@runuai/host 0.9.153 → 0.9.154

package/lib/cloud-credential-leases.ts

@@ -257,6 +257,12 @@ export interface TaskCredentialLeaseRegistryOptions {
     assignment: Readonly<TaskAssignment>,
     view: TaskCredentialView,
   ): void;
+  /** A material update committed while the existing gate stayed open.
+   * Followers may reconcile runtime files from this authoritative view. */
+  credentialMaterialChanged?(
+    assignment: Readonly<TaskAssignment>,
+    view: TaskCredentialView,
+  ): void;
   cleanupExternal(request: CredentialCleanupRequest): Promise<void>;
   /**
    * Installs files/proxy/engine consumers transactionally.  The env-replica
@@ -2279,6 +2285,9 @@ export class TaskCredentialLeaseRegistry {
       state.bundle = next;
       state.bundleGeneration++;
       this.#armBundleTimers(state);
+      if (!refused) {
+        this.#opts.credentialMaterialChanged?.(cloneAssignment(state.assignment), next.view);
+      }
       // A refusal opens through its release, inside this boundary: an open
       // that fails, its compensating close included, escalates below.
       release();

package/lib/cloud-credential-runtime.ts

@@ -63,9 +63,11 @@ import {
   cleanupPersonCredentials,
   closePersonCredentialGate,
   drainPersonCredentialWrites,
+  holdPersonCredentialGate,
   holdTaskGitCredentials,
   installPersonCredentials,
   openPersonCredentialGate,
+  type PersonCredentialLane,
   type TaskGitCredentialHold,
 } from "./credential-consumers/github";
 import {
@@ -160,18 +162,90 @@ export interface CloudCredentialRuntimeDeps {
    *  on a grant's snapshot, or closed): whoever follows the task's env
    *  (the proxy's trust delivery) looks again. */
   envServedChanged?(taskId: string): void;
+  /** Reconcile the owner's GitHub/SSH files in an already-running task.
+   * The signal closes with the exact person-credential gate, and the caller
+   * retries a transient rejection while that gate and material stay current. */
+  personCredentialsReady?(
+    assignment: Readonly<TaskAssignment>,
+    lanes: readonly PersonCredentialLane[],
+    signal: AbortSignal,
+  ): Promise<void>;
   files?: TaskFilesConsumer | null;
   launchDeadlineMs?: number;
   envReadyTimeoutMs?: number;
   shutdownDrainMs?: number;
   /** The first retry's delay for a recovered start whose startup failed. */
   recoveryRetryBaseMs?: number;
+  /** The first retry's delay for task-runtime person-credential writes. */
+  personReconcileRetryBaseMs?: number;
   registry?: Partial<
     Pick<TaskCredentialLeaseRegistryOptions, "createSessionReader" | "now" | "setTimer" | "clearTimer" | "randomId" | "onError">
   >;
   cleanup?: Pick<TaskCredentialCleanupDeps, "db" | "removePath" | "destroyRuntime">;
 }
 
