@runuai/host 0.9.149 → 0.9.151

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/db/migrations/0027_cloud_credential_foundation.sql +51 -0
  2. package/db/migrations/0028_leased_engine_runtimes.sql +11 -0
  3. package/db/migrations/meta/_journal.json +14 -0
  4. package/db/schema.ts +188 -0
  5. package/lib/agent-cli.ts +11 -13
  6. package/lib/agent.ts +177 -7
  7. package/lib/agents/durable-proc.ts +56 -44
  8. package/lib/agents/registry.ts +19 -3
  9. package/lib/agents/session-state.ts +23 -10
  10. package/lib/agents/transport.ts +101 -69
  11. package/lib/apple-one-off.ts +277 -0
  12. package/lib/apple-runtime-recycle.ts +4 -3
  13. package/lib/attachments.ts +19 -17
  14. package/lib/capture-flow.ts +319 -0
  15. package/lib/cloud-credential-cleanup-adapter.ts +123 -0
  16. package/lib/cloud-credential-host.ts +512 -0
  17. package/lib/cloud-credential-leases.ts +2544 -0
  18. package/lib/cloud-credential-runtime.ts +1035 -0
  19. package/lib/codex-auth.ts +21 -1
  20. package/lib/container-runtime.ts +76 -0
  21. package/lib/credential-cleanup-inventory.ts +405 -0
  22. package/lib/credential-consumers/engine-anchor.ts +1876 -0
  23. package/lib/credential-consumers/engines.ts +773 -0
  24. package/lib/credential-consumers/github.ts +594 -0
  25. package/lib/credential-consumers/mcp.ts +384 -0
  26. package/lib/credential-consumers/task-files.ts +127 -0
  27. package/lib/credential-store-pickup.ts +15 -2
  28. package/lib/credential-store.ts +361 -33
  29. package/lib/credentials-activation-authority.ts +546 -0
  30. package/lib/credentials-purge.ts +1006 -0
  31. package/lib/db.ts +11 -0
  32. package/lib/docker-exec.ts +3 -1
  33. package/lib/engine-accounts.ts +42 -32
  34. package/lib/engine-connect.ts +47 -2
  35. package/lib/engine-credential-env.ts +50 -0
  36. package/lib/engine-login.ts +83 -1
  37. package/lib/env-file.ts +62 -8
  38. package/lib/env.ts +5 -0
  39. package/lib/fs-aliases.ts +49 -0
  40. package/lib/git-clone-credentials.ts +334 -0
  41. package/lib/git-diff.ts +219 -177
  42. package/lib/git-identity.ts +59 -14
  43. package/lib/github-origin.ts +28 -0
  44. package/lib/github-tokens.ts +56 -21
  45. package/lib/host-env.ts +17 -4
  46. package/lib/launch-mode.ts +25 -0
  47. package/lib/legacy-runtime-retirement.ts +388 -0
  48. package/lib/machine-exec.ts +14 -3
  49. package/lib/machine-provider-aws.ts +50 -8
  50. package/lib/machine-provider-local.ts +4 -0
  51. package/lib/machine-provider.ts +4 -0
  52. package/lib/managed-operation-drain.ts +8 -0
  53. package/lib/managed-runtime.ts +371 -7
  54. package/lib/mcp-capture.ts +860 -0
  55. package/lib/mcp-connections.ts +8 -1
  56. package/lib/mcp-gateway.ts +168 -10
  57. package/lib/obs.ts +2 -6
  58. package/lib/orchestrator.ts +1847 -236
  59. package/lib/person-capture.ts +327 -0
  60. package/lib/project-env-legacy-tags.ts +130 -0
  61. package/lib/project-env-task-replica.ts +1752 -0
  62. package/lib/runner-boot.ts +10 -0
  63. package/lib/runtime-activation-tail.ts +50 -3
  64. package/lib/runtime-archive.ts +68 -1
  65. package/lib/runtime-reconnect.ts +86 -0
  66. package/lib/runtime-state.ts +429 -13
  67. package/lib/safe-http.ts +364 -0
  68. package/lib/secrets-proxy/task-trust.ts +34 -3
  69. package/lib/sidecar-resume.ts +18 -5
  70. package/lib/skills.ts +47 -8
  71. package/lib/standard-image.ts +157 -103
  72. package/lib/stopped-task-status-queue.ts +68 -10
  73. package/lib/task-credential-cleanup.ts +525 -0
  74. package/lib/task-diff-sandbox.ts +464 -0
  75. package/lib/task-diff.ts +66 -163
  76. package/lib/task-env-source.ts +68 -14
  77. package/lib/task-environment/anchor.ts +31 -0
  78. package/lib/task-environment/apple-container.ts +69 -28
  79. package/lib/task-environment/docker.ts +101 -20
  80. package/lib/task-environment/machine-environment.ts +61 -0
  81. package/lib/task-environment/machine-task-up.ts +459 -96
  82. package/lib/task-environment/machine.ts +101 -11
  83. package/lib/task-environment/self.ts +108 -50
