@runuai/host 0.9.14 → 0.9.42

package/src/protocol.ts

@@ -29,6 +29,31 @@ export type HostCommandResult<T> =
       code: HostErrorCode;
       message: string;
       retryable?: boolean;
+      /**
+       * Narrow rolling-safe reason for a retryable refusal. Old cloud readers
+       * ignore this additive field; new readers use it only to bridge the
+       * short supervisor restart after a managed-runtime activation. Generic
+       * `retryable` failures (for example, no Docker runtime) remain fail-fast.
+       */
+      retryReason?: "managed_restart" | "runtime_setup";
+      /**
+       * Who decided this failed.
+       *
+       * `"cloud"` means the command never reached a host at all — the bridge
+       * had no socket, the socket belongs to another instance, or a relay/ack
+       * deadline expired. Absent means the HOST answered.
+       *
+       * It is a separate field rather than a distinct error code on purpose.
+       * `host_unavailable` is emitted from both sides — the host uses it for
+       * its own probes (Docker not answering, Git state unverifiable) — and a
+       * caller that must tell those apart, like the ADR-084 failure streak,
+       * cannot do it from the code. Splitting the CODE instead would put a new
+       * wire value in front of instances that predate it: during a rolling
+       * deploy an old cloud receives a relayed reply from a new socket owner,
+       * finds no case for it in `hostStatus`, and renders an error as HTTP 200.
+       * An unknown FIELD is ignored by old readers; an unknown CODE is not.
+       */
+      origin?: "cloud";
     };
 
 /** Capability ids shared by host advertisement and fail-closed cloud gates. */
@@ -46,6 +71,41 @@ export const GITHUB_CREDENTIAL_GENERATION_PROTOCOL_FEATURE =
 // a disconnect no longer loses events (they replay), so it keeps its
 // in-flight turn buffers across the gap.
 export const EVENT_REPLAY_PROTOCOL_FEATURE = "event-replay-v1";
+/** ADR-100 L2: the cloud can request a bounded, positive-evidence inventory
+ * of task-owned state from this authenticated host generation. */
+export const HOST_TASK_INVENTORY_PROTOCOL_FEATURE = "host-task-inventory-v1";
+/** ADR-100 L3: a host advertising this feature publishes its one-way
+ * boot-maintenance readiness latch and rejects task/container work until the
+ * initial standard-image and shared-CLI reconciliation has settled. */
+export const HOST_MAINTENANCE_READINESS_PROTOCOL_FEATURE =
+  "host-maintenance-readiness-v1";
+/** ADR-100 L3: bounded health for the host-local MCP gateway listener. */
+export const MCP_GATEWAY_HEALTH_PROTOCOL_FEATURE = "mcp-gateway-health-v1";
+/** ADR-100 remote host operations. Each family is independently advertised so
+ * a rolling cloud can expose only controls that the connected host supports. */
+export const HOST_LOGS_PROTOCOL_FEATURE = "host-logs-v1";
+export const HOST_ENGINE_LOGIN_PROTOCOL_FEATURE = "host-engine-login-v1";
+export const HOST_CONFIG_PROTOCOL_FEATURE = "host-config-v1";
+export const MAX_HOST_OP_ID_CHARS = 128;
+export const MAX_HOST_LOG_LINES = 1_000;
+export const MAX_HOST_LOG_LINE_BYTES = 4 * 1_024;
+export const MAX_HOST_LOG_CHUNK_LINES = 100;
+export const MAX_HOST_LOG_CHUNK_BYTES = 64 * 1_024;
+export const MAX_ENGINE_LOGIN_TEXT_CHARS = 4_096;
+export const MAX_ENGINE_LOGIN_QUERY_CHARS = 4_096;
+export const MAX_ENGINE_LOGIN_URL_CHARS = 2_048;
+export const MAX_REMOTE_HOST_MESSAGE_BYTES = 512;
+export const MAX_HOST_TASK_INVENTORY_PAGE_SIZE = 256;
+export const MAX_HOST_TASK_INVENTORY_SCAN_ID_CHARS = 128;
+export const MAX_HOST_TASK_INVENTORY_TASK_ID_CHARS = 128;
+/**
+ * A redeem response carrying this exact header proves the cloud checks a spent
+ * token before expiry. That lets a new CLI distinguish a definitive 404/410
+ * from an old/rolled-back handler whose 410 could follow a committed response
+ * that was lost in transit.
