@runuai/host 0.9.148 → 0.9.150

package/lib/task-environment/machine-task-up.ts

@@ -28,13 +28,38 @@ import type {
   TaskUpResult,
 } from "../agent";
 import { injectCodexIntoMachine } from "../codex-auth";
+import {
+  ensureMachineGatewayTunnelReady,
+  MACHINE_GATEWAY_TUNNEL_PORT,
+  stopMachineGatewayTunnel,
+} from "../machine-gateway-tunnel";
+import {
+  installMachineProjectEnvLoader,
+  installMachineTaskForwarderAsset,
+} from "../machine-project-env-loader";
+import {
+  MACHINE_RUNTIME_AUTHORITY_ENV,
+  PROJECT_ENV_HOOK_PATH,
+} from "../runtime-authority";
 import { sharedRoot } from "../shared-files";
+import { launchTaskEnvForwarder } from "../task-env-forwarder";
+import { MAX_ENV_SCHEMA_BYTES } from "../env-schema";
+import {
+  captureTaskEnvSchemaFromClone,
+  captureTaskEnvSchemas,
+  taskEnvSchemaObservation,
+  type RemoteGit,
+} from "../project-env-schema-capture";
+import { activeSecretsProxy } from "../secrets-proxy/host";
+import { reconcileSidecarTaskProxy } from "../secrets-proxy/task-trust";
+import { TASK_FORWARDER_SECRET_BYTES } from "../task-gateway-protocol";
 import {
   MACHINE_TASK_ENVIRONMENT_PROVIDER,
   parseMachineTaskEnvironmentLocator,
   type MachineTaskInput,
 } from "./machine";
 import type {
+  ProjectEnvMode,
   TaskEnvironmentDescriptor,
   TaskEnvironmentHandle,
   TaskEnvironmentProvider,
@@ -75,6 +100,51 @@ export interface MachineHostTaskUpDeps {
     workspacePath: string,
     task: { ownerOrgId?: string; ownerUserId: string; sharedFiles?: string },
   ) => Promise<string | null>;
+  /** Test seam for the host-side persistent reverse-tunnel supervisor. */
+  ensureGatewayTunnel?: typeof ensureMachineGatewayTunnelReady;
+}
+
+async function startMachineTaskForwarder(
+  taskId: string,
+  handle: TaskEnvironmentHandle<unknown>,
+  credentials: TaskUpCredentials,
+  ensureGatewayTunnel: typeof ensureMachineGatewayTunnelReady,
+): Promise<void> {
+  const gatewayTunnelSshArgs = handle.gatewayTunnelSshArgs?.bind(handle);
+  if (!gatewayTunnelSshArgs) {
+    // The sidecar gateway is in this root process and assigns loopback
+    // traffic to its one fixed task. Binding another listener would collide.
+    return;
+  }
+  const identity = credentials.taskGateway;
+  if (
+    !identity ||
+    !/^[A-Za-z0-9_-]{16,64}$/.test(identity.generation) ||
+    identity.secret.byteLength !== TASK_FORWARDER_SECRET_BYTES
+  ) {
+    throw new Error("machine task env gateway identity is unavailable");
+  }
+  await installMachineTaskForwarderAsset(handle);
+
+  await launchTaskEnvForwarder(
+    handle,
+    { taskId, generation: identity.generation },
+    Uint8Array.from(identity.secret),
+    {
+      gatewayHost: "127.0.0.1",
+      gatewayPort: MACHINE_GATEWAY_TUNNEL_PORT,
+      nodePath: "/usr/bin/node",
+    },
+  );
+
+  // Start this during task-up rather than waiting for the first agent. The
+  // editor can open a terminal before any roster process exists, and its
+  // first command must already be able to refresh through the forwarder.
+  await ensureGatewayTunnel(
+    taskId,
+    { gatewayTunnelSshArgs },
+    MACHINE_GATEWAY_TUNNEL_PORT,
+  );
 }
 
