@runuai/host 0.9.151 → 0.9.153

package/db/migrations/0029_task_shared_files_mode.sql

@@ -0,0 +1,5 @@
+-- ADR-154 Files v1: persist the cloud-issued mode for crash recovery. The
+-- task-owned `.uai/files-mounted` marker is an observation, never authority.
+ALTER TABLE `uai_host_tasks` ADD `shared_files_mode` text
+	CONSTRAINT `uai_host_tasks_shared_files_mode`
+	CHECK (`shared_files_mode` IS NULL OR `shared_files_mode` IN ('off', 'ro', 'rw'));

package/db/migrations/meta/_journal.json

@@ -204,6 +204,13 @@
       "when": 1791331200001,
       "tag": "0028_leased_engine_runtimes",
       "breakpoints": true
+    },
+    {
+      "idx": 29,
+      "version": "6",
+      "when": 1791590400000,
+      "tag": "0029_task_shared_files_mode",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -39,6 +39,12 @@ export const hostTasks = sqliteTable(
     // Value-free resolver metadata for rebuilding the project-env gateway
     // after a runner restart, before the cloud re-sends task-up.
     projectEnvSpec: text("project_env_spec"),
+    // ADR-154 Files v1: the normalized mode from the cloud's task launch.
+    // Recovery must never trust the task-writable `.uai/files-mounted`
+    // marker as authority for what may be mounted.
+    sharedFilesMode: text("shared_files_mode", {
+      enum: ["off", "ro", "rw"],
+    }),
     statusMirror: text("status_mirror"),
     // Owner + project slugs — received in TaskLaunchInput at task-up and
     // persisted here so the local UI (ADR-028) can show "who/what" without a
@@ -70,6 +76,10 @@ export const hostTasks = sqliteTable(
       "uai_host_tasks_environment_pair",
       sql`(${table.environmentProvider} IS NULL) = (${table.environmentLocator} IS NULL)`,
     ),
+    sharedFilesModeCheck: check(
+      "uai_host_tasks_shared_files_mode",
+      sql`${table.sharedFilesMode} IS NULL OR ${table.sharedFilesMode} IN ('off', 'ro', 'rw')`,
+    ),
   }),
 );
 

package/lib/agent.ts

@@ -68,6 +68,10 @@ export interface LeasedTaskUp {
    * the start.
    */
   runtimeReady: (environment: TaskWriteEnvironment, signal: AbortSignal) => Promise<void>;
+  /** This exact start carries a task-machine Files session.  Machine task-up
+   * skips its legacy copy/mount path only in this case; owned leased tasks do
+   * not receive a Files session and keep their normal Files behavior. */
+  filesV1?: true;
 }
 
 /** Refuses a start on cloud credentials that is not whole, or not this

package/lib/browser-testing.ts

@@ -1390,11 +1390,16 @@ export async function setupBrowserTesting(
       }
     }
 
-    // Grok registers its servers through its own CLI (project scope, see
-    // GROK_BROWSER_ADD_CMD) rather than a file we own; a failure here leaves
-    // the task configured-false so the next ensure retries.
+    // Grok registers through its own read-modify-write CLI (user scope,
+    // see grokBrowserAddCommand), under the same lock as gateway reconciliation
+    // so two successful CLI processes cannot silently lose each other's entry.
+    // A failure leaves the task configured-false so the next ensure retries.
     if (hasGrok) {
       const grokArgv = [
+        "flock",
+        "-w",
+        "10",
+        MCP_CONFIG_LOCK_PATH,
         "sh",
         "-lc",
         selectedGrokHomes.map(grokBrowserAddCommand).join(" && "),

package/lib/cloud-credential-leases.ts

@@ -1126,7 +1126,10 @@ export class TaskCredentialLeaseRegistry {
       await this.#applyCredentialVersion(state, frame);
     } catch (error) {
       this.#report(error, state.assignment);
-      if (this.#isActive(state)) this.#request(state);
+      // A failed consumer install may already have completed full cleanup
+      // and armed the bounded retry which owns what comes next. Do not cancel
+      // that backoff by immediately requesting the same refused manifest.
+      if (this.#isActive(state) && !state.retryTimer) this.#request(state);
     }
   }
 
