@runuai/host 0.9.14 → 0.9.42

package/lib/runtime-authority.ts

@@ -0,0 +1,79 @@
+/**
+ * Host-owned runtime/cache authority for every command launched in a task
+ * container. Admission and recovery separately prove the container's fixed
+ * Config.Env; these values are reasserted for each managed exec so a caller
+ * cannot accidentally omit the policy or inherit project-controlled values.
+ */
+export const RUNTIME_AUTHORITY_ENV: Readonly<Record<string, string>> =
+  Object.freeze({
+    // Shared, host-maintained shims stay ahead of task-installed commands so
+    // `npm install -g claude/codex/node` cannot replace Uai's proved tools.
+    // Packages with new command names remain available from the private
+    // container-layer prefix at the final component, after every trusted
+    // control directory.
+    PATH: "/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/node/.local/share/uai-npm/bin",
+    HOME: "/home/node",
+    XDG_CONFIG_HOME: "/home/node/.config",
+    XDG_DATA_HOME: "/home/node/.local/share",
+    XDG_CACHE_HOME: "/home/node/.cache",
+    ASDF_DIR: "/opt/asdf",
+    ASDF_DATA_DIR: "/opt/asdf-data",
+    ASDF_CONFIG_FILE: "/dev/null",
+    ASDF_DEFAULT_TOOL_VERSIONS_FILENAME: ".tool-versions",
+    ASDF_NODEJS_VERSION: "",
+    ASDF_PYTHON_VERSION: "",
+    ASDF_GOLANG_VERSION: "",
+    ASDF_RUBY_VERSION: "",
+    ASDF_RUST_VERSION: "",
+    // asdf-nodejs wraps global npm installs with an automatic reshim. Task
+    // mounts are intentionally read-only and private bins are already on PATH;
+    // only host maintenance may mutate shared shims.
+    ASDF_SKIP_RESHIM: "1",
+    // Corepack selections are completely prepared by host maintenance. Task
+    // contexts see this path only through the read-only shared volume.
+    COREPACK_HOME: "/opt/asdf-data/corepack",
+    COREPACK_DEFAULT_TO_LATEST: "0",
+    COREPACK_ENV_FILE: "0",
+    COREPACK_NPM_REGISTRY: "https://registry.npmjs.org",
+    COREPACK_ENABLE_NETWORK: "0",
+    COREPACK_ENABLE_AUTO_PIN: "0",
+    COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
+    COREPACK_ENABLE_PROJECT_SPEC: "1",
+    COREPACK_ENABLE_STRICT: "1",
+    COREPACK_ENABLE_UNSAFE_CUSTOM_URLS: "0",
+    COREPACK_INTEGRITY_CHECK: "1",
+    // npm treats npm_config_* names case-insensitively and lifecycle scripts
+    // often receive the lowercase spelling. Pin both to task-private storage
+    // so image/project environment cannot turn an ordinary global install
+    // into a shared-cache writer.
+    NPM_CONFIG_PREFIX: "/home/node/.local/share/uai-npm",
+    npm_config_prefix: "/home/node/.local/share/uai-npm",
+    NPM_CONFIG_CACHE: "/home/node/.cache/uai-npm",
+    npm_config_cache: "/home/node/.cache/uai-npm",
+    NPM_CONFIG_LOGS_DIR: "/home/node/.cache/uai-npm/_logs",
+    npm_config_logs_dir: "/home/node/.cache/uai-npm/_logs",
+    NPM_CONFIG_UMASK: "0002",
+    npm_config_umask: "0002",
+    LD_PRELOAD: "",
+    LD_AUDIT: "",
+    LD_LIBRARY_PATH: "",
+    NODE_OPTIONS: "",
+    NODE_PATH: "",
+    // SHELLOPTS/BASHOPTS deliberately absent: present-in-env (even empty)
+    // makes bash export its live options into children — the Editor-terminal
+    // nounset poisoning of 2026-08-16.
+    PS4: "",
+    BASH_ENV: "",
+    ENV: "",
+  });
+
+/** Docker `exec` options for the fixed authority environment. Callers append
+ * this after every less-trusted `-e` option and immediately before the
+ * container name. Container admission additionally rejects noncanonical
+ * case/underscore/hyphen aliases for npm's host-owned path settings. */
+export function runtimeAuthorityDockerExecArgs(): string[] {
+  return Object.entries(RUNTIME_AUTHORITY_ENV).flatMap(([key, value]) => [
+    "-e",
+    `${key}=${value}`,
+  ]);
+}

