@runuai/host 0.9.142 → 0.9.143

package/lib/orchestrator.ts

@@ -44,6 +44,7 @@ import {
 import { ACTIVE_STATUSES, isActive, isOnDashboard } from "./task-status";
 import { isSafeHostTaskId } from "./task-identity";
 import { projectEnvForTask } from "./host-env";
+import { shadowRoute } from "./routing/shadow";
 import { getHostTask, hostTaskProjectIds, upsertHostTask } from "./runtime-state";
 import { clearRefresh, reconcileTaskGitAuth } from "./github-tokens";
 import { ensureTaskSshIdentity, setupTaskGitIdentity } from "./git-identity";
@@ -299,6 +300,10 @@ interface Channel {
    *  agent bound at this instant" was never true for a mixed roster after a
    *  wake — live 2026-09-10, task machine, 4 agents, screen up for good. */
   everBound: Set<string>;
+  /** ADR-141 rung 1: report what Auto would have routed on every delivery. */
+  routingShadow: boolean;
+  /** The task's workspace path on the environment (from the channel spec). */
+  workspacePath: string;
   /** Factory creates are externally side-effecting before they bind. Teardown
    *  drains them so an old channel cannot resume against a reused container
    *  name and overwrite the replacement generation's durable transport. */
@@ -564,6 +569,8 @@ export class Orchestrator {
     channel.mode = spec.mode === "secretary" ? "secretary" : "open";
     channel.secretaryAgentId = spec.secretaryAgentId;
     channel.browserTesting = spec.browserTesting === true;
+    channel.routingShadow = spec.routing?.shadow === true;
+    channel.workspacePath = spec.workspacePath;
     channel.sharedFiles = spec.sharedFiles ?? "ro";
     channel.mcpConnections = spec.mcpConnections ?? [];
     if (spec.engineAccountScope) channel.engineAccountScope = spec.engineAccountScope;
@@ -724,6 +731,8 @@ export class Orchestrator {
       configGeneration: 0,
       spawning: new Set(),
       everBound: new Set(),
+      routingShadow: spec.routing?.shadow === true,
+      workspacePath: spec.workspacePath,
       factoryOperations: new Set(),
       eventOperations: new Set(),
       accountByAgent: new Map(),
@@ -2361,9 +2370,97 @@ export class Orchestrator {
       // turn boundary because crew replies can arrive during its dispatch turn.
       this.startPrompt(channel, agentId, session, prompt);
     }
+    // ADR-141 rung 1: after the turn is on its way, ask what Auto would have
+    // done and report it. Fire-and-forget by design — it must never delay or
+    // fail a delivery, so every error ends here.
+    if (channel.routingShadow) {
+        void this.shadowRouteDelivery(channel, agentId, text).catch((err) => {
+        console.warn(
+          `[routing] shadow pass failed for ${channel.taskId}/${agentId}: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      });
+    }
     return { ok: true };
   }
 
+  /**
+   * ADR-141 rung 1. Runs the shadow router for one delivery: the classifier
+   * one-shot executes INSIDE the task environment as the task user, with the
+   * same engine account the agent runs on (so the user's own subscription
+   * pays for routing, never Uai), then the result rides a host event. Bounded
+   * by a hard timeout so a hung CLI cannot pile up passes.
+   */
+  private async shadowRouteDelivery(channel: Channel, agentId: string, text: string): Promise<void> {
+    const agent = channel.roster.find((a) => a.id === agentId);
+    if (!agent) return;
+    // Use the SETTLED handle, never await the environment promise: a task
+    // still provisioning must route by rules now, not block the pass until
+    // task-up finishes (and a never-resolving handle would hang it forever).
+    // A test double may also lack methods — none of this may stop the pass.
+    const handle = channel.agentHandle;
+    const canExec = typeof handle?.exec === "function";
+    const canRead = typeof handle?.readWorkspaceFile === "function";
+    const workspace = handle?.descriptor?.workspacePath ?? channel.workspacePath;
+    const scratchDir = `${workspace}/.uai`;
+    // Rung 1 hosts the classifier on the agent's own engine; the Managed
+    // Engine delegates to claude/codex, so borrow the delegate's account.
