@runuai/host 0.9.146 → 0.9.148

package/lib/agent-cli.ts

@@ -305,7 +305,22 @@ async function main() {
     case "memory search": {
       const q = pos.join(" ") || flags.q || "";
       const author = flags.as ? "&author=" + encodeURIComponent(flags.as) : "";
-      out((await api("GET", "/api/agent/memory?q=" + encodeURIComponent(q) + author)).memories);
+      const limit = flags.limit ? "&limit=" + encodeURIComponent(String(flags.limit)) : "";
+      const res = await api(
+        "GET",
+        "/api/agent/memory?q=" + encodeURIComponent(q) + author + limit,
+      );
+      out(res.memories);
+      // Truncation goes to stderr so it cannot corrupt piped JSON, and it is
+      // stated rather than implied: recalling across tasks means reading the
+      // WHOLE store, and a short page that says nothing reads as all there is.
+      // NOTE: this file is a template literal. No backticks, no \${} in here.
+      if (res.truncated) {
+        console.error(
+          "uai: showing " + res.memories.length + " of " + res.total +
+            " — re-run with --limit all for every row.",
+        );
+      }
       break;
     }
     case "memory save": {
@@ -453,7 +468,7 @@ async function main() {
         "  uai task list",
         "  uai task create --name <n> --prompt <p> [--projects id,id] [--team id] [--agents handle,handle]",
         '  uai task close --status finished|canceled [--reason "final report"]',
-        "  uai memory search <query>",
+        "  uai memory search <query> [--as handle] [--limit N|all]",
         "  uai memory save <text> [--project id] [--tags a,b]",
         "  uai memory delete <id>",
         "  uai todo list",

package/lib/agents/attach-compatibility.ts

@@ -0,0 +1,51 @@
+/**
+ * Compatibility for the v0.9.147 -> v0.9.148 durable-session key rollout.
+ *
+ * Older hosts could not receive live roster edits and persisted only the
+ * execution-policy key: null for crew, or one of the Secretary policy
+ * constants. v0.9.148 adds kind/model/effort to that key. Treat the old row as
+ * compatible with the richer desired key only when its policy is unchanged;
+ * the transition is deliberately one-way so future/unknown keys remain exact.
+ */
+
+const LEGACY_SECRETARY_POLICY_KEYS = new Set([
+  "secretary-normal-tools-v1",
+  "secretary-communicator-v1",
+]);
+
+function rosterLaunchPolicy(key: string | null): string | null | undefined {
+  if (key === null) return undefined;
+  try {
+    const parsed: unknown = JSON.parse(key);
+    if (
+      !Array.isArray(parsed) ||
+      parsed.length !== 5 ||
+      parsed[0] !== "roster-launch-v1" ||
+      typeof parsed[1] !== "string" ||
+      typeof parsed[2] !== "string" ||
+      typeof parsed[3] !== "string" ||
+      typeof parsed[4] !== "string"
+    ) {
+      return undefined;
+    }
+    return parsed[4] === "" ? null : parsed[4];
+  } catch {
+    return undefined;
+  }
+}
+
+export function attachCompatibilityKeysMatch(
+  stored: string | null | undefined,
+  desired: string | null | undefined,
+): boolean {
+  const storedKey = stored ?? null;
+  const desiredKey = desired ?? null;
+  if (storedKey === desiredKey) return true;
+
+  const desiredPolicy = rosterLaunchPolicy(desiredKey);
+  if (storedKey === null) return desiredPolicy === null;
+  return (
+    LEGACY_SECRETARY_POLICY_KEYS.has(storedKey) &&
+    desiredPolicy === storedKey
+  );
+}

package/lib/agents/codex.ts

@@ -32,12 +32,13 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-import { and, eq } from "drizzle-orm";
+import { and, eq, isNull } from "drizzle-orm";
 
 import { getDb, schema } from "../db";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
 import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
 import { newId } from "../ulid";
+import { attachCompatibilityKeysMatch } from "./attach-compatibility";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { isRateLimitMessage } from "./rate-limit";
 import { register } from "./registry";
@@ -233,11 +234,21 @@ const delay = (ms: number): Promise<void> =>
 // Thread persistence (ADR-078) — resume the SAME thread across a host restart.
 // ---------------------------------------------------------------------------
 