+interface PersonCredentialStamp {
+  /** Stable without retaining another copy of any credential material. */
+  identity: string;
+  available: boolean;
+}
+
+interface PersonCredentialSnapshot {
+  runEpoch: number;
+  github: PersonCredentialStamp;
+  ssh: PersonCredentialStamp;
+}
+
+function personCredentialStamp(
+  credential: TaskCredentialView["github"] | TaskCredentialView["ssh"],
+): PersonCredentialStamp {
+  if (credential === null) return { identity: "absent", available: false };
+  return {
+    identity: [
+      credential.manifest.credentialId,
+      credential.manifest.revision,
+      credential.availability,
+      credential.observedVersion ?? "unreadable",
+    ].join("\u0000"),
+    available: credential.availability === "available",
+  };
+}
+
+function personCredentialSnapshot(view: TaskCredentialView): PersonCredentialSnapshot {
+  return {
+    runEpoch: view.assignment.runEpoch,
+    github: personCredentialStamp(view.github),
+    ssh: personCredentialStamp(view.ssh),
+  };
+}
+
+function samePersonCredentialSnapshot(
+  left: PersonCredentialSnapshot | undefined,
+  right: PersonCredentialSnapshot,
+): boolean {
+  return Boolean(
+    left &&
+      left.runEpoch === right.runEpoch &&
+      left.github.identity === right.github.identity &&
+      left.ssh.identity === right.ssh.identity,
+  );
+}
+
+/** What must be rewritten for `next`. GitHub and SSH transport are coupled:
+ * when GitHub leaves, the surviving SSH key must select SSH again. */
+function changedPersonCredentialLanes(
+  previous: PersonCredentialSnapshot | undefined,
+  next: PersonCredentialSnapshot,
+): PersonCredentialLane[] {
+  if (samePersonCredentialSnapshot(previous, next)) return [];
+  // The pair shares Git transport configuration. Reconcile both available
+  // lanes, including a write interrupted by the other lane changing.
+  const lanes: PersonCredentialLane[] = [];
+  if (next.github.available) lanes.push("github");
+  if (next.ssh.available) lanes.push("ssh");
+  return lanes;
+}
+
 /**
  * Why a start was interrupted, as its signal's reason: Stop, teardown or a
  * newer run took it over, or the runner is shutting down. The first
@@ -308,6 +382,13 @@ export class CloudCredentialRuntime {
   /** Last agent-facing MCP membership published for each task. Kept across a
    *  gate close/renewal because the config remains in the task runtime. */
   readonly #publishedMcpMembership = new Map<string, string>();
+  /** Person material last opened or installed for each task. Only identities,
+   * availability and observed versions: never another copy of a secret. */
+  readonly #personCredentialSnapshots = new Map<string, PersonCredentialSnapshot>();
+  readonly #personReconciles = new Map<string, { runEpoch: number; controller: AbortController }>();
+  /** Stop fences work before it can acquire the lifecycle slot or close the
+   * lease. A late grant cannot restart writes in that interval. */
+  readonly #personInterrupted = new Map<string, number>();
   readonly #setTimer: typeof setTimeout;
   readonly #clearTimer: typeof clearTimeout;
   #shutDown = false;
@@ -337,6 +418,7 @@ export class CloudCredentialRuntime {
       send: (frame) => deps.send(frame),
       closeTaskGate: (assignment) => this.#close(assignment),
       openTaskGate: (assignment, view) => this.#openGate(assignment, view),
+      credentialMaterialChanged: (assignment, view) => this.#personCredentialsChanged(assignment, view),
       installExternal: (request) => this.#track(this.#install(request)),
       // From a grant's acceptance until its own reader is active, the env
       // replica refuses the run's frames for the cloud to retry: none is
@@ -379,6 +461,7 @@ export class CloudCredentialRuntime {
       throw new CredentialLeaseUnavailableError("a newer run of this task has begun");
     }
     this.#floors.set(assignment.taskId, assignment.runEpoch);
+    if (!options.recovery) this.#personInterrupted.delete(assignment.taskId);
     this.#interruptTokens(assignment.taskId, {});
     // A newer run's start ends an older run's recovery; an ordinary start of
     // the run being recovered takes its startup over.
@@ -418,6 +501,11 @@ export class CloudCredentialRuntime {
    */
   interruptStarts(taskId: string, which: { exact?: number; below?: number } = {}): void {
     this.#interruptTokens(taskId, which);
+    const assignment = this.#assignments.get(taskId);
+    if (assignment && (which.exact === undefined || assignment.runEpoch === which.exact) &&
+        (which.below === undefined || assignment.runEpoch < which.below)) {
+      this.#interruptPersonCredentials(assignment);
+    }
     // A recovery of the run ends with it, ended start token or not.
     const recovered = this.#recovered.get(taskId);
     if (
@@ -441,6 +529,8 @@ export class CloudCredentialRuntime {
   /** A local Stop: the task's recovery, whatever its run, ends now. One
    *  only exists for the run this runner owned at its start. */
   interruptRecovery(taskId: string): void {
+    const assignment = this.#assignments.get(taskId);
+    if (assignment) this.#interruptPersonCredentials(assignment);
     const recovered = this.#recovered.get(taskId);
     if (recovered) this.#endRecovery(taskId, recovered.runEpoch);
   }
@@ -776,41 +866,50 @@ export class CloudCredentialRuntime {
     if (recovered.running === null) this.#recovered.delete(taskId);
   }
 
