@runuai/host 0.9.149 → 0.9.151
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/db/migrations/0027_cloud_credential_foundation.sql +51 -0
- package/db/migrations/0028_leased_engine_runtimes.sql +11 -0
- package/db/migrations/meta/_journal.json +14 -0
- package/db/schema.ts +188 -0
- package/lib/agent-cli.ts +11 -13
- package/lib/agent.ts +177 -7
- package/lib/agents/durable-proc.ts +56 -44
- package/lib/agents/registry.ts +19 -3
- package/lib/agents/session-state.ts +23 -10
- package/lib/agents/transport.ts +101 -69
- package/lib/apple-one-off.ts +277 -0
- package/lib/apple-runtime-recycle.ts +4 -3
- package/lib/attachments.ts +19 -17
- package/lib/capture-flow.ts +319 -0
- package/lib/cloud-credential-cleanup-adapter.ts +123 -0
- package/lib/cloud-credential-host.ts +512 -0
- package/lib/cloud-credential-leases.ts +2544 -0
- package/lib/cloud-credential-runtime.ts +1035 -0
- package/lib/codex-auth.ts +21 -1
- package/lib/container-runtime.ts +76 -0
- package/lib/credential-cleanup-inventory.ts +405 -0
- package/lib/credential-consumers/engine-anchor.ts +1876 -0
- package/lib/credential-consumers/engines.ts +773 -0
- package/lib/credential-consumers/github.ts +594 -0
- package/lib/credential-consumers/mcp.ts +384 -0
- package/lib/credential-consumers/task-files.ts +127 -0
- package/lib/credential-store-pickup.ts +15 -2
- package/lib/credential-store.ts +361 -33
- package/lib/credentials-activation-authority.ts +546 -0
- package/lib/credentials-purge.ts +1006 -0
- package/lib/db.ts +11 -0
- package/lib/docker-exec.ts +3 -1
- package/lib/engine-accounts.ts +42 -32
- package/lib/engine-connect.ts +47 -2
- package/lib/engine-credential-env.ts +50 -0
- package/lib/engine-login.ts +83 -1
- package/lib/env-file.ts +62 -8
- package/lib/env.ts +5 -0
- package/lib/fs-aliases.ts +49 -0
- package/lib/git-clone-credentials.ts +334 -0
- package/lib/git-diff.ts +219 -177
- package/lib/git-identity.ts +59 -14
- package/lib/github-origin.ts +28 -0
- package/lib/github-tokens.ts +56 -21
- package/lib/host-env.ts +17 -4
- package/lib/launch-mode.ts +25 -0
- package/lib/legacy-runtime-retirement.ts +388 -0
- package/lib/machine-exec.ts +14 -3
- package/lib/machine-provider-aws.ts +50 -8
- package/lib/machine-provider-local.ts +4 -0
- package/lib/machine-provider.ts +4 -0
- package/lib/managed-operation-drain.ts +8 -0
- package/lib/managed-runtime.ts +371 -7
- package/lib/mcp-capture.ts +860 -0
- package/lib/mcp-connections.ts +8 -1
- package/lib/mcp-gateway.ts +168 -10
- package/lib/obs.ts +2 -6
- package/lib/orchestrator.ts +1847 -236
- package/lib/person-capture.ts +327 -0
- package/lib/project-env-legacy-tags.ts +130 -0
- package/lib/project-env-task-replica.ts +1752 -0
- package/lib/runner-boot.ts +10 -0
- package/lib/runtime-activation-tail.ts +50 -3
- package/lib/runtime-archive.ts +68 -1
- package/lib/runtime-reconnect.ts +86 -0
- package/lib/runtime-state.ts +429 -13
- package/lib/safe-http.ts +364 -0
- package/lib/secrets-proxy/task-trust.ts +34 -3
- package/lib/sidecar-resume.ts +18 -5
- package/lib/skills.ts +47 -8
- package/lib/standard-image.ts +157 -103
- package/lib/stopped-task-status-queue.ts +68 -10
- package/lib/task-credential-cleanup.ts +525 -0
- package/lib/task-diff-sandbox.ts +464 -0
- package/lib/task-diff.ts +66 -163
- package/lib/task-env-source.ts +68 -14
- package/lib/task-environment/anchor.ts +31 -0
- package/lib/task-environment/apple-container.ts +69 -28
- package/lib/task-environment/docker.ts +101 -20
- package/lib/task-environment/machine-environment.ts +61 -0
- package/lib/task-environment/machine-task-up.ts +459 -96