package/lib/runtime-guard.ts

@@ -0,0 +1,36 @@
+/**
+ * Process-wide, dependency-light admission seam for background work that can
+ * reach Docker without entering through HostCommands. It defaults open so
+ * isolated library tests and non-daemon embeddings preserve their historical
+ * behavior; main.ts installs the authoritative ADR-101 readiness predicate.
+ */
+let containersOperational = (): boolean => true;
+
+/**
+ * A typed failure for work that reached its last Docker boundary after the
+ * process-wide runtime verdict was invalidated. Callers that otherwise use a
+ * boolean for an ordinary domain result (notably GitHub's disconnected state)
+ * must be able to keep infrastructure unavailability distinct.
+ */
+export class ContainerRuntimeUnavailableError extends Error {
+  constructor(message = "container runtime is not operational") {
+    super(message);
+    this.name = "ContainerRuntimeUnavailableError";
+  }
+}
+
+export function setContainerRuntimeOperationalCheck(
+  check: () => boolean,
+): void {
+  containersOperational = check;
+}
+
+export function backgroundContainerWorkAllowed(): boolean {
+  return containersOperational();
+}
+
+export function requireContainerRuntimeOperational(): void {
+  if (!backgroundContainerWorkAllowed()) {
+    throw new ContainerRuntimeUnavailableError();
+  }
+}