-  /** A recovered run's gate opened: its recovery is done, and its setup
-   *  runs, once, in the background, its failure its own. */
+  /** A recovered runtime is ready only after setup succeeds. Transient
+   * reconstruction/exec failures retry; Stop, cleanup and takeover fence
+   * every attempt and its retry delay. */
   #runRecoveredSetup(assignment: Readonly<TaskAssignment>): void {
     const recovered = this.#recovered.get(assignment.taskId);
     if (!recovered || recovered.runEpoch !== assignment.runEpoch || recovered.running !== null) return;
-    if (recovered.controller.signal.aborted) return;
+    if (recovered.controller.signal.aborted || this.#open.get(assignment.taskId) !== assignment.runEpoch) return;
     if (recovered.retry !== null) this.#clearTimer(recovered.retry);
     recovered.retry = null;
     const setup = recovered.setup;
-    recovered.setup = null;
     if (setup === null) {
       this.#recovered.delete(assignment.taskId);
       return;
     }
-    const signal = recovered.controller.signal;
+    const hold = holdPersonCredentialGate(assignment);
+    const signal = AbortSignal.any([recovered.controller.signal, hold.signal]);
+    let complete = false;
     recovered.running = this.#track(
       Promise.resolve()
-        .then(() => {
-          // Stop or a newer run can end recovery after the gate schedules
-          // this microtask but before it starts. Never enter task-machine
-          // setup with already-revoked authority: Files treats a current
-          // setup failure as terminal for the whole machine.
-          if (signal.aborted) return;
-          return setup(signal);
+        .then(async () => {
+          signal.throwIfAborted();
+          await setup(signal);
+          signal.throwIfAborted();
+          complete = true;
+        })
+        .catch(() => {
+          if (!signal.aborted) {
+            console.warn(`[credentials] task ${assignment.taskId} run ${String(assignment.runEpoch)}: recovered runtime setup failed; retrying`);
+          }
         })
-        .catch((error: unknown) =>
-          console.warn(
-            `[credentials] task ${assignment.taskId} run ${String(assignment.runEpoch)}: recovered runtime setup failed: ${
-              error instanceof Error ? error.message : String(error)
-            }`,
-          ),
-        )
         .finally(() => {
+          hold.release();
           recovered.running = null;
-          if (this.#recovered.get(assignment.taskId) === recovered) this.#recovered.delete(assignment.taskId);
+          if (this.#recovered.get(assignment.taskId) !== recovered) return;
+          if (complete || recovered.controller.signal.aborted || this.#shutDown) {
+            this.#recovered.delete(assignment.taskId);
+            return;
+          }
+          const base = this.#deps.recoveryRetryBaseMs ?? RECOVERY_RETRY_BASE_MS;
+          const delay = Math.min(RECOVERY_RETRY_MAX_MS, base * 2 ** Math.min(recovered.attempts++, 20));
+          recovered.retry = this.#setTimer(() => {
+            recovered.retry = null;
+            this.#runRecoveredSetup(assignment);
+          }, delay);
         }),
     );
   }
@@ -983,10 +1082,72 @@ export class CloudCredentialRuntime {
     // Nothing which follows publishes work synchronously. If Files itself
     // fails, the registry compensates by closing the earlier gates.
     this.#deps.files?.open(assignment, view);
+    this.#personCredentialsChanged(assignment, view);
     this.#publishMcpMembership(assignment.taskId, view);
     this.#runRecoveredSetup(assignment);
   }
 
