@runuai/host 0.9.150 → 0.9.152

package/lib/task-environment/docker.ts

@@ -15,6 +15,7 @@ import {
   type TaskUpResult,
 } from "../agent";
 import { dockerCli, type DockerResult } from "../docker-exec";
+import { isLaunchSecretEnvName } from "../engine-credential-env";
 import {
   hostWorkspaceRead,
   hostWorkspaceWrite,
@@ -23,10 +24,13 @@ import { taskDir } from "../env";
 import { PREVIEW_SIDECAR_TASK_LABEL } from "../preview-sidecar";
 import { assertSafeHostTaskId } from "../task-identity";
 import { applyProjectEnvProfile } from "../runtime-authority";
+import { rootAnchoredRequest } from "./anchor";
 import {
   assertTaskEnvironmentExecRequest,
   assertTaskEnvironmentProcessRequest,
   assertTaskEnvironmentSessionRequest,
+  type TaskEnvironmentCallOptions,
+  type TaskEnvironmentReadOptions,
   type TaskEnvironmentCopyRequest,
   type TaskEnvironmentDescriptor,
   type TaskEnvironmentDetachedSessionRequest,
@@ -45,6 +49,7 @@ import {
   type TaskEnvironmentSpawnRequest,
   type TaskEnvironmentStatus,
 } from "./types";
+import type { TaskWriteEnvironment } from "../credential-consumers/task-files";
 
 export const DOCKER_TASK_ENVIRONMENT_PROVIDER = "docker-compose";
 const DOCKER_LOCATOR_SCHEMA_VERSION = 2;
@@ -77,6 +82,7 @@ export interface DockerTaskEnvironmentDeps {
     input: TaskLaunchInput,
     credentials?: TaskUpCredentials,
     envMode?: ProjectEnvMode,
+    runtimeEnvironment?: () => TaskWriteEnvironment,
   ) => Promise<TaskUpResult>;
   taskEnvironmentDown?: (taskId: string) => Promise<TaskDownResult>;
   taskStatus?: (taskId: string) => Promise<TaskStatusResult>;
@@ -131,6 +137,9 @@ export function createDockerTaskEnvironmentProvider(
         request.input,
         request.credentials,
         request.envMode ?? "loader",
+        // ADR-154 §12: the container as task-up has created it, for the
+        // runtime-ready writes before uai-init.
+        () => new DockerTaskEnvironmentHandle(preparedLocator, resolved, request.envMode ?? "loader"),
       );
       const prepared = parseDockerTaskEnvironmentLocator(preparedLocator);
       // task-up composes its worktree path in shell from the operator's
@@ -254,6 +263,8 @@ class DockerTaskEnvironmentHandle
 {
   readonly descriptor: TaskEnvironmentDescriptor;
   readonly durableIdentity: string;
+  /** ADR-154 §6: anchored requests start under the engine supervisor. */
+  readonly anchors = true;
   readonly #value: DockerTaskEnvironmentLocatorValue;
 
   constructor(
@@ -289,16 +300,19 @@ class DockerTaskEnvironmentHandle
     };
   }
 
-  async readWorkspaceFile(filePath: string): Promise<Uint8Array | null> {
+  async readWorkspaceFile(filePath: string, options?: TaskEnvironmentReadOptions): Promise<Uint8Array | null> {
+    options?.admit?.();
     return hostWorkspaceRead(
       this.descriptor,
       path.join(this.#value.hostWorktreePath, "workspace"),
       filePath,
+      options,
     );
   }
 
-  async writeWorkspaceFile(filePath: string, bytes: Uint8Array): Promise<void> {
-    hostWorkspaceWrite(
+  async writeWorkspaceFile(filePath: string, bytes: Uint8Array, options?: TaskEnvironmentCallOptions): Promise<void> {
+    options?.admit?.();
+    await hostWorkspaceWrite(
       this.descriptor,
       path.join(this.#value.hostWorktreePath, "workspace"),
       filePath,
@@ -310,16 +324,23 @@ class DockerTaskEnvironmentHandle
     assertTaskEnvironmentExecRequest(request);
     const { privileged, ...unprivileged } = request;
     const profiled = applyProjectEnvProfile(
-      unprivileged,
+      rootAnchoredRequest(unprivileged),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
     request.admit?.();
+    const invocation = dockerExecArgs(
+      this.#value.containerName,
+      profiled,
+      "interactive",
+      privileged === true,
+    );
     return capturedCliExec(
       this.deps.spawn,
       "docker",
-      dockerExecArgs(this.#value.containerName, profiled, "interactive", privileged === true),
+      invocation.args,
       profiled,
+      invocation.env,
     );
   }
 