+ */
+export const ENROLLMENT_REPLAY_PROTOCOL_HEADER = "x-uai-enrollment-replay";
+export const ENROLLMENT_REPLAY_PROTOCOL_VERSION = "same-host-v1";
 export const COMMUNICATOR_EXECUTION_PROFILE = "communicator";
 export const MAX_AGENT_ID_CHARS = 128;
 export const MAX_SECRETARY_DISPATCH_RECIPIENTS = 16;
@@ -68,6 +128,20 @@ export interface CommandContext {
    * dead resolver per retry.
    */
   timeoutMs?: number;
+  /**
+   * Cloud-internal routing override for a durable taskDown. Lifecycle cleanup
+   * may outlive the task row whose host assignment normally routes commands.
+   * This field is context metadata: it is never serialized onto the host
+   * command frame, and no host/request payload may populate it.
+   */
+  targetHostId?: string;
+  /**
+   * Cloud-internal credential-generation fence paired with targetHostId.
+   * Durable cleanup snapshots the registry verifier before source deletion;
+   * the bridge must route only to a socket authenticated with this exact hash.
+   * Like targetHostId, this is relay metadata and never reaches the host wire.
+   */
+  expectedHostTokenHash?: string;
 }
 
 export type PermissionDecision = { kind: "accept" } | { kind: "decline" };
@@ -100,6 +174,557 @@ export interface TaskAgent {
   permissions?: string[];
 }
 
+export type ContainerRuntimePreference = "auto" | "docker" | "apple-container";
+
+/** ADR-101 runtime state. The wire shape is deliberately impossible to
+ * misinterpret: transitional state has no verdict, ready names the selected
+ * provider, and a failed verdict always carries bounded operator guidance. */
+export type ContainerRuntimeCapability =
+  | {
+      status: "checking";
+      preference: ContainerRuntimePreference;
+      provider?: never;
+      message?: never;
+      action?: never;
+    }
+  | {
+      status: "ready";
+      preference: "auto" | "docker";
+      provider: "docker";
+      message?: never;
+      action?: never;
+    }
+  | {
+      status: "ready";
+      preference: "auto" | "apple-container";
+      provider: "apple-container";
+      message?: never;
+      action?: never;
+    }
+  | {
+      status: "no-runtime";
+      preference: ContainerRuntimePreference;
+      provider?: never;
+      message: string;
+      action: string;
+    };
+
+/** ADR-100: bounded operator-visible state for the host-local MCP gateway.
