@runuai/host 0.9.14 → 0.9.43

package/lib/github-tokens.ts

@@ -12,10 +12,26 @@ import { and, eq } from "drizzle-orm";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import { dockerCli } from "./docker-exec";
+import {
+  removeTaskAppContainer,
+  taskAppContainerName,
+  taskAppContainerState,
+  taskContainerCli,
+} from "./task-container-cli";
+import {
+  RUNTIME_AUTHORITY_ENV,
+  runtimeAuthorityDockerExecArgs,
+} from "./runtime-authority";
+import {
+  backgroundContainerWorkAllowed,
+  ContainerRuntimeUnavailableError,
+  requireContainerRuntimeOperational,
+} from "./runtime-guard";
 import {
   configureTaskSshTransport,
   ensureTaskSshIdentity,
 } from "./git-identity";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
 import {
   MAX_GITHUB_INSTALLATIONS,
   MAX_GITHUB_REPOSITORIES_PER_INSTALLATION,
@@ -84,6 +100,30 @@ const CLEAN_CONTAINER_ENV = [
   `PATH=${SAFE_CONTAINER_PATH}`,
 ] as const;
 
+/** Provider-exec form of {@link SANITIZED_DOCKER_EXEC_ENV}: same overrides,
+ * carried as a bounded env record instead of docker `-e` flags. */
+const SANITIZED_CONTAINER_ENV: Readonly<Record<string, string>> =
+  Object.freeze({
+    HOME: "/home/node",
+    GH_CONFIG_DIR: MANAGED_GH_CONFIG_DIR,
+    PATH: SAFE_CONTAINER_PATH,
+    XDG_CONFIG_HOME: "",
+    LD_PRELOAD: "",
+    LD_LIBRARY_PATH: "",
+    DYLD_INSERT_LIBRARIES: "",
+    DYLD_LIBRARY_PATH: "",
+    GIT_CONFIG: "",
+    GIT_CONFIG_GLOBAL: "",
+    GIT_CONFIG_SYSTEM: "",
+    GIT_CONFIG_NOSYSTEM: "",
+    GIT_CONFIG_COUNT: "0",
+    GIT_EXEC_PATH: "",
+    GIT_SSH: "",
+    GIT_SSH_COMMAND: "",
+    GIT_ASKPASS: "",
+    SSH_ASKPASS: "",
+  });
+
 function managedContainerExecArgs(
   container: string,
   command: string[],
@@ -95,6 +135,7 @@ function managedContainerExecArgs(
     "-u",
     "node",
     ...SANITIZED_DOCKER_EXEC_ENV,
+    ...runtimeAuthorityDockerExecArgs(),
     container,
     ...CLEAN_CONTAINER_ENV,
     ...command,
@@ -129,6 +170,7 @@ function advanceGithubAuthGeneration(userId: string): number {
 export function runGithubConnectionTransition<T>(
   userId: string,
   transition: () => Promise<T>,
+  admit?: () => void,
 ): Promise<T> {
   const previous =
     githubConnectionTransitionQueues.get(userId) ?? Promise.resolve();
@@ -136,7 +178,10 @@ export function runGithubConnectionTransition<T>(
   let tail!: Promise<void>;
   result = previous
     .catch(() => {})
-    .then(transition)
+    .then(() => {
+      admit?.();
+      return transition();
+    })
     .finally(() => {
       if (githubConnectionTransitionQueues.get(userId) === tail) {
         githubConnectionTransitionQueues.delete(userId);
@@ -458,12 +503,12 @@ async function bestEffortRevoke(
 }
 