@@ -328,15 +349,18 @@ class DockerTaskEnvironmentHandle
   ): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentProcessRequest(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(request),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
+    const invocation = dockerExecArgs(this.#value.containerName, profiled);
+    request.admit?.();
     return streamingCliExec(
       this.deps.spawn,
       "docker",
-      dockerExecArgs(this.#value.containerName, profiled),
+      invocation.args,
       profiled,
+      invocation.env,
     );
   }
 
@@ -345,15 +369,18 @@ class DockerTaskEnvironmentHandle
   ): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentSessionRequest(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(request),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
+    const invocation = dockerExecArgs(this.#value.containerName, profiled);
+    request.admit?.();
     return streamingCliExec(
       this.deps.spawn,
       "docker",
-      dockerExecArgs(this.#value.containerName, profiled),
+      invocation.args,
       profiled,
+      invocation.env,
     );
   }
 
@@ -362,17 +389,21 @@ class DockerTaskEnvironmentHandle
   ): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentSessionRequest(request);
     const profiled = applyProjectEnvProfile(
-      request,
+      rootAnchoredRequest(request),
       this.descriptor.envMode ?? "baked",
       "/usr/bin/zsh",
     );
-    const result = await this.deps.docker(
-      dockerExecArgs(this.#value.containerName, profiled, "detached"),
-      {
-        timeoutMs: request.launchTimeoutMs,
-        maxOutputBytes: request.maxOutputBytes,
-      },
+    const invocation = dockerExecArgs(
+      this.#value.containerName,
+      profiled,
+      "detached",
     );
+    request.admit?.();
+    const result = await this.deps.docker(invocation.args, {
+      timeoutMs: request.launchTimeoutMs,
+      maxOutputBytes: request.maxOutputBytes,
+      ...(invocation.env === undefined ? {} : { env: invocation.env }),
+    });
     return {
       exitCode: result.status,
       signal: null,
@@ -397,6 +428,7 @@ class DockerTaskEnvironmentHandle
             `${this.#value.containerName}:${request.source}`,
             request.destination,
           ];
+    request.admit?.();
     const result = await this.deps.docker(args, {
       timeoutMs: 120_000,
       maxOutputBytes: 1024 * 1024,
@@ -634,6 +666,8 @@ function requiredPort(value: unknown, name: string): number {
   return Number(value);
 }
 
+/** The argv of one `docker exec`, and the environment the docker CLI must run
+ * with to resolve the credentials it names (cliExecEnv). */
 function dockerExecArgs(
   containerName: string,
   request:
@@ -644,21 +678,60 @@ function dockerExecArgs(
   mode: "interactive" | "detached" = "interactive",
   /** Passed only by exec(), after assertTaskEnvironmentExecRequest. */
   privileged = false,
-): string[] {
+): { args: string[]; env: NodeJS.ProcessEnv | undefined } {
   const args = ["exec", mode === "detached" ? "-d" : "-i"];
   if (privileged) args.push("--privileged");
   if (request.cwd) args.push("--workdir", request.cwd);
   if (request.user) args.push("--user", request.user);
+  const execEnv = cliExecEnv(request);
+  args.push(...execEnv.args, containerName, ...request.argv);
+  return { args, env: execEnv.env };
+}
+
+/**
+ * The `--env` options of one exec, for a CLI that resolves a bare
+ * `--env NAME` from its own environment (docker, Apple `container`), and the
+ * environment the CLI child must then run with.
+ *
+ * An engine credential, or an agent's task token under any of its names, is
+ * named bare and its value set in that child's environment only, so it never
+ * lands on the runner's argv, which every local user can read with `ps`
+ * (ADR-154 §6). The request's value wins over the
+ * runner's own variable of the same name (an owned runner may still carry a
+ * legacy CLAUDE_CODE_OAUTH_TOKEN), and a credential the request does not
+ * carry is never named here; a name in `inheritEnv` still forwards the
+ * runner's own value, as that field promises. Every other entry keeps its
+ * `NAME=value` form: in the child's environment, a task's HOME or PATH would
+ * steer the CLI's own config and credential-helper lookup. With no
+ * credential, `env` is undefined and the child inherits the runner's
+ * environment as before.
+ */
+export function cliExecEnv(request: {
+  inheritEnv?: readonly string[];
+  env?: Readonly<Record<string, string>>;
+}): { args: string[]; env: NodeJS.ProcessEnv | undefined } {
+  const args: string[] = [];
   for (const name of request.inheritEnv ?? []) {
     if (process.env[name] !== undefined) args.push("--env", name);
   }
+  const credentials: Record<string, string> = {};
   for (const [name, value] of Object.entries(request.env ?? {}).sort(([a], [b]) =>
     a.localeCompare(b),
   )) {
-    args.push("--env", `${name}=${value}`);
+    if (isLaunchSecretEnvName(name)) {
+      args.push("--env", name);
+      credentials[name] = value;
+    } else {
+      args.push("--env", `${name}=${value}`);
+    }
   }
-  args.push(containerName, ...request.argv);
-  return args;
+  return {
+    args,
+    env:
+      Object.keys(credentials).length === 0
+        ? undefined
+        : { ...process.env, ...credentials },
+  };
 }
 
