@runuai/host 0.9.147 → 0.9.149

package/lib/task-environment/machine.ts

@@ -23,9 +23,12 @@ import type {
   MachineProvider,
 } from "../machine-provider";
 import { machineEnvironmentSshArgs } from "../machine-exec";
+import { applyProjectEnvProfile } from "../runtime-authority";
 import { capturedCliExec, streamingCliExec } from "./docker";
 import {
+  assertTaskEnvironmentExecRequest,
   assertTaskEnvironmentProcessRequest,
+  refusePrivilegedExec,
   assertTaskEnvironmentSessionRequest,
   assertWorkspaceScopedPath,
   type TaskEnvironmentCopyRequest,
@@ -37,6 +40,7 @@ import {
   type TaskEnvironmentLocator,
   type TaskEnvironmentPort,
   type TaskEnvironmentProcess,
+  type ProjectEnvMode,
   type TaskEnvironmentProvider,
   type TaskEnvironmentProvisionRequest,
   type TaskEnvironmentProvisioned,
@@ -185,6 +189,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
   constructor(
     locator: TaskEnvironmentLocator,
     deps: MachineTaskEnvironmentDeps,
+    envMode: ProjectEnvMode,
   ) {
     this.#value = parseMachineTaskEnvironmentLocator(locator);
     this.#deps = {
@@ -197,6 +202,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     this.descriptor = {
       taskId: this.#value.taskId,
       locator,
+      envMode,
       workspacePath: this.#value.workspacePath,
     };
   }
@@ -242,6 +248,24 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     return info;
   }
 
+  #maintenanceRequest<
+    T extends {
+      argv: readonly [string, ...string[]];
+      cwd?: string;
+      user?: string;
+      inheritEnv?: readonly string[];
+      env?: Readonly<Record<string, string>>;
+    },
+  >(
+    request: T,
+  ): T & { projectEnvProfile: "maintenance" } {
+    return applyProjectEnvProfile(
+      { ...request, projectEnvProfile: "maintenance" as const },
+      this.descriptor.envMode ?? "baked",
+      "/bin/bash",
+    );
+  }
+
   async readWorkspaceFile(path: string): Promise<Uint8Array | null> {
     assertWorkspaceScopedPath(this.descriptor, path);
     const target = await this.#target();
@@ -250,7 +274,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
       "ssh",
       machineEnvironmentSshArgs(
         target,
-        {
+        this.#maintenanceRequest({
           argv: [
             "/bin/sh",
             "-c",
@@ -260,11 +284,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
             "read",
             path,
           ],
-        },
+        }),
         "interactive",
       ),
       {
         argv: ["/bin/cat"],
+        projectEnvProfile: "maintenance",
         timeoutMs: 60_000,
         maxOutputBytes: 64 * 1024 * 1024,
       },
@@ -286,7 +311,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
       "ssh",
       machineEnvironmentSshArgs(
         target,
-        {
+        this.#maintenanceRequest({
           argv: [
             "/bin/sh",
             "-c",
@@ -294,11 +319,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
             "write",
             path,
           ],
-        },
+        }),
         "interactive",
       ),
       {
         argv: ["/bin/sh"],
+        projectEnvProfile: "maintenance",
         stdin: bytes,
         timeoutMs: 120_000,
         maxOutputBytes: 1024 * 1024,
@@ -314,13 +340,20 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
   async exec(
     request: TaskEnvironmentExecRequest,
   ): Promise<TaskEnvironmentExecResult> {
-    assertTaskEnvironmentProcessRequest(request);
+    assertTaskEnvironmentExecRequest(request);
+    refusePrivilegedExec(request);
+    const profiled = applyProjectEnvProfile(
+      request,
+      this.descriptor.envMode ?? "baked",
+      "/bin/bash",
+    );
     const target = await this.#target();
+    request.admit?.();
     return capturedCliExec(
       this.#deps.spawn,
       "ssh",
-      machineEnvironmentSshArgs(target, request, "interactive"),
-      request,
+      machineEnvironmentSshArgs(target, profiled, "interactive"),
+      profiled,
     );
   }
 