 /** Mirrors src/index.ts isGithubRepo — host-side predicate only. */
@@ -129,6 +199,7 @@ async function execWithStdin(
 ): Promise<StepResult> {
   const proc = await handle.spawn({
     argv,
+    projectEnvProfile: "maintenance",
     inheritEnv: [],
     env: { GIT_TERMINAL_PROMPT: "0" },
     timeoutMs,
@@ -159,6 +230,7 @@ async function execStep(
 ): Promise<StepResult> {
   const result = await handle.exec({
     argv,
+    projectEnvProfile: "maintenance",
     env: { GIT_TERMINAL_PROMPT: "0" },
     timeoutMs,
     maxOutputBytes: STEP_OUTPUT_BYTES,
@@ -175,15 +247,23 @@ async function execStep(
 const CREDENTIALED_CLONE_SCRIPT =
   'IFS= read -r UAI_GIT_TOKEN && export UAI_GIT_TOKEN GIT_ASKPASS=/usr/local/bin/uai-git-askpass GIT_TERMINAL_PROMPT=0 && exec git clone -- "$1" "$2"';
 
+type ProjectEnvSchemaObservation = NonNullable<TaskUpResult["envSchemas"]>[number];
+
+/** What a project's clone step did: cloned it now, found the task's own
+ *  clone already there (a resume), or could not clone it; and what to say. */
+interface CloneOutcome {
+  clone: "fresh" | "existing" | "failed";
+  warning: string | null;
+}
+
 async function cloneProject(
   handle: TaskEnvironmentHandle<unknown>,
-  workspacePath: string,
+  destination: string,
   project: { slug: string; repoUrl: string },
   taskBranch: string,
   owner: { name?: string; email?: string },
   token: string | null,
-): Promise<string | null> {
-  const destination = `${workspacePath}/${projectDirectoryName(project.slug)}`;
+): Promise<CloneOutcome> {
   const url = machineCloneUrl(project.repoUrl);
   const useToken = token !== null && isGithubRepoUrl(project.repoUrl);
 
@@ -194,7 +274,7 @@ async function cloneProject(
     ["/bin/sh", "-c", 'test -e "$1/.git"', "check", destination],
     GIT_STEP_TIMEOUT_MS,
   );
-  if (already.exitCode === 0) return null;
+  if (already.exitCode === 0) return { clone: "existing", warning: null };
 
   const clone = useToken
     ? await execWithStdin(
@@ -214,13 +294,15 @@ async function cloneProject(
     // git's own message ("could not read Username … terminal prompts
     // disabled") explains none of that. Say the actionable thing.
     if (token === null && isGithubRepoUrl(project.repoUrl)) {
-      return (
-        `could not clone ${project.repoUrl} for ${project.slug}: GitHub is ` +
-        "not connected on this host. Connect GitHub on the host's page " +
-        "(Connections → GitHub), then Resume."
-      );
+      return {
+        clone: "failed",
+        warning:
+          `could not clone ${project.repoUrl} for ${project.slug}: GitHub is ` +
+          "not connected on this host. Connect GitHub on the host's page " +
+          "(Connections → GitHub), then Resume.",
+      };
     }
-    return `could not clone ${project.repoUrl} for ${project.slug}: ${clone.stderr || "clone failed"}`;
+    return { clone: "failed", warning: `could not clone ${project.repoUrl} for ${project.slug}: ${clone.stderr || "clone failed"}` };
   }
 
   // Task branch off the clone's default HEAD (matches the compose path's
@@ -232,7 +314,7 @@ async function cloneProject(
     GIT_STEP_TIMEOUT_MS,
   );
   if (branch.exitCode !== 0) {
-    return `cloned ${project.slug} but could not create branch ${taskBranch}: ${branch.stderr}`;
+    return { clone: "fresh", warning: `cloned ${project.slug} but could not create branch ${taskBranch}: ${branch.stderr}` };
   }
 