+  #personCredentialsChanged(assignment: Readonly<TaskAssignment>, view: TaskCredentialView): void {
+    const reconcile = this.#deps.personCredentialsReady;
+    if (!reconcile || this.#shutDown || this.#open.get(assignment.taskId) !== assignment.runEpoch) return;
+    if ((this.#personInterrupted.get(assignment.taskId) ?? -1) >= assignment.runEpoch) return;
+    const previous = this.#personCredentialSnapshots.get(assignment.taskId);
+    const snapshot = personCredentialSnapshot(view);
+    if (samePersonCredentialSnapshot(previous, snapshot)) return;
+    this.#personCredentialSnapshots.set(assignment.taskId, snapshot);
+    this.#personReconciles.get(assignment.taskId)?.controller.abort();
+    const lanes = changedPersonCredentialLanes(previous, snapshot);
+    if (lanes.length === 0) return;
+    const entry = { runEpoch: assignment.runEpoch, controller: new AbortController() };
+    const hold = holdPersonCredentialGate(assignment);
+    const signal = AbortSignal.any([entry.controller.signal, hold.signal]);
+    this.#personReconciles.set(assignment.taskId, entry);
+    this.#background(
+      Promise.resolve().then(async () => {
+        let attempts = 0;
+        while (!signal.aborted) {
+          try {
+            await reconcile(assignment, lanes, signal);
+            signal.throwIfAborted();
+            return;
+          } catch {
+            if (signal.aborted) return;
+            if (attempts === 0) {
+              console.warn(`[credentials] task ${assignment.taskId} run ${String(assignment.runEpoch)}: person credential files not ready; retrying`);
+            }
+            const base = this.#deps.personReconcileRetryBaseMs ?? RECOVERY_RETRY_BASE_MS;
+            await this.#retryDelay(Math.min(RECOVERY_RETRY_MAX_MS, base * 2 ** Math.min(attempts++, 20)), signal);
+          }
+        }
+      }).finally(() => {
+        hold.release();
+        if (this.#personReconciles.get(assignment.taskId) === entry) this.#personReconciles.delete(assignment.taskId);
+      }),
+    );
+  }
+
+  #interruptPersonCredentials(assignment: Readonly<TaskAssignment>): void {
+    this.#personInterrupted.set(assignment.taskId, Math.max(assignment.runEpoch, this.#personInterrupted.get(assignment.taskId) ?? -1));
+    const snapshot = this.#personCredentialSnapshots.get(assignment.taskId);
+    if (snapshot && snapshot.runEpoch <= assignment.runEpoch) this.#personCredentialSnapshots.delete(assignment.taskId);
+    const reconcile = this.#personReconciles.get(assignment.taskId);
+    if (reconcile && reconcile.runEpoch <= assignment.runEpoch) reconcile.controller.abort();
+  }
+
+  /** A retry never holds cleanup for its backoff interval. */
+  #retryDelay(delay: number, signal: AbortSignal): Promise<void> {
+    return new Promise((resolve) => {
+      const finish = (): void => {
+        this.#clearTimer(timer);
+        signal.removeEventListener("abort", finish);
+        resolve();
+      };
+      const timer = this.#setTimer(finish, delay);
+      signal.addEventListener("abort", finish, { once: true });
+      if (signal.aborted) finish();
+    });
+  }
+
   #envServedChanged(taskId: string): void {
     try {
       this.#deps.envServedChanged?.(taskId);
@@ -1030,8 +1191,11 @@ export class CloudCredentialRuntime {
     if (open !== undefined && open <= assignment.runEpoch) {
       this.#open.delete(assignment.taskId);
       this.#served.delete(assignment.taskId);
+      this.#personCredentialSnapshots.delete(assignment.taskId);
       this.#envServedChanged(assignment.taskId);
     }
+    const person = this.#personReconciles.get(assignment.taskId);
+    if (person && person.runEpoch <= assignment.runEpoch) person.controller.abort();
     for (const entry of this.#holds.get(assignment.taskId) ?? []) {
       if (entry.runEpoch <= assignment.runEpoch) {
         attempt(() => entry.controller.abort(new CredentialLeaseUnavailableError("the task's credentials were withdrawn")));
@@ -1134,7 +1298,9 @@ export class CloudCredentialRuntime {
     const recovered = this.#recovered.get(request.taskId);
     const setups: Promise<void>[] = [];
     if (request.credentialIds === undefined && recovered && recovered.runEpoch <= request.runEpoch && recovered.running) {
-      recovered.controller.abort(new StartInterruptedError("takeover"));
+      // The gate hold already cancelled this attempt. A transient full
+      // cleanup may reacquire the same run's lease, so retain its setup for
+      // that next open. Stop/takeover cancel recovery at their own boundary.
       setups.push(recovered.running);
     }
     const consumer = consumerCleanupRequest(request);

package/lib/credential-consumers/github.ts

@@ -23,7 +23,8 @@
  *   is recorded in the cleanup inventory before anything is written to it.
  * - Writes for one task run one at a time, and each exec is admitted at the
  *   provider's last moment against the task's live state: the same
- *   assignment, the same credential revision, not sealed. A cleanup seals
+ *   assignment, credential identity, revision and material version, not
+ *   sealed. A cleanup seals
  *   (or drops the credentials it names), then waits for every write under
  *   way to end, so nothing it is about to delete can be written again after.
  */
@@ -64,6 +65,16 @@ export interface LeasedSshKey {
   publicKey: string;
 }
 