+    const hostEngine = agent.kind === "uai" ? (agent.uaiProvider === "openai" ? "codex" : "claude") : agent.kind;
+    const account = pickEngineAccount(hostEngine, { scope: channel.engineAccountScope });
+    const env: Record<string, string> = { ...(account?.execEnv ?? {}) };
+    const context =
+      handle && canRead
+        ? Buffer.from((await handle.readWorkspaceFile(`${scratchDir}/chat.md`).catch(() => null)) ?? new Uint8Array())
+            .toString("utf8")
+            .slice(-1200)
+        : "";
+    const timeoutMs = 45_000;
+    const result = await Promise.race([
+      shadowRoute(text, context, hostEngine, {
+        scratchDir,
+        exec: async (argv) => {
+          if (!handle || !canExec) return null;
+          const r = await handle.exec({
+            argv,
+            cwd: scratchDir,
+            user: "node",
+            env,
+            timeoutMs,
+            maxOutputBytes: 64 * 1024,
+          });
+          return { exitCode: r.exitCode, stdout: Buffer.from(r.stdout).toString("utf8") };
+        },
+        readFile: async (path) => {
+          if (!handle || !canRead) return null;
+          const bytes = await handle.readWorkspaceFile(path).catch(() => null);
+          return bytes ? Buffer.from(bytes).toString("utf8") : null;
+        },
+      }),
+      new Promise<null>((resolve) => setTimeout(() => resolve(null), timeoutMs + 5_000)),
+    ]);
+    if (!result) {
+      console.warn(`[routing] shadow pass timed out for ${channel.taskId}/${agentId}`);
+      return;
+    }
+    this.emitHost({
+      kind: "agent.route.shadow",
+      taskId: channel.taskId,
+      agentId,
+      at: Date.now(),
+      class: result.cls,
+      workKind: result.kind,
+      via: result.via,
+      host: result.host,
+      wouldEngine: result.would.engine,
+      wouldModel: result.would.model,
+      actualEngine: agent.kind,
+      actualModel: agent.model ?? null,
+      actualEffort: agent.effort ?? null,
+      ms: result.ms,
+    });
+  }
+
   /** Interrupt an agent's current turn (ESC). No-op when the task/agent has no
    *  live session (nothing to stop). */
   async interrupt(

package/lib/routing/shadow.ts

@@ -0,0 +1,261 @@
+/**
+ * ADR-141 rung 1 — the SHADOW router.
+ *
+ * Nothing here changes what runs. On every human delivery to an agent in a
+ * workspace the cloud flagged (`ChannelEnsureInput.routing.shadow`), the
+ * runner classifies the message the way Auto mode would, resolves what Auto
+ * would have picked under the Balanced preset, and reports both beside what
+ * actually ran as an `agent.route.shadow` host event. A week of those rows
+ * turns the on-paper saving into a measured one.
+ *
+ * Shape, kept deliberately: the MODEL answers one fuzzy question ("how hard
+ * is this, and what kind of work"); everything with policy in it is code.
+ *
+ *   fast path (rules)  →  classify (one-shot on the agent's own account)
+ *                      →  hedge (rules that force the ceiling)
+ *                      →  resolve (class → tier → model within the envelope)
+ *
+ * The one-shot runs INSIDE the task environment, as `node`, with the engine
+ * account the agent itself runs on — so Uai never pays for routing and the
+ * classifier sees the same credential the agent does. Rung 0 (2026-09-15)
+ * showed Claude, Codex and Grok all host the rubric within the noise floor
+ * (74–77% tier agreement, Haiku against itself included), so the host is
+ * simply whichever engine the agent is on.
