@runuai/host 0.9.148 → 0.9.149

package/lib/git-diff.ts

@@ -196,6 +196,7 @@ async function runEnvironmentGitCommand(
   maxOutputBytes: number,
 ): Promise<string> {
   const result = await environment.exec({
+    projectEnvProfile: "maintenance",
     argv: ["/usr/bin/git", ...args],
     cwd,
     env: { ...RUNTIME_AUTHORITY_ENV, ...NON_INTERACTIVE_GIT_ENV },

package/lib/git-identity.ts

@@ -73,6 +73,7 @@ async function environmentStep(
   stdin?: Uint8Array,
 ): Promise<{ status: number | null; stdout: string; stderr: string }> {
   const result = await environment.exec({
+    projectEnvProfile: "maintenance",
     argv,
     user: "node",
     env: RUNTIME_AUTHORITY_ENV,
@@ -113,6 +114,7 @@ export async function setupTaskGitIdentity(
     ];
     const res = environment
       ? await environment.exec({
+          projectEnvProfile: "maintenance",
           argv: command,
           user: "node",
           env: RUNTIME_AUTHORITY_ENV,

package/lib/github-tokens.ts

@@ -1736,6 +1736,7 @@ export async function injectIntoContainer(
     ? async (command, input) => {
         const [first, ...rest] = [...CLEAN_CONTAINER_ENV, ...command];
         const result = await environment.exec({
+          projectEnvProfile: "maintenance",
           argv: [first!, ...rest],
           user: "node",
           env: { ...SANITIZED_CONTAINER_ENV, ...RUNTIME_AUTHORITY_ENV },

package/lib/host-env.ts

@@ -27,14 +27,75 @@ import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import { signInBoxMode } from "./signin-box";
 
+// Process-local epochs are enough for loader snapshots: every value mutation
+// also happens in this process, and a host restart rebuilds both the epoch map
+// and every task resolver. Keeping the counter per project lets a task ignore
+// unrelated projects without retaining decrypted values in a shared cache.
+const projectEnvRevisions = new Map<string, number>();
+
+// ADR-153: what a task's view decides moves with more than values: a
+// binding, and the store's gate opening or closing (a value write outside
+// the records closes it too). One process-local counter covers them all.
+let projectEnvAuthorityRevisionCount = 0;
+
+export function noteProjectEnvValueMutation(projectId: string): void {
+  projectEnvRevisions.set(
+    projectId,
+    (projectEnvRevisions.get(projectId) ?? 0) + 1,
+  );
+  // On an activated store, a value written outside its records (an old
+  // frame, the credential store) closes the gate by trigger, which every
+  // task's view depends on, not only this project's.
+  projectEnvAuthorityRevisionCount += 1;
+  emitProjectEnvChange();
+}
+
+const projectEnvChangeListeners = new Set<() => void>();
+
+/** Calls `listener` after any change to project env values, records,
+ *  bindings or the store's gate; returns its removal. A listener that throws
+ *  is skipped, never the change. */
+export function onProjectEnvChange(listener: () => void): () => void {
+  projectEnvChangeListeners.add(listener);
+  return () => {
+    projectEnvChangeListeners.delete(listener);
+  };
+}
+
+function emitProjectEnvChange(): void {
+  for (const listener of projectEnvChangeListeners) {
+    try {
+      listener();
+    } catch {
+      // A listener's failure is its own.
+    }
+  }
+}
+
+/** Current process-local value revision for one project's env. */
+export function projectEnvRevision(projectId: string): number {
+  return projectEnvRevisions.get(projectId) ?? 0;
+}
+
+
+export function noteProjectEnvAuthorityChange(): void {
+  projectEnvAuthorityRevisionCount += 1;
+  emitProjectEnvChange();
+}
+
+/** Current process-local revision of the store's records and gate. */
+export function projectEnvAuthorityRevision(): number {
+  return projectEnvAuthorityRevisionCount;
+}
+
 /** Pack a sealed value (ct + nonce) into the single TEXT column. */
-function packValue(value: string): string {
+export function sealProjectEnvValueForStorage(value: string): string {
   const sealed = sealAesGcm(value);
   return `${sealed.ct.toString("base64")}.${sealed.nonce.toString("base64")}`;
 }
 