+export type PersonCredentialLane = "github" | "ssh";
+
+/** Writer-only authority: clone callers do not need to know the version. */
+type VersionedCredential<T> = T & { version: number };
+
+interface PersonCredentialSlots {
+  github: Slot<VersionedCredential<LeasedGithub>>;
+  ssh: Slot<VersionedCredential<LeasedSshKey>>;
+}
+
 /** A manifest lane: not named, named but unreadable, or in hand. */
 type Slot<T extends { credentialId: string; revision: string }> =
   | { kind: "absent" }
@@ -85,14 +96,12 @@ interface GitHold {
   release(): void;
 }
 
-interface TaskPersonCredentials {
+/** The inherited slots are what the registry's gate opened on: the exact
+ * committed view, absent while closed. Only these serve holds and writers. */
+interface TaskPersonCredentials extends PersonCredentialSlots {
   assignment: TaskAssignment;
-  /** What the registry's gate opened on (the exact committed view): the
-   *  only thing holds and writers read. Absent while closed. */
-  github: Slot<LeasedGithub>;
-  ssh: Slot<LeasedSshKey>;
   /** What the last install proposed: never served until a gate opens on it. */
-  candidate: { github: Slot<LeasedGithub>; ssh: Slot<LeasedSshKey> };
+  candidate: PersonCredentialSlots;
   /** The registry's gate for this run: nothing is held or written while
    *  closed. */
   open: boolean;
@@ -109,33 +118,59 @@ interface TaskPersonCredentials {
 
 const byTask = new Map<string, TaskPersonCredentials>();
 
-function slotOf<T extends GithubLeasedValue | SshLeasedValue, V extends { credentialId: string; revision: string }>(
+function slotOf<
+  T extends GithubLeasedValue | SshLeasedValue,
+  V extends { credentialId: string; revision: string; version: number },
+>(
   credential: TaskStaticCredential<T> | null,
-  value: (material: Readonly<T>) => Omit<V, "credentialId" | "revision">,
+  value: (material: Readonly<T>) => Omit<V, "credentialId" | "revision" | "version">,
 ): Slot<V> {
   if (!credential) return { kind: "absent" };
   const identity = { credentialId: credential.manifest.credentialId, revision: credential.manifest.revision };
-  if (credential.availability !== "available" || !credential.material) return { kind: "unavailable", ...identity };
-  return { kind: "present", value: { ...identity, ...value(credential.material) } as V };
+  if (
+    credential.availability !== "available" ||
+    !credential.material ||
+    credential.observedVersion === null
+  ) {
+    return { kind: "unavailable", ...identity };
+  }
+  return {
+    kind: "present",
+    value: {
+      ...identity,
+      version: credential.observedVersion,
+      ...value(credential.material),
+    } as V,
+  };
 }
 
-function slotsOf(view: TaskCredentialView): { github: Slot<LeasedGithub>; ssh: Slot<LeasedSshKey> } {
+function slotsOf(view: TaskCredentialView): PersonCredentialSlots {
   return {
-    github: slotOf<GithubLeasedValue, LeasedGithub>(view.github, (material) => ({ token: material.token })),
-    ssh: slotOf<SshLeasedValue, LeasedSshKey>(view.ssh, (material) => ({
+    github: slotOf<GithubLeasedValue, VersionedCredential<LeasedGithub>>(view.github, (material) => ({ token: material.token })),
+    ssh: slotOf<SshLeasedValue, VersionedCredential<LeasedSshKey>>(view.ssh, (material) => ({
       privateKey: material.privateKey,
       publicKey: material.publicKey,
     })),
   };
 }
 
