@runuai/host 0.9.140 → 0.9.142

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.140",
+  "version": "0.9.142",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -141,6 +141,42 @@ reject_workspace_runtime_shadow() {
   fi
 }
 
+# The first check of a task-up used to be the refusal above. A fresh task
+# never trips it (the workspace is empty), but a RESUMED one can: the
+# workspace persists across an idle park, agents' shells start in /workspace,
+# and `asdf local nodejs 22` from there writes exactly this file — after
+# which the task could never wake again without someone deleting the file on
+# the host (client runner, 2026-09-14). The entry is the task's own
+# container-writable content, so move it aside instead: a rename is
+# metadata-only (never opens a FIFO/device/socket), the runtime proof is
+# unchanged because nothing is left at the root, and the content survives
+# under .uai/refused/ where the agent can re-pin it in a project. The
+# post-materialization recheck below keeps refusing — by then the root must
+# be empty by construction, so an entry there is a bug, not a user file.
+quarantine_workspace_runtime_shadow() {
+  local path="$task_workspace/.tool-versions" aside_dir aside
+  if [ -L "$path" ] || [ -e "$path" ]; then
+    aside_dir="$task_workspace/.uai/refused"
+    reject_unsafe_host_directory "$task_workspace/.uai" "the task control directory"
+    reject_unsafe_host_directory "$aside_dir" "the refused-files directory"
+    mkdir -p "$aside_dir"
+    aside="$aside_dir/tool-versions.$(date +%s)"
+    if ! mv -f "$path" "$aside" 2>/dev/null || [ -L "$path" ] || [ -e "$path" ]; then
+      reject_workspace_runtime_shadow
+    fi
+    cat > "$aside_dir/README.txt" <<'NOTE'
+Uai moved a /workspace/.tool-versions aside before starting this task.
+
+A .tool-versions at the workspace root is outside the runtime proof and would
+override the runtimes proved for every project in the task, so the host refuses
+to start a container while one exists. The file is kept here, untouched, under
+its original content. Pin runtimes in a project's own .tool-versions instead
+(/workspace/<project>/.tool-versions), which the materializer proves.
+NOTE
+    log "moved a workspace-root .tool-versions aside to ${aside#"$task_workspace"/} (it would override the runtimes proved for this task; pin per project instead)"
+  fi
+}
+
 mapped_host_port() {
   local container="$1" container_port="$2"
   docker port "$container" "$container_port" 2>/dev/null \
@@ -555,7 +591,7 @@ else
 fi
 reject_unsafe_host_directory "$task_workspace" "the task workspace"
 mkdir -p "$task_workspace"
-reject_workspace_runtime_shadow
+quarantine_workspace_runtime_shadow
 
 # Git resolves symlinked ancestors when it writes a linked worktree's absolute
 # `.git` pointer. Keep the configured (lexical) task paths as Uai's stable host

package/src/main.ts

@@ -813,8 +813,13 @@ void connect();
 // Local browser UI (ADR-028) — same single process, alongside the WSS client.
 // Best-effort: a UI bind failure must not take the host service down.
 // A task machine has no operator sitting at it (ADR-133): no local UI, no
-// Mac vnode watch.
-if (!sidecarMode() && !signInBoxMode()) void startLocalUi();
+// Mac vnode watch. The sign-in box (ADR-136) has no operator either, but it
+// keeps a monitor-only status listener: `uai-host status` reads it, and so
+// does the managed installer's post-start check — without it the box read
+// as "service not running" and the first managed install rolled itself back
+// (live 2026-09-14), leaving the box on an npm install that no auto-update
+// reaches.
+if (!sidecarMode()) void startLocalUi();
 // ADR-118 follow-up: vnode-pressure observability (macOS/apple-container
 // hosts). Logs only on band transitions; the sensor caches its sysctl read.
 if (!sidecarMode() && !signInBoxMode()) {
@@ -834,6 +839,7 @@ async function startLocalUi(): Promise<void> {
       cloudUrl: bridgeUrl,
       hostId,
       logPath: serviceLogPath(),
+      monitorOnly: signInBoxMode(),
       taskMemory: async (composeProject) =>
         containerRuntimeProblem()
           ? null
@@ -865,7 +871,11 @@ async function startLocalUi(): Promise<void> {
         }
       },
     });
-    console.log(`[host-agent] local UI on http://127.0.0.1:${handle.port}`);
+    console.log(
+      signInBoxMode()
+        ? `[host-agent] local status endpoint on http://127.0.0.1:${handle.port} (monitor only)`
+        : `[host-agent] local UI on http://127.0.0.1:${handle.port}`,
+    );
   } catch (err) {
     console.warn(
       `[host-agent] local UI failed to start: ${err instanceof Error ? err.message : String(err)}`,

package/src/ui/server.ts

@@ -69,6 +69,15 @@ export interface UiServerOptions {
   uiDir: string;
   /** File to persist the chosen port to (`$UAI_DATA_DIR/host.port`). */
   portFilePath: string;
+  /**
+   * ADR-136 sign-in box: answer only the read-only status trio
+   * (`/api/status`, `/api/cloud`, `/api/tasks`) so `uai-host status` — and
+   * the managed installer's post-start check, which parses it — can see the
+   * box come up and connect. Every write and every other read (engines,
+   * users, events, the static UI) is 404: the box holds no credential at
+   * rest and runs no tasks, and nobody sits at it.
+   */
+  monitorOnly?: boolean;
   /** First port to try (5876 or UAI_HOST_UI_PORT). 0 lets the OS pick (tests). */
   startPort: number;
   // Facts for /api/status:
@@ -110,6 +119,13 @@ export interface UiServerHandle {
   close: () => Promise<void>;
 }
 
+/** The GET routes a `monitorOnly` server still answers (see UiServerOptions). */
+const MONITOR_ONLY_ROUTES: ReadonlySet<string> = new Set([
+  "/api/status",
+  "/api/cloud",
+  "/api/tasks",
+]);
+
 /** Start the local UI server, binding to 127.0.0.1 with port fallback. */
 export async function startUiServer(
   opts: UiServerOptions,
@@ -170,6 +186,9 @@ async function handle(
   const path = (req.url ?? "/").split("?")[0] ?? "/";
   const method = req.method ?? "GET";
   try {
+    if (opts.monitorOnly && !MONITOR_ONLY_ROUTES.has(path)) {
+      return sendError(res, 404, `no such endpoint: ${path}`);
+    }
     // POST — engine connect/disconnect (the only writes; localhost-bound, so
     // the loopback binding is the perimeter, ADR-028).
     if (method === "POST") {