@@ -328,12 +361,17 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     request: TaskEnvironmentSpawnRequest,
   ): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentProcessRequest(request);
+    const profiled = applyProjectEnvProfile(
+      request,
+      this.descriptor.envMode ?? "baked",
+      "/bin/bash",
+    );
     const target = await this.#target();
     return streamingCliExec(
       this.#deps.spawn,
       "ssh",
-      machineEnvironmentSshArgs(target, request, "interactive"),
-      request,
+      machineEnvironmentSshArgs(target, profiled, "interactive"),
+      profiled,
     );
   }
 
@@ -343,10 +381,10 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     assertTaskEnvironmentSessionRequest(request);
     // Sessions default to the workspace the way container images default to
     // WORKDIR /workspace — an agent CLI must start in the task's world.
-    const sessionRequest = {
+    const sessionRequest = applyProjectEnvProfile({
       ...request,
       cwd: request.cwd ?? this.#value.workspacePath,
-    };
+    }, this.descriptor.envMode ?? "baked", "/bin/bash");
     const target = await this.#target();
     return streamingCliExec(
       this.#deps.spawn,
@@ -360,10 +398,10 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     request: TaskEnvironmentDetachedSessionRequest,
   ): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentSessionRequest(request);
-    const sessionRequest = {
+    const sessionRequest = applyProjectEnvProfile({
       ...request,
       cwd: request.cwd ?? this.#value.workspacePath,
-    };
+    }, this.descriptor.envMode ?? "baked", "/bin/bash");
     const target = await this.#target();
     return capturedCliExec(
       this.#deps.spawn,
@@ -402,7 +440,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
           "ssh",
           machineEnvironmentSshArgs(
             target,
-            {
+            this.#maintenanceRequest({
               argv: [
                 "/bin/sh",
                 "-c",
@@ -410,11 +448,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
                 "copy",
                 request.destination,
               ],
-            },
+            }),
             "interactive",
           ),
           {
             argv: ["/bin/sh"],
+            projectEnvProfile: "maintenance",
             stdin: tarball.stdout,
             timeoutMs: 300_000,
             maxOutputBytes: 1024 * 1024,
@@ -433,7 +472,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
         "ssh",
         machineEnvironmentSshArgs(
           target,
-          {
+          this.#maintenanceRequest({
             argv: [
               "/bin/sh",
               "-c",
@@ -441,11 +480,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
               "copy",
               request.destination,
             ],
-          },
+          }),
           "interactive",
         ),
         {
           argv: ["/bin/sh"],
+          projectEnvProfile: "maintenance",
           stdin: bytes,
           timeoutMs: 120_000,
           maxOutputBytes: 1024 * 1024,
@@ -463,11 +503,12 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
       "ssh",
       machineEnvironmentSshArgs(
         target,
-        { argv: ["/bin/cat", request.source] },
+        this.#maintenanceRequest({ argv: ["/bin/cat", request.source] }),
         "interactive",
       ),
       {
         argv: ["/bin/cat"],
+        projectEnvProfile: "maintenance",
         timeoutMs: 120_000,
         maxOutputBytes: 64 * 1024 * 1024,
       },
@@ -572,11 +613,14 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
         "ssh",
         machineEnvironmentSshArgs(
           target,
-          { argv: ["/usr/bin/test", "-d", this.#value.workspacePath] },
+          this.#maintenanceRequest({
+            argv: ["/usr/bin/test", "-d", this.#value.workspacePath],
+          }),
           "interactive",
         ),
         {
           argv: ["/usr/bin/test"],
+          projectEnvProfile: "maintenance",
           timeoutMs: 15_000,
           maxOutputBytes: 4 * 1024,
         },
@@ -618,6 +662,7 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     if (!context.isCurrent()) {
       return { outcome: "deferred", detail: "runtime generation superseded" };
     }
+    await context.prepareConsumers?.();
     context.allowConsumers?.();
     await context.ensureConsumersStarted?.();
     if (!context.isCurrent()) {
@@ -633,9 +678,14 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
       const result = await capturedCliExec(
         this.#deps.spawn,
         "ssh",
-        machineEnvironmentSshArgs(target, { argv: ["/bin/true"] }, "interactive"),
+        machineEnvironmentSshArgs(
+          target,
+          this.#maintenanceRequest({ argv: ["/bin/true"] }),
+          "interactive",
+        ),
         {
           argv: ["/bin/true"],
+          projectEnvProfile: "maintenance",
           timeoutMs: 15_000,
           maxOutputBytes: 4 * 1024,
         },
@@ -745,7 +795,11 @@ export function createMachineTaskEnvironmentProvider(
       }
       // running/pending: fall through to the ssh-readiness proof below.
 
