@runuai/host 0.9.152 → 0.9.154

package/lib/credential-consumers/github.ts

@@ -23,7 +23,8 @@
  *   is recorded in the cleanup inventory before anything is written to it.
  * - Writes for one task run one at a time, and each exec is admitted at the
  *   provider's last moment against the task's live state: the same
- *   assignment, the same credential revision, not sealed. A cleanup seals
+ *   assignment, credential identity, revision and material version, not
+ *   sealed. A cleanup seals
  *   (or drops the credentials it names), then waits for every write under
  *   way to end, so nothing it is about to delete can be written again after.
  */
@@ -64,6 +65,16 @@ export interface LeasedSshKey {
   publicKey: string;
 }
 
+export type PersonCredentialLane = "github" | "ssh";
+
+/** Writer-only authority: clone callers do not need to know the version. */
+type VersionedCredential<T> = T & { version: number };
+
+interface PersonCredentialSlots {
+  github: Slot<VersionedCredential<LeasedGithub>>;
+  ssh: Slot<VersionedCredential<LeasedSshKey>>;
+}
+
 /** A manifest lane: not named, named but unreadable, or in hand. */
 type Slot<T extends { credentialId: string; revision: string }> =
   | { kind: "absent" }
@@ -85,14 +96,12 @@ interface GitHold {
   release(): void;
 }
 
-interface TaskPersonCredentials {
+/** The inherited slots are what the registry's gate opened on: the exact
+ * committed view, absent while closed. Only these serve holds and writers. */
+interface TaskPersonCredentials extends PersonCredentialSlots {
   assignment: TaskAssignment;
-  /** What the registry's gate opened on (the exact committed view): the
-   *  only thing holds and writers read. Absent while closed. */
-  github: Slot<LeasedGithub>;
-  ssh: Slot<LeasedSshKey>;
   /** What the last install proposed: never served until a gate opens on it. */
-  candidate: { github: Slot<LeasedGithub>; ssh: Slot<LeasedSshKey> };
+  candidate: PersonCredentialSlots;
   /** The registry's gate for this run: nothing is held or written while
    *  closed. */
   open: boolean;
@@ -109,33 +118,59 @@ interface TaskPersonCredentials {
 
 const byTask = new Map<string, TaskPersonCredentials>();
 
-function slotOf<T extends GithubLeasedValue | SshLeasedValue, V extends { credentialId: string; revision: string }>(
+function slotOf<
+  T extends GithubLeasedValue | SshLeasedValue,
+  V extends { credentialId: string; revision: string; version: number },
+>(
   credential: TaskStaticCredential<T> | null,
-  value: (material: Readonly<T>) => Omit<V, "credentialId" | "revision">,
+  value: (material: Readonly<T>) => Omit<V, "credentialId" | "revision" | "version">,
 ): Slot<V> {
   if (!credential) return { kind: "absent" };
   const identity = { credentialId: credential.manifest.credentialId, revision: credential.manifest.revision };
-  if (credential.availability !== "available" || !credential.material) return { kind: "unavailable", ...identity };
-  return { kind: "present", value: { ...identity, ...value(credential.material) } as V };
+  if (
+    credential.availability !== "available" ||
+    !credential.material ||
+    credential.observedVersion === null
+  ) {
+    return { kind: "unavailable", ...identity };
+  }
+  return {
+    kind: "present",
+    value: {
+      ...identity,
+      version: credential.observedVersion,
+      ...value(credential.material),
+    } as V,
+  };
 }
 
-function slotsOf(view: TaskCredentialView): { github: Slot<LeasedGithub>; ssh: Slot<LeasedSshKey> } {
+function slotsOf(view: TaskCredentialView): PersonCredentialSlots {
   return {
-    github: slotOf<GithubLeasedValue, LeasedGithub>(view.github, (material) => ({ token: material.token })),
-    ssh: slotOf<SshLeasedValue, LeasedSshKey>(view.ssh, (material) => ({
+    github: slotOf<GithubLeasedValue, VersionedCredential<LeasedGithub>>(view.github, (material) => ({ token: material.token })),
+    ssh: slotOf<SshLeasedValue, VersionedCredential<LeasedSshKey>>(view.ssh, (material) => ({
       privateKey: material.privateKey,
       publicKey: material.publicKey,
     })),
   };
 }
 