package/lib/runtime-provider-state.ts

@@ -0,0 +1,169 @@
+/**
+ * Crash-safe identity for a container backend that may hold task state.
+ *
+ * The marker is deliberately monotonic. Once a bundled-runtime task can create
+ * a container, image, or volume, `auto` must not silently move the host back
+ * to an ambient Docker Desktop/OrbStack daemon on the next service restart. An
+ * explicit `UAI_RUNTIME=docker` remains the operator's switch.
+ */
+
+import { randomBytes } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+export type StatefulRuntimeProvider = "apple-container";
+
+export interface RuntimeProviderState {
+  readonly schemaVersion: 1;
+  readonly statefulProvider: StatefulRuntimeProvider;
+  readonly claimedAt: number;
+}
+
+export interface RuntimeProviderStateStore {
+  read(): RuntimeProviderState | null | Promise<RuntimeProviderState | null>;
+  claim(
+    provider: StatefulRuntimeProvider,
+  ): RuntimeProviderState | Promise<RuntimeProviderState>;
+}
+
+export function runtimeProviderStatePath(dataDir: string): string {
+  return join(dataDir, "container-runtime-provider.json");
+}
+
+export function fileRuntimeProviderStateStore(
+  file: string,
+): RuntimeProviderStateStore {
+  return {
+    read: () => readRuntimeProviderState(file),
+    claim: (provider) => claimRuntimeProviderState(file, provider),
+  };
+}
+
+export function readRuntimeProviderState(
+  file: string,
+): RuntimeProviderState | null {
+  if (!existsSync(file)) return null;
+  const stat = lstatSync(file);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error("container runtime provider state must be a regular file");
+  }
+  let value: unknown;
+  try {
+    value = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    throw new Error("container runtime provider state is malformed");
+  }
+  return validateRuntimeProviderState(value);
+}
+
+/**
+ * Durably claim the first stateful fallback provider without an overwrite
+ * race. The marker is written before task provisioning can mutate that
+ * provider. A false-positive after an interrupted task-up is safe (and only
+ * makes `auto` conservative); a missing marker after VM state was created is
+ * not.
+ */
+export function claimRuntimeProviderState(
+  file: string,
+  provider: StatefulRuntimeProvider,
+): RuntimeProviderState {
+  const existing = readRuntimeProviderState(file);
+  if (existing) {
+    if (existing.statefulProvider !== provider) {
+      throw new Error("container runtime provider is already claimed");
+    }
+    return existing;
+  }
+
+  const state: RuntimeProviderState = {
+    schemaVersion: 1,
+    statefulProvider: provider,
+    claimedAt: Date.now(),
+  };
+  const parent = dirname(file);
+  mkdirSync(parent, { recursive: true, mode: 0o700 });
+  const temporary = join(
+    parent,
+    `.${basename(file)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`,
+  );
+  try {
+    writeDurableFile(temporary, `${JSON.stringify(state, null, 2)}\n`);
+    try {
+      linkSync(temporary, file);
+      fsyncDirectory(parent);
+      return state;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      const winner = readRuntimeProviderState(file);
+      if (!winner) throw new Error("container runtime provider claim disappeared");
+      if (winner.statefulProvider !== provider) {
+        throw new Error("container runtime provider was claimed concurrently");
+      }
+      return winner;
+    }
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
+}
+
+function validateRuntimeProviderState(value: unknown): RuntimeProviderState {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("container runtime provider state is malformed");
+  }
+  const record = value as Record<string, unknown>;
+  if (
+    Object.keys(record).length !== 3 ||
+    record.schemaVersion !== 1 ||
+    record.statefulProvider !== "apple-container" ||
+    typeof record.claimedAt !== "number" ||
+    !Number.isSafeInteger(record.claimedAt) ||
+    record.claimedAt <= 0
+  ) {
+    throw new Error("container runtime provider state is malformed");
+  }
+  return {
+    schemaVersion: 1,
+    statefulProvider: "apple-container",
+    claimedAt: record.claimedAt,
+  };
+}
+
+function writeDurableFile(file: string, body: string): void {
+  const descriptor = openSync(file, "wx", 0o600);
+  try {
+    writeFileSync(descriptor, body, "utf8");
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+  chmodSync(file, 0o600);
+}
+
+function fsyncDirectory(directory: string): void {
+  let descriptor: number | null = null;
+  try {
+    descriptor = openSync(directory, "r");
+    fsyncSync(descriptor);
+  } catch {
+    // Some filesystems do not expose directory fsync. The marker itself was
+    // still fsync'd before the atomic hard-link publication.
+  } finally {
+    if (descriptor !== null) closeSync(descriptor);
+  }
+}

package/lib/runtime-state.ts

@@ -1,9 +1,16 @@
-import { eq } from "drizzle-orm";
+import { eq, inArray, isNull, notInArray, or } from "drizzle-orm";
 
-import { getDb, schema } from "./db";
+import { getDb, schema, type Db } from "./db";
+import { isTerminal, TERMINAL_STATUSES } from "./task-status";
 import { newId } from "./ulid";
 import type { HostTask } from "../db/schema";
 import type { TaskUpResult } from "../src/protocol";
+import {
+  serializeTaskEnvironmentLocator,
+  type TaskEnvironmentLocator,
+} from "./task-environment/types";
+
+type DbExecutor = Pick<Db, "select" | "insert" | "update" | "delete">;
 
 /** Lifecycle event kinds recorded for the local UI's `/api/events` (ADR-028). */
 export type HostEventKind =
@@ -22,12 +29,104 @@ export function getHostTask(taskId: string): HostTask | null {
   );
 }
 
