@runuai/host 0.9.153 → 0.9.155

package/src/main.ts

@@ -92,8 +92,7 @@ import { cancelMcpCapture, completeMcpCapture, probeMcpCapture } from "../lib/mc
 import { captureGithub, mintSsh, readGithubRevision, revokeGithub } from "../lib/person-capture";
 import { handleMcpOp } from "../lib/mcp-connections";
 import {
-  ENGINE_CREDENTIAL_FILES,
-  ENGINE_ENV_CREDENTIAL_KEYS,
+  CLOUD_CREDENTIAL_KINDS,
   HOST_CLOUD_CREDENTIALS_FEATURE,
   parseCredentialsActivateResultFrame,
   runEpochFromWire,
@@ -178,6 +177,7 @@ import {
   reprobeContainerRuntimeMachineIdentity,
 } from "../lib/container-runtime";
 import { persistedTaskEnvironmentsMatchMachine, reconstructPersistedTaskEnvironment } from "../lib/task-environment";
+import { reconcileRunningTaskPersonCredentials } from "../lib/task-person-credentials";
 import { logVnodePressure } from "../lib/vnode-pressure";
 import { resolveAppleTunnelRoute } from "./apple-tunnel-route";
 import {
@@ -300,6 +300,7 @@ import {
   HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
   LIVE_ROSTER_EDIT_PROTOCOL_FEATURE,
+  AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE,
   isEngineAccountScope,
   HOST_LOGS_PROTOCOL_FEATURE,
   HOST_TASK_INVENTORY_PROTOCOL_FEATURE,
@@ -702,10 +703,6 @@ setCredentialsModeSource(() => credentialsActivation.mode());
  *  so the operator turning them on reaches it within minutes. */
 const CREDENTIALS_ACTIVATION_RETRY_MS = 5 * 60_000;
 const CREDENTIALS_ACTIVATION_ANSWER_MS = 60_000;
-const LEASED_ENGINE_KINDS: ReadonlySet<string> = new Set([
-  ...Object.keys(ENGINE_ENV_CREDENTIAL_KEYS),
-  ...Object.keys(ENGINE_CREDENTIAL_FILES),
-]);
 // Started here, first fired long after the bridge's state exists.
 const credentialsActivationTimer = setInterval(() => {
   if (stopping || !credentialFramesReady) return;
@@ -939,6 +936,7 @@ const cloudCredentials = new CloudCredentialRuntime({
   // delivery look again; /env reads it afresh on every command.
   envReplica: new ProjectEnvTaskReplicaManager({ onChange: () => noteProjectEnvViewChange() }),
   envServedChanged: () => noteProjectEnvViewChange(),
+  personCredentialsReady: reconcileRunningTaskPersonCredentials,
   files: taskFiles,
 });
 // Leaving its own credentials ends every task's env from the runner's
@@ -1396,6 +1394,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_ENGINE_ACCOUNT_MANAGE_PROTOCOL_FEATURE,
       HOST_ENGINE_DISCONNECT_PROTOCOL_FEATURE,
       LIVE_ROSTER_EDIT_PROTOCOL_FEATURE,
+      AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
       // dispatch in mock mode would let the composer create a Secretary that
       // has no way to wake crew.
@@ -1897,10 +1896,11 @@ function flushStoppedTaskStatuses(socket: WebSocket | null = ws): void {
 // ADR-131 D3: a stored account (any scope) makes a kind advertisable even
 // when the host's own credential is absent — see hasStoredEngineAccounts.
 setAdvertisementFallback((kind) => hasStoredEngineAccounts(kind));
-// ADR-154: on cloud credentials the runner holds none of its own, so a kind
-// is advertised when the cloud can lease an account for it (Kimi, with no
-// lane yet, is not), whatever this process's env says.
-setLeasedAdvertisement(() => (credentialsMode() === "active" ? LEASED_ENGINE_KINDS : null));
+// ADR-154 §10: on cloud credentials the runner holds none of its own, so it
+// advertises the kinds a leased task can run, whatever this process's env
+// says: the leased lanes and the Managed Engine, which leases nothing (Kimi,
+// with no lane yet, is left out).
+setLeasedAdvertisement(() => (credentialsMode() === "active" ? CLOUD_CREDENTIAL_KINDS : null));
 onRegistryChange(() => sendCapabilities());
 onContainerRuntimeChange((next, previous) => {
   if (stopping) return;
@@ -5416,6 +5416,12 @@ function expectTaskAgents(value: unknown): TaskAgent[] {
       const perms = row.permissions.filter((p): p is string => typeof p === "string");
       if (perms.length > 0) out.permissions = perms;
     }
+    // ADR-157: the built-in Astronaut's marker, set only by the cloud.
+    if (row.builtIn === "astronaut") out.builtIn = "astronaut";
+    // ADR-157 §3: the generation its task token must carry.
+    if (typeof row.tokenGeneration === "string" && row.tokenGeneration.length > 0) {
+      out.tokenGeneration = row.tokenGeneration;
+    }
     return out;
   });
 }