-/** The same credential at the same revision, both readable. */
+function identityOf(slot: Slot<CredentialIdentity>): CredentialIdentity | null {
+  return slot.kind === "present"
+    ? { credentialId: slot.value.credentialId, revision: slot.value.revision }
+    : slot.kind === "unavailable"
+      ? { credentialId: slot.credentialId, revision: slot.revision }
+      : null;
+}
+
+/** The same named credential at the same revision, readable or not. */
 function sameIdentity<T extends CredentialIdentity>(a: Slot<T>, b: Slot<T>): boolean {
-  return (
-    a.kind === "present" &&
-    b.kind === "present" &&
-    a.value.credentialId === b.value.credentialId &&
-    a.value.revision === b.value.revision
+  const left = identityOf(a);
+  const right = identityOf(b);
+  return Boolean(
+    left &&
+      right &&
+      left.credentialId === right.credentialId &&
+      left.revision === right.revision,
   );
 }
 
@@ -194,12 +229,6 @@ export async function cleanupPersonCredentials(request: CredentialCleanupRequest
           removed.credentialId === identity.credentialId &&
           (removed.revision === null || removed.revision === identity.revision),
       ));
-  const identityOf = (slot: Slot<CredentialIdentity>): CredentialIdentity | null =>
-    slot.kind === "present"
-      ? { credentialId: slot.value.credentialId, revision: slot.value.revision }
-      : slot.kind === "unavailable"
-        ? { credentialId: slot.credentialId, revision: slot.revision }
-        : null;
   if (request.mode === "full") {
     current.sealed = true;
     current.open = false;
@@ -286,6 +315,44 @@ export interface TaskGitCredentialHold {
   release(): void;
 }
 
+/**
+ * A task-runtime reconciliation's hold on the exact open person-credential
+ * gate. Unlike a clone's hold, it does not require either credential to be
+ * readable and exposes no material. Cleanup aborts it and waits for release,
+ * so a retry delay or runtime reconstruction cannot outlive the run whose
+ * files it is about to write.
+ */
+export interface TaskPersonCredentialGateHold {
+  signal: AbortSignal;
+  release(): void;
+}
+
+export function holdPersonCredentialGate(
+  assignment: TaskAssignment,
+): TaskPersonCredentialGateHold {
+  const state = liveState(assignment);
+  const controller = new AbortController();
+  let settle!: () => void;
+  const released = new Promise<void>((resolve) => {
+    settle = resolve;
+  });
+  let releasedOnce = false;
+  const hold: GitHold = {
+    controller,
+    github: identityOf(state.github),
+    ssh: identityOf(state.ssh),
+    released,
+    release: () => {
+      if (releasedOnce) return;
+      releasedOnce = true;
+      state.holds.delete(hold);
+      settle();
+    },
+  };
+  state.holds.add(hold);
+  return { signal: controller.signal, release: hold.release };
+}
+
 /**
  * Hold the owner's GitHub sign-in and SSH key for one host-side git
  * operation of the exact assignment, while the registry's gate is open on
@@ -361,7 +428,7 @@ export const TASK_SSH_ALLOWED_SIGNERS_PATH = "/home/node/.ssh/allowed_signers";
 export const TASK_SSH_SIGNING_GITCONFIG_PATH = "/home/node/.ssh/uai-signing.gitconfig";
 /** SSH as git's transport to GitHub, while the task has no GitHub sign-in. */
 export const TASK_SSH_TRANSPORT_GITCONFIG_PATH = "/home/node/.ssh/uai-transport.gitconfig";
-/** The writer's step was refused: the run, the revision or the gate moved. */
+/** The writer's step was refused: the run, material or gate moved. */
 export class PersonCredentialWriteRefused extends Error {
   constructor() {
     super("the task's credentials changed or were cleaned up; the write was not made");
@@ -505,11 +572,18 @@ export function writeTaskGithub(environment: Environment, assignment: TaskAssign
     const slot = current().github;
     if (slot.kind === "absent") return false;
     if (slot.kind === "unavailable") throw new CredentialLeaseUnavailableError("the GitHub sign-in could not be read");
-    const { credentialId, revision, token } = slot.value;
-    // Admitted only while this exact revision is still the task's.
+    const { credentialId, revision, version, token } = slot.value;
+    // Admitted only while this exact material version is still the task's.
     const admit = (): void => {
       const live = current().github;
-      if (live.kind !== "present" || live.value.revision !== revision) throw new PersonCredentialWriteRefused();
+      if (
+        live.kind !== "present" ||
+        live.value.credentialId !== credentialId ||
+        live.value.revision !== revision ||
+        live.value.version !== version
+      ) {
+        throw new PersonCredentialWriteRefused();
+      }
     };
     inventory(environment, assignment, "github", credentialId, withStaged(TASK_GH_HOSTS_PATH, TASK_GH_GITCONFIG_PATH));
     const hosts = await run(environment, ["/bin/sh", "-c", GH_LOGIN_SCRIPT], `${token}\n`, "gh auth login", admit, "root");
@@ -548,10 +622,17 @@ export function writeTaskSshKey(environment: Environment, assignment: TaskAssign
     const slot = current().ssh;
     if (slot.kind === "absent") return false;
     if (slot.kind === "unavailable") throw new CredentialLeaseUnavailableError("the SSH key could not be read");
-    const { credentialId, revision, privateKey, publicKey } = slot.value;
+    const { credentialId, revision, version, privateKey, publicKey } = slot.value;
     const admit = (): void => {
       const live = current().ssh;
-      if (live.kind !== "present" || live.value.revision !== revision) throw new PersonCredentialWriteRefused();
+      if (
+        live.kind !== "present" ||
+        live.value.credentialId !== credentialId ||
+        live.value.revision !== revision ||
+        live.value.version !== version
+      ) {
+        throw new PersonCredentialWriteRefused();
+      }
     };
     inventory(
       environment,
@@ -589,6 +670,33 @@ export function writeTaskSshKey(environment: Environment, assignment: TaskAssign
   });
 }
 
