@runuai/host 0.9.148 → 0.9.149

package/lib/runtime-archive.ts

@@ -28,6 +28,16 @@ const BASE_TOP_LEVEL = Object.freeze(["agent", "bin", "node", "runtime.json"]);
 export const BUNDLED_RUNTIME_ROOT = "agent/bundled-runtime" as const;
 export const BUNDLED_RUNTIME_CAPABILITY =
   "agent/bundled-runtime/capability.json" as const;
+/**
+ * Cross-platform managed-runtime generation capability. Keep this outside the
+ * Darwin-only bundled subtree: the 0.9.148 validator tolerates additive files
+ * below `agent/`, so it can install the first capability-4 generation without
+ * understanding the marker. That generation then uses it to fence every
+ * later update and rollback after project-env activation.
+ */
+export const MANAGED_RUNTIME_CAPABILITY =
+  "agent/managed-runtime-capability.json" as const;
+export const MANAGED_RUNTIME_CAPABILITY_VERSION = 4 as const;
 /** Plugin directory == plugin binary name in Apple's signed pkg payload. */
 const APPLE_CONTAINER_PLUGINS = Object.freeze([
   "container-core-images",
@@ -43,6 +53,7 @@ const STANDARD_IMAGE_ASSETS = Object.freeze([
   Object.freeze({ path: "container/corepack-version", mode: 0o644 as const }),
   Object.freeze({ path: "container/uai-init", mode: 0o755 as const }),
   Object.freeze({ path: "container/uai-materialize-runtimes", mode: 0o755 as const }),
+  Object.freeze({ path: "container/uai-task-forwarder.mjs", mode: 0o644 as const }),
   Object.freeze({ path: "tool-versions", mode: 0o644 as const }),
 ]);
 const RUNTIME_ASSET_ROOTS = Object.freeze([
@@ -107,11 +118,22 @@ export interface RuntimeCapabilityDescriptorV3 {
   readonly bundledRuntime: BundledRuntimeDescriptor;
 }
 
-export type RuntimeDescriptor = RuntimeDescriptorV1;
-export type ResolvedRuntimeDescriptor = RuntimeDescriptor & (
+export interface ManagedRuntimeCapabilityDescriptorV4 {
+  readonly capabilitySchemaVersion: 4;
+}
+
+export type RuntimePlatformCapabilities =
   | { readonly capabilitySchemaVersion: 1 }
-  | RuntimeCapabilityDescriptorV3
-);
+  | RuntimeCapabilityDescriptorV3;
+
+export type ResolvedRuntimeCapabilities = RuntimePlatformCapabilities & {
+  /** Effective rollback/update floor carried by this whole generation. */
+  readonly runtimeCapabilityVersion: 1 | 3 | 4;
+};
+
+export type RuntimeDescriptor = RuntimeDescriptorV1;
+export type ResolvedRuntimeDescriptor = RuntimeDescriptor &
+  ResolvedRuntimeCapabilities;
 
 export interface RuntimeAssetManifestEntry {
   readonly path: string;
@@ -138,9 +160,7 @@ interface ArchiveEntry {
 
 export interface InspectedRuntimeArchive {
   readonly descriptor: RuntimeDescriptor;
-  readonly capabilities:
-    | { readonly capabilitySchemaVersion: 1 }
-    | RuntimeCapabilityDescriptorV3;
+  readonly capabilities: ResolvedRuntimeCapabilities;
   readonly memberCount: number;
 }
 
