@runuai/host 0.9.150 → 0.9.152

package/lib/agents/durable-proc.ts

@@ -18,18 +18,16 @@
  * LineProcess gave them.
  */
 
-import {
-  closeSync,
-  fstatSync,
-  mkdirSync,
-  openSync,
-  promises as fsp,
-  readSync,
-  statSync,
-} from "node:fs";
-import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
+import {
+  appendContainedFile,
+  containedModifiedAt,
+  NotARegularFileError,
+  readContainedFrom,
+  WorkspacePathRefusedError,
+} from "../task-environment/workspace-files";
+
 import type { ExitHandler, LineHandler } from "./proc";
 
 const POLL_MS = 75;
@@ -46,6 +44,14 @@ export function runnerScriptPath(): string {
 export interface DurableProcessOptions {
   /** Session dir as seen FROM THE HOST (on the workspace bind mount). */
   hostSessionDir: string;
+  /** The same directory as the task's workspace root and its components
+   *  below it: every file in it is reached never through a link the task
+   *  put there (#cb3j0z). It exists before the runner is launched. */
+  sessionFiles: { root: string; parts: readonly string[] };
+  /** Settles once that directory has been made, where only the task's
+   *  runtime can make it (macOS, #cb3j0z): no inbox write, the stop
+   *  included, is attempted before. Absent: it exists already. */
+  ready?: Promise<void>;
   /** Provider-owned detached launch. Omit to attach to an existing runner. */
   launch?: () => Promise<{
     exitCode: number | null;
@@ -73,10 +79,10 @@ interface RunnerMeta {
 
 export class DurableProcess {
   readonly durableSessionDir: string;
-  private readonly dir: string;
-  private readonly outboxPath: string;
-  private readonly inboxPath: string;
-  private readonly heartbeatPath: string;
+  private readonly root: string;
+  private readonly outbox: readonly string[];
+  private readonly inbox: readonly string[];
+  private readonly heartbeat: readonly string[];
 
   private readonly lineHandlers = new Set<LineHandler>();
   private readonly exitHandlers = new Set<ExitHandler>();
@@ -97,18 +103,22 @@ export class DurableProcess {
 
   constructor(opts: DurableProcessOptions) {
     this.durableSessionDir = opts.hostSessionDir;
-    this.dir = opts.hostSessionDir;
-    this.outboxPath = join(this.dir, "outbox.jsonl");
-    this.inboxPath = join(this.dir, "inbox.jsonl");
-    this.heartbeatPath = join(this.dir, "heartbeat");
+    this.root = opts.sessionFiles.root;
+    this.outbox = [...opts.sessionFiles.parts, "outbox.jsonl"];
+    this.inbox = [...opts.sessionFiles.parts, "inbox.jsonl"];
+    this.heartbeat = [...opts.sessionFiles.parts, "heartbeat"];
     this.offset = opts.initialOutboxOffset ?? 0;
     this.onOffsetAdvance = opts.onOffsetAdvance ?? null;
     this.onCloseRequested = opts.onCloseRequested ?? null;
+    if (opts.ready) {
+      this.inboxChain = opts.ready.then(
+        () => undefined,
+        () => undefined,
+      );
+    }
     this.debug =
       opts.debugLabel && process.env.UAI_DEBUG_AGENTS ? opts.debugLabel : null;
 
-    mkdirSync(this.dir, { recursive: true });
-
     if (opts.launch) {
       void opts.launch().then(
         (result) => {
@@ -139,27 +149,25 @@ export class DurableProcess {
 
   private poll(): void {
     if (this.closed || this.detached) return;
-    let fd: number;
-    try {
-      fd = openSync(this.outboxPath, "r");
-    } catch {
-      this.checkLiveness();
-      return; // outbox not created yet
-    }
     const before = this.offset;
     try {
-      const size = fstatSync(fd).size;
-      while (this.offset < size) {
-        const len = Math.min(size - this.offset, 256 * 1024);
-        const buf = Buffer.alloc(len);
-        const read = readSync(fd, buf, 0, len, this.offset);
-        if (read <= 0) break;
-        this.offset += read;
-        this.lineBuf += buf.toString("utf8", 0, read);
+      for (;;) {
+        const read = readContainedFrom(this.root, this.outbox, this.offset, 256 * 1024);
+        if (read === null) break; // outbox not created yet
+        if (read.bytes.length === 0) break;
+        this.offset += read.bytes.length;
+        this.lineBuf += read.bytes.toString("utf8");
         this.drainLines();
+        if (this.offset >= read.size) break;
       }
-    } finally {
-      closeSync(fd);
+    } catch (error) {
+      if (error instanceof WorkspacePathRefusedError || error instanceof NotARegularFileError) {
+        // A link, or anything but a regular file, where the outbox is: the
+        // task broke its own session, and it ends (#cb3j0z).
+        this.finish(null);
+        return;
+      }
+      // Anything else may pass: the heartbeat decides, below.
     }
     if (this.offset !== before && this.onOffsetAdvance && !this.closed) {
       try {
@@ -212,17 +220,21 @@ export class DurableProcess {
 