+/** Remove a provisional first-seen row when admission loses a lifecycle gate. */
+export function deleteHostTask(taskId: string): void {
+  getDb()
+    .delete(schema.hostTasks)
+    .where(eq(schema.hostTasks.taskId, taskId))
+    .run();
+}
+
+/** Final orphan-GC metadata purge. Runtime/filesystem and credential proofs
+ * happen before this transaction; a SQLite failure leaves every task-owned
+ * row intact rather than acknowledging a partial metadata deletion. */
+export function purgeHostTaskState(taskId: string): void {
+  getDb().transaction((tx) => {
+    tx.delete(schema.hostAgentSessions)
+      .where(eq(schema.hostAgentSessions.taskId, taskId))
+      .run();
+    tx.delete(schema.hostEvents)
+      .where(eq(schema.hostEvents.taskId, taskId))
+      .run();
+    tx.delete(schema.hostTasks)
+      .where(eq(schema.hostTasks.taskId, taskId))
+      .run();
+  });
+}
+
+/** A managed runtime may restart only when no task lifecycle is active. */
+export function hasActiveHostTasks(): boolean {
+  return Boolean(
+    getDb()
+      .select({ taskId: schema.hostTasks.taskId })
+      .from(schema.hostTasks)
+      .where(inArray(schema.hostTasks.statusMirror, ["starting", "running"]))
+      .limit(1)
+      .get(),
+  );
+}
+
+/**
+ * A task lifecycle mutation is mid-flight: a taskUp between admission and its
+ * recorded result. Steady-state RUNNING tasks are deliberately not counted —
+ * durable sessions survive a managed service restart, so a version update
+ * needs only the mutations drained. The strict all-tasks predicate above
+ * remains for legacy conversion (which takes over a different service's live
+ * workload) and rollback. Live 2026-08-17: using the strict predicate for
+ * plain updates made every update fail while any task merely existed.
+ */
+export function hasInFlightHostTaskLifecycle(): boolean {
+  return Boolean(
+    getDb()
+      .select({ taskId: schema.hostTasks.taskId })
+      .from(schema.hostTasks)
+      .where(eq(schema.hostTasks.statusMirror, "starting"))
+      .limit(1)
+      .get(),
+  );
+}
+
+/**
+ * Whether a persisted workload makes destructive host maintenance unsafe.
+ * Only the closed set of cloud terminal states is removable. Null and future /
+ * malformed values fail closed so a newer or partially-written lifecycle row
+ * cannot be destroyed by an older CLI that does not understand it.
+ */
+export function hostTaskBlocksMaintenance(status: string | null): boolean {
+  return status === null || !isTerminal(status);
+}
+
+/** Uninstall must preserve every local workload that is not provably terminal. */
+export function hasNonTerminalHostTasks(): boolean {
+  return Boolean(
+    getDb()
+      .select({ taskId: schema.hostTasks.taskId })
+      .from(schema.hostTasks)
+      .where(
+        or(
+          isNull(schema.hostTasks.statusMirror),
+          notInArray(schema.hostTasks.statusMirror, [...TERMINAL_STATUSES]),
+        ),
+      )
+      .limit(1)
+      .get(),
+  );
+}
+
 export function upsertHostTask(
   taskId: string,
   values: Partial<Omit<HostTask, "taskId" | "updatedAt">>,
+): void {
+  upsertHostTaskIn(getDb(), taskId, values);
+}
+
+function upsertHostTaskIn(
+  db: DbExecutor,
+  taskId: string,
+  values: Partial<Omit<HostTask, "taskId" | "updatedAt">>,
 ): void {
   const now = Date.now();
-  getDb()
+  db
     .insert(schema.hostTasks)
     .values({
       taskId,
@@ -45,12 +144,21 @@ export function upsertHostTask(
     .run();
 }
 
-export function recordTaskUpResult(taskId: string, result: TaskUpResult): void {
+export function recordTaskUpResult(
+  taskId: string,
+  result: TaskUpResult,
+  environment?: TaskEnvironmentLocator,
+): void {
   upsertHostTask(taskId, {
     codeServerPort: result.codeServerPort ?? null,
     previewPorts: JSON.stringify(result.previewPorts ?? []),
     composeProject: result.composeProject,
     worktreePath: result.worktreePath,
+    environmentProvider: environment?.provider ?? null,
+    environmentLocator:
+      environment === undefined
+        ? null
+        : serializeTaskEnvironmentLocator(environment),
     statusMirror: "running",
     lockedAt: null,
     startedAt: Date.now(),
@@ -67,15 +175,34 @@ export function recordTaskStarting(taskId: string): void {
   });
 }
 
