@runuai/host 0.9.140 → 0.9.141

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.140",
+  "version": "0.9.141",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -141,6 +141,42 @@ reject_workspace_runtime_shadow() {
   fi
 }
 
+# The first check of a task-up used to be the refusal above. A fresh task
+# never trips it (the workspace is empty), but a RESUMED one can: the
+# workspace persists across an idle park, agents' shells start in /workspace,
+# and `asdf local nodejs 22` from there writes exactly this file — after
+# which the task could never wake again without someone deleting the file on
+# the host (client runner, 2026-09-14). The entry is the task's own
+# container-writable content, so move it aside instead: a rename is
+# metadata-only (never opens a FIFO/device/socket), the runtime proof is
+# unchanged because nothing is left at the root, and the content survives
+# under .uai/refused/ where the agent can re-pin it in a project. The
+# post-materialization recheck below keeps refusing — by then the root must
+# be empty by construction, so an entry there is a bug, not a user file.
+quarantine_workspace_runtime_shadow() {
+  local path="$task_workspace/.tool-versions" aside_dir aside
+  if [ -L "$path" ] || [ -e "$path" ]; then
+    aside_dir="$task_workspace/.uai/refused"
+    reject_unsafe_host_directory "$task_workspace/.uai" "the task control directory"
+    reject_unsafe_host_directory "$aside_dir" "the refused-files directory"
+    mkdir -p "$aside_dir"
+    aside="$aside_dir/tool-versions.$(date +%s)"
+    if ! mv -f "$path" "$aside" 2>/dev/null || [ -L "$path" ] || [ -e "$path" ]; then
+      reject_workspace_runtime_shadow
+    fi
+    cat > "$aside_dir/README.txt" <<'NOTE'
+Uai moved a /workspace/.tool-versions aside before starting this task.
+
+A .tool-versions at the workspace root is outside the runtime proof and would
+override the runtimes proved for every project in the task, so the host refuses
+to start a container while one exists. The file is kept here, untouched, under
+its original content. Pin runtimes in a project's own .tool-versions instead
+(/workspace/<project>/.tool-versions), which the materializer proves.
+NOTE
+    log "moved a workspace-root .tool-versions aside to ${aside#"$task_workspace"/} (it would override the runtimes proved for this task; pin per project instead)"
+  fi
+}
+
 mapped_host_port() {
   local container="$1" container_port="$2"
   docker port "$container" "$container_port" 2>/dev/null \
@@ -555,7 +591,7 @@ else
 fi
 reject_unsafe_host_directory "$task_workspace" "the task workspace"
 mkdir -p "$task_workspace"
-reject_workspace_runtime_shadow
+quarantine_workspace_runtime_shadow
 
 # Git resolves symlinked ancestors when it writes a linked worktree's absolute
 # `.git` pointer. Keep the configured (lexical) task paths as Uai's stable host