   /** Backstop: no exit meta, but the runner stopped beating → it's gone. */
   private checkLiveness(): void {
-    const path = this.sawSpawnMeta ? this.heartbeatPath : null;
-    if (!path) {
+    if (!this.sawSpawnMeta) {
       // Runner never wrote anything; give the spawn a grace window.
       if (Date.now() - this.startedAt > HEARTBEAT_STALE_MS) this.finish(null);
       return;
     }
+    let beat: number | null = null;
     try {
-      const age = Date.now() - statSync(path).mtimeMs;
-      if (age > HEARTBEAT_STALE_MS) this.finish(null);
+      beat = containedModifiedAt(this.root, this.heartbeat);
     } catch {
-      if (Date.now() - this.startedAt > HEARTBEAT_STALE_MS) this.finish(null);
+      beat = null;
+    }
+    if (beat !== null) {
+      if (Date.now() - beat > HEARTBEAT_STALE_MS) this.finish(null);
+    } else if (Date.now() - this.startedAt > HEARTBEAT_STALE_MS) {
+      this.finish(null);
     }
   }
 
@@ -265,7 +277,7 @@ export class DurableProcess {
     if (this.debug) this.log(`-> ${json.slice(0, 1000)}`);
     // Chain appends so concurrent writes can't interleave bytes.
     this.inboxChain = this.inboxChain
-      .then(() => fsp.appendFile(this.inboxPath, `${inputMeta}\n${json}\n`))
+      .then(() => appendContainedFile(this.root, this.inbox, Buffer.from(`${inputMeta}\n${json}\n`)))
       .catch(() => {
         // Disk error — liveness checks will surface a dead session.
       });
@@ -306,7 +318,7 @@ export class DurableProcess {
     }
     try {
       await this.inboxChain;
-      await fsp.appendFile(this.inboxPath, '{"__uai":"stop"}\n');
+      await appendContainedFile(this.root, this.inbox, Buffer.from('{"__uai":"stop"}\n'));
     } catch {
       // Inbox unwritable — fall through to the grace timer.
     }

package/lib/agents/registry.ts

@@ -87,6 +87,20 @@ export function setAdvertisementFallback(
   advertisementFallback = fallback ?? (() => false);
 }
 
+/**
+ * ADR-154: on cloud credentials the runner holds no engine credential of its
+ * own, so availability and the fallback above say nothing: the kinds the
+ * cloud can lease an account for are advertised, and only those. Null while
+ * the runner runs its tasks on its own credentials. Installed by main.ts.
+ */
+let leasedKinds: () => ReadonlySet<string> | null = () => null;
+
+export function setLeasedAdvertisement(
+  source: (() => ReadonlySet<string> | null) | null,
+): void {
+  leasedKinds = source ?? (() => null);
+}
+
 /**
  * Register (or replace) an adapter for a kind. Called at module load by the
  * adapter modules. Replacing is allowed so a later import wins deterministically.
@@ -121,10 +135,12 @@ export function supportsExecutionProfile(kind: string, profileId: string): boole
  * Each adapter's `supportedModels()` / `supportedEfforts()` is evaluated here.
  */
 export function capabilities(): AgentKindCapability[] {
+  const leased = leasedKinds();
   return list()
-    .filter(
-      (adapter) =>
-        (adapter.available?.() ?? true) || advertisementFallback(adapter.kind),
+    .filter((adapter) =>
+      leased !== null
+        ? leased.has(adapter.kind)
+        : (adapter.available?.() ?? true) || advertisementFallback(adapter.kind),
     )
     .map((adapter) => {
     const out: AgentKindCapability = {

package/lib/agents/session-state.ts

@@ -8,12 +8,16 @@
  * thread id when launch settings change.
  */
 
-import { promises as fsp } from "node:fs";
-import { join } from "node:path";
 