+/**
+ * Reconcile the task-visible person credentials in their coupled order.
+ * GitHub chooses HTTPS and removes SSH transport; SSH then observes whether
+ * GitHub is present and either keeps HTTPS or restores SSH transport. Every
+ * individual exec remains fenced by the exact run and material version.
+ * Absent lanes rely on the coordinator having removed their inventoried
+ * files. When GitHub is removed, callers must select the surviving SSH lane
+ * even if its credential has not changed, so transport is restored too.
+ */
+export async function writeTaskPersonCredentials(
+  environment: Environment,
+  assignment: TaskAssignment,
+  lanes: readonly PersonCredentialLane[] = ["github", "ssh"],
+  signal?: AbortSignal,
+): Promise<void> {
+  const selected = new Set(lanes);
+  for (const [lane, write] of [
+    ["github", writeTaskGithub],
+    ["ssh", writeTaskSshKey],
+  ] as const) {
+    if (!selected.has(lane)) continue;
+    signal?.throwIfAborted();
+    await write(environment, assignment);
+  }
+  signal?.throwIfAborted();
+}
+
 function sameAssignment(a: TaskAssignment, b: TaskAssignment): boolean {
   return a.taskId === b.taskId && a.runEpoch === b.runEpoch;
 }

package/lib/credential-consumers/mcp.ts

@@ -282,7 +282,12 @@ export function leasedMcpFor(taskId: string): TaskMcpLease | undefined {
 export function leasedMcpAclEntries(taskId: string): Array<{ id: string; slug: string }> {
   const served = tasks.get(taskId)?.served;
   if (!served) return [];
-  return [...served.values()].filter(isLeased).map((connection) => ({ id: connection.credentialId, slug: connection.slug }));
+  // Membership follows the committed manifest, not whether its material was
+  // readable on this pass. A named-but-unreadable connection remains in agent
+  // config so the gateway can distinguish the temporary 503 from an absent
+  // connection's 404, and so a later material refresh needs no process
+  // restart just to make the tool visible again.
+  return [...served.values()].map((connection) => ({ id: connection.credentialId, slug: connection.slug }));
 }
 
 export function setMcpCredentialRefresher(next: McpCredentialRefresher | null): void {