-/** The same credential at the same revision, both readable. */
+function identityOf(slot: Slot<CredentialIdentity>): CredentialIdentity | null {
+  return slot.kind === "present"
+    ? { credentialId: slot.value.credentialId, revision: slot.value.revision }
+    : slot.kind === "unavailable"
+      ? { credentialId: slot.credentialId, revision: slot.revision }
+      : null;
+}
+
+/** The same named credential at the same revision, readable or not. */
 function sameIdentity<T extends CredentialIdentity>(a: Slot<T>, b: Slot<T>): boolean {
-  return (
-    a.kind === "present" &&
-    b.kind === "present" &&
-    a.value.credentialId === b.value.credentialId &&
-    a.value.revision === b.value.revision
+  const left = identityOf(a);
+  const right = identityOf(b);
+  return Boolean(
+    left &&
+      right &&
+      left.credentialId === right.credentialId &&
+      left.revision === right.revision,
   );
 }
 
@@ -194,12 +229,6 @@ export async function cleanupPersonCredentials(request: CredentialCleanupRequest
           removed.credentialId === identity.credentialId &&
           (removed.revision === null || removed.revision === identity.revision),
       ));
-  const identityOf = (slot: Slot<CredentialIdentity>): CredentialIdentity | null =>
-    slot.kind === "present"
-      ? { credentialId: slot.value.credentialId, revision: slot.value.revision }
-      : slot.kind === "unavailable"
-        ? { credentialId: slot.credentialId, revision: slot.revision }
-        : null;
   if (request.mode === "full") {
     current.sealed = true;
     current.open = false;
@@ -286,6 +315,44 @@ export interface TaskGitCredentialHold {
   release(): void;
 }
 
+/**
+ * A task-runtime reconciliation's hold on the exact open person-credential
+ * gate. Unlike a clone's hold, it does not require either credential to be
+ * readable and exposes no material. Cleanup aborts it and waits for release,
+ * so a retry delay or runtime reconstruction cannot outlive the run whose
+ * files it is about to write.
+ */
+export interface TaskPersonCredentialGateHold {
+  signal: AbortSignal;
+  release(): void;
+}
+
+export function holdPersonCredentialGate(
+  assignment: TaskAssignment,
+): TaskPersonCredentialGateHold {
+  const state = liveState(assignment);
+  const controller = new AbortController();
+  let settle!: () => void;
+  const released = new Promise<void>((resolve) => {
+    settle = resolve;
+  });
+  let releasedOnce = false;
+  const hold: GitHold = {
+    controller,
+    github: identityOf(state.github),
+    ssh: identityOf(state.ssh),
+    released,
+    release: () => {
+      if (releasedOnce) return;
+      releasedOnce = true;
+      state.holds.delete(hold);
+      settle();
+    },
+  };
+  state.holds.add(hold);
+  return { signal: controller.signal, release: hold.release };
+}
+
 /**
  * Hold the owner's GitHub sign-in and SSH key for one host-side git
  * operation of the exact assignment, while the registry's gate is open on
@@ -361,7 +428,7 @@ export const TASK_SSH_ALLOWED_SIGNERS_PATH = "/home/node/.ssh/allowed_signers";
 export const TASK_SSH_SIGNING_GITCONFIG_PATH = "/home/node/.ssh/uai-signing.gitconfig";
 /** SSH as git's transport to GitHub, while the task has no GitHub sign-in. */
 export const TASK_SSH_TRANSPORT_GITCONFIG_PATH = "/home/node/.ssh/uai-transport.gitconfig";
-/** The writer's step was refused: the run, the revision or the gate moved. */
+/** The writer's step was refused: the run, material or gate moved. */
 export class PersonCredentialWriteRefused extends Error {
   constructor() {
     super("the task's credentials changed or were cleaned up; the write was not made");
@@ -505,11 +572,18 @@ export function writeTaskGithub(environment: Environment, assignment: TaskAssign
     const slot = current().github;
     if (slot.kind === "absent") return false;
     if (slot.kind === "unavailable") throw new CredentialLeaseUnavailableError("the GitHub sign-in could not be read");
-    const { credentialId, revision, token } = slot.value;
-    // Admitted only while this exact revision is still the task's.
+    const { credentialId, revision, version, token } = slot.value;
+    // Admitted only while this exact material version is still the task's.
     const admit = (): void => {
       const live = current().github;
-      if (live.kind !== "present" || live.value.revision !== revision) throw new PersonCredentialWriteRefused();
+      if (
+        live.kind !== "present" ||
+        live.value.credentialId !== credentialId ||
+        live.value.revision !== revision ||
+        live.value.version !== version
+      ) {
+        throw new PersonCredentialWriteRefused();
+      }
     };
     inventory(environment, assignment, "github", credentialId, withStaged(TASK_GH_HOSTS_PATH, TASK_GH_GITCONFIG_PATH));
     const hosts = await run(environment, ["/bin/sh", "-c", GH_LOGIN_SCRIPT], `${token}\n`, "gh auth login", admit, "root");
@@ -548,10 +622,17 @@ export function writeTaskSshKey(environment: Environment, assignment: TaskAssign
     const slot = current().ssh;
     if (slot.kind === "absent") return false;
     if (slot.kind === "unavailable") throw new CredentialLeaseUnavailableError("the SSH key could not be read");
-    const { credentialId, revision, privateKey, publicKey } = slot.value;
+    const { credentialId, revision, version, privateKey, publicKey } = slot.value;
     const admit = (): void => {
       const live = current().ssh;
-      if (live.kind !== "present" || live.value.revision !== revision) throw new PersonCredentialWriteRefused();
+      if (
+        live.kind !== "present" ||
+        live.value.credentialId !== credentialId ||
+        live.value.revision !== revision ||
+        live.value.version !== version
+      ) {
+        throw new PersonCredentialWriteRefused();
+      }
     };
     inventory(
       environment,
@@ -589,6 +670,33 @@ export function writeTaskSshKey(environment: Environment, assignment: TaskAssign
   });
 }
 