 /** Bounded one-shot exec, generalized over the CLI so the Apple container
@@ -668,10 +741,14 @@ export function capturedCliExec(
   command: string,
   args: readonly string[],
   request: TaskEnvironmentExecRequest,
+  /** The child's own environment, when it must differ from the runner's
+   * (cliExecEnv). */
+  env?: NodeJS.ProcessEnv,
 ): Promise<TaskEnvironmentExecResult> {
   return new Promise((resolve) => {
     const child = spawn(command, [...args], {
       stdio: ["pipe", "pipe", "pipe"],
+      ...(env === undefined ? {} : { env }),
     }) as ChildProcessWithoutNullStreams;
     let stdout: Buffer[] = [];
     let stderr: Buffer[] = [];
@@ -739,9 +816,12 @@ export function streamingCliExec(
   command: string,
   args: readonly string[],
   request: TaskEnvironmentSpawnRequest | TaskEnvironmentSessionRequest,
+  /** As for capturedCliExec. */
+  env?: NodeJS.ProcessEnv,
 ): TaskEnvironmentProcess {
   const child = spawn(command, [...args], {
     stdio: ["pipe", "pipe", "pipe"],
+    ...(env === undefined ? {} : { env }),
   }) as ChildProcessWithoutNullStreams;
   // Every kill forces settlement within a bounded grace, like the captured
   // runner: a wedged client must not leave an agent session's completion
@@ -997,6 +1077,7 @@ async function inspectDockerTaskEnvironmentStatus(
     state: state === "running" ? "running" : "stopped",
     instances: [environment.containerName],
     workspacePresent,
+    ...(state === "paused" || state === "restarting" ? { frozen: true as const } : {}),
   };
 }
 

package/lib/task-environment/machine-environment.ts

@@ -0,0 +1,61 @@
+/**
+ * A task machine's machine-wide environment, /etc/environment, which sshd's
+ * pam_env applies to every session on it: what a self or machine task's
+ * processes run beneath their own `env`.
+ *
+ * ADR-154 §6: it never supplies an engine's credential. A machine-wide value
+ * of one (an owner's sign-in left in an older image) never reaches a task's
+ * process, leased or not: a leased engine's comes from its admission, and an
+ * unleased one's from its own request.
+ */
+import { isEngineCredentialEnvName, isLaunchSecretEnvName } from "../engine-credential-env";
+
+export const ETC_ENVIRONMENT_PATH = "/etc/environment";
+
+/** What an anchored launch's environment starts from where nothing else
+ *  gives a PATH: the usual system one. */
+export const BASELINE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+
+/**
+ * /etc/environment, as pam_env reads it: `KEY=value` lines, optional
+ * `export`, optional single or double quotes, `#` comments.
+ */
+export function parseEtcEnvironment(text: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!match) continue;
+    let value = match[2]!.trim();
+    if (
+      value.length >= 2 &&
+      ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'")))
+    ) {
+      value = value.slice(1, -1);
+    }
+    out[match[1]!] = value;
+  }
+  return out;
+}
+
+/** `environment` without any engine's credential. */
+export function withoutEngineCredentials(
+  environment: Readonly<Record<string, string>>,
+): Record<string, string> {
+  return Object.fromEntries(Object.entries(environment).filter(([name]) => !isEngineCredentialEnvName(name)));
+}
+
+/**
+ * `environment` without any launch secret: an engine's credential, or an
+ * agent's task token under any of its names. What an anchored launch's
+ * baseline takes from the machine-wide environment, which rides its command
+ * line: its secrets come from its admission. An unanchored launch keeps the
+ * machine-wide values it always had, but for an engine's credential.
+ */
+export function withoutLaunchSecrets(
+  environment: Readonly<Record<string, string>>,
+): Record<string, string> {
+  return Object.fromEntries(Object.entries(environment).filter(([name]) => !isLaunchSecretEnvName(name)));
+}