+ * Raw bind errors are deliberately not part of the capability frame. */
+export type McpGatewayCapability =
+  | { status: "starting"; port: number }
+  | { status: "ready"; port: number }
+  | {
+      status: "down";
+      port: number;
+      reason: "port_in_use" | "bind_failed";
+    };
+
+/** ADR-100 operation ids are deliberately URL/DOM-safe and bounded before
+ * they are admitted to any per-connection operation map. */
+export type HostOpId = string;
+
+export interface HostLogsStartFrame {
+  kind: "host.logs.start";
+  opId: HostOpId;
+  lines: number;
+  follow: boolean;
+}
+
+export interface HostLogsStopFrame {
+  kind: "host.logs.stop";
+  opId: HostOpId;
+}
+
+export interface HostLogsChunkFrame {
+  kind: "host.logs.chunk";
+  opId: HostOpId;
+  lines: string[];
+  /** Lines discarded by the host's bounded drop-oldest buffer. Omitted at 0. */
+  dropped?: number;
+}
+
+export type HostLogsEndReason = "complete" | "stopped" | "error";
+
+export type HostLogsEndFrame =
+  | {
+      kind: "host.logs.end";
+      opId: HostOpId;
+      reason: "complete" | "stopped";
+      message?: never;
+    }
+  | {
+      kind: "host.logs.end";
+      opId: HostOpId;
+      reason: "error";
+      message: string;
+    };
+
+export type EngineLoginKind = "claude" | "codex";
+export type EngineLoginPhase =
+  | "starting"
+  | "authorize"
+  | "awaiting_input"
+  | "awaiting_callback"
+  | "succeeded"
+  | "failed"
+  | "cancelled"
+  | "timed_out";
+export type EngineLoginErrorCode =
+  | "unavailable"
+  | "start_failed"
+  | "invalid_input"
+  | "invalid_callback"
+  | "persist_failed"
+  | "timeout";
+
+export interface EngineLoginStartFrame {
+  kind: "engine.login.start";
+  opId: HostOpId;
+  engine: EngineLoginKind;
+}
+
+/** The only generic one-time response channel. Long-lived tokens must never
+ * be represented by this protocol and are persisted entirely on the host. */
+export interface EngineLoginInputFrame {
+  kind: "engine.login.input";
+  opId: HostOpId;
+  text: string;
+}
+
+/** The pasted failed-localhost callback query used by Codex's login flow. */
+export interface EngineLoginCallbackFrame {
+  kind: "engine.login.callback";
+  opId: HostOpId;
+  query: string;
+}
+
+export interface EngineLoginStopFrame {
+  kind: "engine.login.stop";
+  opId: HostOpId;
+}
+
+interface EngineLoginEventBase {
+  kind: "engine.login.event";
+  opId: HostOpId;
+  engine: EngineLoginKind;
+  message?: string;
+}
+
+/** Secret-blind host→cloud login progress. OAuth codes and callback queries
+ * have no field in this direction; `errorCode` is a closed machine reason. */
+export type EngineLoginEventFrame =
+  | (EngineLoginEventBase & {
+      phase: "authorize";
+      url: string;
+      errorCode?: never;
+    })
+  | (EngineLoginEventBase & {
+      phase: "failed" | "timed_out";
+      url?: never;
+      errorCode?: EngineLoginErrorCode;
+    })
+  | (EngineLoginEventBase & {
+      phase:
+        | "starting"
+        | "awaiting_input"
+        | "awaiting_callback"
+        | "succeeded"
+        | "cancelled";
+      url?: never;
+      errorCode?: never;
+    });
+
+/** Rolling-safe, secret-free engine state. v1 intentionally makes no claim
+ * about expiry; that requires positive adapter evidence in a future version. */
+export interface EngineLoginCapability {
+  engine: EngineLoginKind;
+  status: "configured" | "missing";
+  loginSupported: true;
+}
+
+/** The exact local host settings ADR-100 permits over the bridge. */
+export interface HostConfigState {
+  agentCliAutoupdate: boolean;
+  telemetryEnabled: boolean;
+  retainTerminalHistory: boolean;
+}
+
+export type HostConfigPatch = Partial<HostConfigState>;