+ */
+
+export const ROUTE_CLASSES = ["trivial", "routine", "hard", "decision"] as const;
+export type RouteClass = (typeof ROUTE_CLASSES)[number];
+export const WORK_KINDS = ["edit", "debug", "explain", "plan", "research", "write", "browser", "other"] as const;
+export type WorkKind = (typeof WORK_KINDS)[number];
+
+/** hard and decision both route to the ceiling; that is what the resolver
+ *  compares, and what rung 0 measured agreement on. */
+export const TIER_OF: Record<RouteClass, 0 | 1 | 2> = {
+  trivial: 0,
+  routine: 1,
+  hard: 2,
+  decision: 2,
+};
+
+export const RUBRIC = `You classify ONE human message sent to a coding agent inside a task channel.
+
+Pick exactly one class:
+- trivial: acknowledgements, greetings, yes/no, "go ahead", "continue", thanks,
+  a one-line question about current state. No repository work is needed.
+- routine: a clear, bounded ask done in one or two steps: explain a file, small
+  fix, rename, run the tests, answer a factual question about the code.
+- hard: multi-step implementation, debugging where the cause is unknown, a
+  change across several files, a bug report, anything needing exploration first.
+- decision: architecture, design or trade-off questions, planning, "should we…",
+  reviewing a proposal — judgement matters more than execution.
+
+And one kind of work: edit, debug, explain, plan, research, write, browser, other.
+
+The preceding channel turns are context only. Judge the LAST human message.
+Return ONLY this JSON, nothing else:
+{"class":"<trivial|routine|hard|decision>","kind":"<edit|debug|explain|plan|research|write|browser|other>","reason":"<8 words max>"}`;
+
+// ---------------------------------------------------------------------------
+// Fast path: turns that never need the model. Rung 0's regex caught only 10 of
+// 135 trivials; this one is wider on purpose and still conservative: short,
+// no path, no code, no question about anything specific.
+const ACK = new RegExp(
+  "^(ok(ay)?|yes|yeah|yep|ya|no|nope|go|go ahead|continue|proceed|do it|ship it|" +
+    "thanks|thank you|ty|thx|cool|nice|great|good|done|sure|k|kk|lgtm|approved|" +
+    "sounds good|perfect|awesome|please do|yes please|no thanks|not now|later|" +
+    "👍|🙏|✅)[.!\\s]*$",
+  "i",
+);
+const LOOKS_LIKE_WORK = /[\/\\`{}()=;]|\.(ts|js|tsx|py|md|json|sql|sh|yml|yaml)\b|https?:\/\//i;
+
+export function fastPath(text: string): RouteClass | null {
+  const t = text.trim();
+  if (t.length === 0) return "trivial";
+  if (ACK.test(t)) return "trivial";
+  // A very short message with no code-shaped content and no question mark
+  // is a reaction, not a request ("k .11 is shipping", "@luigi").
+  if (t.length <= 24 && !LOOKS_LIKE_WORK.test(t) && !t.includes("?")) return "trivial";
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Hedges: deterministic upgrades to the ceiling. Rung 0's systematic miss was
+// bug reports and multi-ask messages labelled routine; these cut Codex's cold
+// misses from 6 to 3 of 51 at one needless escalation in 70.
+const BUG = /\b(bug|broken|not working|doesn'?t work|isn'?t working|won'?t|error|fail(ed|ing|s)?|duplicated|wrong|stuck|crash(ed|es)?|regression|não está|nao esta|não funciona|quebr(ou|ado))\b/i;
+const ATTACH = /\[image:|attachments\/|screenshot|\bprint\b/i;
+const MULTI = /(\n\s*[-*•]|\n\s*\d+[.)-]|another thing|a couple more|one more thing|also,|and then|then i want|\b[12]-\s)/i;
+const DECIDE = /\b(should we|how is that gonna|how would that|what should|what would|do we need|is it (risky|worth|safe)|let'?s think|thoughts on|what do you think)\b/i;
+
+export function hedge(text: string, cls: RouteClass): RouteClass {
+  if (TIER_OF[cls] === 2) return cls;
+  const long = text.length > 60;
+  if (DECIDE.test(text) && text.length > 40) return "decision";
+  if (BUG.test(text) && (ATTACH.test(text) || long)) return "hard";
+  if (MULTI.test(text) && text.length > 80) return "hard";
+  return cls;
+}
+
+// ---------------------------------------------------------------------------
+// Resolve: class → tier → model, per engine, under the Balanced preset. Rung 1
+// keeps the agent's own engine (cross-engine is rung 3) and a static tier
+// table; the catalog's tier column replaces this once it exists.