 /**
- * Disconnect GitHub on this host (gh.connect.clear handler). Deletes the token
- * locally FIRST (so capability readers stop trusting it immediately), waits
- * for best-effort revocation, then waits for every live container to drop the
- * credential and select its disconnected transport. The surrounding
- * generation transition is serialized so a delayed revoke cannot target a
- * subsequently stored replacement.
+ * Disconnect GitHub on this host (gh.connect.clear handler). The surrounding
+ * claimed `clear` generation makes the stored row inert immediately. Keep that
+ * row recoverable until every live container has dropped the credential and
+ * selected its disconnected transport; only then delete it and best-effort
+ * revoke remotely. A runtime loss can therefore reject without turning a
+ * retryable scrub into an irreversible half-transition.
  *
  * ADR-033: only a non-expiring ACCESS token can be revoked by token
  * (`DELETE /applications/{client_id}/token` matches access tokens only — a
@@ -500,25 +545,6 @@ export async function onConnectClear(
     );
   }
 
-  // Local capability removal is synchronous and authoritative. It must happen
-  // even when token decryption or GitHub's revoke endpoint is unavailable.
-  (deps.deleteLocal ?? deleteToken)(userId);
-
-  // Await best-effort remote revocation while the caller still owns the
-  // per-user transition lock. revokeAtGitHub catches its own failures; the
-  // wrapper also contains failures from injected test/alternate implementations.
-  if (stored?.kind === "access") {
-    await bestEffortRevoke(
-      userId,
-      stored.token,
-      deps.revoke ?? revokeAtGitHub,
-    );
-  } else if (stored) {
-    console.warn(
-      `[github] user ${userId}: legacy refresh token cleared locally; cannot single-token revoke at GitHub`,
-    );
-  }
-
   // Incrementing the host-Git generation prevents any not-yet-started use of
   // an old prepared handle. Await already-started task-up operations before
   // discovering and scrubbing containers: a task may create its app container
@@ -539,6 +565,27 @@ export async function onConnectClear(
     (result): result is PromiseRejectedResult => result.status === "rejected",
   );
   if (failed) throw failed.reason;
+
+  // The claimed clear already removed this generation from every authority
+  // read. Delete the recoverable ciphertext only after all container scrubs
+  // crossed their durable boundary, so the same-generation operation can be
+  // retried if Docker disappeared mid-transition.
+  (deps.deleteLocal ?? deleteToken)(userId);
+
+  // Await best-effort remote revocation while the caller still owns the
+  // per-user transition lock. revokeAtGitHub catches its own failures; the
+  // wrapper also contains failures from injected test/alternate implementations.
+  if (stored?.kind === "access") {
+    await bestEffortRevoke(
+      userId,
+      stored.token,
+      deps.revoke ?? revokeAtGitHub,
+    );
+  } else if (stored) {
+    console.warn(
+      `[github] user ${userId}: legacy refresh token cleared locally; cannot single-token revoke at GitHub`,
+    );
+  }
 }
 
 /** Fail-closed rollback for a generation that was claimed for set but could
@@ -1279,7 +1326,10 @@ export type DockerExec = (
 ) => Promise<{ status: number | null; stderr: string }>;
 
 const defaultExec: DockerExec = async (args, input) => {
-  const res = await dockerCli(args, { input, timeoutMs: EXEC_TIMEOUT_MS });
+  const res = await taskContainerCli(args, {
+    input,
+    timeoutMs: EXEC_TIMEOUT_MS,
+  });
   return { status: res.status, stderr: res.stderr };
 };
 