+
+export interface HostConfigGetFrame {
+  kind: "host.config.get";
+  opId: HostOpId;
+}
+
+export interface HostConfigSetFrame {
+  kind: "host.config.set";
+  opId: HostOpId;
+  patch: HostConfigPatch;
+}
+
+export type HostConfigErrorCode = "invalid_patch" | "persistence_failed";
+
+export type HostConfigAckFrame =
+  | {
+      kind: "host.config.ack";
+      opId: HostOpId;
+      ok: true;
+      config: HostConfigState;
+      restartRequired: boolean;
+    }
+  | {
+      kind: "host.config.ack";
+      opId: HostOpId;
+      ok: false;
+      errorCode: HostConfigErrorCode;
+      message: string;
+    };
+
+type WireObject = Record<string, unknown>;
+const utf8Encoder = new TextEncoder();
+
+function utf8ByteLength(value: string): number {
+  return utf8Encoder.encode(value).byteLength;
+}
+
+function exactWireObject(
+  value: unknown,
+  required: readonly string[],
+  optional: readonly string[] = [],
+): WireObject | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const object = value as WireObject;
+  const keys = Object.keys(object);
+  const allowed = new Set([...required, ...optional]);
+  if (
+    required.some((key) => !Object.hasOwn(object, key)) ||
+    keys.some((key) => !allowed.has(key))
+  ) {
+    return null;
+  }
+  return object;
+}
+
+function isBoundedMessage(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    utf8ByteLength(value) <= MAX_REMOTE_HOST_MESSAGE_BYTES
+  );
+}
+
+function isEngineLoginKind(value: unknown): value is EngineLoginKind {
+  return value === "claude" || value === "codex";
+}
+
+function isEngineLoginErrorCode(value: unknown): value is EngineLoginErrorCode {
+  return (
+    value === "unavailable" ||
+    value === "start_failed" ||
+    value === "invalid_input" ||
+    value === "invalid_callback" ||
+    value === "persist_failed" ||
+    value === "timeout"
+  );
+}
+
+function isHttpsUrl(value: unknown): value is string {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > MAX_ENGINE_LOGIN_URL_CHARS ||
+    value.trim() !== value
+  ) {
+    return false;
+  }
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+
+export function isHostOpId(value: unknown): value is HostOpId {
+  return (
+    typeof value === "string" &&
+    value.length <= MAX_HOST_OP_ID_CHARS &&
+    /^[A-Za-z0-9_-]+$/.test(value)
+  );
+}
+
+export function isHostLogsStartFrame(
+  value: unknown,
+): value is HostLogsStartFrame {
+  const frame = exactWireObject(value, ["kind", "opId", "lines", "follow"]);
+  return Boolean(
+    frame &&
+      frame.kind === "host.logs.start" &&
+      isHostOpId(frame.opId) &&
+      typeof frame.lines === "number" &&
+      Number.isSafeInteger(frame.lines) &&
+      frame.lines >= 1 &&
+      frame.lines <= MAX_HOST_LOG_LINES &&
+      typeof frame.follow === "boolean",
+  );
+}
+
+export function isHostLogsStopFrame(
+  value: unknown,
+): value is HostLogsStopFrame {
+  const frame = exactWireObject(value, ["kind", "opId"]);
+  return Boolean(
+    frame && frame.kind === "host.logs.stop" && isHostOpId(frame.opId),
+  );
+}
+
+export function isHostLogsChunkFrame(
+  value: unknown,
+): value is HostLogsChunkFrame {
+  const frame = exactWireObject(value, ["kind", "opId", "lines"], ["dropped"]);
+  if (
+    !frame ||
+    frame.kind !== "host.logs.chunk" ||
+    !isHostOpId(frame.opId) ||
+    !Array.isArray(frame.lines) ||
+    frame.lines.length < 1 ||
+    frame.lines.length > MAX_HOST_LOG_CHUNK_LINES ||
+    frame.lines.some(
+      (line) =>
+        typeof line !== "string" ||
+        utf8ByteLength(line) > MAX_HOST_LOG_LINE_BYTES,
+    ) ||
+    frame.lines.reduce(
+      (bytes, line) => bytes + utf8ByteLength(line as string),
