@runuai/host 0.9.150 → 0.9.151

package/lib/mcp-connections.ts

@@ -15,6 +15,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { eq } from "drizzle-orm";
 
 import { configuredCredentialStore, queueStoreWrite, userParameterName } from "./credential-store";
+import { LeftOwnCredentialsError, whileOnOwnCredentials } from "./cloud-credential-host";
 import { getDb, schema } from "./db";
 import { sealAesGcm, openAesGcm } from "./secrets";
 import { signInBoxMode } from "./signin-box";
@@ -627,7 +628,13 @@ export async function authHeaderFor(
     forceRefresh ||
     (secret.expiresAt && secret.expiresAt - REFRESH_LEAD_MS < Date.now())
   ) {
-    secret = await refreshTokens(row, secret);
+    // ADR-154 §7: a refresh only while the runner is on its own
+    // credentials, counted whole (the rotated secret written, its store
+    // mirror queued): leaving them waits for it, and none begins after.
+    const current = secret;
+    const refreshing = whileOnOwnCredentials(() => refreshTokens(row, current));
+    if (refreshing === null) throw new LeftOwnCredentialsError();
+    secret = await refreshing;
   }
   return { name: "authorization", value: `Bearer ${secret.accessToken}` };
 }

package/lib/mcp-gateway.ts

@@ -15,6 +15,12 @@
  * VERIFY-ON-MAC: OrbStack forwards host.docker.internal to loopback-bound
  * host services; if not, set UAI_MCP_GATEWAY_BIND=0.0.0.0 (the unguessable
  * per-task token stays the auth).
+ *
+ * ADR-154 §11: a task on cloud credentials is served from its lease instead
+ * (credential-consumers/mcp.ts): the header comes from memory, every request
+ * goes through the SSRF rule, and an expired or refused OAuth token is
+ * refreshed by the cloud's broker, never here. On a runner past its
+ * credentials floor nothing falls back to the local store.
  */
 
 import {
@@ -56,7 +62,16 @@ import {
   runtimeAuthorityDockerExecArgs,
 } from "./runtime-authority";
 import type { TaskEnvironmentHandle } from "./task-environment/types";
+import { LeftOwnCredentialsError, onOwnCredentials, whileOnOwnCredentials } from "./cloud-credential-host";
 import { authHeaderFor, getConnection } from "./mcp-connections";
+import {
+  forgetLeasedMcp,
+  holdLeasedMcp,
+  leasedMcpFor,
+  type McpRequestHold,
+  type LeasedMcpConnection,
+} from "./credential-consumers/mcp";
+import { safeRequest, type SafeHttpDeps, type SafeHttpResponse } from "./safe-http";
 import { agentClisReady } from "./standard-image";
 import { isSafeHostTaskId, assertSafeHostTaskId } from "./task-identity";
 import type { McpGatewayCapability } from "../src/protocol";
@@ -224,6 +239,7 @@ export function clearTaskGatewayAcl(taskId: string): void {
   // like `../container-runtime-provider` must never resolve outside the ACL
   // directory, so an unsafe id is a no-op here rather than a deletion.
   if (!isSafeHostTaskId(taskId)) return;
+  forgetLeasedMcp(taskId);
   try {
     rmSync(aclPath(taskId));
   } catch {
@@ -263,16 +279,28 @@ function deny(res: ServerResponse, status: number, message: string): void {
   res.end(JSON.stringify({ error: message }));
 }
 
-async function readBody(req: IncomingMessage): Promise<Buffer | null> {
-  const chunks: Buffer[] = [];
-  let size = 0;
-  for await (const chunk of req) {
-    const buf = chunk as Buffer;
-    size += buf.length;
-    if (size > MAX_BODY_BYTES) return null;
-    chunks.push(buf);
+/** The request's body, or null past MAX_BODY_BYTES. With `signal`, an abort
+ *  ends the request where it is (the read rejects): a task that stops
+ *  sending mid-body never holds what waits for its request to end. */
+async function readBody(req: IncomingMessage, signal?: AbortSignal): Promise<Buffer | null> {
+  const stop = (): void => {
+    req.destroy(new Error("request ended"));
+  };
+  if (signal?.aborted) stop();
+  else signal?.addEventListener("abort", stop, { once: true });
+  try {
+    const chunks: Buffer[] = [];
+    let size = 0;
+    for await (const chunk of req) {
+      const buf = chunk as Buffer;
+      size += buf.length;
+      if (size > MAX_BODY_BYTES) return null;
+      chunks.push(buf);
+    }
+    return Buffer.concat(chunks);
+  } finally {
+    signal?.removeEventListener("abort", stop);
   }
-  return Buffer.concat(chunks);
 }
 