-/** Reverse {@link packValue}; throws if the column is malformed. */
-function unpackValue(valueEnc: string): string {
+/** Reverse {@link sealProjectEnvValueForStorage}; throws if malformed. */
+export function openProjectEnvValueFromStorage(valueEnc: string): string {
   const dot = valueEnc.indexOf(".");
   if (dot === -1) throw new Error("malformed value_enc");
   const ct = Buffer.from(valueEnc.slice(0, dot), "base64");
@@ -56,15 +117,16 @@ export function setProjectEnvVar(
     .values({
       projectId,
       key,
-      valueEnc: packValue(value),
+      valueEnc: sealProjectEnvValueForStorage(value),
       updatedAt: now,
       ...(orgId ? { orgId } : {}),
     })
     .onConflictDoUpdate({
       target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key],
-      set: { valueEnc: packValue(value), updatedAt: now, ...(orgId ? { orgId } : {}) },
+      set: { valueEnc: sealProjectEnvValueForStorage(value), updatedAt: now, ...(orgId ? { orgId } : {}) },
     })
     .run();
+  noteProjectEnvValueMutation(projectId);
   if (orgId) noteProjectOrg(projectId, orgId, { except: key });
   mirrorProjectEnvToStore(projectId, key);
 }
@@ -159,8 +221,21 @@ export function deleteProjectEnvVar(projectId: string, key: string): void {
     )
     .run();
   if (result.changes > 0) {
-    const name = projectEnvParameterName(projectId, key);
-    if (name) queueStoreWrite(`delete project env ${projectId}/${key}`, (store) => store.delete(name));
+    noteProjectEnvValueMutation(projectId);
+    mirrorProjectEnvDeletionToStore(projectId, key);
+  }
+}
+
+/** Queue only the credential-store side of a committed local deletion. */
+export function mirrorProjectEnvDeletionToStore(
+  projectId: string,
+  key: string,
+): void {
+  const name = projectEnvParameterName(projectId, key);
+  if (name) {
+    queueStoreWrite(`delete project env ${projectId}/${key}`, (store) =>
+      store.delete(name),
+    );
   }
 }
 
@@ -202,7 +277,7 @@ export function projectEnvStoreValue(projectId: string, key: string): StoredProj
     kind: "project-env",
     projectId,
     key,
-    value: unpackValue(row.valueEnc),
+    value: openProjectEnvValueFromStorage(row.valueEnc),
     updatedAt: row.updatedAt,
     ...(row.orgId ? { orgId: row.orgId } : {}),
   };
@@ -249,22 +324,24 @@ export function importProjectEnvFromStore(value: StoredProjectEnv, storeRef: str
     .values({
       projectId: value.projectId,
       key: value.key,
-      valueEnc: packValue(value.value),
+      valueEnc: sealProjectEnvValueForStorage(value.value),
       updatedAt: value.updatedAt,
       storeRef,
       ...(value.orgId ? { orgId: value.orgId } : {}),
     })
     .onConflictDoNothing({ target: [schema.hostProjectEnv.projectId, schema.hostProjectEnv.key] })
     .run();
+  if (result.changes > 0) noteProjectEnvValueMutation(value.projectId);
   return result.changes > 0;
 }
 
 /** Reconcile: the row's parameter vanished elsewhere; drop the row only. */
 export function deleteProjectEnvLocal(projectId: string, key: string): void {
-  getDb()
+  const result = getDb()
     .delete(schema.hostProjectEnv)
     .where(and(eq(schema.hostProjectEnv.projectId, projectId), eq(schema.hostProjectEnv.key, key)))
     .run();
+  if (result.changes > 0) noteProjectEnvValueMutation(projectId);
 }
 