+      0,
+    ) > MAX_HOST_LOG_CHUNK_BYTES
+  ) {
+    return false;
+  }
+  return (
+    !Object.hasOwn(frame, "dropped") ||
+    (typeof frame.dropped === "number" &&
+      Number.isSafeInteger(frame.dropped) &&
+      frame.dropped >= 0)
+  );
+}
+
+export function isHostLogsEndFrame(value: unknown): value is HostLogsEndFrame {
+  const frame = exactWireObject(value, ["kind", "opId", "reason"], ["message"]);
+  if (
+    !frame ||
+    frame.kind !== "host.logs.end" ||
+    !isHostOpId(frame.opId)
+  ) {
+    return false;
+  }
+  if (frame.reason === "error") {
+    return Object.hasOwn(frame, "message") && isBoundedMessage(frame.message);
+  }
+  return (
+    (frame.reason === "complete" || frame.reason === "stopped") &&
+    !Object.hasOwn(frame, "message")
+  );
+}
+
+export function isEngineLoginStartFrame(
+  value: unknown,
+): value is EngineLoginStartFrame {
+  const frame = exactWireObject(value, ["kind", "opId", "engine"]);
+  return Boolean(
+    frame &&
+      frame.kind === "engine.login.start" &&
+      isHostOpId(frame.opId) &&
+      isEngineLoginKind(frame.engine),
+  );
+}
+
+export function isEngineLoginInputFrame(
+  value: unknown,
+): value is EngineLoginInputFrame {
+  const frame = exactWireObject(value, ["kind", "opId", "text"]);
+  return Boolean(
+    frame &&
+      frame.kind === "engine.login.input" &&
+      isHostOpId(frame.opId) &&
+      typeof frame.text === "string" &&
+      frame.text.length >= 1 &&
+      frame.text.length <= MAX_ENGINE_LOGIN_TEXT_CHARS,
+  );
+}
+
+export function isEngineLoginCallbackFrame(
+  value: unknown,
+): value is EngineLoginCallbackFrame {
+  const frame = exactWireObject(value, ["kind", "opId", "query"]);
+  return Boolean(
+    frame &&
+      frame.kind === "engine.login.callback" &&
+      isHostOpId(frame.opId) &&
+      typeof frame.query === "string" &&
+      frame.query.length >= 1 &&
+      frame.query.length <= MAX_ENGINE_LOGIN_QUERY_CHARS,
+  );
+}
+
+export function isEngineLoginStopFrame(
+  value: unknown,
+): value is EngineLoginStopFrame {
+  const frame = exactWireObject(value, ["kind", "opId"]);
+  return Boolean(
+    frame && frame.kind === "engine.login.stop" && isHostOpId(frame.opId),
+  );
+}
+
+export function isEngineLoginEventFrame(
+  value: unknown,
+): value is EngineLoginEventFrame {
+  const frame = exactWireObject(
+    value,
+    ["kind", "opId", "engine", "phase"],
+    ["url", "errorCode", "message"],
+  );
+  if (
+    !frame ||
+    frame.kind !== "engine.login.event" ||
+    !isHostOpId(frame.opId) ||
+    !isEngineLoginKind(frame.engine) ||
+    (Object.hasOwn(frame, "message") && !isBoundedMessage(frame.message))
+  ) {
+    return false;
+  }
+  if (frame.phase === "authorize") {
+    return (
+      isHttpsUrl(frame.url) &&
+      !Object.hasOwn(frame, "errorCode")
+    );
+  }
+  if (Object.hasOwn(frame, "url")) return false;
+  if (frame.phase === "failed" || frame.phase === "timed_out") {
+    return (
+      !Object.hasOwn(frame, "errorCode") ||
+      isEngineLoginErrorCode(frame.errorCode)
+    );
+  }
+  return (
+    (frame.phase === "starting" ||
+      frame.phase === "awaiting_input" ||
+      frame.phase === "awaiting_callback" ||
+      frame.phase === "succeeded" ||
+      frame.phase === "cancelled") &&
+    !Object.hasOwn(frame, "errorCode")
+  );
+}
+
+export function isEngineLoginCapability(
+  value: unknown,
+): value is EngineLoginCapability {
+  const capability = exactWireObject(value, [
+    "engine",
+    "status",
+    "loginSupported",
+  ]);
+  return Boolean(
+    capability &&
+      isEngineLoginKind(capability.engine) &&
+      (capability.status === "configured" || capability.status === "missing") &&