@@ -1226,7 +1229,7 @@ export class TaskCredentialLeaseRegistry {
         });
       } catch (error) {
         this.#report(error, state.assignment);
-        this.#request(state);
+        if (this.#isActive(state) && !state.retryTimer) this.#request(state);
       }
     } else if (frame.outcome === "needs_sign_in") {
       // The authoritative stale frame supplies any floor and removals.
@@ -2452,8 +2455,16 @@ export class TaskCredentialLeaseRegistry {
         // A permanent revocation answers every request with another denial.
         // Keep asking, but do not turn that into a tight
         // deny/cleanup/request loop against the cloud.
-        if (reason === "denied") this.#armRetry(state);
-        else this.#request(state);
+        // A denial is stable until cloud state changes, and a consumer which
+        // refused a grant can keep refusing the same manifest (for example
+        // while a task-owned workspace entry is being repaired).  Neither is
+        // allowed to become a cleanup/request loop which repeatedly mints STS
+        // sessions and reads Parameter Store without delay.
+        if (reason === "denied" || reason === "manifest-narrowed") {
+          this.#armRetry(state);
+        } else {
+          this.#request(state);
+        }
       }
     }
   }

package/lib/cloud-credential-runtime.ts

@@ -79,6 +79,8 @@ import {
   setMcpCredentialRefresher,
 } from "./credential-consumers/mcp";
 import type { ProjectEnvTaskReplicaManager, ProjectEnvTaskReplicaSnapshot } from "./project-env-task-replica";
+import type { SharedFilesMode } from "./shared-files-s3";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
 import {
   TaskCredentialCleanupCoordinator,
   type TaskCredentialCleanupDeps,
@@ -95,6 +97,17 @@ const ENV_READY_POLL_MS = 50;
  *  way; the next process's recovery sweep finishes what is left. */
 export const SHUTDOWN_DRAIN_MS = 30_000;
 
+/** The only MCP state an agent config exposes. Material, provider URL,
+ * revision and availability stay behind the task gateway, so changing any of
+ * them must not churn a long-lived agent process. */
+function mcpAgentMembershipFingerprint(view: TaskCredentialView): string {
+  return JSON.stringify(
+    view.mcp
+      .map((connection) => connection.manifest.slug)
+      .sort((left, right) => left.localeCompare(right)),
+  );
+}
+
 /** The task's Files (ADR-154 §12): installed, opened and closed with the
  *  rest. `close` is synchronous: no new Files admission after it. */
 export interface TaskFilesConsumer {
@@ -102,6 +115,32 @@ export interface TaskFilesConsumer {
   open(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void;
   close(assignment: Readonly<TaskAssignment>): void;
   closeConsumers(request: TaskCredentialCleanupRequest): Promise<void>;
+  /** A trusted task-machine runtime could not establish its Files boundary.
+   * This run cannot be reopened on the same machine. */
+  retire(assignment: Readonly<TaskAssignment>, error: unknown): void;
+  /** Optional only so owned runners can use the same composer without a
+   * task-machine Files implementation. */
+  runtimeReady?(
+    assignment: Readonly<TaskAssignment>,
+    environment: TaskEnvironmentHandle<unknown>,
+    mode: SharedFilesMode,
+    signal: AbortSignal,
+  ): Promise<void>;
+  /** Drop secrets at process shutdown without starting cleanup. */
+  shutdown?(): void;
+}
+
+/** A Files implementation proved that the runtime-ready operation which
+ * failed still owns the exact open run and requested terminal retirement of
+ * its one-task machine; a stale operation throws its ordinary error. */
+export class AuthoritativeTaskFilesFailure extends Error {
+  override readonly cause: unknown;
+
+  constructor(cause: unknown) {
+    super(cause instanceof Error ? cause.message : "the task's Files boundary failed");
+    this.name = "AuthoritativeTaskFilesFailure";
+    this.cause = cause;
+  }
 }
 
 export interface CloudCredentialRuntimeDeps {
@@ -266,6 +305,9 @@ export class CloudCredentialRuntime {
   /** Work accepted and not yet over (startups, frames, installs, holds not
    *  yet released, closes): what shutdown joins. */
   readonly #work = new Set<Promise<unknown>>();
+  /** Last agent-facing MCP membership published for each task. Kept across a
+   *  gate close/renewal because the config remains in the task runtime. */
+  readonly #publishedMcpMembership = new Map<string, string>();
   readonly #setTimer: typeof setTimeout;
   readonly #clearTimer: typeof clearTimeout;
   #shutDown = false;
@@ -500,6 +542,69 @@ export class CloudCredentialRuntime {
     };
   }
 