@@ -245,9 +265,7 @@ export function inspectRuntimeArchive(
 ): {
   entries: readonly ArchiveEntry[];
   descriptor: RuntimeDescriptor;
-  capabilities:
-    | { readonly capabilitySchemaVersion: 1 }
-    | RuntimeCapabilityDescriptorV3;
+  capabilities: ResolvedRuntimeCapabilities;
 } {
   assertCanonicalGzipHeader(archiveBytes);
   const tar = gunzipSync(archiveBytes, { maxOutputLength: MAX_UNCOMPRESSED_BYTES });
@@ -423,7 +441,7 @@ function validateEntryLayout(
   entries: readonly ArchiveEntry[],
   byPath: ReadonlyMap<string, ArchiveEntry>,
   descriptor: RuntimeDescriptor,
-): { readonly capabilitySchemaVersion: 1 } | RuntimeCapabilityDescriptorV3 {
+): ResolvedRuntimeCapabilities {
   const topLevel = new Set(entries.map((entry) => entry.memberPath.split("/")[0]!));
   if (
     [...topLevel].sort().join("\0") !== [...BASE_TOP_LEVEL].sort().join("\0")
@@ -447,9 +465,16 @@ function validateEntryLayout(
     "agent/scripts/agent/task-down.sh",
     "agent/scripts/agent/task-status.sh",
   ];
-  const capabilities = validateArchivedRuntimeCapability(byPath, descriptor);
-  if (capabilities.capabilitySchemaVersion === 3) {
-    const bundled = capabilities.bundledRuntime;
+  const platformCapabilities = validateArchivedRuntimeCapability(
+    byPath,
+    descriptor,
+  );
+  const runtimeCapabilityVersion = validateArchivedManagedRuntimeCapability(
+    byPath,
+    platformCapabilities.capabilitySchemaVersion,
+  );
+  if (platformCapabilities.capabilitySchemaVersion === 3) {
+    const bundled = platformCapabilities.bundledRuntime;
     const pluginBinaries = APPLE_CONTAINER_PLUGINS.map(
       (plugin) => `${bundled.layout.plugins}/${plugin}/bin/${plugin}`,
     );
@@ -484,7 +509,7 @@ function validateEntryLayout(
       `${bundled.layout.standardImage}/container`,
       bundled.layout.licenses,
     );
-    validateArchivedRuntimeAssets(byPath, capabilities);
+    validateArchivedRuntimeAssets(byPath, platformCapabilities);
     executables.push(
       bundled.layout.containerCli,
       bundled.layout.apiserver,
@@ -506,7 +531,27 @@ function validateEntryLayout(
       throw new Error(`runtime archive executable mode is invalid: ${executable}`);
     }
   }
-  return capabilities;
+  return { ...platformCapabilities, runtimeCapabilityVersion };
+}
+
+function validateArchivedManagedRuntimeCapability(
+  byPath: ReadonlyMap<string, ArchiveEntry>,
+  legacyCapabilityVersion: 1 | 3,
+): 1 | 3 | 4 {
+  const entry = byPath.get(MANAGED_RUNTIME_CAPABILITY);
+  if (entry === undefined) return legacyCapabilityVersion;
+  if (entry.type !== "0" || entry.data.length > MAX_PAX_BYTES) {
+    throw new Error(
+      "managed runtime capability descriptor is missing or too large",
+    );
+  }
+  let raw: unknown;
+  try {
+    raw = JSON.parse(entry.data.toString("utf8"));
+  } catch {
+    throw new Error("managed runtime capability descriptor is invalid JSON");
+  }
+  return validateManagedRuntimeCapabilityDescriptor(raw).capabilitySchemaVersion;
 }
 
 function validateArchivedRuntimeCapability(
@@ -609,6 +654,24 @@ export function validateRuntimeCapabilityDescriptor(
   };
 }
 
+export function validateManagedRuntimeCapabilityDescriptor(
+  value: unknown,
+): ManagedRuntimeCapabilityDescriptorV4 {
+  const object = strictObject(
+    value,
+    ["capabilitySchemaVersion"],
+    "managed runtime capability descriptor",
+  );
+  if (
+    object.capabilitySchemaVersion !== MANAGED_RUNTIME_CAPABILITY_VERSION
+  ) {
+    throw new Error("unsupported managed runtime capability schema");
+  }
+  return {
+    capabilitySchemaVersion: MANAGED_RUNTIME_CAPABILITY_VERSION,
+  };
+}
+
 function validateBundledRuntimeDescriptor(
   value: unknown,
 ): BundledRuntimeDescriptor {

package/lib/runtime-authority.ts

@@ -1,3 +1,8 @@
+import type {
+  ProjectEnvMode,
+  ProjectEnvProfile,
+} from "./task-environment/types";
+
 /**
  * Host-owned runtime/cache authority for every command launched in a task
  * container. Admission and recovery separately prove the container's fixed
@@ -95,6 +100,45 @@ export const MACHINE_RUNTIME_AUTHORITY_ENV: Readonly<Record<string, string>> =
     ENV: "",
   });
 