 import { and, eq } from "drizzle-orm";
 
 import { getDb, schema } from "../db";
+import { taskWorkspaceDir } from "../env";
+import {
+  appendContainedFile,
+  hostPathParts,
+  WorkspaceDirectoryMissingError,
+} from "../task-environment/workspace-files";
 import type { TaskEnvironmentHandle } from "../task-environment/types";
 import { isEnvironmentTransportProvider } from "../task-environment/types";
 import {
@@ -81,15 +85,24 @@ export async function stopPersistedAgentSession(
       row.sessionDir,
     );
   } else {
+    // Never through a link the task put in the session's place (#cb3j0z).
+    const root = taskWorkspaceDir(taskId);
+    let parts: string[] | null;
     try {
-      await fsp.appendFile(
-        join(row.sessionDir, "inbox.jsonl"),
-        '{"__uai":"stop"}\n',
-      );
-    } catch (err) {
-      // A removed generation directory proves there is no runner left to read
-      // it. Permission, I/O, and other failures are not proof: retry them.
-      if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+      parts = hostPathParts(root, row.sessionDir);
+    } catch {
+      // Not below the task's workspace: no runner of this task reads it.
+      parts = null;
+    }
+    if (parts !== null) {
+      try {
+        await appendContainedFile(root, [...parts, "inbox.jsonl"], Buffer.from('{"__uai":"stop"}\n'));
+      } catch (err) {
+        // A removed generation directory proves there is no runner left to
+        // read it. Permission, I/O, and other failures are not proof: retry
+        // them.
+        if (!(err instanceof WorkspaceDirectoryMissingError)) throw err;
+      }
     }
   }
 

package/lib/agents/transport.ts

@@ -21,16 +21,7 @@
  * durable spawn ships the runner version matching this host.
  */
 
-import {
-  copyFileSync,
-  readFileSync,
-  mkdirSync,
-  renameSync,
-  rmSync,
-  statSync,
-  symlinkSync,
-  promises as fsp,
-} from "node:fs";
+import { readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
 import { and, eq, isNull } from "drizzle-orm";
@@ -39,7 +30,20 @@ import { getDb, schema, type Db } from "../db";
 import { taskWorkspaceDir } from "../env";
 import { machineSessionAuthorityEnv } from "../runtime-authority";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
-import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
+import type { TaskEnvironmentAgentSessionSurface, TaskEnvironmentHandle } from "../task-environment/types";
+import {
+  appendContainedFile,
+  containedModifiedAt,
+  hostPathParts,
+  makeContainedDirectories,
+  makeContainedDirectoriesSync,
+  removeContainedEntry,
+  replaceContainedLink,
+  runtimeNamespaceOf,
+  writeContainedFile,
+  writeContainedFileSync,
+  type RuntimeNamespace,
+} from "../task-environment/workspace-files";
 import { DurableProcess, runnerScriptPath } from "./durable-proc";
 import {
   MachineDurableProcess,
@@ -206,7 +210,7 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
       explicitEnv: machineSessionAuthorityEnv(opts.explicitEnv),
     };
     if (!durableEnabled()) {
-      clearCurrentSession(machineOpts.taskId, machineOpts.agentId);
+      clearCurrentSession(machineOpts.taskId, machineOpts.agentId, workspaceRuntime(machineOpts.environment));
       return directEnvironmentTransport(machineOpts);
     }
     return machineDurableTransport(machineOpts);
@@ -216,7 +220,7 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
   // spawn boundary so a cached ready verdict cannot launch container work.
   requireContainerRuntimeOperational();
   if (!durableEnabled()) {
-    clearCurrentSession(opts.taskId, opts.agentId);
+    clearCurrentSession(opts.taskId, opts.agentId, workspaceRuntime(opts.environment));
     return directEnvironmentTransport(opts);
   }
 
@@ -234,14 +238,18 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
 
   const tailKey = `${opts.taskId}:${opts.agentId}`;
 