+      capability.loginSupported === true,
+  );
+}
+
+export function isHostConfigState(value: unknown): value is HostConfigState {
+  const config = exactWireObject(value, [
+    "agentCliAutoupdate",
+    "telemetryEnabled",
+    "retainTerminalHistory",
+  ]);
+  return Boolean(
+    config &&
+      typeof config.agentCliAutoupdate === "boolean" &&
+      typeof config.telemetryEnabled === "boolean" &&
+      typeof config.retainTerminalHistory === "boolean",
+  );
+}
+
+export function isHostConfigPatch(value: unknown): value is HostConfigPatch {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const patch = value as WireObject;
+  const keys = Object.keys(patch);
+  const allowed = new Set([
+    "agentCliAutoupdate",
+    "telemetryEnabled",
+    "retainTerminalHistory",
+  ]);
+  return (
+    keys.length >= 1 &&
+    keys.every(
+      (key) => allowed.has(key) && typeof patch[key] === "boolean",
+    )
+  );
+}
+
+export function isHostConfigGetFrame(
+  value: unknown,
+): value is HostConfigGetFrame {
+  const frame = exactWireObject(value, ["kind", "opId"]);
+  return Boolean(
+    frame && frame.kind === "host.config.get" && isHostOpId(frame.opId),
+  );
+}
+
+export function isHostConfigSetFrame(
+  value: unknown,
+): value is HostConfigSetFrame {
+  const frame = exactWireObject(value, ["kind", "opId", "patch"]);
+  return Boolean(
+    frame &&
+      frame.kind === "host.config.set" &&
+      isHostOpId(frame.opId) &&
+      isHostConfigPatch(frame.patch),
+  );
+}
+
+export function isHostConfigAckFrame(
+  value: unknown,
+): value is HostConfigAckFrame {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value as WireObject;
+  if (candidate.ok === true) {
+    const frame = exactWireObject(value, [
+      "kind",
+      "opId",
+      "ok",
+      "config",
+      "restartRequired",
+    ]);
+    return Boolean(
+      frame &&
+        frame.kind === "host.config.ack" &&
+        isHostOpId(frame.opId) &&
+        isHostConfigState(frame.config) &&
+        typeof frame.restartRequired === "boolean",
+    );
+  }
+  if (candidate.ok === false) {
+    const frame = exactWireObject(value, [
+      "kind",
+      "opId",
+      "ok",
+      "errorCode",
+      "message",
+    ]);
+    return Boolean(
+      frame &&
+        frame.kind === "host.config.ack" &&
+        isHostOpId(frame.opId) &&
+        (frame.errorCode === "invalid_patch" ||
+          frame.errorCode === "persistence_failed") &&
+        isBoundedMessage(frame.message),
+    );
+  }
+  return false;
+}
+
 /**
  * Host capability advertisement (ADR-021). Sent as a `host.capabilities`
  * frame after auth-success and re-sent when the host's adapter registry
@@ -131,6 +756,16 @@ export interface HostCapabilities {
     kind: string;
     availableVersions: string[];
   }>;
+  /** ADR-101: the machine-level container backend. Optional for rolling
+   *  compatibility with hosts predating runtime detection. */
+  containerRuntime?: ContainerRuntimeCapability;
+  /** ADR-100: one-way boot latch. It becomes true after the initial shared
+   * image/CLI maintenance pass settles, including a best-effort failure. */
+  maintenanceReady?: boolean;
+  /** ADR-100: health of the independently-retrying host MCP gateway. */
+  mcpGateway?: McpGatewayCapability;
+  /** ADR-100: feature-gated, secret-free remote login availability. */
+  engineLogins?: EngineLoginCapability[];
   // ADR-033: cloud user ids that currently have a GitHub token ON THIS HOST —
   // the per-host gh-connected state shown on the host detail page. Re-advertised
   // whenever a token is added/removed. Optional: older hosts omit it.
