@runuai/host 0.9.150 → 0.9.152

package/lib/safe-http.ts

@@ -0,0 +1,364 @@
+/**
+ * ADR-154 §11: the one SSRF rule for every request to an MCP server, or to an
+ * endpoint discovered from it, whoever sends it — the sign-in box (probe,
+ * discovery, registration, code exchange), the broker (refresh) and the
+ * runner's gateway (every call a task makes).
+ *
+ * - The URL is `https`, with no userinfo.
+ * - The name is resolved immediately before the request is sent, and the
+ *   request is refused if any A or AAAA answer is not a global unicast
+ *   address (`isPublicAddress`): one private answer rejects the whole
+ *   answer, so a rebinding record cannot win by mixing one in.
+ * - It connects to the vetted address while keeping the hostname for SNI and
+ *   certificate checks, so nothing can re-resolve the name between the check
+ *   and the connect.
+ * - It follows no redirect: a 3xx is the answer, for the caller to refuse.
+ * - It bounds the connect and header time, the request body, an idle gap in
+ *   the response and the number of connections in flight — never a stream's
+ *   total life or bytes, since MCP streams over SSE and streamable HTTP. A
+ *   caller that buffers a body (discovery, token responses) bounds its size
+ *   and, through an abort signal, its total time.
+ */
+
+import type { LookupAddress } from "node:dns";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpsRequest, type RequestOptions } from "node:https";
+import type { IncomingMessage } from "node:http";
+import { isIP, type LookupFunction } from "node:net";
+
+import { isPublicAddress } from "./secrets-proxy/address";
+
+export type SafeHttpRefusalReason =
+  | "url"
+  | "resolve_failed"
+  | "non_public_address"
+  | "too_many_connections"
+  | "request_too_large"
+  | "response_too_large"
+  | "timeout"
+  | "connection_failed";
+
+/** A request the rule refused, or one that failed before an answer. */
+export class SafeHttpRefusal extends Error {
+  constructor(
+    readonly reason: SafeHttpRefusalReason,
+    message: string,
+  ) {
+    super(message);
+    this.name = "SafeHttpRefusal";
+  }
+}
+
+export interface SafeHttpLimits {
+  /** Resolve, TCP and TLS, together. */
+  connectMs: number;
+  /** From the request sent to the response's headers. */
+  headersMs: number;
+  /** The longest gap between two pieces of the response body. */
+  idleMs: number;
+  maxRequestBodyBytes: number;
+}
+
+export const DEFAULT_SAFE_HTTP_LIMITS: SafeHttpLimits = {
+  connectMs: 10_000,
+  headersMs: 60_000,
+  idleMs: 5 * 60_000,
+  maxRequestBodyBytes: 4 * 1024 * 1024,
+};
+
+/** The most requests one process has in flight under this rule. */
+export const MAX_SAFE_HTTP_CONNECTIONS = 64;
+
+export interface SafeHttpDeps {
+  /** Every address the name resolves to. */
+  resolveHost?: (hostname: string) => Promise<string[]>;
+  /** Tests only: which addresses count as public. */
+  isPublic?: (address: string) => boolean;
+  /** Tests only: extra trusted roots, PEM. */
+  ca?: string[];
+}
+
+export interface SafeHttpRequest {
+  url: string;
+  method?: "GET" | "POST" | "DELETE";
+  headers?: Record<string, string>;
+  body?: string | Uint8Array;
+  /** Ends the exchange, whatever phase it is in (a buffered call's total
+   *  deadline). A stream's own reader may leave it unset. */
+  signal?: AbortSignal;
+}
+