  84. package/lib/task-environment/types.ts +89 -5
  85. package/lib/task-environment/workspace-files.ts +623 -25
  86. package/lib/task-environment/workspace-runtime.fixture.ts +50 -0
  87. package/lib/task-gateway-recovery.ts +4 -1
  88. package/lib/task-gateway-state.ts +15 -0
  89. package/lib/task-machine-swap-safety.ts +729 -0
  90. package/lib/token-broker-adopt.ts +344 -0
  91. package/lib/token-broker-lambda.ts +56 -2
  92. package/lib/token-broker-local.ts +28 -4
  93. package/lib/token-broker-revision.ts +310 -0
  94. package/lib/token-broker-ssm.ts +368 -28
  95. package/lib/token-lanes/openai-oauth.ts +7 -3
  96. package/lib/token-lanes/xai-oauth.ts +7 -3
  97. package/lib/transcript.ts +9 -5
  98. package/package.json +6 -2
  99. package/scripts/agent/task-up.sh +242 -100
  100. package/src/cloud-credentials.ts +2399 -0
  101. package/src/event-outbox.ts +8 -6
  102. package/src/index.ts +1386 -875
  103. package/src/main.ts +1062 -140
  104. package/src/outbound-frame.ts +31 -0
  105. package/src/project-env-policy.ts +125 -10
  106. package/src/protocol.ts +699 -23
  107. package/src/ui/server.ts +48 -10
@@ -0,0 +1,50 @@
1
+ /**
2
+ * Tests only: the task's runtime as a `RuntimeNamespace` (#cb3j0z), its
3
+ * workspace the host directory `root` mounted at /workspace. What it is asked
4
+ * to make, remove and link is recorded and done there. A path through a link
5
+ * the task made resolves inside the runtime, never to the host's own files,
6
+ * so nothing is done on the host for it.
7
+ */
8
+ import { lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
9
+ import { join, relative } from "node:path";
10
+
11
+ import type { RuntimeNamespace } from "./workspace-files";
12
+
13
+ /** Whether a runtime path below /workspace passes through a link before its
14
+ * last component. */
15
+ export function throughLink(root: string, path: string): boolean {
16
+ let at = root;
17
+ for (const part of relative("/workspace", path).split("/").slice(0, -1)) {
18
+ at = join(at, part);
19
+ try {
20
+ if (lstatSync(at).isSymbolicLink()) return true;
21
+ } catch {
22
+ return false;
23
+ }
24
+ }
25
+ return false;
26
+ }
27
+
28
+ export function hostRuntimeNamespace(root: string, calls: string[][] = []): RuntimeNamespace {
29
+ const at = (path: string): string | null => (throughLink(root, path) ? null : join(root, relative("/workspace", path)));
30
+ return {
31
+ workspacePath: "/workspace",
32
+ makeDirectories: async (path) => {
33
+ calls.push(["mkdir", path]);
34
+ const host = at(path);
35
+ if (host) mkdirSync(host, { recursive: true });
36
+ },
37
+ remove: async (path) => {
38
+ calls.push(["rm", path]);
39
+ const host = at(path);
40
+ if (host) rmSync(host, { force: true });
41
+ },
42
+ replaceLink: async (target, path) => {
43
+ calls.push(["ln", target, path]);
44
+ const host = at(path);
45
+ if (!host) return;
46
+ rmSync(host, { force: true });
47
+ symlinkSync(target, host);
48
+ },
49
+ };
50
+ }
@@ -24,8 +24,11 @@ export function recoverActiveTaskGateways(): TaskGatewayRecoverySummary {
24
24
  if (spec === null) {
25
25
  throw new Error("loader task has no persisted project env spec");
26
26
  }
27
+ // The generation serves the run its runtime was established for.
28
+ const runEpoch = task.runEpoch > 0 ? task.runEpoch : null;
27
29
  const identity = recoverTaskGatewayTask(task.taskId, {
28
- resolveEnv: taskEnvResolver(task.taskId, spec),
30
+ resolveEnv: taskEnvResolver(task.taskId, spec, runEpoch),
31
+ runEpoch,
29
32
  });
30
33
  if (identity === null) {
31
34
  throw new Error("loader task has no valid persisted gateway identity");
@@ -44,6 +44,9 @@ interface TaskGatewayRecord {
44
44
  suspended: boolean;
45
45
  resolveEnv: TaskGatewayEnvResolver | null;
46
46
  snapshot: TaskGatewayEnvSnapshot | null;
47
+ /** ADR-154: the run this generation serves (null: one from before run
48
+ * epochs). What its task's env and proxy are read for. */
49
+ runEpoch: number | null;
47
50
  }
48
51
 