+/** Root-owned loader paths installed in every PR2+ task environment. */
+export const PROJECT_ENV_HOOK_PATH = "/usr/local/share/uai/env-hook.sh";
+export const PROJECT_ENV_EXEC_PATH = "/usr/local/bin/uai-env-exec";
+
+/** Names that must reach a provider-added outer shell as well as the payload. */
+export const PROJECT_ENV_PROFILE_ENV_NAMES = Object.freeze([
+  "BASH_ENV",
+  "SHELL",
+  "UAI_ENV_HOOK",
+] as const);
+
+/**
+ * Apply the caller's classified project-env policy at the final provider
+ * boundary. The overlay is deliberately last, so inherited/caller env cannot
+ * opt a maintenance command into the hook or replace the task login shell.
+ * Legacy baked environments are a rollout no-op: their image has no loader.
+ */
+export function applyProjectEnvProfile<
+  T extends {
+    projectEnvProfile: ProjectEnvProfile;
+    env?: Readonly<Record<string, string>>;
+  },
+>(
+  request: T,
+  envMode: ProjectEnvMode,
+  taskShell: "/usr/bin/zsh" | "/bin/bash",
+): T {
+  if (envMode === "baked") return request;
+  const profileEnv =
+    request.projectEnvProfile === "maintenance"
+      ? { BASH_ENV: "", UAI_ENV_HOOK: "0" }
+      : {
+          BASH_ENV: PROJECT_ENV_HOOK_PATH,
+          SHELL: taskShell,
+          UAI_ENV_HOOK: "1",
+        };
+  return { ...request, env: { ...request.env, ...profileEnv } };
+}
+
 /** Rewrite a session env assembled for a CONTAINER into its machine form:
  * every container-authority key is dropped, then the machine authority is
  * overlaid. Non-authority keys (engine credentials, task tokens, preview

package/lib/runtime-state.ts

@@ -1,12 +1,13 @@
-import { eq, inArray, isNull, notInArray, or } from "drizzle-orm";
+import { and, eq, inArray, isNull, notInArray, or } from "drizzle-orm";
 
 import { getDb, schema, type Db } from "./db";
 import { isTerminal, TERMINAL_STATUSES } from "./task-status";
 import { newId } from "./ulid";
 import type { HostTask } from "../db/schema";
-import type { TaskUpResult } from "../src/protocol";
+import type { TaskLaunchInput, TaskUpResult } from "../src/protocol";
 import {
   serializeTaskEnvironmentLocator,
+  type ProjectEnvMode,
   type TaskEnvironmentLocator,
 } from "./task-environment/types";
 
@@ -29,6 +30,22 @@ export function getHostTask(taskId: string): HostTask | null {
   );
 }
 