-/** The Codex thread id persisted for (task, agent), or null if none yet. */
-function readCodexThreadId(taskId: string, agentId: string): string | null {
+/** The compatible Codex thread id persisted for (task, agent), or null. */
+function readCodexThreadId(
+  taskId: string,
+  agentId: string,
+  attachCompatibilityKey: string | undefined,
+): string | null {
   try {
     const row = getDb()
-      .select({ id: schema.hostAgentSessions.codexThreadId })
+      .select({
+        id: schema.hostAgentSessions.codexThreadId,
+        kind: schema.hostAgentSessions.kind,
+        sessionDir: schema.hostAgentSessions.sessionDir,
+        attachCompatibilityKey:
+          schema.hostAgentSessions.attachCompatibilityKey,
+      })
       .from(schema.hostAgentSessions)
       .where(
         and(
@@ -246,6 +257,31 @@ function readCodexThreadId(taskId: string, agentId: string): string | null {
         ),
       )
       .get();
+    if (
+      row?.kind !== "codex" ||
+      !attachCompatibilityKeysMatch(
+        row.attachCompatibilityKey,
+        attachCompatibilityKey,
+      )
+    ) {
+      // Transport will promote the row to the new launch key while preserving
+      // codexThreadId. Clear the incompatible id first so a crash between that
+      // upsert and thread/started cannot make the next host resume it.
+      if (row?.id && row.sessionDir) {
+        getDb()
+          .update(schema.hostAgentSessions)
+          .set({ codexThreadId: null, updatedAt: Date.now() })
+          .where(
+            and(
+              eq(schema.hostAgentSessions.taskId, taskId),
+              eq(schema.hostAgentSessions.agentId, agentId),
+              eq(schema.hostAgentSessions.sessionDir, row.sessionDir),
+            ),
+          )
+          .run();
+      }
+      return null;
+    }
     return row?.id ?? null;
   } catch {
     return null;
@@ -258,15 +294,57 @@ function readCodexThreadId(taskId: string, agentId: string): string | null {
  * thread (today's behavior). The transport's session-row upsert never clears
  * this column, so it survives the kill+respawn of a host restart.
  */
-function saveCodexThreadId(taskId: string, agentId: string, threadId: string): void {
+function saveCodexThreadId(
+  taskId: string,
+  agentId: string,
+  threadId: string,
+  sessionDir: string | undefined,
+  attachCompatibilityKey: string | undefined,
+): void {
+  if (!sessionDir) return;
   try {
-    getDb()
+    const db = getDb();
+    const row = db
+      .select({
+        kind: schema.hostAgentSessions.kind,
+        sessionDir: schema.hostAgentSessions.sessionDir,
+        attachCompatibilityKey:
+          schema.hostAgentSessions.attachCompatibilityKey,
+      })
+      .from(schema.hostAgentSessions)
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, taskId),
+          eq(schema.hostAgentSessions.agentId, agentId),
+        ),
+      )
+      .get();
+    const persistedKey = row?.attachCompatibilityKey ?? null;
+    if (
+      row?.kind !== "codex" ||
+      row.sessionDir !== sessionDir ||
+      !attachCompatibilityKeysMatch(
+        row.attachCompatibilityKey,
+        attachCompatibilityKey,
+      )
+    ) {
+      return;
+    }
+    db
       .update(schema.hostAgentSessions)
       .set({ codexThreadId: threadId, updatedAt: Date.now() })
       .where(
         and(
           eq(schema.hostAgentSessions.taskId, taskId),
           eq(schema.hostAgentSessions.agentId, agentId),
+          eq(schema.hostAgentSessions.kind, "codex"),
+          eq(schema.hostAgentSessions.sessionDir, sessionDir),
+          persistedKey === null
+            ? isNull(schema.hostAgentSessions.attachCompatibilityKey)
+            : eq(
+                schema.hostAgentSessions.attachCompatibilityKey,
+                persistedKey,
+              ),
         ),
       )
       .run();
@@ -302,6 +380,7 @@ export class CodexSession implements AgentSession {
 
   private threadId: string | null = null;
   private readonly ready: Promise<void>;
+  private readonly attachCompatibilityKey: string | undefined;
 
   constructor(args: {
     taskId: string;
@@ -309,15 +388,21 @@ export class CodexSession implements AgentSession {
     environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
+    attachCompatibilityKey?: string;
     /** ADR-128: `-c key=value` overrides a delegating adapter prepends. */
     cliConfigOverrides?: string[];
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
     this.taskId = args.taskId;
+    this.attachCompatibilityKey = args.attachCompatibilityKey;
     // ADR-078: read BEFORE createAgentTransport (whose session-row upsert
     // preserves this column). Non-null → a host restart; resume the thread.
-    this.resumeThreadId = readCodexThreadId(args.taskId, args.agent.id);
+    this.resumeThreadId = readCodexThreadId(
+      args.taskId,
+      args.agent.id,
+      args.attachCompatibilityKey,
+    );
 