+/** The response as it arrives: headers now, the body as a stream. */
+export interface SafeHttpResponse {
+  status: number;
+  headers: IncomingMessage["headers"];
+  body: IncomingMessage;
+}
+
+let inFlight = 0;
+
+async function defaultResolve(hostname: string): Promise<string[]> {
+  const answers: LookupAddress[] = await dnsLookup(hostname, { all: true, verbatim: true });
+  return answers.map((answer) => answer.address);
+}
+
+/** The URL, if the rule accepts its shape: https, a host, no userinfo. */
+export function parseSafeUrl(raw: string): URL | null {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hostname === "") {
+    return null;
+  }
+  return url;
+}
+
+function tooLong(): SafeHttpRefusal {
+  return new SafeHttpRefusal("timeout", "the exchange took too long");
+}
+
+async function vet(
+  hostname: string,
+  limits: SafeHttpLimits,
+  deps: SafeHttpDeps,
+  signal?: AbortSignal,
+): Promise<{ address: string; family: 4 | 6 }> {
+  const isPublic = deps.isPublic ?? isPublicAddress;
+  // A bracketed IPv6 literal arrives with its brackets.
+  const bare = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  if (signal?.aborted) throw tooLong();
+  let answers: string[];
+  if (isIP(bare) !== 0) {
+    answers = [bare];
+  } else {
+    let timer: NodeJS.Timeout | undefined;
+    let onAbort: (() => void) | undefined;
+    try {
+      answers = await Promise.race([
+        (deps.resolveHost ?? defaultResolve)(bare),
+        new Promise<never>((_resolve, reject) => {
+          timer = setTimeout(() => reject(new Error("resolve timed out")), limits.connectMs);
+          timer.unref();
+        }),
+        // The caller's deadline ends the lookup too, not only what follows.
+        new Promise<never>((_resolve, reject) => {
+          if (!signal) return;
+          onAbort = () => reject(tooLong());
+          signal.addEventListener("abort", onAbort, { once: true });
+          if (signal.aborted) onAbort();
+        }),
+      ]);
+    } catch {
+      if (signal?.aborted) throw tooLong();
+      throw new SafeHttpRefusal("resolve_failed", `could not resolve ${bare}`);
+    } finally {
+      clearTimeout(timer);
+      if (onAbort) signal?.removeEventListener("abort", onAbort);
+    }
+  }
+  if (signal?.aborted) throw tooLong();
+  if (!Array.isArray(answers) || answers.length === 0) {
+    throw new SafeHttpRefusal("resolve_failed", `${bare} has no address`);
+  }
+  for (const address of answers) {
+    if (typeof address !== "string" || !isPublic(address)) {
+      throw new SafeHttpRefusal("non_public_address", `${bare} resolves to an address that is not public`);
+    }
+  }
+  const address = answers[0]!;
+  return { address, family: isIP(address) === 6 ? 6 : 4 };
+}
+
+/**
+ * The rule for a URL nothing here will fetch (an authorization page handed
+ * to the browser): https, no userinfo, and every address its name resolves
+ * to public. Throws `SafeHttpRefusal` otherwise.
+ */
+export async function vetPublicUrl(
+  raw: string,
+  limits: SafeHttpLimits = DEFAULT_SAFE_HTTP_LIMITS,
+  deps: SafeHttpDeps = {},
+  signal?: AbortSignal,
+): Promise<void> {
+  const url = parseSafeUrl(raw);
+  if (!url) throw new SafeHttpRefusal("url", "only https URLs without userinfo are allowed");
+  await vet(url.hostname, limits, deps, signal);
+}
+
+/**
+ * Send one request under the rule. Resolves with the response once its