 /** JSON-RPC method (+ tool name for tools/call) out of a request body. */
@@ -405,6 +433,20 @@ async function handleMcpRequest(
     res.setHeader("connection", "close");
     return deny(res, 429, "task connection limit reached");
   }
+  // ADR-154 §11: a task on cloud credentials is served from its lease.
+  const lease = leasedMcpFor(taskId);
+  if (lease || leaseOnly) {
+    if (!lease?.open) return deny(res, 503, "credentials unavailable");
+    const leased = lease.connections.get(slug);
+    if (!leased) return deny(res, 404, `no connection "${slug}" for this task`);
+    // Named but unreadable: unavailable, never "no such connection".
+    const hold = "unavailable" in leased ? null : holdLeasedMcp(taskId, slug);
+    if (!hold) return deny(res, 503, "credentials unavailable");
+    return serveLeasedConnection(req, res, taskId, hold);
+  }
+  // ADR-154: the runner's own connections only while it is on its own
+  // credentials; from the moment it begins leaving them, none is read.
+  if (!onOwnCredentials()) return deny(res, 503, "credentials unavailable");
   const entry = acl.connections.find((c) => c.slug === slug);
   if (!entry) return deny(res, 404, `no connection "${slug}" for this task`);
   const conn = getConnection(entry.id);
@@ -432,7 +474,12 @@ async function handleMcpRequest(
   res.on("close", () => controller.abort());
 
   const attempt = async (forceRefresh: boolean): Promise<Response> => {
-    const auth = await authHeaderFor(conn, forceRefresh);
+    // Counted (leaving waits for a refresh under way), and never a local
+    // header sent once leaving has begun, however long the read took.
+    const reading = whileOnOwnCredentials(() => authHeaderFor(conn, forceRefresh));
+    if (reading === null) throw new LeftOwnCredentialsError();
+    const auth = await reading;
+    if (!onOwnCredentials()) throw new LeftOwnCredentialsError();
     if (auth) headers[auth.name] = auth.value;
     const connectTimer = setTimeout(
       () => controller.abort(),
@@ -457,6 +504,7 @@ async function handleMcpRequest(
       upstream = await attempt(true);
     }
   } catch (err) {
+    if (err instanceof LeftOwnCredentialsError) return deny(res, 503, "credentials unavailable");
     audit({ taskId, slug, method: req.method, error: String(err) });
     return deny(res, 502, "upstream unreachable");
   }
@@ -495,6 +543,116 @@ async function handleMcpRequest(
   }
 }
 