+/**
+ * Reconcile the task-visible person credentials in their coupled order.
+ * GitHub chooses HTTPS and removes SSH transport; SSH then observes whether
+ * GitHub is present and either keeps HTTPS or restores SSH transport. Every
+ * individual exec remains fenced by the exact run and material version.
+ * Absent lanes rely on the coordinator having removed their inventoried
+ * files. When GitHub is removed, callers must select the surviving SSH lane
+ * even if its credential has not changed, so transport is restored too.
+ */
+export async function writeTaskPersonCredentials(
+  environment: Environment,
+  assignment: TaskAssignment,
+  lanes: readonly PersonCredentialLane[] = ["github", "ssh"],
+  signal?: AbortSignal,
+): Promise<void> {
+  const selected = new Set(lanes);
+  for (const [lane, write] of [
+    ["github", writeTaskGithub],
+    ["ssh", writeTaskSshKey],
+  ] as const) {
+    if (!selected.has(lane)) continue;
+    signal?.throwIfAborted();
+    await write(environment, assignment);
+  }
+  signal?.throwIfAborted();
+}
+
 function sameAssignment(a: TaskAssignment, b: TaskAssignment): boolean {
   return a.taskId === b.taskId && a.runEpoch === b.runEpoch;
 }

package/lib/task-person-credentials.ts

@@ -0,0 +1,76 @@
+/**
+ * Restore GitHub/SSH files when a running task's cloud credentials become
+ * usable, after recovery or a live change. The persisted provider locator
+ * is the only runtime authority; a missing runtime is a retryable failure.
+ * Fresh task-up uses the same writer on its newly provisioned handle.
+ */
+import type { HostTask } from "../db/schema";
+import { CredentialLeaseUnavailableError, type TaskAssignment } from "./cloud-credential-leases";
+import { writeTaskPersonCredentials, type PersonCredentialLane } from "./credential-consumers/github";
+import type { TaskWriteEnvironment } from "./credential-consumers/task-files";
+import { getHostTask, readTaskRunEpochState } from "./runtime-state";
+import { reconstructPersistedTaskEnvironment } from "./task-environment";
+
+/**
+ * The composer retries a rejection while the same material is current and
+ * aborts this signal before cleanup or takeover. In particular, a fresh
+ * task that is still starting must retry: a rotation after its runtime-ready
+ * writes but before it is marked running must not be silently missed.
+ */
+export async function reconcileRunningTaskPersonCredentials(
+  assignment: Readonly<TaskAssignment>,
+  lanes: readonly PersonCredentialLane[],
+  signal: AbortSignal,
+): Promise<void> {
+  const current = (): HostTask => {
+    signal.throwIfAborted();
+    const task = getHostTask(assignment.taskId);
+    const run = readTaskRunEpochState(assignment.taskId);
+    if (
+      task === null ||
+      task.statusMirror !== "running" ||
+      task.runEpoch !== assignment.runEpoch ||
+      run === null ||
+      !run.assignmentOpen ||
+      run.highestRunEpoch !== assignment.runEpoch ||
+      run.runtimeEstablishedEpoch !== assignment.runEpoch
+    ) {
+      throw new CredentialLeaseUnavailableError("the task's running credential assignment is not current");
+    }
+    return task;
+  };
+  const task = current();
+  const assertCurrent = (): void => {
+    const live = current();
+    if (
+      live.environmentProvider !== task.environmentProvider ||