@@ -1292,10 +1342,38 @@ export async function injectIntoContainer(
   taskId: string,
   accessToken: string,
   exec: DockerExec = defaultExec,
+  admitContainerWork: () => void = requireContainerRuntimeOperational,
+  environment?: Pick<TaskEnvironmentHandle, "exec">,
 ): Promise<void> {
-  const container = `task-${taskId}-app-1`;
-  const args = managedContainerExecArgs(
-    container,
+  const container = taskAppContainerName(taskId);
+  // Provider-neutral path: same in-container `/usr/bin/env -i` command, same
+  // sanitized-plus-authority environment, argv/stdin separation preserved.
+  const run: (
+    command: string[],
+    input: string,
+  ) => Promise<{ status: number | null; stderr: string }> = environment
+    ? async (command, input) => {
+        const [first, ...rest] = [...CLEAN_CONTAINER_ENV, ...command];
+        const result = await environment.exec({
+          argv: [first!, ...rest],
+          user: "node",
+          env: { ...SANITIZED_CONTAINER_ENV, ...RUNTIME_AUTHORITY_ENV },
+          ...(input ? { stdin: Buffer.from(input) } : {}),
+          timeoutMs: EXEC_TIMEOUT_MS,
+          maxOutputBytes: 256 * 1024,
+        });
+        return {
+          status: result.exitCode,
+          stderr: Buffer.from(result.stderr).toString("utf8"),
+        };
+      }
+    : (command, input) =>
+        exec(
+          managedContainerExecArgs(container, command, input.length > 0),
+          input,
+        );
+  admitContainerWork();
+  const res = await run(
     [
       "/usr/bin/gh",
       "auth",
@@ -1306,40 +1384,38 @@ export async function injectIntoContainer(
       "--git-protocol",
       "https",
     ],
-    true,
+    `${accessToken}\n`,
   );
-  const res = await exec(args, `${accessToken}\n`);
+  admitContainerWork();
   if (res.status !== 0) {
     throw new Error(`gh auth login failed in ${container}: ${res.stderr.trim()}`);
   }
 
-  const setup = await exec(
-    managedContainerExecArgs(container, [
-      "/usr/bin/gh",
-      "auth",
-      "setup-git",
-      "--hostname",
-      "github.com",
-    ]),
+  admitContainerWork();
+  const setup = await run(
+    ["/usr/bin/gh", "auth", "setup-git", "--hostname", "github.com"],
     "",
   );
+  admitContainerWork();
   if (setup.status !== 0) {
     throw new Error(
       `gh git credential setup failed in ${container}: ${setup.stderr.trim()}`,
     );
   }
 
-  const transport = await exec(
-    managedContainerExecArgs(container, [
+  admitContainerWork();
+  const transport = await run(
+    [
       "/bin/sh",
       "-c",
       "/usr/bin/git config --global --unset-all 'url.git@github.com:.insteadOf' >/dev/null 2>&1 || true; " +
         "/usr/bin/git config --global --unset-all core.sshCommand >/dev/null 2>&1 || true; " +
         "/usr/bin/git config --global --replace-all 'url.https://github.com/.insteadOf' 'git@github.com:'; " +
         "/usr/bin/git config --global --add 'url.https://github.com/.insteadOf' 'ssh://git@github.com/'",
-    ]),
+    ],
     "",
   );
+  admitContainerWork();
   if (transport.status !== 0) {
     throw new Error(
       `Git HTTPS transport setup failed in ${container}: ${transport.stderr.trim()}`,
@@ -1370,6 +1446,10 @@ export function scheduleRefresh(
   const timer = setTimeout(() => {
     timers.delete(taskId);
     if (githubAuthGeneration(userId) !== generation) return;
+    if (!backgroundContainerWorkAllowed()) {
+      scheduleGithubRetry(taskId, userId, 0, {}, generation);
+      return;
+    }
     void enqueueTaskGitAuth(taskId, userId, {}, {
       generation,
       getGeneration: () => githubAuthGeneration(userId),
@@ -1496,6 +1576,13 @@ function scheduleGithubRetry(
     if (githubAuthGeneration(userId) !== generation) return;
     const isActive = deps.taskIsActive ?? taskIsActive;
     if (!isActive(taskId)) return; // task ended while we backed off
+    if (!backgroundContainerWorkAllowed()) {
+      // Runtime downtime is not a failed GitHub attempt. Preserve the same
+      // retry budget and wait for another backoff window instead of spawning
+      // Docker while the host is deliberately fail-closed.
+      scheduleGithubRetry(taskId, userId, attempt, deps, generation);
+      return;
+    }
     void enqueueTaskGitAuth(taskId, userId, {}, {
       generation,
       getGeneration: () => githubAuthGeneration(userId),
@@ -1534,6 +1621,9 @@ export interface SetupTaskDeps {
   deleteToken?: (userId: string) => void;
   taskIsActive?: (taskId: string) => boolean;
   scrub?: (taskId: string) => Promise<boolean | void>;
+  /** Late-bound provider handle for the default injection path. Absent (or
+   * null at call time) keeps the legacy Docker fallback. */
+  environment?: () => Pick<TaskEnvironmentHandle, "exec"> | null;
 }
 