+/** Loader tasks whose authenticated gateway generation may still have a live
+ * runtime after this host process restarts. Terminal/stopped rows are never
+ * reactivated merely because an old credential file survived. */
+export function activeLoaderHostTasks(): HostTask[] {
+  return getDb()
+    .select()
+    .from(schema.hostTasks)
+    .where(
+      and(
+        eq(schema.hostTasks.envMode, "loader"),
+        inArray(schema.hostTasks.statusMirror, ["starting", "running"]),
+      ),
+    )
+    .all();
+}
+
 /** Remove a provisional first-seen row when admission loses a lifecycle gate. */
 export function deleteHostTask(taskId: string): void {
   // Row deletions are rare and load-bearing; a silent one cost a live
@@ -153,18 +170,17 @@ function upsertHostTaskIn(
 export function recordTaskUpResult(
   taskId: string,
   result: TaskUpResult,
-  environment?: TaskEnvironmentLocator,
+  environment: TaskEnvironmentLocator,
+  envMode: ProjectEnvMode,
 ): void {
   upsertHostTask(taskId, {
     codeServerPort: result.codeServerPort ?? null,
     previewPorts: JSON.stringify(result.previewPorts ?? []),
     composeProject: result.composeProject,
     worktreePath: result.worktreePath,
-    environmentProvider: environment?.provider ?? null,
-    environmentLocator:
-      environment === undefined
-        ? null
-        : serializeTaskEnvironmentLocator(environment),
+    environmentProvider: environment.provider,
+    environmentLocator: serializeTaskEnvironmentLocator(environment),
+    envMode,
     statusMirror: "running",
     lockedAt: null,
     startedAt: Date.now(),
@@ -187,10 +203,12 @@ export function recordTaskStarting(taskId: string): void {
 export function recordTaskEnvironmentPrepared(
   taskId: string,
   environment: TaskEnvironmentLocator,
+  envMode: ProjectEnvMode,
 ): void {
   upsertHostTask(taskId, {
     environmentProvider: environment.provider,
     environmentLocator: serializeTaskEnvironmentLocator(environment),
+    envMode,
   });
 }
 
@@ -204,6 +222,8 @@ export function recordTaskDown(taskId: string, status: string | undefined): void
       worktreePath: null,
       environmentProvider: null,
       environmentLocator: null,
+      envMode: null,
+      projectEnvSpec: null,
       statusMirror: status ?? "killed",
       lockedAt: null,
       endedAt: Date.now(),
@@ -245,8 +265,8 @@ export function recordTaskOwner(
   });
 }
 
-/** The task's project ids, lead project first; `[]` for rows that predate
- *  the column or carry an unreadable value. */
+/** Legacy baked-machine project ids, lead first; `[]` for rows that predate
+ *  the column or carry an unreadable value. Loader resolution uses projectEnvSpec. */
 export function hostTaskProjectIds(task: { projectIds?: string | null }): string[] {
   try {
     const parsed: unknown = JSON.parse(task.projectIds ?? "[]");
@@ -258,6 +278,151 @@ export function hostTaskProjectIds(task: { projectIds?: string | null }): string
   }
 }
 