 /** Sorted list of a project's env var KEY NAMES (never the values). */
@@ -297,7 +374,7 @@ export function getDecryptedForProject(projectId: string): Record<string, string
   const out: Record<string, string> = {};
   for (const row of rows) {
     try {
-      out[row.key] = unpackValue(row.valueEnc);
+      out[row.key] = openProjectEnvValueFromStorage(row.valueEnc);
     } catch (err) {
       console.warn(
         `[host-env] skipping ${projectId}/${row.key}: decrypt failed (${
@@ -322,7 +399,9 @@ const RESERVED_TASK_ENV_EXACT = new Set([
   "GIT_ASKPASS", "SSH_ASKPASS", "GIT_SSH", "GIT_SSH_COMMAND",
   "HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME",
   "PATH", "LD_PRELOAD", "LD_AUDIT", "LD_LIBRARY_PATH", "NODE_OPTIONS",
-  "NODE_PATH", "SHELLOPTS", "BASHOPTS", "PS4", "BASH_ENV", "ENV",
+  "NODE_PATH", "SHELL", "SHELLOPTS", "BASHOPTS", "PS4", "BASH_ENV", "ENV",
+  "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "REQUESTS_CA_BUNDLE",
+  "__CURSOR_SANDBOX_ENV_RESTORE", "GROK_LOGIN_ENV",
   "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN",
   "XAI_API_KEY", "PLAYWRIGHT_BROWSERS_PATH",
 ]);
@@ -332,16 +411,17 @@ export function isReservedTaskEnvName(name: string): boolean {
   if (RESERVED_TASK_ENV_EXACT.has(name)) return true;
   if (name.startsWith("GIT_CONFIG") || name.startsWith("ASDF_")) return true;
   if (name.startsWith("COREPACK_") || name.startsWith("UAI_")) return true;
+  if (name.startsWith("__UAI_ENV_")) return true;
   return RESERVED_TASK_ENV_NPM.test(name);
 }
 
 /**
- * Project env for a task that has no container env to carry it (ADR-121
- * machine tasks): every project's decrypted values, lead project winning a
- * key collision, minus the reserved names above — exactly what task-up hands
- * Compose for a Docker task. Live 2026-09-09: a machine task on Uai Cloud
- * had the Infisical identity in the store and the host, and the agent never
- * saw it, because only the compose path injected project env.
+ * Rollout-only project env for an ADR-121 machine task whose persisted mode
+ * is still `baked`: every project's decrypted values, lead project winning a
+ * key collision, minus the reserved names above. Loader tasks must use the
+ * declaration-pinned gateway instead. Live 2026-09-09: a machine task on Uai
+ * Cloud had the Infisical identity in the store and the host, and the agent
+ * never saw it, because only the compose path injected project env.
  */
 export function projectEnvForTask(projectIds: readonly string[]): Record<string, string> {
   const merged: Record<string, string> = {};

package/lib/lease.ts

@@ -110,13 +110,21 @@ export function leaseAwsConfig(lease: Pick<TaskLease, "region">): string {
   return `[default]\nregion = ${lease.region}\ncredential_process = ${LEASE_CREDENTIAL_PROCESS}\n`;
 }
 
-/** The org and user a lease was issued for — the credential store paths a
+/** The org and user a current, unexpired lease was issued for — the credential store paths a
  * sidecar may list (`/uai/orgs/<org>`, `/uai/users/<user>`; the task-machine
  * policy grants nothing above them). Null on an owned host or before the
  * first grant; `orgId` is null for a lease with no org scope. Absent from
  * the lease when the cloud predates the field. */
-export function leaseScope(): { orgId: string | null; userId: string } | null {
-  if (!current || typeof current.userId !== "string") return null;
+export function leaseScope(
+  now: number = Date.now(),
+): { orgId: string | null; userId: string } | null {
+  if (
+    !current ||
+    current.expiresAt <= now ||
+    typeof current.userId !== "string"
+  ) {
+    return null;
+  }
   return { orgId: current.orgId ?? null, userId: current.userId };
 }
 