 /**
@@ -1546,6 +1636,7 @@ export interface SetupTaskDeps {
 interface SetupExecutionGuard {
   generation: number;
   isCurrent: () => boolean;
+  admitContainerWork: () => void;
 }
 
 export async function setupTaskGithub(
@@ -1563,13 +1654,23 @@ export async function setupTaskGithub(
   const _hasToken = deps.hasToken ?? hasToken;
   const _request = deps.requestAccessToken ?? requestAccessToken;
   const _inject =
-    deps.inject ?? ((t: string, tok: string) => injectIntoContainer(t, tok));
+    deps.inject ??
+    ((t: string, tok: string) =>
+      injectIntoContainer(
+        t,
+        tok,
+        defaultExec,
+        guard?.admitContainerWork ?? requireContainerRuntimeOperational,
+        deps.environment?.() ?? undefined,
+      ));
   if (!isCurrent()) return false;
   try {
     if (_hasToken(userId)) {
       const tok = await _request(userId);
       if (tok && isCurrent()) {
+        guard?.admitContainerWork();
         await _inject(taskId, tok.accessToken);
+        guard?.admitContainerWork();
         // The mutation itself cannot be interrupted, but a newer transition is
         // already queued behind us. Do not let this stale run arm more work.
         if (!isCurrent()) return false;
@@ -1618,7 +1719,9 @@ export async function setupTaskGithub(
             `not task owner ${userId} — skipping.`,
         );
       } else {
+        guard?.admitContainerWork();
         await _inject(taskId, pat);
+        guard?.admitContainerWork();
         clearGithubRetry(taskId);
         console.log(`[github] task ${taskId}: using PAT fallback (no refresh)`);
         return true;
@@ -1630,6 +1733,10 @@ export async function setupTaskGithub(
     // A newer connect/disconnect owns the final state and is queued behind this
     // operation. The superseded run must neither delete its grant nor retry.
     if (!isCurrent()) return false;
+    // Runtime unavailability is not an ordinary "GitHub not configured" or
+    // retryable credential verdict. Reconciliation callers must reject so a
+    // destructive set/clear transition cannot be acknowledged as complete.
+    if (err instanceof ContainerRuntimeUnavailableError) throw err;
     const reason = err instanceof Error ? err.message : String(err);
     console.warn(`[github] task ${taskId}: gh setup failed: ${reason}`);
     // A revoked refresh token can't recover by retrying — drop it so the user
@@ -1687,8 +1794,11 @@ async function checkedDockerCommand(
   args: string[],
   label: string,
   timeoutMs = EXEC_TIMEOUT_MS,
+  admitContainerWork: () => void = requireContainerRuntimeOperational,
 ): Promise<Awaited<ReturnType<DockerCommand>>> {
+  admitContainerWork();
   const result = await run(args, { timeoutMs });
+  admitContainerWork();
   if (result.status !== 0) {
     throw new Error(
       `${label} failed: ${result.stderr.trim() || `exit ${result.status}`}`,
@@ -1699,52 +1809,27 @@ async function checkedDockerCommand(
 