+export interface WouldRoute {
+  engine: string;
+  model: string | null;
+}
+
+const BALANCED: Record<string, [string, string, string] | undefined> = {
+  // [floor, default, ceiling]
+  claude: ["haiku", "sonnet", "opus"],
+  uai: ["haiku-4.5", "sonnet-5", "opus-5"],
+  codex: ["gpt-5.6-luna", "gpt-5.6-terra", "gpt-5.6-sol"],
+};
+
+export function resolveBalanced(cls: RouteClass, engine: string): WouldRoute {
+  const ladder = BALANCED[engine];
+  if (!ladder) return { engine, model: null };
+  return { engine, model: ladder[TIER_OF[cls]] };
+}
+
+/** The cheapest model each engine serves on a connected account — what the
+ *  classifier itself runs on. Verified 2026-09-15: a ChatGPT-account Codex
+ *  refuses gpt-5-mini and the codex-mini variants but serves Luna. */
+export const CLASSIFIER_MODEL: Record<string, string | null> = {
+  claude: "haiku",
+  codex: "gpt-5.6-luna",
+  grok: null, // the CLI's default; the login decides
+};
+
+// ---------------------------------------------------------------------------
+// One-shot completion argv per engine. No tools, no session, plain text back.
+export interface OneShot {
+  argv: [string, ...string[]];
+  /** Where the answer lands: the process's stdout, or a file it writes. */
+  output: { kind: "stdout-json"; field: string } | { kind: "file"; path: string };
+}
+
+export function oneShotFor(engine: string, prompt: string, scratchDir: string): OneShot | null {
+  switch (engine) {
+    case "claude":
+    case "uai":
+      return {
+        argv: ["claude", "-p", prompt, "--model", "haiku", "--output-format", "json", "--no-session-persistence"],
+        output: { kind: "stdout-json", field: "result" },
+      };
+    case "codex": {
+      const out = `${scratchDir}/router-last.txt`;
+      return {
+        argv: [
+          "codex", "exec", "--skip-git-repo-check", "--ephemeral", "-s", "read-only",
+          "-m", "gpt-5.6-luna", "-o", out, prompt,
+        ],
+        output: { kind: "file", path: out },
+      };
+    }
+    case "grok":
+      return {
+        argv: ["grok", "-p", prompt, "--output-format", "json", "--disable-web-search"],
+        output: { kind: "stdout-json", field: "text" },
+      };
+    default:
+      return null;
+  }
+}
+
+export interface Label {
+  cls: RouteClass;
+  kind: WorkKind | null;
+  reason: string;
+}
+
+/** Tolerant of chatter around the JSON and of a model inventing a class. */
+export function parseLabel(text: string): Label | null {
+  const m = text.match(/\{[^{}]*"class"[^{}]*\}/);
+  if (!m) return null;
+  try {
+    const o = JSON.parse(m[0]) as { class?: unknown; kind?: unknown; reason?: unknown };
+    const cls = String(o.class ?? "").toLowerCase() as RouteClass;
+    if (!ROUTE_CLASSES.includes(cls)) return null;
+    const kind = String(o.kind ?? "").toLowerCase() as WorkKind;
+    return {
+      cls,
+      kind: WORK_KINDS.includes(kind) ? kind : null,
+      reason: typeof o.reason === "string" ? o.reason.slice(0, 80) : "",
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function buildPrompt(message: string, context: string): string {
+  const ctx = context.trim().length > 0 ? context.trim().slice(-900) : "(none)";
+  return `${RUBRIC}\n\nRECENT CHANNEL (context only):\n${ctx}\n\nLAST HUMAN MESSAGE:\n${message.slice(0, 1600)}`;
+}
+
+// ---------------------------------------------------------------------------
+// The pass itself, with every side effect injected so it is testable without
+// an orchestrator.