+  const runtime = workspaceRuntime(opts.environment);
+  const rowFiles = row ? sessionFilesOf(opts.taskId, row.sessionDir) : null;
+
   // ---- Attach: a previous host process left this agent's runner alive. ----
   if (
     opts.allowAttach &&
     row &&
+    rowFiles &&
     row.status === "running" &&
     row.containerName === opts.environment.durableIdentity &&
     row.kind === opts.kind &&
-    heartbeatFresh(row.sessionDir) &&
+    heartbeatFresh(rowFiles) &&
     claimCompatibleAttachRow(
       db,
       opts.taskId,
@@ -259,13 +267,14 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
     );
     const proc = new DurableProcess({
       hostSessionDir: row.sessionDir,
+      sessionFiles: rowFiles,
       initialOutboxOffset: row.outboxOffset,
       onOffsetAdvance: persistOffset,
       onCloseRequested: markClosed,
       debugLabel: opts.debugLabel,
     });
     proc.onExit(markClosed);
-    publishCurrentSession(row.sessionDir);
+    publishCurrentSession(rowFiles, runtime);
     return claimTail(tailKey, proc);
   }
 
@@ -274,26 +283,20 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
   // by a stale-heartbeat verdict may still be alive, and a stop appended to
   // a dead session's inbox is harmless — this is what guarantees one live
   // CLI per (task, agent).
-  if (row) {
-    void fsp
-      .appendFile(join(row.sessionDir, "inbox.jsonl"), '{"__uai":"stop"}\n')
-      .catch(() => {
+  if (rowFiles) {
+    void appendContainedFile(rowFiles.root, [...rowFiles.parts, "inbox.jsonl"], Buffer.from('{"__uai":"stop"}\n')).catch(
+      () => {
         // Dir already gone / runner already dead — nothing to stop.
-      });
+      },
+    );
   }
 
-  const sessionDir = join(
-    taskWorkspaceDir(opts.taskId),
-    ".uai",
-    "sessions",
-    opts.agentId,
-    `${String(Date.now())}-${process.pid}`,
-  );
-  mkdirSync(sessionDir, { recursive: true });
-  // Ship this host's runner with the session: works in containers created
-  // before this feature (the workspace is mounted at its host path) and
-  // never skews against the host version.
-  const runnerInSession = join(sessionDir, "runner.mjs");
+  const workspace = taskWorkspaceDir(opts.taskId);
+  const sessionFiles = {
+    root: workspace,
+    parts: [".uai", "sessions", opts.agentId, `${String(Date.now())}-${process.pid}`],
+  };
+  const sessionDir = join(workspace, ...sessionFiles.parts);
   const environmentSessionDir = join(
     opts.environment.descriptor.workspacePath,
     ".uai",
@@ -308,8 +311,9 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
     sessionDir,
   );
   const runnerInEnvironment = join(environmentSessionDir, "runner.mjs");
+  let runnerSource: Buffer;
   try {
-    copyFileSync(runnerScriptPath(), runnerInSession);
+    runnerSource = readFileSync(runnerScriptPath());
   } catch (err) {
     // Runner asset missing (a packaging miss — the 0.3.0/0.3.1 desktop
     // builds vendored the agent without runner/). Degrade to legacy pipes:
@@ -317,16 +321,45 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
     console.warn(
       `[transport] runner unavailable (${err instanceof Error ? err.message : err}) — falling back to direct pipes for ${opts.agentId}`,
     );
-    clearCurrentSession(opts.taskId, opts.agentId);
+    clearCurrentSession(opts.taskId, opts.agentId, workspaceRuntime(opts.environment));
     return directEnvironmentTransport(opts);
   }
 
+  // Ship this host's runner with the session: works in containers created
+  // before this feature (the workspace is mounted at its host path) and
+  // never skews against the host version. Its directory and the runner are
+  // made in the task's workspace never through a link the task put there
+  // (#cb3j0z), before the runner launches.
+  // On Linux both are made at once; on macOS the directory is made through
+  // the task's runtime first.
+  let preparedNow = false;
+  let prepared: Promise<void>;
+  try {
+    if (makeContainedDirectoriesSync(workspace, sessionFiles.parts)) {
+      writeContainedFileSync(workspace, [...sessionFiles.parts, "runner.mjs"], runnerSource);
+      preparedNow = true;
+      prepared = Promise.resolve();
+    } else {
+      prepared = (async () => {
+        await makeContainedDirectories(workspace, sessionFiles.parts, runtime);
+        await writeContainedFile(workspace, [...sessionFiles.parts, "runner.mjs"], runnerSource);
+      })();
+    }
+  } catch (error) {
+    prepared = Promise.reject(error);
+  }
+  prepared.catch(() => {
+    // Reported through the launch, which awaits it.
+  });
   const proc = new DurableProcess({
     hostSessionDir: sessionDir,
+    sessionFiles,
+    ...(preparedNow ? {} : { ready: prepared }),
     onOffsetAdvance: persistOffset,
     onCloseRequested: markClosed,
     debugLabel: opts.debugLabel,
     launch: async () => {
+      await prepared;
       const cliArgv = agentCliArgv(opts.environment, [opts.cli, ...opts.cliArgs]);
       const result = await opts.environment.launchDetachedSession({
         argv: [
@@ -375,7 +408,8 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
     .run();
 