package/lib/machine-gateway-tunnel.ts

@@ -4,18 +4,18 @@
  * Containers reach the host's MCP gateway via container topology
  * (host.docker.internal, the vmnet gateway IP). A machine — an EC2
  * instance behind its own network — can never route to the host, so the
- * host pushes the gateway TO the machine instead: one persistent
- * `ssh -N -R 127.0.0.1:<port>:127.0.0.1:<port>` per machine task, using
- * the same per-task key every other machine operation rides. Task configs
- * then point MCP servers at the machine's own loopback
- * (setupMcpTaskConfig's machine branch).
+ * host pushes the gateway TO the machine instead: one persistent reverse
+ * tunnel publishes the runner's 5877 listener as machine-loopback 5878.
+ * The task-local authenticated forwarder owns 5877 and relays there only
+ * after proving the task generation. Task configs keep pointing MCP servers
+ * at the machine's own loopback (setupMcpTaskConfig's machine branch).
  *
  * Supervision: the tunnel respawns with a short backoff while ensured —
  * re-resolving the machine address each spawn, since it changes across
  * stop/start — and stops when the task stops, tears down, or the process
- * exits. Failure is quiet-but-logged: MCP servers failing to connect is
- * the visible symptom, and the agent-facing degradation is already
- * per-server.
+ * exits. Initial provisioning can await an OpenSSH forwarding acknowledgement
+ * before starting consumers; background recovery keeps the original
+ * quiet-but-logged behavior.
  */
 
 import { spawn, type ChildProcess } from "node:child_process";
@@ -23,10 +23,20 @@ import { spawn, type ChildProcess } from "node:child_process";
 import { MCP_GATEWAY_PORT } from "./mcp-gateway";
 
 const RESPAWN_DELAY_MS = 3_000;
+/** Long enough for the provider's 10s SSH connect deadline plus remote
+ * forwarding setup, but bounded so task-up fails closed rather than starting
+ * consumers with an unusable env loader. */
+export const MACHINE_GATEWAY_TUNNEL_READY_TIMEOUT_MS = 20_000;
+/** Task-local 5877 belongs to the authenticated forwarder. SSH publishes the
+ * runner's real gateway one hop away so unproved traffic can never dial it. */
+export const MACHINE_GATEWAY_TUNNEL_PORT = 5_878;
 /** After this many consecutive sub-5s deaths, slow the respawn cadence so a
  * permanently unreachable machine does not spin ssh forever. */
 const FAST_DEATH_THRESHOLD = 5;
 const SLOW_RESPAWN_DELAY_MS = 60_000;
+const READY_MARKER = "__UAI_MACHINE_GATEWAY_TUNNEL_READY__";
+const READY_REMOTE_COMMAND =
+  `/bin/echo '${READY_MARKER}'; while :; do sleep 3600; done`;
 
 export interface MachineTunnelSource {
   gatewayTunnelSshArgs(
@@ -37,36 +47,125 @@ export interface MachineTunnelSource {
 
 interface TunnelState {
   generation: number;
+  machinePort: number;
   child: ChildProcess | null;
   timer: ReturnType<typeof setTimeout> | null;
+  spawning: boolean;
+  ready: boolean;
+  readinessWaiters: Set<ReadinessWaiter>;
   fastDeaths: number;
   spawnedAt: number;
 }
 
+interface ReadinessWaiter {
+  resolve(): void;
+  reject(error: Error): void;
+}
+
 const tunnels = new Map<string, TunnelState>();
 
