@runuai/host 0.9.152 → 0.9.153

package/lib/orchestrator.ts

@@ -201,6 +201,7 @@ import {
   listLeasedEngineRuntimes,
   rememberLeasedEngineRuntime,
 } from "./credential-cleanup-inventory";
+import { leasedMcpAclEntries } from "./credential-consumers/mcp";
 import { ENGINE_CREDENTIAL_FILES, ENGINE_ENV_CREDENTIAL_KEYS } from "../src/cloud-credentials";
 import { clearTaskGatewayAcl, setupMcpTaskConfig } from "./mcp-gateway";
 import {
@@ -389,6 +390,9 @@ interface Channel {
   sharedFiles: string;
   /** ADR-057: the owner's MCP connections exposed through the host gateway. */
   mcpConnections: Array<{ id: string; slug: string }>;
+  /** Last normalized membership published by the cloud composer. Non-null is
+   *  sticky: never fall back to the independently delivered channel snapshot. */
+  mcpLeaseConnections: Array<{ id: string; slug: string }> | null;
   /** Last connection set written into the container (skip repeat execs —
    *  ensure runs on every message). Live sessions read MCP config at spawn,
    *  so a mid-task write takes effect on the next (re)spawn. */
@@ -479,6 +483,31 @@ interface Channel {
   leasedLaunches: Map<string, LeasedLaunchSlot>;
 }
 
+/** MCP configs expose only a slug routed to a credential id. Manifest order
+ * is not observable, so normalize it before deciding to write or recycle. */
+function normalizeMcpConnections(
+  connections: readonly { id: string; slug: string }[],
+): Array<{ id: string; slug: string }> {
+  return connections
+    .map(({ id, slug }) => ({ id, slug }))
+    .sort(
+      (left, right) =>
+        left.slug.localeCompare(right.slug) || left.id.localeCompare(right.id),
+    );
+}
+
+/** Credential ids select gateway material but never enter an agent config:
+ * the stable task URL exposes only the named slug. */
+function mcpAgentMembershipFingerprint(
+  connections: readonly { id: string; slug: string }[],
+): string {
+  return JSON.stringify(
+    connections
+      .map(({ slug }) => slug)
+      .sort((left, right) => left.localeCompare(right)),
+  );
+}
+
 interface AcceptedPrompt {
   text: string;
 }
@@ -753,6 +782,44 @@ export class Orchestrator {
     return () => this.hostSubscribers.delete(fn);
   }
 