+export interface ShadowDeps {
+  /** Run a one-shot in the task environment; null when it cannot run at all. */
+  exec: (argv: [string, ...string[]]) => Promise<{ exitCode: number | null; stdout: string } | null>;
+  readFile: (path: string) => Promise<string | null>;
+  scratchDir: string;
+  now?: () => number;
+}
+
+export interface ShadowResult {
+  cls: RouteClass;
+  kind: WorkKind | null;
+  via: "rules" | "account" | "none";
+  host: string | null;
+  would: WouldRoute;
+  ms: number;
+}
+
+export async function shadowRoute(
+  message: string,
+  context: string,
+  engine: string,
+  deps: ShadowDeps,
+): Promise<ShadowResult> {
+  const now = deps.now ?? Date.now;
+  const t0 = now();
+  const fast = fastPath(message);
+  if (fast) {
+    return { cls: fast, kind: null, via: "rules", host: null, would: resolveBalanced(fast, engine), ms: now() - t0 };
+  }
+  const shot = oneShotFor(engine, buildPrompt(message, context), deps.scratchDir);
+  let label: Label | null = null;
+  let host: string | null = null;
+  if (shot) {
+    const res = await deps.exec(shot.argv).catch(() => null);
+    if (res && res.exitCode === 0) {
+      let text = "";
+      if (shot.output.kind === "file") {
+        text = (await deps.readFile(shot.output.path).catch(() => null)) ?? "";
+      } else {
+        try {
+          const d = JSON.parse(res.stdout) as Record<string, unknown>;
+          text = typeof d[shot.output.field] === "string" ? (d[shot.output.field] as string) : res.stdout;
+        } catch {
+          text = res.stdout;
+        }
+      }
+      label = parseLabel(text);
+      if (label) host = engine;
+    }
+  }
+  // No usable answer: the deterministic layer still routes — default tier,
+  // hedged upward where the message says so.
+  const base: RouteClass = label?.cls ?? "routine";
+  const cls = hedge(message, base);
+  return {
+    cls,
+    kind: label?.kind ?? null,
+    via: label ? "account" : "none",
+    host,
+    would: resolveBalanced(cls, engine),
+    ms: now() - t0,
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.142",
+  "version": "0.9.143",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/protocol.ts

@@ -1325,6 +1325,9 @@ export interface ChannelEnsureInput {
   /** ADR-062: shared-files mount mode — drives the preamble "## Files"
    *  section ("off" | "ro" | "rw"). */
   sharedFiles?: string;
+  /** ADR-141 rung 1: `shadow` asks the runner to classify every human
+   *  delivery and report what Auto mode WOULD have routed, changing nothing. */
+  routing?: { shadow?: boolean };
   globalContext?: string;
   projects: Array<{ slug: string; defaultPrompt: string }>;
   branch: string;
@@ -1973,6 +1976,24 @@ export type HostEvent =
       tool: string;
       meta: unknown;
     }
+  // ADR-141 rung 1: one row per human delivery in a shadow-routed workspace.
+  // `would` is the Balanced-preset pick; `actual` is what the agent runs on.
+  | {
+      kind: "agent.route.shadow";
+      taskId: string;
+      agentId: string;
+      at: number;
+      class: string;
+      workKind: string | null;
+      via: "rules" | "account" | "none";
+      host: string | null;
+      wouldEngine: string;
+      wouldModel: string | null;
+      actualEngine: string;
+      actualModel: string | null;
+      actualEffort: string | null;
+      ms: number;
+    }
   | {
       kind: "agent.permission_request";
       taskId: string;