@@ -190,6 +825,9 @@ export interface TaskUpResult {
 export interface TaskDownResult {
   status?: string;
   alreadyGone?: boolean;
+  /** Present only after an ADR-100 orphan-GC command has proved runtime,
+   * filesystem, credential/ACL, and host-SQLite task state absent. */
+  localStatePruned?: true;
   [key: string]: unknown;
 }
 
@@ -278,6 +916,28 @@ export interface TaskDownInput {
   taskId: string;
   task: TaskCommandTask;
   projects: TaskCommandProject[];
+  /** Optional and additive for rolling compatibility. Ordinary taskDown keeps
+   * terminal host history; orphan GC deletes task-owned local metadata only
+   * after the destructive teardown has been positively verified. */
+  cleanup?: {
+    kind: "orphan-gc";
+    pruneLocalState: true;
+  };
+}
+
+export type HostTaskInventorySource =
+  | "db"
+  | "session"
+  | "event"
+  | "workspace"
+  | "compose"
+  | "network"
+  | "volume"
+  | "preview";
+
+export interface HostTaskInventoryEntry {
+  taskId: string;
+  sources: HostTaskInventorySource[];
 }
 
 export interface TaskDiffInput {
@@ -609,6 +1269,24 @@ export type CloudToHost =
   // probe (headerValue, clientSecret) are write-only; nothing secret ever
   // rides an ack. `opId` correlates request↔ack.
   | { kind: "mcp.op"; opId: string; op: McpOp }
+  // ADR-100 remote host operations. Each family is capability-gated by the
+  // cloud during rolling deploys and parsed with the exact guards above.
+  | HostLogsStartFrame
+  | HostLogsStopFrame
+  | EngineLoginStartFrame
+  | EngineLoginInputFrame
+  | EngineLoginCallbackFrame
+  | EngineLoginStopFrame
+  | HostConfigGetFrame
+  | HostConfigSetFrame
+  | {
+      kind: "host.inventory.request";
+      scanId: string;
+      /** Null starts a new immutable snapshot. Otherwise this is the previous
+       * page's opaque/safe task-id cursor. */
+      cursor: string | null;
+      limit: number;
+    }
   // ADR-103: sent once right after auth to a host that supplied a bootId.
   // `afterSeq` is the cloud's replay watermark for this boot: the host
   // replays every outbox entry with seq > afterSeq. `null` means the cloud
@@ -650,6 +1328,16 @@ export type HostToCloud =
   // for pre-103 hosts (which also never send seq'd events).
   | { kind: "auth"; token: string; hostId: string; bootId?: string }
   | { kind: "host.capabilities"; capabilities: HostCapabilities }
+  | {
+      kind: "host.inventory.page";
+      scanId: string;
+      cursor: string | null;
+      entries: HostTaskInventoryEntry[];
+      nextCursor: string | null;
+      /** False means one or more Docker label queries failed. Positive
+       * evidence from successful sources remains valid and is still sent. */
+      runtimeEnumerated: boolean;
+    }
   | {
       kind: "result";
       commandId: string;
@@ -733,7 +1421,13 @@ export type HostToCloud =
       authorizeUrl?: string;
       scopes?: string[];
     }
-  | { kind: "mcp.ack"; opId: string; ok: false; error: string };
+  | { kind: "mcp.ack"; opId: string; ok: false; error: string }
+  // ADR-100 remote operation output remains outside the durable task-event
+  // outbox: it belongs to one authenticated bridge connection and opId.
+  | HostLogsChunkFrame
+  | HostLogsEndFrame
+  | EngineLoginEventFrame
+  | HostConfigAckFrame;
 
 export type HostEvent =
   | {