+ * headers arrive; the body streams, with an idle bound but no total one.
+ * Throws `SafeHttpRefusal` for anything the rule refuses or that fails first.
+ */
+export async function safeRequest(
+  request: SafeHttpRequest,
+  limits: SafeHttpLimits = DEFAULT_SAFE_HTTP_LIMITS,
+  deps: SafeHttpDeps = {},
+): Promise<SafeHttpResponse> {
+  const url = parseSafeUrl(request.url);
+  if (!url) throw new SafeHttpRefusal("url", "only https URLs without userinfo are allowed");
+  if (request.signal?.aborted) throw tooLong();
+  const body =
+    request.body === undefined
+      ? undefined
+      : typeof request.body === "string"
+        ? Buffer.from(request.body, "utf8")
+        : Buffer.from(request.body);
+  if (body && body.byteLength > limits.maxRequestBodyBytes) {
+    throw new SafeHttpRefusal("request_too_large", "the request body is too large");
+  }
+  if (inFlight >= MAX_SAFE_HTTP_CONNECTIONS) {
+    throw new SafeHttpRefusal("too_many_connections", "too many requests in flight");
+  }
+  inFlight += 1;
+  let released = false;
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    inFlight -= 1;
+  };
+  try {
+    const target = await vet(url.hostname, limits, deps, request.signal);
+    const lookup: LookupFunction = (_hostname, options, callback) => {
+      if (options.all === true) callback(null, [{ address: target.address, family: target.family }]);
+      else callback(null, target.address, target.family);
+    };
+    const servername = isIP(url.hostname.replace(/^\[|\]$/g, "")) === 0 ? url.hostname : undefined;
+    const options: RequestOptions = {
+      host: url.hostname,
+      port: url.port === "" ? 443 : Number(url.port),
+      path: `${url.pathname}${url.search}`,
+      method: request.method ?? (body ? "POST" : "GET"),
+      headers: {
+        ...request.headers,
+        ...(body ? { "content-length": String(body.byteLength) } : {}),
+      },
+      lookup,
+      ...(servername ? { servername } : {}),
+      // A connection per request: nothing pooled, nothing re-resolved.
+      agent: false,
+      rejectUnauthorized: true,
+      ...(deps.ca ? { ca: deps.ca } : {}),
+    };
+    return await new Promise<SafeHttpResponse>((resolve, reject) => {
+      const req = httpsRequest(options);
+      let settled = false;
+      const onAbort = (): void => fail(tooLong());
+      const fail = (error: SafeHttpRefusal): void => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(connectTimer);
+        request.signal?.removeEventListener("abort", onAbort);
+        req.destroy();
+        release();
+        reject(error);
+      };
+      const connectTimer = setTimeout(
+        () => fail(new SafeHttpRefusal("timeout", "the connection took too long")),
+        limits.connectMs,
+      );
+      connectTimer.unref();
+      request.signal?.addEventListener("abort", onAbort, { once: true });
+      let headersTimer: NodeJS.Timeout | undefined;
+      req.once("socket", (socket) => {
+        socket.once("secureConnect", () => {
+          clearTimeout(connectTimer);
+          headersTimer = setTimeout(
+            () => fail(new SafeHttpRefusal("timeout", "the server took too long to answer")),
+            limits.headersMs,
+          );
+          headersTimer.unref();
+        });
+      });
+      req.once("error", (error) => {
