@runuai/host 0.9.150 → 0.9.152

package/src/ui/server.ts

@@ -25,6 +25,7 @@ import type { ZodType } from "zod";
 
 import { agentMode } from "../../lib/agents/mode";
 import { schema, type Db } from "../../lib/db";
+import { whileOnOwnCredentials } from "../../lib/cloud-credential-host";
 import { getOrchestrator } from "../../lib/orchestrator";
 import { parsePreviewPortRuntimes } from "../../lib/preview-ports";
 import { getCloudState } from "../../lib/cloud-state";
@@ -178,6 +179,38 @@ async function listenWithFallback(
   );
 }
 
+/** The local UI's writes of an engine credential (a sign-in, a key, an
+ *  account): refused once the runner is off its own credentials. */
+const ENGINE_CREDENTIAL_ROUTES: ReadonlySet<string> = new Set([
+  "/api/engines/connect",
+  "/api/engines/disconnect",
+  "/api/engines/accounts/connect",
+  "/api/engines/accounts/add",
+  "/api/engines/accounts/remove",
+]);
+
+async function handleEngineCredentialWrite(
+  path: string,
+  req: IncomingMessage,
+  res: ServerResponse,
+  opts: UiServerOptions,
+): Promise<void> {
+  switch (path) {
+    case "/api/engines/connect":
+      return handleEngineConnect(req, res, opts);
+    case "/api/engines/disconnect":
+      return handleEngineDisconnect(req, res, opts);
+    case "/api/engines/accounts/connect":
+      return handleEngineAccountConnect(req, res, opts);
+    case "/api/engines/accounts/add":
+      return handleEngineAccountAdd(req, res, opts);
+    case "/api/engines/accounts/remove":
+      return handleEngineAccountRemove(req, res, opts);
+    default:
+      return sendError(res, 404, `no such endpoint: ${path}`);
+  }
+}
+
 async function handle(
   req: IncomingMessage,
   res: ServerResponse,
@@ -192,19 +225,24 @@ async function handle(
     // POST — engine connect/disconnect (the only writes; localhost-bound, so
     // the loopback binding is the perimeter, ADR-028).
     if (method === "POST") {
+      // ADR-154 §13: an engine credential is written here only while the
+      // runner is on its own credentials, as work on them that leaving them
+      // waits for; off them it keeps none, and Connections in Uai Cloud
+      // holds them.
+      if (ENGINE_CREDENTIAL_ROUTES.has(path)) {
+        const write = whileOnOwnCredentials(() => handleEngineCredentialWrite(path, req, res, opts));
+        if (write === null) {
+          return sendError(
+            res,
+            409,
+            "this runner reads its credentials from Uai Cloud; manage them in Connections",
+          );
+        }
+        return await write;
+      }
       switch (path) {
-        case "/api/engines/connect":
-          return await handleEngineConnect(req, res, opts);
         case "/api/engines/install":
           return await handleEngineInstall(req, res);
-        case "/api/engines/disconnect":
-          return await handleEngineDisconnect(req, res, opts);
-        case "/api/engines/accounts/connect":
-          return await handleEngineAccountConnect(req, res, opts);
-        case "/api/engines/accounts/add":
-          return await handleEngineAccountAdd(req, res, opts);
-        case "/api/engines/accounts/remove":
-          return await handleEngineAccountRemove(req, res, opts);
         case "/api/tasks/stop":
           return await handleTaskStop(req, res, opts);
         case "/api/runtime/recheck": {