+      live.environmentLocator !== task.environmentLocator ||
+      live.envMode !== task.envMode
+    ) {
+      throw new CredentialLeaseUnavailableError("the task's credential runtime has changed");
+    }
+  };
+  const environment = await reconstructPersistedTaskEnvironment(task);
+  assertCurrent();
+  if (environment === null) {
+    throw new CredentialLeaseUnavailableError("the task's credential runtime is unavailable");
+  }
+  // Keep the exact running assignment and cancellation at each provider's
+  // last exec boundary too: reconstruction or address lookup can suspend
+  // while Stop or a new run replaces the runtime.
+  const writable: TaskWriteEnvironment = {
+    descriptor: environment.descriptor,
+    exec: (request) => {
+      assertCurrent();
+      return environment.exec({
+        ...request,
+        admit: () => {
+          assertCurrent();
+          request.admit?.();
+        },
+      });
+    },
+  };
+  await writeTaskPersonCredentials(writable, assignment, lanes, signal);
+  assertCurrent();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.153",
+  "version": "0.9.154",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -15,14 +15,14 @@ import {
   whileOnOwnCredentials,
   type LegacyStartPermit,
 } from "../lib/cloud-credential-host";
-import { CredentialLeaseUnavailableError, type TaskAssignment } from "../lib/cloud-credential-leases";
+import type { TaskAssignment } from "../lib/cloud-credential-leases";
 import {
   StartInterruptedError,
   type CloudCredentialRuntime,
   type TaskCredentialStart,
   type TaskUpHold,
 } from "../lib/cloud-credential-runtime";
-import { writeTaskGithub, writeTaskSshKey } from "../lib/credential-consumers/github";
+import { writeTaskPersonCredentials } from "../lib/credential-consumers/github";
 import { agentClisReady, ensureStandardImage } from "../lib/standard-image";
 import { cloneRepo } from "../lib/repo-clone";
 import { handleFilesOp } from "../lib/shared-files";
@@ -315,10 +315,7 @@ function leasedTaskUp(
           signal,
         );
       }
-      for (const write of [writeTaskGithub, writeTaskSshKey]) {
-        if (signal.aborted) throw new CredentialLeaseUnavailableError("the task's credentials were withdrawn");
-        await write(environment, start.assignment);
-      }
+      await writeTaskPersonCredentials(environment, start.assignment, undefined, signal);
     },
     ...(filesV1 ? { filesV1: true as const } : {}),
   };

package/src/main.ts

@@ -178,6 +178,7 @@ import {
   reprobeContainerRuntimeMachineIdentity,
 } from "../lib/container-runtime";
 import { persistedTaskEnvironmentsMatchMachine, reconstructPersistedTaskEnvironment } from "../lib/task-environment";
+import { reconcileRunningTaskPersonCredentials } from "../lib/task-person-credentials";
 import { logVnodePressure } from "../lib/vnode-pressure";
 import { resolveAppleTunnelRoute } from "./apple-tunnel-route";
 import {
@@ -939,6 +940,7 @@ const cloudCredentials = new CloudCredentialRuntime({
   // delivery look again; /env reads it afresh on every command.
   envReplica: new ProjectEnvTaskReplicaManager({ onChange: () => noteProjectEnvViewChange() }),
   envServedChanged: () => noteProjectEnvViewChange(),
+  personCredentialsReady: reconcileRunningTaskPersonCredentials,
   files: taskFiles,
 });
 // Leaving its own credentials ends every task's env from the runner's