+  /** Whether this process has the task-machine Files-v1 consumer wired. */
+  taskFilesV1(): boolean {
+    return typeof this.#deps.files?.runtimeReady === "function";
+  }
+
+  /** Runtime-ready half of Files v1.  It is tracked with the composer's
+   * accepted work so shutdown joins a write/mount already admitted. */
+  prepareTaskFiles(
+    assignment: Readonly<TaskAssignment>,
+    environment: TaskEnvironmentHandle<unknown>,
+    mode: SharedFilesMode,
+    signal: AbortSignal,
+  ): Promise<void> {
+    const ready = this.#deps.files?.runtimeReady;
+    if (!ready) return Promise.reject(new Error("task-machine Files v1 is unavailable"));
+    return this.#track(
+      ready.call(this.#deps.files, assignment, environment, mode, signal).catch((error: unknown) => {
+        if (error instanceof AuthoritativeTaskFilesFailure) {
+          // Never reopen this run on the same machine. The consumer already
+          // proved this is authoritative; centrally latch/request exact-run
+          // terminal retirement too, so an implementation cannot turn this
+          // into an ordinary cleanup/regrant by omission.
+          let retirementError: unknown = null;
+          try {
+            this.#deps.files!.retire(assignment, error.cause);
+          } catch (failure) {
+            retirementError = failure;
+          }
+          void this.closeAssignment({ ...assignment }, "stop").catch(() => {});
+          if (retirementError !== null) throw retirementError;
+          throw error.cause;
+        }
+        throw error;
+      }),
+    );
+  }
+
+  /** A recovered task whose trusted Files metadata is absent or invalid has
+   * failed the same boundary before the consumer can be called. Request its
+   * terminal machine retirement, close its gate synchronously, and run the
+   * run's full cleanup. */
+  failTaskFilesSetup(
+    assignment: Readonly<TaskAssignment>,
+    error: unknown = new Error("the recovered task has no trusted Files-v1 metadata"),
+  ): void {
+    try {
+      this.#deps.files?.retire(assignment, error);
+    } catch (retirementError) {
+      console.warn(
+        `[credentials] task ${assignment.taskId} run ${String(assignment.runEpoch)}: Files machine retirement could not be requested: ${
+          retirementError instanceof Error ? retirementError.message : String(retirementError)
+        }`,
+      );
+    }
+    void this.closeAssignment({ ...assignment }, "stop").catch((error: unknown) => {
+      console.warn(
+        `[credentials] task ${assignment.taskId} run ${String(assignment.runEpoch)}: Files recovery cleanup failed: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    });
+  }
+
   /** The start is over, successful or not: its token has no authority left,
    *  and it is no longer the task's newest. */
   endStart(start: TaskCredentialStart): void {
@@ -688,7 +793,14 @@ export class CloudCredentialRuntime {
     const signal = recovered.controller.signal;
     recovered.running = this.#track(
       Promise.resolve()
-        .then(() => setup(signal))
+        .then(() => {
+          // Stop or a newer run can end recovery after the gate schedules
+          // this microtask but before it starts. Never enter task-machine
+          // setup with already-revoked authority: Files treats a current
+          // setup failure as terminal for the whole machine.
+          if (signal.aborted) return;
+          return setup(signal);
+        })
         .catch((error: unknown) =>
           console.warn(
             `[credentials] task ${assignment.taskId} run ${String(assignment.runEpoch)}: recovered runtime setup failed: ${
@@ -830,6 +942,7 @@ export class CloudCredentialRuntime {
     setEngineCredentialRefresher(null);
     setEngineLaunchFenceEscalator(null);
     setMcpCredentialRefresher(null);
+    this.#deps.files?.shutdown?.();
   }
 