+        clearTimeout(connectTimer);
+        clearTimeout(headersTimer);
+        fail(new SafeHttpRefusal("connection_failed", error.message));
+      });
+      req.once("response", (response) => {
+        clearTimeout(connectTimer);
+        clearTimeout(headersTimer);
+        if (settled) {
+          response.destroy();
+          return;
+        }
+        settled = true;
+        request.signal?.removeEventListener("abort", onAbort);
+        // Idle, never total: a stream may run as long as it keeps talking.
+        response.socket.setTimeout(limits.idleMs, () => {
+          response.destroy(new SafeHttpRefusal("timeout", "the response went idle"));
+        });
+        // A caller's deadline still ends the body it is reading.
+        request.signal?.addEventListener("abort", () => response.destroy(tooLong()), { once: true });
+        response.once("close", release);
+        resolve({ status: response.statusCode ?? 0, headers: response.headers, body: response });
+      });
+      // A listener added after the signal fired never runs: check it too,
+      // once every handler is in place (a destroyed request still errors).
+      if (request.signal?.aborted) {
+        onAbort();
+        return;
+      }
+      if (body) req.end(body);
+      else req.end();
+    });
+  } catch (error) {
+    release();
+    if (error instanceof SafeHttpRefusal) throw error;
+    throw new SafeHttpRefusal("connection_failed", error instanceof Error ? error.message : String(error));
+  }
+}
+
+/** Read a whole response body, refusing one larger than `maxBytes`. */
+export async function readSafeBody(response: SafeHttpResponse, maxBytes: number): Promise<Buffer> {
+  const chunks: Buffer[] = [];
+  let size = 0;
+  for await (const chunk of response.body) {
+    const piece = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as Uint8Array);
+    size += piece.byteLength;
+    if (size > maxBytes) {
+      response.body.destroy();
+      throw new SafeHttpRefusal("response_too_large", "the response is too large");
+    }
+    chunks.push(piece);
+  }
+  return Buffer.concat(chunks);
+}
+
+/** A buffered JSON exchange (discovery, registration, token endpoints):
+ *  the status and the parsed body, or null when it is not JSON. */
+export async function safeJson(
+  request: SafeHttpRequest,
+  options: {
+    maxResponseBytes?: number;
+    limits?: SafeHttpLimits;
+    deps?: SafeHttpDeps;
+    /** The whole exchange, connect to last byte. */
+    deadlineMs?: number;
+  } = {},
+): Promise<{ status: number; json: unknown }> {
+  const signal =
+    request.signal ?? (options.deadlineMs !== undefined ? AbortSignal.timeout(Math.max(1, options.deadlineMs)) : undefined);
+  const response = await safeRequest(
+    { ...request, headers: { accept: "application/json", ...request.headers }, ...(signal ? { signal } : {}) },
+    options.limits,
+    options.deps,
+  );
+  let raw: Buffer;
+  try {
+    raw = await readSafeBody(response, options.maxResponseBytes ?? 256 * 1024);
+  } catch (error) {
+    if (error instanceof SafeHttpRefusal) throw error;
+    throw new SafeHttpRefusal(signal?.aborted ? "timeout" : "connection_failed", "the response did not complete");
+  }
+  let json: unknown = null;
+  try {
+    json = JSON.parse(raw.toString("utf8"));
+  } catch {
+    json = null;
+  }
+  return { status: response.status, json };
+}