+  /**
+   * The cloud credential composer changed the MCP view it serves for a task.
+   * Its committed lease view, not the independently delivered channel spec,
+   * is authoritative once this fires. Re-publish config after an initial
+   * start already under way, then recycle idle sessions so long-lived MCP
+   * clients reload a changed connection set. Busy sessions recycle at their
+   * ordinary turn boundary through the existing stale-session path.
+   */
+  mcpServedChanged(taskId: string): void {
+    const channel = this.channels.get(taskId);
+    if (!channel || !this.isActiveChannel(channel)) return;
+    const next = normalizeMcpConnections(leasedMcpAclEntries(taskId));
+    const unchanged = channel.mcpLeaseConnections !== null &&
+      mcpAgentMembershipFingerprint(channel.mcpLeaseConnections) ===
+        mcpAgentMembershipFingerprint(next);
+    // Retain the latest ids even when the agent-visible names did not move;
+    // they are useful if a later engine-roster change writes the whole ACL.
+    channel.mcpLeaseConnections = next;
+    if (unchanged) return;
+    channel.mcpConfigDirtyEpoch += 1;
+    const starting = channel.sessionsReady;
+    if (!starting) return;
+    void starting
+      .then(async () => {
+        if (!this.isActiveChannel(channel)) return;
+        await this.ensureMcpConfig(channel);
+        if (!this.isActiveChannel(channel)) return;
+        await this.reconcileIfStarted(channel);
+      })
+      .catch((err: unknown) => {
+        console.warn(
+          `[orchestrator] ${taskId}: rewriting leased MCP config failed: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      });
+  }
+
   /** Run one task lifecycle mutation in arrival order. Different task ids
    *  remain fully concurrent. The queue tail never rejects, so one failed
    *  command cannot poison later recovery. */
@@ -846,7 +913,10 @@ export class Orchestrator {
     const browserWasEnabled = channel.browserTesting;
     const previousRoster = channel.roster;
     const previousMcpShape = JSON.stringify({
-      connections: channel.mcpConnections,
+      connections:
+        channel.mcpLeaseConnections === null
+          ? normalizeMcpConnections(channel.mcpConnections)
+          : mcpAgentMembershipFingerprint(channel.mcpLeaseConnections),
       kinds: [...new Set(previousRoster.map((agent) => agent.kind))].sort(),
     });
     const previousById = new Map(previousRoster.map((agent) => [agent.id, agent]));
@@ -947,7 +1017,10 @@ export class Orchestrator {
     channel.mcpConnections = spec.mcpConnections ?? [];
     if (spec.engineAccountScope) channel.engineAccountScope = spec.engineAccountScope;
     const nextMcpShape = JSON.stringify({
-      connections: channel.mcpConnections,
+      connections:
+        channel.mcpLeaseConnections === null
+          ? normalizeMcpConnections(channel.mcpConnections)
+          : mcpAgentMembershipFingerprint(channel.mcpLeaseConnections),
       kinds: [...new Set(channel.roster.map((agent) => agent.kind))].sort(),
     });
     if (nextMcpShape !== previousMcpShape) {
@@ -1266,6 +1339,7 @@ export class Orchestrator {
       browserTesting: spec.browserTesting === true,
       sharedFiles: spec.sharedFiles ?? "ro",
       mcpConnections: spec.mcpConnections ?? [],
+      mcpLeaseConnections: null,
       mcpConfigWrite: null,
       mcpConfigDirtyEpoch: 1,
       mcpConfigAppliedEpoch: 0,
@@ -2037,10 +2111,14 @@ export class Orchestrator {
 
   private async writeMcpConfigPass(channel: Channel): Promise<void> {
     if (!this.isActiveChannel(channel)) return;
-    const connections = channel.mcpConnections.map((connection) => ({
-      id: connection.id,
-      slug: connection.slug,
-    }));
+    let connections = channel.mcpLeaseConnections;
+    if (connections === null && this.isLeasedChannel(channel)) {
+      connections = normalizeMcpConnections(
+        leasedMcpAclEntries(channel.taskId),
+      );
+      channel.mcpLeaseConnections = connections;
+    }
+    connections ??= normalizeMcpConnections(channel.mcpConnections);
     const engineKinds = [
       ...new Set(channel.roster.map((agent) => agent.kind)),
     ].sort();
@@ -2048,8 +2126,11 @@ export class Orchestrator {
       ? this.codexHomes(true, channel)
       : [];
     const grokHomes = this.grokHomes(engineKinds.includes("grok"), channel);
+    const fingerprintConnections = channel.mcpLeaseConnections === null
+      ? connections
+      : connections.map(({ slug }) => ({ slug }));
     const fingerprint = JSON.stringify({
-      connections,
+      connections: fingerprintConnections,
       engineKinds,
       codexHomes,
       ...(grokHomes.length > 0 ? { grokHomes } : {}),
@@ -2070,7 +2151,7 @@ export class Orchestrator {
     const hadPrevious = channel.mcpConfigFingerprint !== undefined;
     let previous:
       | {
-          connections: Array<{ id: string; slug: string }>;
+          connections: Array<{ id?: string; slug: string }>;
           engineKinds: string[];
           codexHomes?: string[];
         }
@@ -2083,7 +2164,8 @@ export class Orchestrator {
       previous = undefined;
     }
     const connectionsChanged =
-      JSON.stringify(previous?.connections) !== JSON.stringify(connections);
+      JSON.stringify(previous?.connections) !==
+      JSON.stringify(fingerprintConnections);
     const addedKinds = new Set(
       engineKinds.filter((kind) => !previous?.engineKinds?.includes(kind)),
     );

package/lib/runtime-state.ts

@@ -6,6 +6,7 @@ import { newId } from "./ulid";
 import type { HostTask } from "../db/schema";
 import type { TaskLaunchInput, TaskUpResult } from "../src/protocol";
 import {
+  parseTaskEnvironmentLocator,
   serializeTaskEnvironmentLocator,
   type ProjectEnvMode,
   type TaskEnvironmentLocator,
@@ -705,6 +706,93 @@ export function hostTaskEnvMode(task: {
   throw new Error(`unsupported task project env mode: ${task.envMode}`);
 }
 