-      const handle = new MachineTaskEnvironmentHandle(locator, deps);
+      const handle = new MachineTaskEnvironmentHandle(
+        locator,
+        deps,
+        request.envMode ?? "loader",
+      );
       await waitForSsh(handle, deps.readyTimeoutMs ?? 120_000);
 
       // Workspace + optional in-env clone (ADR-121: the clone happens in the
@@ -762,6 +816,7 @@ export function createMachineTaskEnvironmentProvider(
           workspacePath,
         ],
         user: "root",
+        projectEnvProfile: "maintenance",
         timeoutMs: 30_000,
         maxOutputBytes: 64 * 1024,
       });
@@ -780,6 +835,7 @@ export function createMachineTaskEnvironmentProvider(
         ];
         const clone = await handle.exec({
           argv: cloneArgv,
+          projectEnvProfile: "maintenance",
           timeoutMs: 10 * 60_000,
           maxOutputBytes: 4 * 1024 * 1024,
         });
@@ -794,8 +850,9 @@ export function createMachineTaskEnvironmentProvider(
 
     async reconstruct(
       locator: TaskEnvironmentLocator,
+      envMode: ProjectEnvMode = "baked",
     ): Promise<TaskEnvironmentHandle> {
-      return new MachineTaskEnvironmentHandle(locator, deps);
+      return new MachineTaskEnvironmentHandle(locator, deps, envMode);
     },
   };
 }
@@ -810,6 +867,7 @@ async function waitForSsh(
     try {
       const probe = await handle.exec({
         argv: ["/bin/true"],
+        projectEnvProfile: "maintenance",
         timeoutMs: 10_000,
         maxOutputBytes: 4 * 1024,
       });

package/lib/task-environment/registry.ts

@@ -1,4 +1,5 @@
 import type {
+  ProjectEnvMode,
   TaskEnvironmentLocator,
   TaskEnvironmentProvider,
 } from "./types";
@@ -48,8 +49,8 @@ export class TaskEnvironmentRegistry<
     return provider;
   }
 
-  reconstruct(locator: TaskEnvironmentLocator) {
-    return this.provider(locator.provider).reconstruct(locator);
+  reconstruct(locator: TaskEnvironmentLocator, envMode: ProjectEnvMode = "baked") {
+    return this.provider(locator.provider).reconstruct(locator, envMode);
   }
 
   kinds(): string[] {

package/lib/task-environment/self-identity.ts

@@ -0,0 +1,20 @@
+/**
+ * The `self` provider's fixed names: a Uai Cloud machine's own task, run by
+ * the sidecar on that machine (ADR-133). A module with no imports, so the
+ * secrets proxy can name them without loading the provider, which reaches it
+ * back through the agent.
+ */
+
+export const SELF_TASK_ENVIRONMENT_PROVIDER = "self";
+
+/** The task user every agent, editor, and shell runs as. */
+export const SELF_TASK_USER = "node";
+
+/**
+ * A task process's own view of the hosts on its machine (ADR-153): the
+ * machine's /etc/hosts plus the secrets proxy's pins, which the root
+ * sidecar's own processes must never resolve. Every process the sidecar
+ * starts as the task user gets it bind-mounted over /etc/hosts, in a mount
+ * namespace of its own that still follows the machine's mounts.
+ */
+export const TASK_HOSTS_VIEW_PATH = "/run/uai/task-hosts";

package/lib/task-environment/self.ts

@@ -19,10 +19,16 @@ import { existsSync, readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 
 import { buildRemoteCommand } from "../machine-exec";
+import {
+  applyProjectEnvProfile,
+  PROJECT_ENV_PROFILE_ENV_NAMES,
+} from "../runtime-authority";
 import { capturedCliExec, streamingCliExec } from "./docker";
 import type { MachineTaskInput } from "./machine";
 import {
+  assertTaskEnvironmentExecRequest,
   assertTaskEnvironmentProcessRequest,
+  refusePrivilegedExec,
   assertTaskEnvironmentSessionRequest,
   assertWorkspaceScopedPath,
   type TaskEnvironmentCopyRequest,
@@ -34,6 +40,7 @@ import {
   type TaskEnvironmentLocator,
   type TaskEnvironmentPort,
   type TaskEnvironmentProcess,
+  type ProjectEnvMode,
   type TaskEnvironmentProvider,
   type TaskEnvironmentProvisionRequest,
   type TaskEnvironmentProvisioned,
@@ -44,11 +51,29 @@ import {
   type TaskEnvironmentStatus,
   TASK_ENVIRONMENT_LOCATOR_SCHEMA_VERSION,
 } from "./types";
+import { SELF_TASK_ENVIRONMENT_PROVIDER, SELF_TASK_USER, TASK_HOSTS_VIEW_PATH } from "./self-identity";
 