-/** Idempotently keep a gateway tunnel alive for this machine task. */
+/** Idempotently keep a gateway tunnel alive for this machine task. Legacy
+ * baked tasks retain direct 5877→5877 forwarding; loader tasks explicitly
+ * request 5878 so their authenticated task-local forwarder owns 5877. */
 export function ensureMachineGatewayTunnel(
   taskId: string,
   source: MachineTunnelSource,
+  machinePort = MCP_GATEWAY_PORT,
 ): void {
-  const existing = tunnels.get(taskId);
-  if (existing && (existing.child !== null || existing.timer !== null)) {
-    return; // live or already scheduled
+  armMachineGatewayTunnel(taskId, source, machinePort);
+}
+
+/** Keep the tunnel supervised and wait until OpenSSH has acknowledged the
+ * remote listener. `ExitOnForwardFailure=yes` delays the remote command until
+ * every requested forwarding listener is installed; its stdout marker is
+ * therefore stronger than the local child `spawn` event. A timeout rejects
+ * (fail closed) but deliberately leaves the supervisor armed for recovery. */
+export function ensureMachineGatewayTunnelReady(
+  taskId: string,
+  source: MachineTunnelSource,
+  machinePort = MCP_GATEWAY_PORT,
+  timeoutMs = MACHINE_GATEWAY_TUNNEL_READY_TIMEOUT_MS,
+): Promise<void> {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    return Promise.reject(
+      new Error("machine gateway tunnel readiness timeout must be positive"),
+    );
+  }
+  const state = armMachineGatewayTunnel(taskId, source, machinePort);
+  if (state.ready) return Promise.resolve();
+
+  return new Promise<void>((resolve, reject) => {
+    let settled = false;
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    const waiter: ReadinessWaiter = {
+      resolve: () => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        state.readinessWaiters.delete(waiter);
+        resolve();
+      },
+      reject: (error) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        state.readinessWaiters.delete(waiter);
+        reject(error);
+      },
+    };
+    state.readinessWaiters.add(waiter);
+    // Readiness can race the waiter registration when an already-running ssh
+    // child emits its marker in the same turn.
+    if (state.ready) {
+      waiter.resolve();
+      return;
+    }
+    timer = setTimeout(() => {
+      waiter.reject(
+        new Error(
+          `machine gateway tunnel ${taskId} did not become ready within ${timeoutMs}ms`,
+        ),
+      );
+    }, timeoutMs);
+    timer.unref?.();
+  });
+}
+
+function armMachineGatewayTunnel(
+  taskId: string,
+  source: MachineTunnelSource,
+  machinePort: number,
+): TunnelState {
+  let existing = tunnels.get(taskId);
+  if (
+    existing &&
+    (existing.child !== null || existing.timer !== null || existing.spawning)
+  ) {
+    if (existing.machinePort === machinePort) return existing;
+    // The persisted env mode is attach-incompatible, so this should only be
+    // a recovery-order correction. Replace the wrong topology immediately.
+    stopMachineGatewayTunnel(taskId);
+    existing = undefined;
   }
   const state: TunnelState = existing ?? {
     generation: 0,
+    machinePort,
     child: null,
     timer: null,
+    spawning: false,
+    ready: false,
+    readinessWaiters: new Set(),
     fastDeaths: 0,
     spawnedAt: 0,
   };
+  state.machinePort = machinePort;
   state.generation += 1;
   tunnels.set(taskId, state);
   if (existing === undefined) {
     console.log(`[machine-tunnel] ${taskId}: ensuring gateway tunnel`);
   }
   void spawnTunnel(taskId, source, state, state.generation);
+  return state;
 }
 