   // -- the registry's gate and install --------------------------------------------
@@ -860,13 +973,17 @@ export class CloudCredentialRuntime {
     openEngineGate(assignment, view);
     openMcpGate(assignment, view);
     openPersonCredentialGate(assignment, view);
-    this.#deps.files?.open(assignment, view);
     this.#open.set(assignment.taskId, assignment.runEpoch);
     const generation = this.#generations.get(view);
     if (generation === undefined) this.#served.delete(assignment.taskId);
     else this.#served.set(assignment.taskId, generation);
-    this.#deps.mcpServedChanged?.(assignment.taskId);
     this.#envServedChanged(assignment.taskId);
+    // Last throwing boundary: a recovered runtime's mounts stay staged and
+    // root-inaccessible until every other consumer accepted this exact view.
+    // Nothing which follows publishes work synchronously. If Files itself
+    // fails, the registry compensates by closing the earlier gates.
+    this.#deps.files?.open(assignment, view);
+    this.#publishMcpMembership(assignment.taskId, view);
     this.#runRecoveredSetup(assignment);
   }
 
@@ -878,6 +995,21 @@ export class CloudCredentialRuntime {
     }
   }
 
+  /** Publish only a normalized change visible to agent configuration. A
+   * renewed lease, a refreshed OAuth token, and available/unavailable
+   * transitions all keep the same named gateway route and therefore do not
+   * rewrite config or restart agents; an unavailable route answers 503. */
+  #publishMcpMembership(taskId: string, view: TaskCredentialView): void {
+    const fingerprint = mcpAgentMembershipFingerprint(view);
+    if (this.#publishedMcpMembership.get(taskId) === fingerprint) return;
+    this.#publishedMcpMembership.set(taskId, fingerprint);
+    try {
+      this.#deps.mcpServedChanged?.(taskId);
+    } catch {
+      // The gateway gate is authoritative even when its config follower fails.
+    }
+  }
+
   /**
    * Synchronous and idempotent: every consumer of this run (and older)
    * stops being served, env and Files included, and every start holding its
@@ -947,6 +1079,12 @@ export class CloudCredentialRuntime {
     installPersonCredentials(request);
     await this.#deps.files?.install(request);
     this.#assertInstallCurrent(request);
+    // Credential changes normally affect material or availability only. Keep
+    // this normalized comparison at the install boundary so even a future
+    // same-run membership change publishes exactly once.
+    if (request.reason === "credential-change") {
+      this.#publishMcpMembership(request.assignment.taskId, request.next);
+    }
   }
 
   #assertInstallCurrent(request: CredentialInstallRequest): void {
@@ -1019,6 +1157,7 @@ export class CloudCredentialRuntime {
     if (request.credentialIds !== undefined) return;
     this.#deps.envReplica?.dropAssignment(request.taskId, request.runEpoch);
     if (request.reason !== "teardown") return;
+    this.#publishedMcpMembership.delete(request.taskId);
     forgetLeasedEngines({ taskId: request.taskId, runEpoch: request.runEpoch });
     const mcp = leasedMcpFor(request.taskId);
     if (mcp && mcp.assignment.runEpoch <= request.runEpoch) forgetLeasedMcp(request.taskId);

package/lib/credential-cleanup-inventory.ts

@@ -165,7 +165,9 @@ const SSH_PATHS = new Set(
 );
 const FILES_SESSION_PATHS = new Set([
   LEASE_CREDENTIALS_FILE,
+  `${LEASE_CREDENTIALS_FILE}.uai-tmp`,
   LEASE_AWS_CONFIG_FILE,
+  `${LEASE_AWS_CONFIG_FILE}.uai-tmp`,
 ]);
 
 /** Destructive cleanup accepts only lane-owned files. The executor repeats

package/lib/credential-consumers/engine-anchor.ts

@@ -1685,7 +1685,11 @@ export async function stopAnchoredEngines(
       request.taskId,
       String(request.runEpoch),
       named === undefined ? "all" : "named",
-      (named ?? []).map(idPathSegment).join("\n"),
+      // Every provider refuses an empty argv entry, and "all" names no
+      // account: a lone newline stands for the empty list (the helper drops
+      // blank names). Live 2026-10-11: the empty string failed every
+      // stop-all, so no cleanup, recovery sweep or relaunch could finish.
+      (named ?? []).map(idPathSegment).join("\n") || "\n",
       String(anchorStopSeconds),
       carrierRoots(),
     ],