   // Repo-local commit identity so agent commits work out of the box.
@@ -250,7 +332,85 @@ async function cloneProject(
       GIT_STEP_TIMEOUT_MS,
     );
   }
-  return null;
+  return { clone: "fresh", warning: null };
+}
+
+/** Git, read-only, in a fresh clone on the machine, as the task's user (the
+ *  way the clone ran) but with nothing of that user's environment: no
+ *  profile variable, PATH entry or global config can point it elsewhere. */
+function gitInClone(handle: TaskEnvironmentHandle<unknown>, destination: string): RemoteGit {
+  return async (args) => {
+    for (let attempt = 1; ; attempt += 1) {
+      const result = await handle.exec({
+        argv: [
+          "/usr/bin/env",
+          "-i",
+          "PATH=/usr/bin:/bin",
+          "HOME=/nonexistent",
+          "LC_ALL=C",
+          "GIT_CONFIG_NOSYSTEM=1",
+          "GIT_CONFIG_GLOBAL=/dev/null",
+          "GIT_TERMINAL_PROMPT=0",
+          "/usr/bin/git",
+          "--no-replace-objects",
+          "-C",
+          destination,
+          "-c",
+          "core.hooksPath=/dev/null",
+          "-c",
+          "core.fsmonitor=false",
+          ...args,
+        ],
+        projectEnvProfile: "maintenance",
+        timeoutMs: GIT_STEP_TIMEOUT_MS,
+        maxOutputBytes: MAX_ENV_SCHEMA_BYTES + 64 * 1024,
+      });
+      // A process that did not run to its end says nothing about the clone.
+      if (result.exitCode !== null) {
+        return result.exitCode === 0 && !result.stdoutTruncated ? Buffer.from(result.stdout) : null;
+      }
+      if (attempt >= 3) return null;
+    }
+  };
+}
+
+/**
+ * ADR-153 §4, "Machine and sidecar": each project's schema observation,
+ * stored where the task cannot write before anything in it starts, and the
+ * same one reported by every task-up of the task (the cloud keeps the first).
+ * Only a clone made now, on a machine where nothing of the task has run, is
+ * read. A resumed clone is the task's live work, and a clone that failed is
+ * retried on a resume after the task's processes have run, so neither is
+ * ever read: with nothing stored, the base is missing, for the task's life.
+ * A failure here withholds that project's unbound keys, never fails the
+ * start.
+ */
+async function captureMachineEnvSchemas(
+  taskId: string,
+  handle: TaskEnvironmentHandle<unknown>,
+  clones: ReadonlyArray<{ projectId: string; destination: string; clone: CloneOutcome["clone"] }>,
+): Promise<ProjectEnvSchemaObservation[]> {
+  const observations: ProjectEnvSchemaObservation[] = [];
+  for (const { projectId, destination, clone } of clones) {
+    try {
+      const stored = taskEnvSchemaObservation(taskId, projectId);
+      observations.push(
+        stored ??
+          (clone === "fresh"
+            ? await captureTaskEnvSchemaFromClone(taskId, projectId, gitInClone(handle, destination))
+            : // No base is ever recorded on a machine: this stores it missing.
+              captureTaskEnvSchemas(taskId, [projectId])[0]!),
+      );
+    } catch (error) {
+      console.warn(
+        `[machine] task ${taskId}: .env.schema capture failed for ${projectId}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      observations.push(captureTaskEnvSchemas(taskId, [projectId])[0]!);
+    }
+  }
+  return observations;
 }
 