 async function spawnTunnel(
@@ -76,13 +175,15 @@ async function spawnTunnel(
   generation: number,
 ): Promise<void> {
   if (tunnels.get(taskId) !== state || state.generation !== generation) return;
+  state.spawning = true;
   let args: string[];
   try {
     args = await source.gatewayTunnelSshArgs(
-      MCP_GATEWAY_PORT,
+      state.machinePort,
       MCP_GATEWAY_PORT,
     );
   } catch (err) {
+    state.spawning = false;
     // Machine not reachable right now (stopped, address settling) — retry
     // on the slow cadence; a stop/teardown clears us before it matters.
     scheduleRespawn(taskId, source, state, generation, SLOW_RESPAWN_DELAY_MS);
@@ -94,19 +195,52 @@ async function spawnTunnel(
     state.fastDeaths += 1;
     return;
   }
+  if (tunnels.get(taskId) !== state || state.generation !== generation) return;
+  let sshArgs: string[];
+  try {
+    sshArgs = readinessAwareSshArgs(
+      args,
+      state.machinePort,
+      MCP_GATEWAY_PORT,
+    );
+  } catch (err) {
+    state.spawning = false;
+    scheduleRespawn(taskId, source, state, generation, SLOW_RESPAWN_DELAY_MS);
+    console.warn(
+      `[machine-tunnel] ${taskId}: invalid ssh arguments (${err instanceof Error ? err.message : err}) — retrying`,
+    );
+    return;
+  }
+  state.spawning = false;
+  state.ready = false;
   state.spawnedAt = Date.now();
-  const child = spawn("ssh", args, { stdio: ["ignore", "ignore", "pipe"] });
+  const child = spawn("ssh", sshArgs, {
+    stdio: ["ignore", "pipe", "pipe"],
+  });
   state.child = child;
+  let stdoutTail = "";
   let stderrTail = "";
+  child.stdout?.setEncoding("utf8");
+  child.stdout?.on("data", (chunk: string) => {
+    if (tunnels.get(taskId) !== state || state.generation !== generation) {
+      return;
+    }
+    stdoutTail = (stdoutTail + chunk).slice(-2048);
+    if (!state.ready && stdoutTail.includes(`${READY_MARKER}\n`)) {
+      state.ready = true;
+      for (const waiter of [...state.readinessWaiters]) waiter.resolve();
+    }
+  });
   child.stderr?.setEncoding("utf8");
   child.stderr?.on("data", (chunk: string) => {
     stderrTail = (stderrTail + chunk).slice(-2048);
   });
-  child.once("exit", (code) => {
+  child.once("close", (code) => {
     if (tunnels.get(taskId) !== state || state.generation !== generation) {
       return;
     }
     state.child = null;
+    state.ready = false;
     const lifetimeMs = Date.now() - state.spawnedAt;
     if (lifetimeMs < 5_000) state.fastDeaths += 1;
     else state.fastDeaths = 0;
@@ -127,10 +261,48 @@ async function spawnTunnel(
     );
   });
   child.once("error", () => {
-    // exit fires too; the handler above owns respawn.
+    // close fires too; the handler above owns respawn.
   });
 }
 
+/** Replace `-N` (no remote command) with a fixed remote command. With the
+ * provider's `ExitOnForwardFailure=yes`, OpenSSH runs this command only after
+ * the server has acknowledged the `-R` listener. The loop keeps the session
+ * alive exactly as `-N` did. */
+function readinessAwareSshArgs(
+  args: readonly string[],
+  machinePort: number,
+  hostPort: number,
+): string[] {
+  const noCommandIndex = args.indexOf("-N");
+  if (noCommandIndex === -1) {
+    throw new Error("machine gateway tunnel ssh args must include -N");
+  }
+  const exitOnForwardFailure = args.some(
+    (value, index) =>
+      value === "ExitOnForwardFailure=yes" && args[index - 1] === "-o",
+  );
+  if (!exitOnForwardFailure) {
+    throw new Error(
+      "machine gateway tunnel ssh args must enable ExitOnForwardFailure",
+    );
+  }
+  const expectedForward =
+    `127.0.0.1:${machinePort}:127.0.0.1:${hostPort}`;
+  const remoteForward = args.some(
+    (value, index) => value === expectedForward && args[index - 1] === "-R",
+  );
+  if (!remoteForward) {
+    throw new Error(
+      `machine gateway tunnel ssh args must publish ${expectedForward}`,
+    );
+  }
+  const readyArgs = [...args];
+  readyArgs.splice(noCommandIndex, 1);
+  readyArgs.unshift("-T", "-o", `RemoteCommand=${READY_REMOTE_COMMAND}`);
+  return readyArgs;
+}
+
 function scheduleRespawn(
   taskId: string,
   source: MachineTunnelSource,
@@ -153,6 +325,9 @@ export function stopMachineGatewayTunnel(taskId: string): void {
   tunnels.delete(taskId);
   state.generation += 1; // invalidate in-flight spawns
   if (state.timer) clearTimeout(state.timer);
+  for (const waiter of [...state.readinessWaiters]) {
+    waiter.reject(new Error(`machine gateway tunnel ${taskId} was stopped`));
+  }
   if (state.child) {
     state.child.kill("SIGTERM");
     state.child = null;
@@ -162,5 +337,8 @@ export function stopMachineGatewayTunnel(taskId: string): void {
 /** Test-only view. */
 export function machineGatewayTunnelActive(taskId: string): boolean {
   const state = tunnels.get(taskId);
-  return Boolean(state && (state.child !== null || state.timer !== null));
+  return Boolean(
+    state &&
+      (state.child !== null || state.timer !== null || state.spawning),
+  );
 }