-export const SELF_TASK_ENVIRONMENT_PROVIDER = "self";
+export { SELF_TASK_ENVIRONMENT_PROVIDER, SELF_TASK_USER, TASK_HOSTS_VIEW_PATH };
 
-/** The task user every agent, editor, and shell runs as. */
-export const SELF_TASK_USER = "node";
+/**
+ * Binds the view, then runs the rest of its argv. With no view yet (nothing
+ * pinned so far: a start whose CA failed, the proxy off), it first makes one,
+ * a copy of the machine's file, so every task process has the view bound
+ * from its start and a later pin, rewritten into it in place, reaches them
+ * all. Made whole under another name and linked in, so it never shows half
+ * written and never replaces one made meanwhile. A view that cannot be
+ * bound fails the start: the task never runs with the proxy half in place.
+ */
+const TASK_VIEW_SCRIPT = [
+  "PATH=/usr/sbin:/usr/bin:/sbin:/bin; view=$1; shift",
+  'if [ ! -f "$view" ]; then',
+  '  umask 022; dir=${view%/*}; mkdir -p "$dir"',
+  '  tmp=$(mktemp "$dir/.task-hosts.XXXXXX") || exit 126',
+  '  cat /etc/hosts > "$tmp" && chmod 0644 "$tmp" && ln "$tmp" "$view" 2>/dev/null; rm -f "$tmp"',
+  "fi",
+  'mount --bind "$view" /etc/hosts || exit 126',
+  'exec "$@"',
+].join("\n");
 
 const SAFE_TASK_ID = /^[a-z0-9]{1,32}$/i;
 
@@ -163,23 +188,43 @@ export function selfCommand(
   privileged: boolean,
 ): { command: string; args: string[] } {
   const line = buildRemoteCommand({ ...request, detached: mode === "detached" });
+  const outerProfileEnv = PROJECT_ENV_PROFILE_ENV_NAMES.flatMap((name) => {
+    const value = request.env?.[name];
+    return value === undefined ? [] : [`${name}=${value}`];
+  });
+  const shellCommand =
+    outerProfileEnv.length === 0
+      ? { command: "/bin/sh", args: ["-lc", line] }
+      : {
+          command: "/usr/bin/env",
+          args: [...outerProfileEnv, "/bin/sh", "-lc", line],
+        };
   const user = request.user ?? SELF_TASK_USER;
   if (privileged && user !== "root") {
     return {
-      command: "/usr/bin/setpriv",
+      command: "/usr/bin/unshare",
       args: [
+        "--mount",
+        "--propagation",
+        "slave",
+        "--",
+        "/bin/sh",
+        "-c",
+        TASK_VIEW_SCRIPT,
+        "uai-task-view",
+        TASK_HOSTS_VIEW_PATH,
+        "/usr/bin/setpriv",
         `--reuid=${user}`,
         `--regid=${user}`,
         "--init-groups",
         "--reset-env",
         "--",
-        "/bin/sh",
-        "-lc",
-        line,
+        shellCommand.command,
+        ...shellCommand.args,
       ],
     };
   }
-  return { command: "/bin/sh", args: ["-lc", line] };
+  return shellCommand;
 }
 
 class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
@@ -190,7 +235,11 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
   readonly #privileged: () => boolean;
   readonly #etcEnvironment: () => Readonly<Record<string, string>>;
 