 /** The curated code-server defaults (slim chrome, telemetry off, trust
@@ -293,6 +453,7 @@ async function seedEditorSettings(
       "seed",
       destination,
     ],
+    projectEnvProfile: "maintenance",
     stdin: Buffer.from(editorSettingsSeed(editorTheme)),
     timeoutMs: GIT_STEP_TIMEOUT_MS,
     maxOutputBytes: STEP_OUTPUT_BYTES,
@@ -351,6 +512,7 @@ async function copySharedFiles(
           "shared",
           scope.destination,
         ],
+        projectEnvProfile: "maintenance",
         stdin: tarball.stdout,
         timeoutMs: 5 * 60_000,
         maxOutputBytes: STEP_OUTPUT_BYTES,
@@ -392,6 +554,7 @@ export async function ensureCodeServer(
   handle: TaskEnvironmentHandle<unknown>,
   workspacePath: string,
   editorTheme: string | undefined,
+  envMode: ProjectEnvMode = handle.descriptor.envMode ?? "baked",
 ): Promise<void> {
   // Settings before process: code-server reads them at startup. A failed
   // seed still launches — a themed editor is worth less than one that starts.
@@ -413,21 +576,49 @@ export async function ensureCodeServer(
       "-c",
       'pgrep -f "[c]ode-server.*--bind-addr" >/dev/null 2>&1',
     ],
+    projectEnvProfile: "maintenance",
     timeoutMs: GIT_STEP_TIMEOUT_MS,
     maxOutputBytes: STEP_OUTPUT_BYTES,
   });
   if (running.exitCode === 0) return;
-  const script =
-    "mkdir -p /home/node/.local/share/code-server && " +
-    "exec /home/node/.local/bin/code-server " +
-    "--user-data-dir /home/node/.local/share/code-server " +
-    "--disable-workspace-trust --auth none --disable-telemetry " +
-    `--disable-update-check --bind-addr 0.0.0.0:${MACHINE_CODE_SERVER_PORT} ` +
-    '"$1" >/tmp/code-server.log 2>&1';
+  // Editor processes are task processes, but code-server must not inherit a
+  // real project value that a fixed-task sidecar's outer login shell loaded.
+  // Start it from an explicit empty environment and give its descendants only
+  // the host-owned runtime baseline plus the loader controls editor terminals
+  // need. The maintenance profile also prevents the provider-added outer
+  // shell from fetching project env before `env -i` gets control.
+  const editorEnvironment = {
+    ...MACHINE_RUNTIME_AUTHORITY_ENV,
+    ...(envMode === "loader"
+      ? { BASH_ENV: PROJECT_ENV_HOOK_PATH, UAI_ENV_HOOK: "1" }
+      : {}),
+    LOGNAME: "node",
+    PLAYWRIGHT_BROWSERS_PATH: "/opt/pw-browsers",
+    SHELL: "/bin/bash",
+    USER: "node",
+  } as const;
   const result = await handle.launchDetachedSession({
-    argv: ["/bin/sh", "-c", script, "code-server", workspacePath],
+    argv: [
+      "/usr/bin/env",
+      "-i",
+      ...Object.entries(editorEnvironment)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, value]) => `${name}=${value}`),
+      "/home/node/.local/bin/code-server",
+      "--user-data-dir",
+      "/home/node/.local/share/code-server",
+      "--disable-workspace-trust",
+      "--auth",
+      "none",
+      "--disable-telemetry",
+      "--disable-update-check",
+      "--bind-addr",
+      `0.0.0.0:${MACHINE_CODE_SERVER_PORT}`,
+      workspacePath,
+    ],
     inheritEnv: [],
     env: {},
+    projectEnvProfile: "maintenance",
     launchTimeoutMs: 30_000,
     maxOutputBytes: 64 * 1024,
   });
@@ -502,6 +693,7 @@ export function createMachineHostTaskEnvironmentProvider(
       request: TaskEnvironmentProvisionRequest<TaskLaunchInput, TaskUpCredentials>,
     ): Promise<TaskEnvironmentProvisioned<TaskUpResult, TaskDownResult>> {
       const { input } = request;
+      const envMode = request.envMode ?? "loader";
       const provisioned = await deps.environment.provision({
         taskId: request.taskId,
         input: {
@@ -511,13 +703,27 @@ export function createMachineHostTaskEnvironmentProvider(
           ...(deps.publishSsh() ? { publishSsh: true } : {}),
         },
         credentials: undefined,
+        envMode,
         onPrepared: request.onPrepared,
       });
       const handle = provisioned.handle;
       const workspacePath = handle.descriptor.workspacePath;
       const warnings: string[] = [];
+      const clones: Array<{ projectId: string; destination: string; clone: CloneOutcome["clone"] }> = [];
 