     // The agent's model / effort (when set) are selected via config overrides
     // (`-c model=<model>`, `-c model_reasoning_effort=<effort>`) on the
@@ -349,6 +434,7 @@ export class CodexSession implements AgentSession {
       passEnv: [],
       explicitEnv: args.agentEnv ?? {},
       allowAttach: false,
+      attachCompatibilityKey: args.attachCompatibilityKey,
       kind: "codex",
       debugLabel: `codex:${this.agentId}`,
     });
@@ -387,6 +473,10 @@ export class CodexSession implements AgentSession {
   // -- JSON-RPC plumbing ----------------------------------------------------
 
   private onLine(line: string): void {
+    // close() severs this generation before the durable runner necessarily
+    // exits. Ignore buffered notifications so a late thread/started cannot
+    // restore the resume id that a live roster edit just cleared.
+    if (this.closed) return;
     let msg: unknown;
     try {
       msg = JSON.parse(line);
@@ -439,7 +529,7 @@ export class CodexSession implements AgentSession {
         const thread = msg.params.thread;
         if (isObj(thread) && typeof thread.id === "string") {
           this.threadId = thread.id;
-          saveCodexThreadId(this.taskId, this.agentId, thread.id);
+          this.persistThreadId(thread.id);
         }
       }
       for (const ev of mapCodexNotification(method, msg.params)) {
@@ -568,7 +658,7 @@ export class CodexSession implements AgentSession {
     if (isObj(result) && isObj(result.thread)) {
       const id = str(result.thread.id) || this.threadId;
       this.threadId = id;
-      if (id) saveCodexThreadId(this.taskId, this.agentId, id);
+      if (id) this.persistThreadId(id);
     }
   }
 
@@ -594,7 +684,7 @@ export class CodexSession implements AgentSession {
             ? str(result.thread.id)
             : threadId;
         this.threadId = id;
-        saveCodexThreadId(this.taskId, this.agentId, id);
+        this.persistThreadId(id);
         return true;
       } catch (err) {
         const code = (err as { rpcCode?: number }).rpcCode;
@@ -615,6 +705,16 @@ export class CodexSession implements AgentSession {
 
   // -- AgentSession ---------------------------------------------------------
 
+  private persistThreadId(threadId: string): void {
+    saveCodexThreadId(
+      this.taskId,
+      this.agentId,
+      threadId,
+      this.proc.durableSessionDir,
+      this.attachCompatibilityKey,
+    );
+  }
+
   onEvent(handler: AgentEventHandler): () => void {
     this.handlers.add(handler);
     return () => this.handlers.delete(handler);
@@ -704,6 +804,22 @@ register({
   // provider block rides it, and this destructuring silently dropped it on
   // the first live gpt-5-mini smoke (2026-09-12, host 0.9.136 — codex still
   // dialed api.openai.com).
-  create: async ({ taskId, agent, environment, systemPreamble, agentEnv, cliConfigOverrides }) =>
-    new CodexSession({ taskId, agent, environment, systemPreamble, agentEnv, cliConfigOverrides }),
+  create: async ({
+    taskId,
+    agent,
+    environment,
+    systemPreamble,
+    agentEnv,
+    attachCompatibilityKey,
+    cliConfigOverrides,
+  }) =>
+    new CodexSession({
+      taskId,
+      agent,
+      environment,
+      systemPreamble,
+      agentEnv,
+      attachCompatibilityKey,
+      cliConfigOverrides,
+    }),
 });

package/lib/agents/durable-proc.ts

@@ -72,6 +72,7 @@ interface RunnerMeta {
 }
 
 export class DurableProcess {
+  readonly durableSessionDir: string;
   private readonly dir: string;
   private readonly outboxPath: string;
   private readonly inboxPath: string;
@@ -95,6 +96,7 @@ export class DurableProcess {
   private readonly debug: string | null;
 
   constructor(opts: DurableProcessOptions) {
+    this.durableSessionDir = opts.hostSessionDir;
     this.dir = opts.hostSessionDir;
     this.outboxPath = join(this.dir, "outbox.jsonl");
     this.inboxPath = join(this.dir, "inbox.jsonl");

package/lib/agents/machine-durable.ts

@@ -129,6 +129,7 @@ export interface MachineDurableOptions {
 }
 
 export class MachineDurableProcess implements LineTransport {
+  readonly durableSessionDir: string;
   readonly #environment: MachineSessionEnvironment;
   readonly #sessionDir: string;
   readonly #outboxPath: string;
@@ -158,6 +159,7 @@ export class MachineDurableProcess implements LineTransport {
   readonly #debug: string | null;
 