- package/lib/task-environment/machine.ts +101 -11
- package/lib/task-environment/self.ts +108 -50
- package/lib/task-environment/types.ts +89 -5
- package/lib/task-environment/workspace-files.ts +623 -25
- package/lib/task-environment/workspace-runtime.fixture.ts +50 -0
- package/lib/task-gateway-recovery.ts +4 -1
- package/lib/task-gateway-state.ts +15 -0
- package/lib/task-machine-swap-safety.ts +729 -0
- package/lib/token-broker-adopt.ts +344 -0
- package/lib/token-broker-lambda.ts +56 -2
- package/lib/token-broker-local.ts +28 -4
- package/lib/token-broker-revision.ts +310 -0
- package/lib/token-broker-ssm.ts +368 -28
- package/lib/token-lanes/openai-oauth.ts +7 -3
- package/lib/token-lanes/xai-oauth.ts +7 -3
- package/lib/transcript.ts +9 -5
- package/package.json +6 -2
- package/scripts/agent/task-up.sh +242 -100
- package/src/cloud-credentials.ts +2399 -0
- package/src/event-outbox.ts +8 -6
- package/src/index.ts +1386 -875
- package/src/main.ts +1062 -140
- package/src/outbound-frame.ts +31 -0
- package/src/project-env-policy.ts +125 -10
- package/src/protocol.ts +699 -23
- package/src/ui/server.ts +48 -10
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Tests only: the task's runtime as a `RuntimeNamespace` (#cb3j0z), its
|
|
3
|
+
* workspace the host directory `root` mounted at /workspace. What it is asked
|
|
4
|
+
* to make, remove and link is recorded and done there. A path through a link
|
|
5
|
+
* the task made resolves inside the runtime, never to the host's own files,
|
|
6
|
+
* so nothing is done on the host for it.
|
|
7
|
+
*/
|
|
8
|
+
import { lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
|
|
9
|
+
import { join, relative } from "node:path";
|
|
10
|
+
|
|
11
|
+
import type { RuntimeNamespace } from "./workspace-files";
|
|
12
|
+
|
|
13
|
+
/** Whether a runtime path below /workspace passes through a link before its
|
|
14
|
+
* last component. */
|
|
15
|
+
export function throughLink(root: string, path: string): boolean {
|
|
16
|
+
let at = root;
|
|
17
|
+
for (const part of relative("/workspace", path).split("/").slice(0, -1)) {
|
|
18
|
+
at = join(at, part);
|
|
19
|
+
try {
|
|
20
|
+
if (lstatSync(at).isSymbolicLink()) return true;
|
|
21
|
+
} catch {
|
|
22
|
+
return false;
|
|
23
|
+
}
|
|
24
|
+
}
|
|
25
|
+
return false;
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
export function hostRuntimeNamespace(root: string, calls: string[][] = []): RuntimeNamespace {
|
|
29
|
+
const at = (path: string): string | null => (throughLink(root, path) ? null : join(root, relative("/workspace", path)));
|
|
30
|
+
return {
|
|
31
|
+
workspacePath: "/workspace",
|
|
32
|
+
makeDirectories: async (path) => {
|
|
33
|
+
calls.push(["mkdir", path]);
|
|
34
|
+
const host = at(path);
|
|
35
|
+
if (host) mkdirSync(host, { recursive: true });
|
|
36
|
+
},
|
|
37
|
+
remove: async (path) => {
|
|
38
|
+
calls.push(["rm", path]);
|
|
39
|
+
const host = at(path);
|
|
40
|
+
if (host) rmSync(host, { force: true });
|
|
41
|
+
},
|
|
42
|
+
replaceLink: async (target, path) => {
|
|
43
|
+
calls.push(["ln", target, path]);
|
|
44
|
+
const host = at(path);
|
|
45
|
+
if (!host) return;
|
|
46
|
+
rmSync(host, { force: true });
|
|
47
|
+
symlinkSync(target, host);
|
|
48
|
+
},
|
|
49
|
+
};
|
|
50
|
+
}
|
|
@@ -24,8 +24,11 @@ export function recoverActiveTaskGateways(): TaskGatewayRecoverySummary {
|
|
|
24
24
|
if (spec === null) {
|
|
25
25
|
throw new Error("loader task has no persisted project env spec");
|
|
26
26
|
}
|
|
27
|
+
// The generation serves the run its runtime was established for.