-export function recordTaskDown(taskId: string, status: string | undefined): void {
+/** Persist the provider-owned crash-recovery identity before provisioning may
+ * create worktrees, containers, networks, or volumes. Status remains
+ * `starting`; the enriched locator is written by `recordTaskUpResult`. */
+export function recordTaskEnvironmentPrepared(
+  taskId: string,
+  environment: TaskEnvironmentLocator,
+): void {
   upsertHostTask(taskId, {
-    codeServerPort: null,
-    previewPorts: "[]",
-    composeProject: null,
-    worktreePath: null,
-    statusMirror: status ?? "killed",
-    lockedAt: null,
-    endedAt: Date.now(),
+    environmentProvider: environment.provider,
+    environmentLocator: serializeTaskEnvironmentLocator(environment),
+  });
+}
+
+export function recordTaskDown(taskId: string, status: string | undefined): void {
+  const db = getDb();
+  db.transaction((tx) => {
+    upsertHostTaskIn(tx, taskId, {
+      codeServerPort: null,
+      previewPorts: "[]",
+      composeProject: null,
+      worktreePath: null,
+      environmentProvider: null,
+      environmentLocator: null,
+      statusMirror: status ?? "killed",
+      lockedAt: null,
+      endedAt: Date.now(),
+    });
+    applyTaskTerminalHistoryRetentionInTransaction(tx, taskId);
   });
 }
 
@@ -113,8 +240,101 @@ export function recordHostEvent(
   kind: HostEventKind,
   detail?: string | null,
 ): void {
+  // `recordTaskDown` prunes the earlier lifecycle history before this terminal
+  // event is appended. Do not immediately recreate that owner-facing history
+  // when retention is disabled; the correctness tombstone remains in
+  // `uai_host_tasks` either way.
+  if (kind === "task.ended" && !retainsTerminalHistory()) return;
   getDb()
     .insert(schema.hostEvents)
     .values({ id: newId(), taskId, kind, detail: detail ?? null })
     .run();
 }
+
+function retainsTerminalHistory(db: DbExecutor = getDb()): boolean {
+  return (
+    db
+      .select({
+        retainTerminalHistory: schema.hostSettings.retainTerminalHistory,
+      })
+      .from(schema.hostSettings)
+      .where(eq(schema.hostSettings.id, "host"))
+      .get()?.retainTerminalHistory ?? true
+  );
+}
+
+/**
+ * Apply the owner-facing terminal-history policy without deleting the durable
+ * lifecycle tombstone used by idempotence, maintenance admission, and orphan
+ * GC. Active/stopped/error rows and their history are deliberately untouched.
+ *
+ * Returns whether terminal history remains enabled. The optional DB keeps the
+ * operation testable and lets the config manager apply a newly-disabled policy
+ * to the same host database immediately.
+ */
+export function applyTerminalHistoryRetention(db: Db = getDb()): boolean {
+  let retained = true;
+  db.transaction((tx) => {
+    retained = applyTerminalHistoryRetentionInTransaction(tx);
+  });
+  return retained;
+}
+
+/** Same policy, for callers that already own the crash-consistency boundary. */
+export function applyTerminalHistoryRetentionInTransaction(
+  db: DbExecutor,
+): boolean {
+  if (retainsTerminalHistory(db)) return true;
+
+  const terminalTasks = db
+    .select({ taskId: schema.hostTasks.taskId })
+    .from(schema.hostTasks)
+    .where(inArray(schema.hostTasks.statusMirror, [...TERMINAL_STATUSES]))
+    .all();
+
+  for (const { taskId } of terminalTasks) {
+    scrubTerminalTaskHistory(db, taskId);
+  }
+
+  return false;
+}
+
+/**
+ * Apply disabled retention to the task that is transitioning terminal.
+ *
+ * The full sweep above is reserved for boot reconciliation and the one-time
+ * config transition. Re-scanning every permanent tombstone on each task-down
+ * would make teardown cost grow with all historical tasks.
+ */
+export function applyTaskTerminalHistoryRetentionInTransaction(
+  db: DbExecutor,
+  taskId: string,
+): boolean {
+  if (retainsTerminalHistory(db)) return true;
+  const status = db
+    .select({ statusMirror: schema.hostTasks.statusMirror })
+    .from(schema.hostTasks)
+    .where(eq(schema.hostTasks.taskId, taskId))
+    .get()?.statusMirror;
+  if (status && isTerminal(status)) scrubTerminalTaskHistory(db, taskId);
+  return false;
+}
+
+function scrubTerminalTaskHistory(db: DbExecutor, taskId: string): void {
+  db.delete(schema.hostAgentSessions)
+    .where(eq(schema.hostAgentSessions.taskId, taskId))
+    .run();
+  db.delete(schema.hostEvents)
+    .where(eq(schema.hostEvents.taskId, taskId))
+    .run();
+  db.update(schema.hostTasks)
+    .set({
+      ownerUserId: null,
+      ownerEmail: null,
+      ownerName: null,
+      projectSlugs: "[]",
+      startedAt: null,
+    })
+    .where(eq(schema.hostTasks.taskId, taskId))
+    .run();
+}