   constructor(opts: MachineDurableOptions) {
+    this.durableSessionDir = opts.sessionDir;
     this.#environment = opts.environment;
     this.#sessionDir = opts.sessionDir;
     this.#outboxPath = posix.join(opts.sessionDir, "outbox.jsonl");
@@ -563,3 +565,16 @@ export async function stopMachinePredecessor(
     // Dir gone / runner dead — nothing to stop.
   }
 }
+
+/** Removal/recovery variant: failure is not success because no later attach
+ * will provide the transport layer's usual predecessor-stop backstop. */
+export async function stopMachinePredecessorStrict(
+  environment: MachineSessionEnvironment,
+  sessionDir: string,
+): Promise<void> {
+  await appendEnvironmentFile(
+    environment,
+    posix.join(sessionDir, "inbox.jsonl"),
+    '{"__uai":"stop"}\n',
+  );
+}

package/lib/agents/session-state.ts

@@ -0,0 +1,107 @@
+/**
+ * Durable agent-session state used by live roster reconciliation.
+ *
+ * The orchestrator normally owns a live AgentSession and closes it through the
+ * adapter. After a host restart, however, a removed agent can exist only as a
+ * host_agent_sessions row. These helpers stop that persisted runner
+ * without deleting its row or generation directory, and clear Codex's durable
+ * thread id when launch settings change.
+ */
+
+import { promises as fsp } from "node:fs";
+import { join } from "node:path";
+
+import { and, eq } from "drizzle-orm";
+
+import { getDb, schema } from "../db";
+import type { TaskEnvironmentHandle } from "../task-environment/types";
+import { isEnvironmentTransportProvider } from "../task-environment/types";
+import {
+  stopMachinePredecessorStrict,
+  type MachineSessionEnvironment,
+} from "./machine-durable";
+
+/** Durable-session ids persisted for one task, including rows marked closed.
+ * A crash can land after markClosed but before its stop reaches the runner. */
+export function persistedAgentIds(taskId: string): string[] {
+  return getDb()
+    .select({ agentId: schema.hostAgentSessions.agentId })
+    .from(schema.hostAgentSessions)
+    .where(eq(schema.hostAgentSessions.taskId, taskId))
+    .all()
+    .map((row) => row.agentId);
+}
+
+/**
+ * A changed model/engine/effort starts a fresh Codex thread. The channel
+ * transcript is the durable memory; resuming a thread created under the old
+ * launch settings can make the replacement keep using the old model.
+ */
+export function clearPersistedCodexThread(
+  taskId: string,
+  agentId: string,
+): void {
+  getDb()
+    .update(schema.hostAgentSessions)
+    .set({ codexThreadId: null, updatedAt: Date.now() })
+    .where(
+      and(
+        eq(schema.hostAgentSessions.taskId, taskId),
+        eq(schema.hostAgentSessions.agentId, agentId),
+      ),
+    )
+    .run();
+}
+
+/**
+ * Stop a persisted runner that has no in-memory AgentSession (boot recovery).
+ * The session directory and DB row deliberately remain for diagnostics.
+ */
+export async function stopPersistedAgentSession(
+  taskId: string,
+  agentId: string,
+  environment: TaskEnvironmentHandle<unknown>,
+): Promise<string | null> {
+  const db = getDb();
+  const row = db
+    .select()
+    .from(schema.hostAgentSessions)
+    .where(
+      and(
+        eq(schema.hostAgentSessions.taskId, taskId),
+        eq(schema.hostAgentSessions.agentId, agentId),
+      ),
+    )
+    .get();
+  if (!row) return null;
+
+  if (isEnvironmentTransportProvider(environment.descriptor.locator.provider)) {
+    await stopMachinePredecessorStrict(
+      environment as MachineSessionEnvironment,
+      row.sessionDir,
+    );
+  } else {
+    try {
+      await fsp.appendFile(
+        join(row.sessionDir, "inbox.jsonl"),
+        '{"__uai":"stop"}\n',
+      );
+    } catch (err) {
+      // A removed generation directory proves there is no runner left to read
+      // it. Permission, I/O, and other failures are not proof: retry them.
+      if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+    }
+  }
+
+  db.update(schema.hostAgentSessions)
+    .set({ status: "closed", updatedAt: Date.now() })
+    .where(
+      and(
+        eq(schema.hostAgentSessions.taskId, taskId),
+        eq(schema.hostAgentSessions.agentId, agentId),
+        eq(schema.hostAgentSessions.sessionDir, row.sessionDir),
+      ),
+    )
+    .run();
+  return row.sessionDir;
+}