@runuai/host 0.9.160 → 0.9.162

package/lib/agent-cli.ts

@@ -183,11 +183,15 @@ export async function writeAgentCliViaEnvironment(
 
 /**
  * Per-agent env for the `docker exec` that spawns one agent (ADR-048): its OWN
- * task token (carrying only ITS permissions) + the API url. Empty when the agent
- * has no permissions (or no owner/url) — unless `allowPermissionless` is set
- * for the designated Secretary, whose dispatch route is role-gated rather than
- * permission-gated. That token still carries an empty permission set and
- * cannot borrow anyone else's powers.
+ * task token (carrying only ITS permissions) + the API url. Every agent gets
+ * one, permissions or not: it is the agent's identity — the Uai Managed
+ * Engine's gateway authenticates and bills by it (ADR-128), and the
+ * Secretary's dispatch is role-gated on it. Until 2026-10-20 an agent with no
+ * CLI permissions got none, so such a persona could not run on the managed
+ * engine at all. An empty-permission token cannot borrow anyone else's powers:
+ * every permissioned route refuses it, and the self-scoped ones
+ * (`requireAnyPersonaPermission`) do too. Empty only when the task has no
+ * owner, API url or CLI secret.
  */
 export function agentCliEnv(
   taskId: string,
@@ -195,18 +199,10 @@ export function agentCliEnv(
   ownerUserId: string | null,
   apiUrl: string | null,
   cliSecret: string | null,
-  allowPermissionless = false,
 ): Record<string, string> {
   const runtimeAuthority = { ...AGENT_RUNTIME_AUTHORITY_ENV };
   const permissions = agent.permissions ?? [];
-  if (
-    !ownerUserId ||
-    !apiUrl ||
-    !cliSecret ||
-    (permissions.length === 0 && !allowPermissionless)
-  ) {
-    return runtimeAuthority;
-  }
+  if (!ownerUserId || !apiUrl || !cliSecret) return runtimeAuthority;
   return {
     ...runtimeAuthority,
     UAI_TASK_TOKEN: signTaskToken(
@@ -498,7 +494,22 @@ async function main() {
       const port = Number(pos[1] || flags.port);
       if (!name || !Number.isInteger(port)) { console.error("uai: preview add <name> <containerPort>"); process.exit(1); }
       const r = await api("POST", "/api/agent/previews", { name, containerPort: port });
-      out("preview '" + r.name + "' on port " + r.containerPort + " — enable it in the task's preview menu to get a URL");
+      out("preview '" + r.name + "' on port " + r.containerPort + " — turn it on with: uai preview enable " + r.name);
+      break;
+    }
+    case "preview enable":
+    case "preview disable":
+    case "preview public":
+    case "preview private": {
+      const name = pos[0] || flags.name;
+      if (!name) { console.error("uai: preview " + action + " <name>"); process.exit(1); }
+      const body = action === "enable" || action === "disable"
+        ? { enabled: action === "enable" }
+        : { public: action === "public" };
+      const r = await api("PATCH", "/api/agent/previews/" + encodeURIComponent(name), body);
+      const state = (r.enabled ? "on" : "off") + ", " + (r.public ? "public (anyone with the link)" : "private (sign-in)");
+      out("preview '" + r.name + "' is " + state + (r.url ? " — " + r.url : ""));
+      if (!r.enabled && r.public) console.error("uai: it's public but off — it serves nothing until: uai preview enable " + r.name);
       break;
     }
     case "project create": {
@@ -551,6 +562,8 @@ async function main() {
         "  uai todo remove <#id>",
         "  uai todo claim|done|reopen|unclaim <#id>",
         "  uai preview add <name> <containerPort>",
+        "  uai preview enable|disable <name>      (turn it on; prints its URL)",
+        "  uai preview public|private <name>      (public: a link anyone can open)",
         "  uai project create --name <n> --repo <git-url> [--prompt <p>]",
         "  uai task search <query>            (your own past tasks)",
         "  uai task history                   (list your past tasks)",

package/lib/agent.ts

@@ -157,6 +157,13 @@ const TaskUpData = z.object({
 export type TaskUpResult = z.infer<typeof TaskUpData>;
 
 // task-down
+/** task-down.sh destroys the task's runtime AND its directory (worktree +
+ *  task-private Git data), so it refuses without this explicit terminal
+ *  intent. Only the cloud taskDown reaches these two calls: the handler in
+ *  src/index.ts, and a credential cleanup under that same command
+ *  (`reason: "teardown"`, task-credential-cleanup.ts). */
+const TASK_DOWN_TERMINAL_ENV = Object.freeze({ UAI_TASK_DOWN_TERMINAL: "1" });
+
 const TaskDownData = z
   .object({
     status: z.string().optional(),
@@ -598,6 +605,7 @@ export const agent = {
         [input.taskId],
         TaskDownData,
         commandDbPath,
+        TASK_DOWN_TERMINAL_ENV,
       );
     } finally {
       removeCommandDb(commandDbPath);
@@ -617,6 +625,7 @@ export const agent = {
         [taskId],
         TaskDownData,
         commandDbPath,
+        TASK_DOWN_TERMINAL_ENV,
       );
     } finally {
       removeCommandDb(commandDbPath);