+/** ADR-154 §13: a runner past its credentials floor serves MCP only from
+ *  leases; a task without one is answered 503, never from the local store. */
+let leaseOnly = false;
+
+export function setMcpGatewayLeaseOnly(on: boolean): void {
+  leaseOnly = on;
+}
+
+/** Tests only: the SSRF rule's injectable resolver and trust roots. */
+let leasedSafeHttpDeps: SafeHttpDeps = {};
+export function setLeasedMcpSafeHttpDepsForTests(deps: SafeHttpDeps): void {
+  leasedSafeHttpDeps = deps;
+}
+
+const LEASED_METHODS = new Set(["GET", "POST", "DELETE"]);
+
+/**
+ * One request for a leased connection: attach its header, send it under the
+ * SSRF rule, and stream the answer back. The request is held on its task: the
+ * gate closing, a cleanup, or the task hanging up ends it wherever it is,
+ * connecting, waiting for headers or streaming. An OAuth token past its
+ * expiry is refreshed first and never sent; a 401 is retried once, only with
+ * a newer token for the very connection the request began with.
+ */
+async function serveLeasedConnection(
+  req: IncomingMessage,
+  res: ServerResponse,
+  taskId: string,
+  hold: McpRequestHold,
+): Promise<void> {
+  const slug = hold.connection.slug;
+  // From the start: a hang-up ends the request before headers too.
+  const client = new AbortController();
+  res.once("close", () => {
+    client.abort();
+    hold.end();
+  });
+  const signal = AbortSignal.any([hold.signal, client.signal]);
+  const method = req.method ?? "GET";
+  if (!LEASED_METHODS.has(method)) return deny(res, 405, "method not allowed");
+  let body: Buffer | null = null;
+  if (method === "POST") {
+    try {
+      body = await readBody(req, signal);
+    } catch {
+      // Ended before its body arrived: the gate closed, or the task went.
+      if (!res.destroyed && !res.headersSent) deny(res, 503, "credentials unavailable");
+      return;
+    }
+    if (body === null) return deny(res, 413, "request body too large");
+  }
+  const forwarded: Record<string, string> = {};
+  for (const name of FORWARD_REQ_HEADERS) {
+    const v = req.headers[name];
+    if (typeof v === "string") forwarded[name] = v;
+  }
+
+  let connection = hold.current();
+  if (!connection) return deny(res, 503, "credentials unavailable");
+  if (connection.authKind === "oauth" && connection.expiresAt !== null && connection.expiresAt <= Date.now()) {
+    connection = await hold.refresh(connection);
+    if (!connection) return deny(res, 503, "credentials unavailable");
+  }
+
+  const attempt = (current: LeasedMcpConnection): Promise<SafeHttpResponse> =>
+    safeRequest(
+      {
+        url: current.url,
+        method: method as "GET" | "POST" | "DELETE",
+        headers: current.header ? { ...forwarded, [current.header.name]: current.header.value } : forwarded,
+        ...(body ? { body } : {}),
+        signal,
+      },
+      undefined,
+      leasedSafeHttpDeps,
+    );
+
+  let upstream: SafeHttpResponse;
+  try {
+    upstream = await attempt(connection);
+    if (upstream.status === 401 && connection.authKind === "oauth") {
+      upstream.body.destroy();
+      const refreshed = await hold.refresh(connection);
+      if (!refreshed) return deny(res, 401, `connection "${slug}" needs a new sign-in`);
+      connection = refreshed;
+      upstream = await attempt(connection);
+    }
+  } catch (err) {
+    if (signal.aborted) return deny(res, 503, "credentials unavailable");
+    audit({ taskId, slug, method, error: err instanceof Error ? err.message : String(err) });
+    return deny(res, 502, "upstream unreachable");
+  }
+
+  const summary = body ? rpcSummary(body) : {};
+  audit({ taskId, slug, method, rpc: summary.method, tool: summary.tool, status: upstream.status });
+  const resHeaders: Record<string, string> = {};
+  for (const name of FORWARD_RES_HEADERS) {
+    const v = upstream.headers[name];
+    if (typeof v === "string") resHeaders[name] = v;
+  }
+  res.writeHead(upstream.status, resHeaders);
+  // A stream ends with its task's gate or its client: the signal destroys the
+  // upstream body, and the pipeline tears down both ends.
+  pipeline(upstream.body, res, (err) => {
+    if (err && err.name !== "AbortError" && !signal.aborted) {
+      audit({ taskId, slug, stream: "ended", error: err.name });
+    }
+  });
+}
+
 async function handleGatewayRequest(
   req: IncomingMessage,
   res: ServerResponse,

package/lib/obs.ts

@@ -41,6 +41,7 @@ import { join } from "node:path";
 import * as Sentry from "@sentry/node";
 
 import { env } from "./env";
+import { isDevelopmentLaunch } from "./launch-mode";
 
 /**
  * The uai-host Sentry project's DSN, baked into the shipped package (npm +
@@ -79,12 +80,7 @@ export function resolveHostDsn(env: {
   // filesystem position (review finding: real dev launches — root
   // `pnpm host-agent`, desktop non-packaged — set none of the explicit
   // flags). The explicit flags remain as overrides/belt.
-  const repoOrDev =
-    env.NODE_ENV === "development" ||
-    env.NODE_ENV === "test" ||
-    env.UAI_AGENT_FROM_REPO === "1" ||
-    env.UAI_AGENT_FROM_REPO === "true" ||
-    env.UAI_LAUNCHED_FROM_REPO === "1";
+  const repoOrDev = isDevelopmentLaunch(env);
   if (DEFAULT_HOST_DSN && !repoOrDev) {
     return { dsn: DEFAULT_HOST_DSN, source: "default" };
   }