package/src/protocol.ts

@@ -82,6 +82,14 @@ export type HostCommandResult<T> =
        * An unknown FIELD is ignored by old readers; an unknown CODE is not.
        */
       origin?: "cloud";
+      /**
+       * With `origin: "cloud"`: the protocol feature the command's payload
+       * needs and this runner does not advertise, so the bridge never sent it
+       * (ADR-157 §3: a roster with token generations needs
+       * `agent-token-generation-v1`). Additive for the same reason as
+       * `origin`; never set by a host.
+       */
+      requiresFeature?: string;
     };
 
 /** Capability ids shared by host advertisement and fail-closed cloud gates. */
@@ -156,6 +164,12 @@ export const HOST_ENGINE_ACCOUNT_SCOPES_PROTOCOL_FEATURE =
  * unrelated respawn and never stops a removed one, so the cloud refuses to
  * edit or remove a running task's agents on it. */
 export const LIVE_ROSTER_EDIT_PROTOCOL_FEATURE = "live-roster-edit-v1";
+/** ADR-157 §3: the host signs an agent's `tokenGeneration` into its task token
+ * (claim `g`). The cloud stamps a fresh generation on an agent that joins a
+ * running task only on a host advertising this, and refuses a token whose
+ * generation is not its roster entry's, so a token minted for an earlier agent
+ * under the same handle stays dead. */
+export const AGENT_TOKEN_GENERATION_PROTOCOL_FEATURE = "agent-token-generation-v1";
 /** ADR-153 declarations + owner bindings. Advertising this means the host
  * understands every additive env frame field, persists bindings separately
  * from values, and reports immutable repository schema observations. Keep it
@@ -2956,6 +2970,29 @@ export const MAX_HOST_TASK_INVENTORY_TASK_ID_CHARS = 128;
 export const ENROLLMENT_REPLAY_PROTOCOL_HEADER = "x-uai-enrollment-replay";
 export const ENROLLMENT_REPLAY_PROTOCOL_VERSION = "same-host-v1";
 export const COMMUNICATOR_EXECUTION_PROFILE = "communicator";
+/**
+ * ADR-157: the built-in Astronaut. An Astronaut task has exactly one lead agent with
+ * this id, marked `builtIn: "astronaut"` by the cloud when it builds the entry;
+ * no client may send the marker. The lead runs under the `astronaut` execution
+ * profile: normal tools, but no native subagents (Claude's Agent/Task, Codex's
+ * multi-agent), so every helper it uses is an accounted crew agent.
+ */
+export const ASTRONAUT_AGENT_ID = "astronaut";
+export const ASTRONAUT_BUILT_IN = "astronaut";
+export const ASTRONAUT_EXECUTION_PROFILE = "astronaut";
+
+/** Whether `agent` is this task's built-in Astronaut (ADR-157 §1). */
+export function isBuiltInAstronaut(
+  task: { mode?: string | null; secretaryAgentId?: string | null },
+  agent: { id: string; builtIn?: string | null } | null | undefined,
+): boolean {
+  return (
+    task.mode === "secretary" &&
+    task.secretaryAgentId === ASTRONAUT_AGENT_ID &&
+    agent?.id === ASTRONAUT_AGENT_ID &&
+    agent.builtIn === ASTRONAUT_BUILT_IN
+  );
+}
 export const MAX_AGENT_ID_CHARS = 128;
 export const MAX_SECRETARY_DISPATCH_RECIPIENTS = 16;
 export const MAX_SECRETARY_DISPATCH_INSTRUCTION_CHARS = 8_000;
@@ -3023,6 +3060,11 @@ export interface TaskAgent {
   }>;
   /** ADR-048: the source persona's flat permission list for the `uai` CLI. */
   permissions?: string[];
+  /** ADR-157: set by the cloud on the built-in Astronaut only. */
+  builtIn?: "astronaut";
+  /** ADR-157 §3: this agent's token generation, stamped by the cloud when it
+   *  joined the running task; signed into its task token as `g`. */
+  tokenGeneration?: string;
 }
 
 export type ContainerRuntimePreference = "auto" | "docker" | "apple-container";