|
|
28
|
+
const runEpoch = task.runEpoch > 0 ? task.runEpoch : null;
|
|
27
29
|
const identity = recoverTaskGatewayTask(task.taskId, {
|
|
28
|
-
resolveEnv: taskEnvResolver(task.taskId, spec),
|
|
30
|
+
resolveEnv: taskEnvResolver(task.taskId, spec, runEpoch),
|
|
31
|
+
runEpoch,
|
|
29
32
|
});
|
|
30
33
|
if (identity === null) {
|
|
31
34
|
throw new Error("loader task has no valid persisted gateway identity");
|
|
@@ -44,6 +44,9 @@ interface TaskGatewayRecord {
|
|
|
44
44
|
suspended: boolean;
|
|
45
45
|
resolveEnv: TaskGatewayEnvResolver | null;
|
|
46
46
|
snapshot: TaskGatewayEnvSnapshot | null;
|
|
47
|
+
/** ADR-154: the run this generation serves (null: one from before run
|
|
48
|
+
* epochs). What its task's env and proxy are read for. */
|
|
49
|
+
runEpoch: number | null;
|
|
47
50
|
}
|
|
48
51
|
|
|
49
52
|
export interface TaskGatewayRegistration extends TaskForwarderIdentity {}
|
|
@@ -70,6 +73,8 @@ export interface ResolvedTaskGatewayEnv {
|
|
|
70
73
|
export interface RegisterTaskGatewayOptions {
|
|
71
74
|
resolveEnv?: TaskGatewayEnvResolver;
|
|
72
75
|
snapshot?: TaskGatewayEnvSnapshot;
|
|
76
|
+
/** The run the generation serves; absent for one from before run epochs. */
|
|
77
|
+
runEpoch?: number | null;
|
|
73
78
|
}
|
|
74
79
|
|
|
75
80
|
type RevocationListener = (identity: TaskGatewayRegistration) => void;
|
|
@@ -153,6 +158,7 @@ function persistedRecord(taskId: string): TaskGatewayRecord | null {
|
|
|
153
158
|
suspended: false,
|
|
154
159
|
resolveEnv: null,
|
|
155
160
|
snapshot: null,
|
|
161
|
+
runEpoch: null,
|
|
156
162
|
};
|
|
157
163
|
} catch {
|
|
158
164
|
return null;
|
|
@@ -228,6 +234,7 @@ function assignEnv(
|
|
|
228
234
|
}
|
|
229
235
|
record.resolveEnv = options.resolveEnv ?? null;
|
|
230
236
|
record.snapshot = options.snapshot ?? null;
|
|
237
|
+
record.runEpoch = options.runEpoch ?? null;
|
|
231
238
|
}
|
|
232
239
|
|
|
233
240
|
/** Mint and durably register a fresh task generation. */
|
|
@@ -254,6 +261,7 @@ export function registerTaskGatewayTask(
|
|
|
254
261
|
suspended: false,
|
|
255
262
|
resolveEnv: null,
|
|
256
263
|
snapshot: null,
|
|
264
|
+
runEpoch: null,
|
|
257
265
|
};
|
|
258
266
|
assignEnv(record, options);
|
|
259
267
|
records.set(taskId, record);
|
|
@@ -398,6 +406,13 @@ export function currentTaskGatewayRegistration(
|
|
|
398
406
|
: null;
|
|
399
407
|
}
|
|
400
408
|
|
|
409
|
+
/** ADR-154: the run the task's live generation serves; null with none live,
|
|
410
|
+
* or for one from before run epochs. */
|
|
411
|
+
export function currentTaskGatewayRun(taskId: string): number | null {
|
|
412
|
+
const record = currentRecord(taskId);
|
|
413
|
+
return record?.active ? record.runEpoch : null;
|
|
414
|
+
}
|
|
415
|
+
|
|
401
416
|
/** Trusted recovery identity, available while public authentication is shut. */
|
|
402
417
|
export function taskGatewayRegistrationForRecovery(
|
|
403
418
|
taskId: string,
|