package/lib/skills.ts

@@ -23,6 +23,11 @@ import { resolve } from "node:path";
 
 import { taskWorkspaceDir } from "./env";
 import { dockerCli } from "./docker-exec";
+import {
+  taskAppContainerName,
+  taskContainerCli,
+} from "./task-container-cli";
+import { runtimeAuthorityDockerExecArgs } from "./runtime-authority";
 import type { RosterAgent, RosterSkill } from "./agents/types";
 
 /** Skills that go into the flat per-agent SKILL.md — link/document only. The
@@ -176,9 +181,25 @@ export type SkillExec = (
   cwd?: string,
 ) => Promise<{ status: number | null; stderr: string }>;
 
+export function packageSkillDockerExecArgs(
+  container: string,
+  cmd: string[],
+  cwd?: string,
+): string[] {
+  return [
+    "exec",
+    "-u",
+    "node",
+    ...(cwd ? ["-w", cwd] : []),
+    ...runtimeAuthorityDockerExecArgs(),
+    container,
+    ...cmd,
+  ];
+}
+
 const dockerExec: SkillExec = async (container, cmd, cwd) => {
-  const full = ["exec", "-u", "node", ...(cwd ? ["-w", cwd] : []), container, ...cmd];
-  const res = await dockerCli(full, { timeoutMs: SKILL_EXEC_TIMEOUT_MS });
+  const full = packageSkillDockerExecArgs(container, cmd, cwd);
+  const res = await taskContainerCli(full, { timeoutMs: SKILL_EXEC_TIMEOUT_MS });
   return { status: res.status, stderr: res.stderr };
 };
 
@@ -197,7 +218,7 @@ export async function installPackageSkills(
 ): Promise<string[]> {
   const pkgs = collectPackageSkills(agents);
   if (pkgs.length === 0) return [];
-  const container = `task-${taskId}-app-1`;
+  const container = taskAppContainerName(taskId);
   const done: string[] = [];
 
   for (const s of pkgs) {

package/lib/ssh.ts

@@ -11,6 +11,7 @@
 
 import { spawnSync } from "node:child_process";
 import {
+  lstatSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
@@ -25,6 +26,7 @@ import { eq } from "drizzle-orm";
 import { getDb, schema } from "./db";
 import { env } from "./env";
 import { sealAesGcm, openAesGcm } from "./secrets";
+import { assertSafeHostTaskId } from "./task-identity";
 
 const withNewline = (s: string): string => (s.endsWith("\n") ? s : `${s}\n`);
 
@@ -187,3 +189,19 @@ export function writeTaskIdentity(
 export function removeTaskIdentity(taskId: string): void {
   rmSync(taskIdentityDir(taskId), { recursive: true, force: true });
 }
+
+/** Orphan GC may acknowledge only after the materialized private key is
+ * positively absent. The caller first retires every task-scoped ensure, so no
+ * trusted host continuation can recreate this directory after the check. */
+export function removeTaskIdentityStrict(taskId: string): void {
+  assertSafeHostTaskId(taskId);
+  const dir = taskIdentityDir(taskId);
+  rmSync(dir, { recursive: true, force: true });
+  try {
+    lstatSync(dir);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+  throw new Error("task SSH identity remains after removal");
+}