package/lib/secrets-proxy/task-trust.ts

@@ -103,11 +103,35 @@ let quiescing = false;
  *  nothing), so none can land over, or recreate readiness for, what follows. */
 const epochs = new Map<string, number>();
 const epochOf = (taskId: string): number => epochs.get(taskId) ?? 0;
+/** A credential cleanup closes this fence before it drains existing writers.
+ * Unlike an epoch bump, the seal also refuses writers that arrive while the
+ * cleanup is in progress. It is reopened only after a safe assignment/grant
+ * has been installed. */
+const sealedTaskWrites = new Set<string>();
 
 export function invalidateTaskWrites(taskId: string): void {
   epochs.set(taskId, epochOf(taskId) + 1);
 }
 
+export function sealTaskWrites(taskId: string): void {
+  sealedTaskWrites.add(taskId);
+  invalidateTaskWrites(taskId);
+}
+
+export function openTaskWrites(taskId: string): void {
+  if (!sealedTaskWrites.delete(taskId)) return;
+  // Writers which observed the closed assignment must not become live merely
+  // because a later assignment opens the task again.
+  invalidateTaskWrites(taskId);
+}
+
+/** Join every root mutation already admitted for one task after its epoch has
+ * been invalidated. Callers close the task's other producers before awaiting
+ * this; a rejected superseded writer counts as drained. */
+export async function drainTaskWrites(taskId: string): Promise<void> {
+  await (queues.get(taskId) ?? Promise.resolve()).catch(() => undefined);
+}
+
 /** Whether the runner is shutting down: nothing root may start in a task. */
 export function taskWritesQuiescing(): boolean {
   return quiescing;
@@ -128,8 +152,15 @@ function refusal(): Error {
  *  could land over the replacement's. */
 function mutate<T>(taskId: string, step: (live: Live) => Promise<T>, isCurrent?: () => boolean): Promise<T> {
   if (quiescing) return Promise.reject(new Error("the runner is shutting down"));
+  if (sealedTaskWrites.has(taskId)) {
+    return Promise.reject(new Error("this task's credential gate is closed"));
+  }
   const epoch = epochOf(taskId);
-  const live: Live = () => !quiescing && epochOf(taskId) === epoch && (isCurrent === undefined || isCurrent());
+  const live: Live = () =>
+    !quiescing &&
+    !sealedTaskWrites.has(taskId) &&
+    epochOf(taskId) === epoch &&
+    (isCurrent === undefined || isCurrent());
   const previous = queues.get(taskId) ?? Promise.resolve();
   const next = previous
     .catch(() => undefined)
@@ -540,7 +571,7 @@ export function applyTaskRootSteps(
 export async function reconcileSidecarTaskProxy(
   environment: TaskRootExec,
   runtime: SecretsProxyRuntime | null,
-  options: { start: boolean },
+  options: { start: boolean; isCurrent?: () => boolean },
 ): Promise<string | null> {
   if (!takesTrust(environment)) return null;
   // A start voids every write queued or under way before it. Whether the
@@ -549,7 +580,7 @@ export async function reconcileSidecarTaskProxy(
   if (options.start) invalidateTaskWrites(environment.descriptor.taskId);
   let failure: unknown = null;
   try {
-    failure = (await applyTaskRootSteps(environment, { runtime }, async () => undefined))?.error ?? null;
+    failure = (await applyTaskRootSteps(environment, { runtime }, async () => undefined, options.isCurrent))?.error ?? null;
   } catch (error) {
     failure = error;
   }

package/lib/sidecar-resume.ts

@@ -40,6 +40,13 @@ export interface SidecarResumeDeps {
   loader?: (handle: TaskEnvironmentHandle<unknown>) => Promise<void>;
   editor?: (handle: TaskEnvironmentHandle<unknown>, workspacePath: string) => Promise<void>;
   proxy?: typeof reconcileSidecarTaskProxy;
+  /** Remount the shared files from the v0 lease (the default). ADR-154: a
+   *  task on cloud credentials remounts them from its own run's Files
+   *  session instead, never from the runner's process-wide v0 lease. */
+  remountFiles?: boolean;
+  /** ADR-154: aborted when the run this resume is for ends (Stop, teardown,
+   *  a newer run, shutdown): no step starts after. */
+  signal?: AbortSignal;
 }
 
 export interface SidecarResumeResult {
@@ -48,7 +55,7 @@ export interface SidecarResumeResult {
    * task-up does the work). `resumed`: the
    * task was up before this runner started; its mounts and editor were
    * re-asserted, with any per-step warning listed. */
-  outcome: "no-task" | "not-up" | "resumed";
+  outcome: "no-task" | "not-up" | "resumed" | "interrupted";
   warnings: string[];
 }
 
@@ -90,8 +97,11 @@ export async function resumeSidecarTask(
   if (!handle) return { outcome: "not-up", warnings: [] };
   const workspacePath = handle.descriptor.workspacePath;
   const warnings: string[] = [];
+  const ended = (): boolean => deps.signal?.aborted === true;
+  const interrupted = (): SidecarResumeResult => ({ outcome: "interrupted", warnings });
 
   if (task.envMode === "loader") {
+    if (ended()) return interrupted();
     try {
       await (deps.loader ?? installMachineProjectEnvLoader)(handle);
     } catch (error) {
@@ -104,17 +114,19 @@ export async function resumeSidecarTask(
     }
     // ADR-153: the proxy's CA and pins again (a reboot keeps neither the
     // chain nor this runner's record of any of it).
+    if (ended()) return interrupted();
     const proxyWarning = await (deps.proxy ?? reconcileSidecarTaskProxy)(
       handle,
       activeSecretsProxy()?.runtime ?? null,
-      { start: false },
+      { start: false, ...(deps.signal ? { isCurrent: () => !ended() } : {}) },
     );
     if (proxyWarning !== null) warnings.push(proxyWarning);
   }
 