+/** Null is the durable meaning of a task created before ADR-153 PR2. */
+export function hostTaskEnvMode(task: {
+  envMode?: string | null;
+}): ProjectEnvMode {
+  if (task.envMode === null || task.envMode === undefined) return "baked";
+  if (task.envMode === "baked" || task.envMode === "loader") {
+    return task.envMode;
+  }
+  throw new Error(`unsupported task project env mode: ${task.envMode}`);
+}
+
+export interface TaskProjectEnvSpec {
+  schemaVersion: 1;
+  projects: Array<{
+    projectId: string;
+    position: number;
+    declaredNames: string[];
+  }>;
+  /** Cloud-computed, explicitly non-secret task literals (preview/theme). */
+  previewEnv: Record<string, string>;
+}
+
+const PROJECT_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+/** Build the value-free resolver input while the authoritative launch frame is present. */
+export function taskProjectEnvSpec(
+  input: Pick<TaskLaunchInput, "projects" | "task">,
+): TaskProjectEnvSpec {
+  const projects = input.projects
+    .map((project) => {
+      let parsed: unknown = [];
+      try {
+        parsed = JSON.parse(project.env);
+      } catch {
+        // Match task-up's established malformed-env behavior: no declarations.
+      }
+      const names: string[] = [];
+      const seen = new Set<string>();
+      if (Array.isArray(parsed)) {
+        for (const declaration of parsed) {
+          if (
+            !declaration ||
+            typeof declaration !== "object" ||
+            Array.isArray(declaration)
+          ) {
+            continue;
+          }
+          const name = (declaration as { key?: unknown }).key;
+          if (
+            typeof name === "string" &&
+            PROJECT_ENV_NAME.test(name) &&
+            !seen.has(name)
+          ) {
+            seen.add(name);
+            names.push(name);
+          }
+        }
+      }
+      return {
+        projectId: project.id,
+        position: project.position,
+        declaredNames: names,
+      };
+    })
+    .sort(
+      (left, right) =>
+        left.position - right.position ||
+        left.projectId.localeCompare(right.projectId),
+    );
+  const previewEnv = Object.fromEntries(
+    Object.entries(input.task.previewEnv ?? {}).sort(([left], [right]) =>
+      left.localeCompare(right),
+    ),
+  );
+  return { schemaVersion: 1, projects, previewEnv };
+}
+
+/** Persist resolver metadata before environment provisioning starts. */
+export function recordTaskProjectEnvSpec(
+  taskId: string,
+  input: Pick<TaskLaunchInput, "projects" | "task">,
+): void {
+  upsertHostTask(taskId, {
+    projectEnvSpec: JSON.stringify(taskProjectEnvSpec(input)),
+  });
+}
+
+/** Null is a pre-feature row; malformed/newer persisted state fails closed. */
+export function hostTaskProjectEnvSpec(task: {
+  projectEnvSpec?: string | null;
+}): TaskProjectEnvSpec | null {
+  if (task.projectEnvSpec === null || task.projectEnvSpec === undefined) {
+    return null;
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(task.projectEnvSpec);
+  } catch {
+    throw new Error("persisted task project env spec is malformed");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("persisted task project env spec is malformed");
+  }
+  const record = parsed as Record<string, unknown>;
+  if (
+    record.schemaVersion !== 1 ||
+    !Array.isArray(record.projects) ||
+    !record.previewEnv ||
+    typeof record.previewEnv !== "object" ||
+    Array.isArray(record.previewEnv)
+  ) {
+    throw new Error("unsupported persisted task project env spec");
+  }
+  const projects = record.projects.map((entry) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error("persisted task project env spec has a malformed project");
+    }
+    const project = entry as Record<string, unknown>;
+    if (
+      typeof project.projectId !== "string" ||
+      project.projectId.length === 0 ||
+      !Number.isSafeInteger(project.position) ||
+      !Array.isArray(project.declaredNames) ||
+      project.declaredNames.some(
+        (name) => typeof name !== "string" || !PROJECT_ENV_NAME.test(name),
+      )
+    ) {
+      throw new Error("persisted task project env spec has a malformed project");
+    }
+    return {
+      projectId: project.projectId,
+      position: project.position as number,
+      declaredNames: [...new Set(project.declaredNames as string[])],
+    };
+  });
+  const previewEnv: Record<string, string> = {};
+  for (const [name, value] of Object.entries(record.previewEnv)) {
+    if (!PROJECT_ENV_NAME.test(name) || typeof value !== "string") {
+      throw new Error("persisted task project env spec has malformed preview env");
+    }
+    previewEnv[name] = value;
+  }
+  return { schemaVersion: 1, projects, previewEnv };
+}
+
 /** Append a task lifecycle event to the host event log (local `/api/events`). */
 export function recordHostEvent(
   taskId: string,