+export type TaskSharedFilesMode = "off" | "ro" | "rw";
+
+/**
+ * Normalize the trusted task-launch setting before it is persisted. The wire
+ * default has always been read-only; recovery records that decision rather
+ * than consulting the task-writable `.uai/files-mounted` marker.
+ */
+export function normalizeTaskSharedFilesMode(
+  value: string | undefined,
+): TaskSharedFilesMode {
+  if (value === undefined) return "ro";
+  if (value === "off" || value === "ro" || value === "rw") return value;
+  throw new Error(`unsupported task shared-files mode: ${value}`);
+}
+
+/** Persist the normalized mode while the authoritative task launch exists. */
+export function recordTaskSharedFilesMode(
+  taskId: string,
+  task: { sharedFiles?: string },
+  db: Db = getDb(),
+): TaskSharedFilesMode {
+  const mode = normalizeTaskSharedFilesMode(task.sharedFiles);
+  upsertHostTaskIn(db, taskId, { sharedFilesMode: mode });
+  return mode;
+}
+
+/**
+ * Read the trusted recovery authority. Null identifies a pre-Files-v1 row;
+ * malformed or newer values fail closed instead of becoming read-only.
+ */
+export function hostTaskSharedFilesMode(task: {
+  sharedFilesMode?: string | null;
+}): TaskSharedFilesMode | null {
+  const mode = task.sharedFilesMode;
+  if (mode === null || mode === undefined) return null;
+  if (mode === "off" || mode === "ro" || mode === "rw") return mode;
+  throw new Error(`unsupported persisted task shared-files mode: ${mode}`);
+}
+
+export interface TaskFilesRecoveryBinding {
+  locator: TaskEnvironmentLocator;
+  workspacePath: string;
+  mode: TaskSharedFilesMode;
+}
+
+/** Files may be staged before a recovered grant opens only from an exact,
+ * established v1 runtime row. A fresh/starting/different run has no binding;
+ * an exact running row with incomplete or non-self metadata is corruption and
+ * fails closed instead of letting root operate on a guessed workspace. */
+export function taskFilesRecoveryBinding(
+  task: Pick<
+    HostTask,
+    | "statusMirror"
+    | "runEpoch"
+    | "environmentLocator"
+    | "worktreePath"
+    | "sharedFilesMode"
+  > | null,
+  assignment: { taskId: string; runEpoch: number },
+): TaskFilesRecoveryBinding | null {
+  if (
+    task === null ||
+    task.statusMirror !== "running" ||
+    hostTaskRunEpoch(task) !== assignment.runEpoch
+  ) {
+    return null;
+  }
+  if (task.environmentLocator === null || task.worktreePath === null) {
+    throw new Error("the recovered task has no complete runtime locator");
+  }
+  const mode = hostTaskSharedFilesMode(task);
+  if (mode === null) throw new Error("the recovered task predates Files v1");
+  const locator = parseTaskEnvironmentLocator(task.environmentLocator);
+  const value = locator.value;
+  if (
+    locator.provider !== "self" ||
+    typeof value !== "object" ||
+    value === null ||
+    Array.isArray(value) ||
+    (value as Record<string, unknown>).workspacePath !== "/workspace" ||
+    (value as Record<string, unknown>).taskId !== assignment.taskId
+  ) {
+    throw new Error("the recovered task does not have the canonical Files-v1 runtime");
+  }
+  return { locator, workspacePath: "/workspace", mode };
+}
+
 export interface TaskProjectEnvSpec {
   schemaVersion: 1;
   projects: Array<{