@runuai/host 0.9.141 → 0.9.142

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.141",
+  "version": "0.9.142",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -813,8 +813,13 @@ void connect();
 // Local browser UI (ADR-028) — same single process, alongside the WSS client.
 // Best-effort: a UI bind failure must not take the host service down.
 // A task machine has no operator sitting at it (ADR-133): no local UI, no
-// Mac vnode watch.
-if (!sidecarMode() && !signInBoxMode()) void startLocalUi();
+// Mac vnode watch. The sign-in box (ADR-136) has no operator either, but it
+// keeps a monitor-only status listener: `uai-host status` reads it, and so
+// does the managed installer's post-start check — without it the box read
+// as "service not running" and the first managed install rolled itself back
+// (live 2026-09-14), leaving the box on an npm install that no auto-update
+// reaches.
+if (!sidecarMode()) void startLocalUi();
 // ADR-118 follow-up: vnode-pressure observability (macOS/apple-container
 // hosts). Logs only on band transitions; the sensor caches its sysctl read.
 if (!sidecarMode() && !signInBoxMode()) {
@@ -834,6 +839,7 @@ async function startLocalUi(): Promise<void> {
       cloudUrl: bridgeUrl,
       hostId,
       logPath: serviceLogPath(),
+      monitorOnly: signInBoxMode(),
       taskMemory: async (composeProject) =>
         containerRuntimeProblem()
           ? null
@@ -865,7 +871,11 @@ async function startLocalUi(): Promise<void> {
         }
       },
     });
-    console.log(`[host-agent] local UI on http://127.0.0.1:${handle.port}`);
+    console.log(
+      signInBoxMode()
+        ? `[host-agent] local status endpoint on http://127.0.0.1:${handle.port} (monitor only)`
+        : `[host-agent] local UI on http://127.0.0.1:${handle.port}`,
+    );
   } catch (err) {
     console.warn(
       `[host-agent] local UI failed to start: ${err instanceof Error ? err.message : String(err)}`,

package/src/ui/server.ts

@@ -69,6 +69,15 @@ export interface UiServerOptions {
   uiDir: string;
   /** File to persist the chosen port to (`$UAI_DATA_DIR/host.port`). */
   portFilePath: string;
+  /**
+   * ADR-136 sign-in box: answer only the read-only status trio
+   * (`/api/status`, `/api/cloud`, `/api/tasks`) so `uai-host status` — and
+   * the managed installer's post-start check, which parses it — can see the
+   * box come up and connect. Every write and every other read (engines,
+   * users, events, the static UI) is 404: the box holds no credential at
+   * rest and runs no tasks, and nobody sits at it.
+   */
+  monitorOnly?: boolean;
   /** First port to try (5876 or UAI_HOST_UI_PORT). 0 lets the OS pick (tests). */
   startPort: number;
   // Facts for /api/status:
@@ -110,6 +119,13 @@ export interface UiServerHandle {
   close: () => Promise<void>;
 }
 
+/** The GET routes a `monitorOnly` server still answers (see UiServerOptions). */
+const MONITOR_ONLY_ROUTES: ReadonlySet<string> = new Set([
+  "/api/status",
+  "/api/cloud",
+  "/api/tasks",
+]);
+
 /** Start the local UI server, binding to 127.0.0.1 with port fallback. */
 export async function startUiServer(
   opts: UiServerOptions,
@@ -170,6 +186,9 @@ async function handle(
   const path = (req.url ?? "/").split("?")[0] ?? "/";
   const method = req.method ?? "GET";
   try {
+    if (opts.monitorOnly && !MONITOR_ONLY_ROUTES.has(path)) {
+      return sendError(res, 404, `no such endpoint: ${path}`);
+    }
     // POST — engine connect/disconnect (the only writes; localhost-bound, so
     // the loopback binding is the perimeter, ADR-028).
     if (method === "POST") {