 export async function removeGithubFromContainer(
   taskId: string,
-  run: DockerCommand = dockerCli,
+  run: DockerCommand = taskContainerCli,
+  admitContainerWork: () => void = requireContainerRuntimeOperational,
 ): Promise<boolean> {
-  const container = `task-${taskId}-app-1`;
-  const listed = await checkedDockerCommand(
-    run,
-    [
-      "ps",
-      "--all",
-      "--filter",
-      `name=^/${container}$`,
-      "--format",
-      "{{.State}}",
-    ],
-    `inspect ${container}`,
-  );
-  const states = listed.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-  if (states.length === 0) return false; // no container means no credential to retain
-  if (states.length !== 1) {
-    throw new Error(`inspect ${container} returned ${states.length} containers`);
+  const container = taskAppContainerName(taskId);
+  admitContainerWork();
+  const observed = await taskAppContainerState(container, run as never);
+  admitContainerWork();
+  if (observed.kind === "unknown") {
+    throw new Error(`inspect ${container} failed: ${observed.detail}`);
+  }
+  if (observed.kind === "absent") {
+    return false; // no container means no credential to retain
   }
 
-  const originalState = states[0];
-  if (originalState !== "running") {
+  if (observed.kind !== "running") {
     // Never start or unpause untrusted task code while its old credential is
     // still on disk. The app container is disposable; workspace/repository
-    // state lives outside it and Compose recreates it on Resume.
-    await checkedDockerCommand(
-      run,
-      ["rm", "--force", container],
-      `remove credential-bearing ${container}`,
-    );
-    const remaining = await checkedDockerCommand(
-      run,
-      [
-        "ps",
-        "--all",
-        "--filter",
-        `name=^/${container}$`,
-        "--format",
-        "{{.State}}",
-      ],
-      `verify removal of ${container}`,
-    );
-    if (remaining.stdout.trim()) {
-      throw new Error(`remove ${container} was not verified`);
-    }
+    // state lives outside it and provisioning recreates it on Resume.
+    admitContainerWork();
+    await removeTaskAppContainer(container, run as never);
+    admitContainerWork();
     return false;
   }
 
@@ -1756,6 +1841,8 @@ export async function removeGithubFromContainer(
       REMOVE_MANAGED_GITHUB_AUTH,
     ]),
     `remove managed GitHub auth from ${container}`,
+    EXEC_TIMEOUT_MS,
+    admitContainerWork,
   );
   return true;
 }
@@ -1768,6 +1855,9 @@ export interface ReconcileTaskGitAuthDeps {
   logoutContainer?: (taskId: string) => Promise<boolean | void>;
   ensureSsh?: (taskId: string, userId: string) => Promise<boolean>;
   selectSsh?: (taskId: string) => Promise<boolean>;
+  /** Last-hop Docker admission. Recovery supplies an epoch-scoped predicate
+   * while the public runtime deliberately remains `checking`. */
+  admitContainerWork?: () => void;
 }
 
 interface ReconcileInvocation {
@@ -1810,7 +1900,10 @@ function enqueueTaskGitAuth(
     .then(async () => {
       const isCurrent = () =>
         invocation.getGeneration() === invocation.generation;
+      const admitContainerWork =
+        deps.admitContainerWork ?? requireContainerRuntimeOperational;
       if (!isCurrent()) return false;
+      admitContainerWork();
 
       const connected =
         deps.hasToken ?? invocation.setupDeps?.hasToken ?? hasToken;
@@ -1821,12 +1914,14 @@ function enqueueTaskGitAuth(
       // remove every managed account/helper first, in the same per-task queue,
       // then install only the current user's credential. Non-running containers
       // are removed rather than executed with the old credential on disk.
-      const canConfigureLiveTransport = await (
+      const logoutContainer =
         deps.logoutContainer ??
         invocation.setupDeps?.scrub ??
-        removeGithubFromContainer
-      )(taskId);
+        ((id: string) =>
+          removeGithubFromContainer(id, taskContainerCli, admitContainerWork));
+      const canConfigureLiveTransport = await logoutContainer(taskId);
       if (!isCurrent()) return false;
+      admitContainerWork();
       if (canConfigureLiveTransport === false) {
         // No credential-bearing container remains. A connected credential will
         // be installed when Compose recreates it; disconnected state is already
@@ -1836,29 +1931,45 @@ function enqueueTaskGitAuth(
 