package/lib/secrets-proxy/address.ts

@@ -0,0 +1,72 @@
+/**
+ * Which upstream addresses the secrets proxy may dial (ADR-153 §3, rule 6).
+ *
+ * A proxied request carries a real secret, so its destination must be the
+ * public API the key is bound to — never something only the runner can
+ * reach (its loopback, the Docker bridge, a cloud metadata endpoint, the
+ * tailnet). The runner resolves the domain itself, and one non-public
+ * address anywhere in the answer rejects the whole answer, so a rebinding
+ * record cannot win by mixing a private address in with a public one.
+ *
+ * IPv6 is an allow-list (global unicast 2000::/3 only) minus special-purpose
+ * blocks; everything that embeds an IPv4 address (mapped, compatible,
+ * NAT64, 6to4, Teredo) is refused outright rather than unpacked.
+ */
+
+import { BlockList, isIP } from "node:net";
+
+const DENIED_IPV4: ReadonlyArray<readonly [string, number]> = [
+  ["0.0.0.0", 8], // "this network"
+  ["10.0.0.0", 8], // RFC 1918
+  ["100.64.0.0", 10], // CGNAT (RFC 6598) — Tailscale lives here
+  ["127.0.0.0", 8], // loopback
+  ["169.254.0.0", 16], // link-local, incl. cloud metadata
+  ["172.16.0.0", 12], // RFC 1918
+  ["192.0.0.0", 24], // IETF protocol assignments
+  ["192.0.2.0", 24], // TEST-NET-1
+  ["192.88.99.0", 24], // deprecated 6to4 relay anycast
+  ["192.168.0.0", 16], // RFC 1918
+  ["198.18.0.0", 15], // benchmarking
+  ["198.51.100.0", 24], // TEST-NET-2
+  ["203.0.113.0", 24], // TEST-NET-3
+  ["224.0.0.0", 4], // multicast
+  ["240.0.0.0", 4], // reserved, incl. 255.255.255.255
+];
+
+const DENIED_IPV6: ReadonlyArray<readonly [string, number]> = [
+  ["::ffff:0:0", 96], // IPv4-mapped
+  ["2001::", 23], // IETF protocol assignments, incl. Teredo 2001::/32
+  ["2001:db8::", 32], // documentation
+  ["2002::", 16], // 6to4
+  ["3fff::", 20], // documentation (RFC 9637)
+];
+
+// Two lists, never one: BlockList compares IPv4 against IPv6 rules through
+// the mapped form, so a `::ffff:0:0/96` rule in a shared list denies EVERY
+// IPv4 address (checked live on Node 22.11).
+const deniedIpv4 = new BlockList();
+for (const [network, prefix] of DENIED_IPV4) deniedIpv4.addSubnet(network, prefix, "ipv4");
+const deniedIpv6 = new BlockList();
+for (const [network, prefix] of DENIED_IPV6) deniedIpv6.addSubnet(network, prefix, "ipv6");
+
+// Loopback, unspecified, ULA fc00::/7, link-local fe80::/10, multicast
+// ff00::/8, NAT64 64:ff9b::/96 and IPv4-compatible ::/96 all fall outside.
+const globalUnicast = new BlockList();
+globalUnicast.addSubnet("2000::", 3, "ipv6");
+
+export function isPublicAddress(ip: string): boolean {
+  // isIP accepts zone ids (`fe80::1%eth0`); BlockList would quietly miss them.
+  if (typeof ip !== "string" || ip.includes("%")) return false;
+  try {
+    switch (isIP(ip)) {
+      case 4:
+        return !deniedIpv4.check(ip, "ipv4");
+      case 6:
+        return globalUnicast.check(ip, "ipv6") && !deniedIpv6.check(ip, "ipv6");
+      default:
+        return false;
+    }
+  } catch {
+    return false;
+  }
+}

package/lib/secrets-proxy/audit.ts

@@ -0,0 +1,30 @@
+/**
+ * The secrets proxy's audit log (ADR-153 §3 rule 8), next to
+ * mcp-audit.jsonl. The engine already keeps values, placeholders, paths and
+ * queries out of every entry; this only appends.
+ *
+ * It THROWS when a line cannot be written. An injection is recorded before
+ * its value leaves, and the engine refuses the request when that record
+ * fails; refusals and skips go through the engine's best-effort wrapper.
+ */
+
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+
+export const SECRETS_PROXY_AUDIT_FILE = "secrets-proxy-audit.jsonl";
+
+export function createAuditWriter(logsDir: string): (entry: Record<string, unknown>) => void {
+  const file = join(logsDir, SECRETS_PROXY_AUDIT_FILE);
+  return (entry) => {
+    const line = `${JSON.stringify(entry)}\n`;
+    try {
+      appendFileSync(file, line, { mode: 0o600 });
+    } catch (error) {
+      // A logs dir removed under a running runner (a cleanup job) must not
+      // refuse every proxied request until a restart: recreate and retry once.
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      mkdirSync(logsDir, { recursive: true, mode: 0o700 });
+      appendFileSync(file, line, { mode: 0o600 });
+    }
+  };
+}