could never wake again without someone deleting the file on
+# the host (client runner, 2026-09-14). The entry is the task's own
+# container-writable content, so move it aside instead: a rename is
+# metadata-only (never opens a FIFO/device/socket), the runtime proof is
+# unchanged because nothing is left at the root, and the content survives
+# under .uai/refused/ where the agent can re-pin it in a project. The
+# post-materialization recheck below keeps refusing — by then the root must
+# be empty by construction, so an entry there is a bug, not a user file.
+quarantine_workspace_runtime_shadow() {
+  local path="$task_workspace/.tool-versions" aside_dir aside
+  if [ -L "$path" ] || [ -e "$path" ]; then
+    aside_dir="$task_workspace/.uai/refused"
+    reject_unsafe_host_directory "$task_workspace/.uai" "the task control directory"
+    reject_unsafe_host_directory "$aside_dir" "the refused-files directory"
+    mkdir -p "$aside_dir"
+    aside="$aside_dir/tool-versions.$(date +%s)"
+    if ! mv -f "$path" "$aside" 2>/dev/null || [ -L "$path" ] || [ -e "$path" ]; then
+      reject_workspace_runtime_shadow
+    fi
+    cat > "$aside_dir/README.txt" <<'NOTE'
+Uai moved a /workspace/.tool-versions aside before starting this task.
+
+A .tool-versions at the workspace root is outside the runtime proof and would
+override the runtimes proved for every project in the task, so the host refuses
+to start a container while one exists. The file is kept here, untouched, under
+its original content. Pin runtimes in a project's own .tool-versions instead
+(/workspace/<project>/.tool-versions), which the materializer proves.
+NOTE
+    log "moved a workspace-root .tool-versions aside to ${aside#"$task_workspace"/} (it would override the runtimes proved for this task; pin per project instead)"
+  fi
+}
+
 mapped_host_port() {
   local container="$1" container_port="$2"
   docker port "$container" "$container_port" 2>/dev/null \
@@ -555,7 +591,7 @@ else
 fi
 reject_unsafe_host_directory "$task_workspace" "the task workspace"
 mkdir -p "$task_workspace"
-reject_workspace_runtime_shadow
+quarantine_workspace_runtime_shadow
 
 # Git resolves symlinked ancestors when it writes a linked worktree's absolute
 # `.git` pointer. Keep the configured (lexical) task paths as Uai's stable host