       if (shouldConnect) {
         if (deps.setupGithub) {
+          admitContainerWork();
           const result = await deps.setupGithub(taskId, userId);
-          return isCurrent() ? result : false;
+          if (!isCurrent()) return false;
+          admitContainerWork();
+          return result;
         }
-        return setupTaskGithub(
+        admitContainerWork();
+        const result = await setupTaskGithub(
           taskId,
           userId,
           invocation.setupDeps,
           invocation.attempt,
-          { generation: invocation.generation, isCurrent },
+          {
+            generation: invocation.generation,
+            isCurrent,
+            admitContainerWork,
+          },
         );
+        if (!isCurrent()) return false;
+        admitContainerWork();
+        return result;
       }
 
       // SSH remains an opt-in fallback for users who did not connect GitHub;
       // ensuring the identity also keeps commit/tag signing available. Never
       // select SSH transport unless a usable identity was actually asserted.
+      admitContainerWork();
       const hasSshIdentity = await (
         deps.ensureSsh ?? ensureTaskSshIdentity
       )(taskId, userId);
       if (!isCurrent()) return false;
+      admitContainerWork();
       if (hasSshIdentity) {
+        admitContainerWork();
         const selected = await (
           deps.selectSsh ?? configureTaskSshTransport
         )(taskId);
+        if (!isCurrent()) return false;
+        admitContainerWork();
         if (!selected) {
           throw new Error(
             `task ${taskId}: SSH fallback transport could not be configured`,

package/lib/host-cloud-url.ts

@@ -0,0 +1,62 @@
+/**
+ * Canonical cloud endpoint parsing shared by first enrollment, later org
+ * attachment, and the crash-recovery journal.
+ *
+ * The HTTP enrollment call and the persistent WebSocket connection must name
+ * the same authority. Accepting an arbitrary path/query for one while sending
+ * the other to a fixed API origin can successfully spend a one-time token and
+ * then leave a host that can never connect.
+ */
+
+const ALLOWED_PROTOCOLS = new Set(["ws:", "wss:", "http:", "https:"]);
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+export interface HostCloudEndpoint {
+  /** Canonical value persisted as UAI_CLOUD_URL. */
+  readonly bridgeUrl: string;
+  /** Matching HTTPS/HTTP authority used by enrollment API calls. */
+  readonly apiOrigin: string;
+  readonly displayHost: string;
+  readonly secure: boolean;
+}
+
+export function parseHostCloudEndpoint(raw: string): HostCloudEndpoint {
+  if (raw.length === 0 || raw.length > 2_048) {
+    throw new Error("cloud URL is invalid");
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error("cloud URL is invalid");
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error(`unsupported cloud URL protocol: ${parsed.protocol}`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error("cloud URL must not contain credentials");
+  }
+  if (parsed.pathname !== "/host") {
+    throw new Error("cloud URL path must be exactly /host");
+  }
+  if (parsed.search || parsed.hash) {
+    throw new Error("cloud URL must not contain a query or fragment");
+  }
+
+  const secure = parsed.protocol === "wss:" || parsed.protocol === "https:";
+  if (!secure && !LOOPBACK_HOSTS.has(parsed.hostname)) {
+    throw new Error("refusing to use a plaintext cloud URL outside loopback");
+  }
+
+  parsed.protocol = secure ? "wss:" : "ws:";
+  const bridgeUrl = parsed.toString();
+  const apiOrigin = `${secure ? "https:" : "http:"}//${parsed.host}`;
+  return Object.freeze({
+    bridgeUrl,
+    apiOrigin,
+    displayHost: parsed.host,
+    secure,
+  });
+}
+