-  const marker = await handle
-    .readWorkspaceFile(`${workspacePath}/.uai/files-mounted`)
-    .catch(() => null);
+  const marker =
+    deps.remountFiles === false
+      ? null
+      : await handle.readWorkspaceFile(`${workspacePath}/.uai/files-mounted`).catch(() => null);
   const mode = mountedModeFromMarker(marker);
   if (mode) {
     try {
@@ -129,6 +141,7 @@ export async function resumeSidecarTask(
     }
   }
 
+  if (ended()) return interrupted();
   try {
     await (deps.editor ?? defaultEditor)(handle, workspacePath);
   } catch (error) {

package/lib/skills.ts

@@ -18,8 +18,6 @@
  * skills are Claude-only and task-level (shared by the container's agents),
  * NOT written into the flat per-agent SKILL.md.
  */
-import { mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
 
 import { taskWorkspaceDir } from "./env";
 import { dockerCli } from "./docker-exec";
@@ -29,6 +27,14 @@ import {
 } from "./task-container-cli";
 import { runtimeAuthorityDockerExecArgs } from "./runtime-authority";
 import type { RosterAgent, RosterSkill } from "./agents/types";
+import {
+  makeContainedDirectories,
+  makeContainedDirectoriesSync,
+  removeContainedEntry,
+  WorkspaceDirectoryMissingError,
+  writeContainedFileSync,
+  type RuntimeNamespace,
+} from "./task-environment/workspace-files";
 
 /** Skills that go into the flat per-agent SKILL.md — link/document only. The
  *  ADR-047 `package` skills install into the container's skills dir instead. */
@@ -65,16 +71,49 @@ export function renderSkillMd(agent: RosterAgent): string {
  * when written, else null. Best-effort — a write failure is swallowed so a
  * skills problem never blocks the agent from running.
  */
-export function writeAgentSkills(taskId: string, agent: RosterAgent): string | null {
-  const dir = resolve(taskWorkspaceDir(taskId), ".uai", "agents", agent.id);
-  const file = resolve(dir, "SKILL.md");
+export function writeAgentSkills(
+  taskId: string,
+  agent: RosterAgent,
+  runtime?: () => Promise<RuntimeNamespace | null>,
+): string | null {
+  // Into the task's own .uai, never through a link the task put there
+  // (#cb3j0z). Where only the task's runtime can make the agent's directory
+  // (macOS), it is made there once the runtime is reachable, then the file
+  // written; the agent reads it when it consults its skills.
+  const workspace = taskWorkspaceDir(taskId);
+  const directory = [".uai", "agents", agent.id];
+  const file = [...directory, "SKILL.md"];
   try {
     if (flatSkills(agent).length === 0) {
-      rmSync(file, { force: true });
+      void (async () => {
+        try {
+          await removeContainedEntry(workspace, file);
+        } catch (error) {
+          // Where only the runtime can remove it (macOS).
+          const reached = await runtime?.();
+          if (!reached) throw error;
+          await removeContainedEntry(workspace, file, reached);
+        }
+      })().catch(() => {});
       return null;
     }
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(file, renderSkillMd(agent));
+    const content = Buffer.from(renderSkillMd(agent));
+    if (!makeContainedDirectoriesSync(workspace, directory)) {
+      try {
+        writeContainedFileSync(workspace, file, content);
+        return containerSkillFile(agent.id);
+      } catch (error) {
+        if (!(error instanceof WorkspaceDirectoryMissingError) || !runtime) throw error;
+      }
+      void (async () => {
+        const reached = await runtime();
+        if (!reached) return;
+        await makeContainedDirectories(workspace, directory, reached);
+        writeContainedFileSync(workspace, file, content);
+      })().catch(() => {});
+      return containerSkillFile(agent.id);
+    }
+    writeContainedFileSync(workspace, file, content);
     return containerSkillFile(agent.id);
   } catch {
     return null;