49
52
  export interface TaskGatewayRegistration extends TaskForwarderIdentity {}
@@ -70,6 +73,8 @@ export interface ResolvedTaskGatewayEnv {
70
73
  export interface RegisterTaskGatewayOptions {
71
74
  resolveEnv?: TaskGatewayEnvResolver;
72
75
  snapshot?: TaskGatewayEnvSnapshot;
76
+ /** The run the generation serves; absent for one from before run epochs. */
77
+ runEpoch?: number | null;
73
78
  }
74
79
 
75
80
  type RevocationListener = (identity: TaskGatewayRegistration) => void;
@@ -153,6 +158,7 @@ function persistedRecord(taskId: string): TaskGatewayRecord | null {
153
158
  suspended: false,
154
159
  resolveEnv: null,
155
160
  snapshot: null,
161
+ runEpoch: null,
156
162
  };
157
163
  } catch {
158
164
  return null;
@@ -228,6 +234,7 @@ function assignEnv(
228
234
  }
229
235
  record.resolveEnv = options.resolveEnv ?? null;
230
236
  record.snapshot = options.snapshot ?? null;
237
+ record.runEpoch = options.runEpoch ?? null;
231
238
  }
232
239
 
233
240
  /** Mint and durably register a fresh task generation. */
@@ -254,6 +261,7 @@ export function registerTaskGatewayTask(
254
261
  suspended: false,
255
262
  resolveEnv: null,
256
263
  snapshot: null,
264
+ runEpoch: null,
257
265
  };
258
266
  assignEnv(record, options);
259
267
  records.set(taskId, record);
@@ -398,6 +406,13 @@ export function currentTaskGatewayRegistration(
398
406
  : null;
399
407
  }
400
408
 
409
+ /** ADR-154: the run the task's live generation serves; null with none live,
410
+ * or for one from before run epochs. */
411
+ export function currentTaskGatewayRun(taskId: string): number | null {
412
+ const record = currentRecord(taskId);
413
+ return record?.active ? record.runEpoch : null;
414
+ }
415
+
401
416
  /** Trusted recovery identity, available while public authentication is shut. */
402
417
  export function taskGatewayRegistrationForRecovery(
403
418
  taskId: string,