@runuai/host 0.9.157 → 0.9.159

package/lib/orchestrator.ts

@@ -9374,10 +9374,54 @@ async function recoverPersistedTaskEnvironment(
     return result.outcome === "recovered";
   } catch (error) {
     if (tunnelReadinessFailed) return false;
+    if (error instanceof TaskRecoveryRowConflictError && isCurrent()) {
+      return quarantineConflictingTask(task, environment, error, isCurrent, lifecycle);
+    }
     throw error;
   }
 }
 
+/** A durable row the provider can never reconcile with its locator. Retrying
+ * cannot change the verdict, so the sweep must not treat it as an unknown
+ * runtime state: that kept the whole runtime in checking, retrying every
+ * ~50 s, while one task's row was wrong (2026-10-19). */
+export class TaskRecoveryRowConflictError extends Error {
+  override name = "TaskRecoveryRowConflictError";
+}
+
+/** Settle one task whose row conflicts with its locator without holding the
+ * runtime: drain its consumers, stop the locator's environment, and mark the
+ * row `error` so the task reads as failed rather than running. Only a stop
+ * that cannot be proven throws on, keeping the sweep unresolved, because
+ * then the runtime state really is unknown. Resume or Destroy clears it. */
+async function quarantineConflictingTask(
+  task: typeof schema.hostTasks.$inferSelect,
+  environment: TaskEnvironmentHandle<unknown>,
+  conflict: TaskRecoveryRowConflictError,
+  isCurrent: () => boolean,
+  lifecycle?: Orchestrator,
+): Promise<boolean> {
+  await lifecycle?.quarantineChannelForRecovery(task.taskId);
+  if (!isCurrent()) return true;
+  await environment.stop();
+  const after = await environment.status();
+  if (!isCurrent()) return true;
+  if (after.state === "running" || after.state === "unknown") {
+    throw new Error(
+      `${conflict.message}, and its environment could not be proven stopped`,
+    );
+  }
+  db_setStatus(task.taskId, "error", {
+    codeServerPort: null,
+    previewPorts: "[]",
+  });
+  clearTaskGatewayAcl(task.taskId);
+  console.error(
+    `[orchestrator] recovery: ${task.taskId} quarantined: ${conflict.message}; its environment was stopped and the task marked error so the runtime can go operational`,
+  );
+  return true;
+}
+
 interface RecoveryTaskConsumers {
   quarantineChannelForRecovery(taskId: string): Promise<void>;
   prepareChannelForRecovery(taskId: string): Promise<void>;
@@ -10020,23 +10064,28 @@ async function recoverDockerTaskEnvironment(
   if (!task || !task.statusMirror || !isActive(task.statusMirror)) {
     return { outcome: "recovered" };
   }
-  const isPreparedRow =
-    (task.statusMirror === "starting" || task.statusMirror === "error") &&
-    task.composeProject === null &&
-    task.worktreePath === null;
+  // A starting/error row may hold only part of its legacy mirrors: a crash
+  // before task-up finished leaves both NULL, and a start that failed after
+  // an earlier recovery settled the row half-written leaves compose_project
+  // set with worktree_path NULL (live 2026-10-19: one such row held the
+  // whole runtime in checking for 2.5 h). Each mirror present must still
+  // equal the locator; a missing one is adopted from it.
+  const mayAdoptLocator =
+    task.statusMirror === "starting" || task.statusMirror === "error";
+  const mirrorAgrees = (mirror: string | null, expected: string): boolean =>
+    mirror === expected || (mayAdoptLocator && mirror === null);
   if (
-    !isPreparedRow &&
-    (task.composeProject !== locator.composeProject ||
-      task.worktreePath !== locator.hostWorktreePath)
+    !mirrorAgrees(task.composeProject, locator.composeProject) ||
+    !mirrorAgrees(task.worktreePath, locator.hostWorktreePath)
   ) {
-    throw new Error(
+    throw new TaskRecoveryRowConflictError(
       `task ${descriptor.taskId} environment locator no longer matches its durable row`,
     );
   }
   // Provider-owned provisional metadata is authoritative after a crash. Feed
   // the already-validated deterministic values to the Docker-private repair
   // helpers without teaching the generic sweep how to derive them.
-  const recoveryTask = isPreparedRow
+  const recoveryTask = mayAdoptLocator
     ? {
         ...task,
         composeProject: locator.composeProject,
@@ -10147,7 +10196,13 @@ async function recoverOneDockerTask(
     db_setStatus(task.taskId, next, {
       codeServerPort: null,
       previewPorts: "[]",
-      composeProject: next === "error" ? null : composeProject,
+      // A prepared row reaches here with both mirrors adopted from its
+      // locator: write them back as a pair. Writing compose_project alone
+      // left a stopped row whose next failed Resume became the half-written
+      // error row of 2026-10-19.
+      ...(next === "error"
+        ? { composeProject: null }
+        : { composeProject, worktreePath: task.worktreePath }),
     });
     console.log(
       `[orchestrator] recovery: ${task.taskId} -> ${next} (container gone, ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.157",
+  "version": "0.9.159",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -773,9 +773,13 @@ const credentialsActivation = new CredentialsActivationAuthority<CredentialsReti
   log: (line) => console.warn(line),
 });
 setCredentialsModeSource(() => credentialsActivation.mode());
-/** ADR-154 §13: how often a runner not yet on cloud credentials asks again,
- *  so the operator turning them on reaches it within minutes. */
+/** ADR-154 §13: the steady/operator cadence. Active runners report their
+ * purge again here too, so keep it deliberately quiet. */
 const CREDENTIALS_ACTIVATION_RETRY_MS = 5 * 60_000;
+/** A newly assigned marked machine is already behind its floor. Retry a
+ * transient freshness/Files proof inside Cloud's boot budget, without making
+ * its eventual active purge report a five-second heartbeat. */
+const TASK_MACHINE_CREDENTIALS_ACTIVATION_RETRY_MS = 5_000;
 const CREDENTIALS_ACTIVATION_ANSWER_MS = 60_000;
 // Started here, first fired long after the bridge's state exists.
 const credentialsActivationTimer = setInterval(() => {
@@ -788,6 +792,18 @@ const credentialsActivationTimer = setInterval(() => {
   void credentialsActivation.advance();
 }, CREDENTIALS_ACTIVATION_RETRY_MS);
 credentialsActivationTimer.unref?.();
+const taskMachineCredentialsActivationTimer =
+  taskMachineCredentialsRequired && sidecarTaskId() !== null
+    ? setInterval(() => {
+        if (
+          stopping ||
+          !credentialFramesReady ||
+          credentialsMode() !== "pending"
+        ) return;
+        void credentialsActivation.advance();
+      }, TASK_MACHINE_CREDENTIALS_ACTIVATION_RETRY_MS)
+    : null;
+taskMachineCredentialsActivationTimer?.unref?.();
 
 const credentialsActivationAsks = new Map<
   string,