   proc.onExit(markClosed);
-  publishCurrentSession(sessionDir);
+  if (preparedNow) publishCurrentSession(sessionFiles, runtime);
+  else void prepared.then(() => publishCurrentSession(sessionFiles, runtime), () => {});
   return claimTail(tailKey, proc);
 }
 
@@ -401,7 +435,7 @@ function machineDurableTransport(opts: AgentTransportOptions): LineTransport {
     }
   }
   if (!capable || runnerSource === null) {
-    clearCurrentSession(opts.taskId, opts.agentId);
+    clearCurrentSession(opts.taskId, opts.agentId, workspaceRuntime(opts.environment));
     return directEnvironmentTransport(opts);
   }
   const environment = surface as unknown as MachineSessionEnvironment &
@@ -551,51 +585,49 @@ function directEnvironmentTransport(opts: AgentTransportOptions): LineTransport
   });
 }
 
+/** #cb3j0z: the task's runtime, where only it can make, remove or link an
+ *  entry in the task's workspace without following its links (macOS). */
+function workspaceRuntime(environment: TaskEnvironmentAgentSessionSurface): RuntimeNamespace | undefined {
+  return "exec" in environment
+    ? runtimeNamespaceOf(environment as unknown as Pick<TaskEnvironmentHandle, "exec" | "descriptor">)
+    : undefined;
+}
+
+/** A stored session directory as the task's workspace root and its parts
+ *  below it; null when it is not below the workspace root. */
+function sessionFilesOf(taskId: string, sessionDir: string): { root: string; parts: string[] } | null {
+  const root = taskWorkspaceDir(taskId);
+  try {
+    return { root, parts: hostPathParts(root, sessionDir) };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Make the opaque generation directory discoverable from inside the task.
  * The relative link resolves on both sides of the workspace bind mount. The
  * pointer is diagnostic only: failure to publish it must not kill a session.
+ * Made beside the generation, never through a link the task put there.
  */
-function publishCurrentSession(sessionDir: string): void {
-  const parent = dirname(sessionDir);
-  const current = join(parent, "current");
-  const pending = join(parent, `.current-${process.pid}-${Date.now()}`);
-  try {
-    symlinkSync(basename(sessionDir), pending, "dir");
-    renameSync(pending, current);
-  } catch {
-    try {
-      rmSync(pending, { force: true });
-    } catch {
-      // Best-effort navigation aid; the generation path remains authoritative.
-    }
-  }
+function publishCurrentSession(files: { root: string; parts: readonly string[] }, runtime?: RuntimeNamespace): void {
+  const generation = files.parts[files.parts.length - 1]!;
+  void replaceContainedLink(files.root, [...files.parts.slice(0, -1), "current"], generation, runtime).catch(() => {
+    // Best-effort navigation aid; the generation path remains authoritative.
+  });
 }
 
 /** A direct-pipe session must not leave an older durable inbox looking live. */
-function clearCurrentSession(taskId: string, agentId: string): void {
-  try {
-    rmSync(
-      join(
-        taskWorkspaceDir(taskId),
-        ".uai",
-        "sessions",
-        agentId,
-        "current",
-      ),
-      { force: true },
-    );
-  } catch {
+function clearCurrentSession(taskId: string, agentId: string, runtime?: RuntimeNamespace): void {
+  void removeContainedEntry(taskWorkspaceDir(taskId), [".uai", "sessions", agentId, "current"], runtime).catch(() => {
     // Same best-effort rule as publishCurrentSession.
-  }
+  });
 }
 
-function heartbeatFresh(sessionDir: string): boolean {
+function heartbeatFresh(files: { root: string; parts: readonly string[] }): boolean {
   try {
-    return (
-      Date.now() - statSync(join(sessionDir, "heartbeat")).mtimeMs <
-      ATTACH_HEARTBEAT_FRESH_MS
-    );
+    const beat = containedModifiedAt(files.root, [...files.parts, "heartbeat"]);
+    return beat !== null && Date.now() - beat < ATTACH_HEARTBEAT_FRESH_MS;
   } catch {
     return false;
   }