       try {
+        if (envMode === "loader") {
+          await installMachineProjectEnvLoader(handle);
+          // ADR-153, on a machine's own task (the sidecar's): the proxy's CA
+          // and pins before anything in the task loads its env. Never fails
+          // the start; its proxied keys stay withheld until they are in.
+          const proxyWarning = await reconcileSidecarTaskProxy(
+            handle,
+            activeSecretsProxy()?.runtime ?? null,
+            { start: true },
+          );
+          if (proxyWarning !== null) console.warn(`[machine] task ${request.taskId}: ${proxyWarning}`);
+        }
         const projects = [...input.projects].sort(
           (a, b) => a.position - b.position,
         );
@@ -528,15 +734,17 @@ export function createMachineHostTaskEnvironmentProvider(
           ? await deps.githubToken(input.task.ownerUserId)
           : null;
         for (const project of projects) {
-          const warning = await cloneProject(
+          const destination = `${workspacePath}/${projectDirectoryName(project.slug)}`;
+          const outcome = await cloneProject(
             handle,
-            workspacePath,
+            destination,
             project,
             input.task.branch,
             { name: input.ownerName, email: input.ownerEmail },
             token?.accessToken ?? null,
           );
-          if (warning) warnings.push(warning);
+          clones.push({ projectId: project.id, destination, clone: outcome.clone });
+          if (outcome.warning) warnings.push(outcome.warning);
         }
       } catch (error) {
         // Provisioning-infrastructure failures (ssh died, unsafe slug) tear
@@ -545,6 +753,9 @@ export function createMachineHostTaskEnvironmentProvider(
         await handle.teardown().catch(() => {});
         throw error;
       }
+      // ADR-153 §4: right after the clones, before shared files, the
+      // forwarder, the editor or any agent.
+      const envSchemas = await captureMachineEnvSchemas(request.taskId, handle, clones);
 
       // ADR-062 shared files: point-in-time copy (see copySharedFiles).
       const sharedWarning = await (deps.sharedFiles ?? copySharedFiles)(handle, workspacePath, {
@@ -574,6 +785,24 @@ export function createMachineHostTaskEnvironmentProvider(
         });
       }
 
+      if (envMode === "loader") {
+        try {
+          await startMachineTaskForwarder(
+            request.taskId,
+            handle,
+            request.credentials,
+            deps.ensureGatewayTunnel ?? ensureMachineGatewayTunnelReady,
+          );
+        } catch (error) {
+          // Unlike editor/auth conveniences, the loader is the only project
+          // env delivery path. A task without it must not start and silently
+          // hand consumers an incomplete or legacy environment.
+          stopMachineGatewayTunnel(request.taskId);
+          await handle.teardown().catch(() => {});
+          throw error;
+        }
+      }
+
       // Editor pane: code-server on the machine (same flags as uai-init's
       // container launch), idempotent across provision re-runs and resume.
       // Best-effort — a missing binary degrades the Editor tab, never the task.
@@ -581,6 +810,7 @@ export function createMachineHostTaskEnvironmentProvider(
         handle,
         workspacePath,
         input.task.previewEnv?.UAI_EDITOR_THEME,
+        envMode,
       ).catch((error: unknown) => {
         console.warn(
           `[machine] task ${request.taskId}: code-server launch failed: ${
@@ -597,6 +827,7 @@ export function createMachineHostTaskEnvironmentProvider(
           composeProject: environmentRuntimeIdentity(handle),
           worktreePath: deps.taskControlDir(request.taskId),
           codeServerPort: MACHINE_CODE_SERVER_PORT,
+          ...(envSchemas.length > 0 ? { envSchemas } : {}),
           ...(warnings.length > 0
             ? { initWarning: warnings.join("\n") }
             : {}),
@@ -604,8 +835,10 @@ export function createMachineHostTaskEnvironmentProvider(
       };
     },
 
-    async reconstruct(locator) {
-      return withTaskDownResult(await deps.environment.reconstruct(locator));
+    async reconstruct(locator, envMode = "baked") {
+      return withTaskDownResult(
+        await deps.environment.reconstruct(locator, envMode),
+      );
     },
   };
 }