-  constructor(locator: TaskEnvironmentLocator, deps: SelfTaskEnvironmentDeps) {
+  constructor(
+    locator: TaskEnvironmentLocator,
+    deps: SelfTaskEnvironmentDeps,
+    envMode: ProjectEnvMode,
+  ) {
     this.#value = parseSelfTaskEnvironmentLocator(locator);
     this.#spawn = deps.spawn ?? nodeSpawn;
     this.#privileged =
@@ -200,6 +249,7 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     this.descriptor = {
       taskId: this.#value.taskId,
       locator,
+      envMode,
       workspacePath: this.#value.workspacePath,
     };
   }
@@ -220,6 +270,7 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     // agents touch (a root-owned file inside the workspace is a trap).
     const result = await this.exec({
       argv: ["/bin/sh", "-c", 'mkdir -p "$(dirname "$1")" && cat > "$1"', "write", path],
+      projectEnvProfile: "maintenance",
       stdin: bytes,
       timeoutMs: 120_000,
       maxOutputBytes: 1024 * 1024,
@@ -233,16 +284,30 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
 
   /** The request with the machine-wide environment beneath its own: what an
    * ssh session on a machine task gets from pam_env, applied here by hand. */
-  #withMachineEnv<T extends { env?: Readonly<Record<string, string>> }>(request: T): T {
+  #withMachineEnv<
+    T extends {
+      env?: Readonly<Record<string, string>>;
+      projectEnvProfile: "maintenance" | "task";
+    },
+  >(request: T): T {
     const base = this.#etcEnvironment();
-    if (Object.keys(base).length === 0) return request;
-    return { ...request, env: { ...base, ...request.env } };
+    const withMachineEnv =
+      Object.keys(base).length === 0
+        ? request
+        : { ...request, env: { ...base, ...request.env } };
+    return applyProjectEnvProfile(
+      withMachineEnv,
+      this.descriptor.envMode ?? "baked",
+      "/bin/bash",
+    );
   }
 
   async exec(request: TaskEnvironmentExecRequest): Promise<TaskEnvironmentExecResult> {
-    assertTaskEnvironmentProcessRequest(request);
+    assertTaskEnvironmentExecRequest(request);
+    refusePrivilegedExec(request);
     const scoped = this.#withMachineEnv(request);
     const { command, args } = selfCommand(scoped, "interactive", this.#privileged());
+    request.admit?.();
     return capturedCliExec(this.#spawn, command, args, scoped);
   }
 
@@ -306,6 +371,7 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     const result = await this.exec({
       argv: ["/bin/sh", "-c", script, "copy", request.source, request.destination],
       user: "root",
+      projectEnvProfile: "maintenance",
       timeoutMs: 5 * 60_000,
       maxOutputBytes: 64 * 1024,
     });
@@ -341,6 +407,7 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     if (!context.isCurrent()) {
       return { outcome: "deferred", detail: "runtime generation superseded" };
     }
+    await context.prepareConsumers?.();
     context.allowConsumers?.();
     await context.ensureConsumersStarted?.();
     if (!context.isCurrent()) {
@@ -378,10 +445,15 @@ export function createSelfTaskEnvironmentProvider(
       const workspacePath = input.workspacePath ?? "/workspace";
       const locator = selfTaskEnvironmentLocator({ taskId, workspacePath });
       await request.onPrepared?.(locator);
-      const handle = new SelfTaskEnvironmentHandle(locator, deps);
+      const handle = new SelfTaskEnvironmentHandle(
+        locator,
+        deps,
+        request.envMode ?? "loader",
+      );
       const prepare = await handle.exec({
         argv: ["/bin/sh", "-c", 'mkdir -p "$1" && chown node:node "$1"', "prepare", workspacePath],
         user: "root",
+        projectEnvProfile: "maintenance",
         timeoutMs: 30_000,
         maxOutputBytes: 64 * 1024,
       });
@@ -399,6 +471,7 @@ export function createSelfTaskEnvironmentProvider(
             input.repo.url,
             workspacePath,
           ],
+          projectEnvProfile: "maintenance",
           timeoutMs: 10 * 60_000,
           maxOutputBytes: 4 * 1024 * 1024,
         });
@@ -411,8 +484,11 @@ export function createSelfTaskEnvironmentProvider(
       return { handle, result: handle.descriptor };
     },
 
-    async reconstruct(locator: TaskEnvironmentLocator): Promise<TaskEnvironmentHandle> {
-      return new SelfTaskEnvironmentHandle(locator, deps);
+    async reconstruct(
+      locator: TaskEnvironmentLocator,
+      envMode: ProjectEnvMode = "baked",
+    ): Promise<TaskEnvironmentHandle> {
+      return new SelfTaskEnvironmentHandle(locator, deps, envMode);
     },
   };
 }