package/lib/agents/uai.ts

@@ -93,11 +93,10 @@ const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession
   }
   const taskToken = args.agentEnv?.UAI_TASK_TOKEN;
   if (!taskToken) {
-    // agentCliEnv mints no token for a permissionless non-secretary agent;
-    // the gateway authenticates with exactly that token, so the engine
-    // needs it. The default crew grants permissions, so this is rare.
+    // agentCliEnv mints one for every managed-engine agent, permissions or
+    // not; none here means the task has no owner, API url or CLI secret.
     throw new Error(
-      "uai engine: this agent has no task token (no CLI permissions) — grant it at least one permission or use a direct engine",
+      "uai engine: this agent has no task token (the task has no CLI identity yet) — restart the task",
     );
   }
   return delegate.create({

package/lib/managed-runtime.ts

@@ -1004,6 +1004,11 @@ async function managedInstallState(paths: ManagedRuntimePaths): Promise<ManagedI
   ] as const) {
     try {
       await lstat(state);
+      // ensureManagedDirectories (a capability-floor claim) creates the bare
+      // runtime directory on an npm install too. Empty, it holds no
+      // generation: still no managed install. Every npm-installed task
+      // machine sat pending on this (2026-10-20).
+      if (state === paths.runtime && (await readdir(state)).length === 0) continue;
       return { kind: "damaged", detail: `the managed runtime has a ${what} but no current runtime; repair it first` };
     } catch (error) {
       if (!isMissing(error)) throw error;

package/lib/orchestrator.ts

@@ -2595,7 +2595,6 @@ export class Orchestrator {
                   task.ownerUserId,
                   apiUrl,
                   cliSecret,
-                  this.isPromptLevelSecretary(channel, agent.id),
                 ),
                 task,
               ),
@@ -4371,7 +4370,6 @@ export class Orchestrator {
                 task.ownerUserId,
                 apiUrl,
                 cliSecret,
-                this.isPromptLevelSecretary(channel, agent.id),
               ),
               task,
             ),
@@ -5488,7 +5486,6 @@ export class Orchestrator {
         task.ownerUserId,
         apiUrl,
         cliSecret,
-        this.isPromptLevelSecretary(channel, agent.id),
       );
       const boundAccountId = channel.accountByAgent.get(agentId);
       const boundAccount = boundAccountId
@@ -5698,7 +5695,6 @@ export class Orchestrator {
         task.ownerUserId,
         apiUrl,
         cliSecret,
-        this.isPromptLevelSecretary(channel, agent.id),
       );
       channel.accountByAgent.set(agentId, next.id);
       noteEngineAccountUsed(next.id);
@@ -5908,7 +5904,6 @@ export class Orchestrator {
         task.ownerUserId,
         apiUrl,
         cliSecret,
-        this.isPromptLevelSecretary(channel, agent.id),
       );
       channel.accountByAgent.set(agentId, account.id);
       noteEngineAccountUsed(account.id);
@@ -7280,7 +7275,7 @@ export function buildSystemPreamble(
               ? ", `todo list|add|edit|remove|claim|done`"
               : "") +
             (agent.permissions?.includes("previews.write")
-              ? ", `preview add <name> <port>`"
+              ? ", `preview add|enable|public <name>`"
               : "") +
             (agent.permissions?.includes("projects.write")
               ? ", `project create --name --repo`"
@@ -7355,8 +7350,10 @@ export function buildSystemPreamble(
           ...(agent.permissions?.includes("previews.write")
             ? [
                 "**Previews:** started a dev server? `preview add <name>",
-                "<containerPort>` exposes it so the human can open it (they",
-                "enable it from the task's preview menu).",
+                "<containerPort>` registers it, then `preview enable <name>` turns",
+                "it on and prints its URL: give that URL to the humans. It needs",
+                "a sign-in; `preview public <name>` makes the task's previews",
+                "a link anyone can open — only when a human asks for that.",
               ]
             : []),
           "",

package/lib/standard-image-pin.ts

@@ -22,8 +22,11 @@ import { join } from "node:path";
 /** Image label carrying the build-context content hash (rebuild trigger). */
 export const CONTEXT_HASH_LABEL = "com.runuai.context-hash";
 
-/** The public registry repository CI publishes the prebuilt image to. */
-export const STANDARD_IMAGE_RELEASE_REF = "ghcr.io/runuai/uai-standard";
+/** The public registry repository CI publishes the prebuilt image to. The
+ * GitHub org was renamed runuai → moondeckio on 2026-10-20; GHCR, unlike
+ * github.com, does not redirect the old owner (pushes fail "owner not
+ * found", pulls 404). */
+export const STANDARD_IMAGE_RELEASE_REF = "ghcr.io/moondeckio/uai-standard";
 
 /** Pin file basename; packaged at `agent/images/<basename>` in the payload,
  * one directory above the build context so it never perturbs the hash. */

package/lib/task-credential-cleanup.ts

@@ -64,7 +64,8 @@ export interface TaskCredentialCleanupDeps {
   db?: Db;
   hooks: TaskCredentialCleanupHooks;
   removePath?: (row: HostCredentialCleanupPath) => Promise<void>;
-  /** Full cleanup only: destroy one exact runtime and prove it absent. */
+  /** Full cleanup under the cloud's taskDown (`reason: "teardown"`) only:
+   *  destroy one exact runtime and prove it absent. */
   destroyRuntime?: (request: {
     taskId: string;
     runEpoch: number;
@@ -464,9 +465,18 @@ export class TaskCredentialCleanupCoordinator {
     }
 
     // A whole-task cleanup may prove absence by destroying the exact writable
-    // runtime instead. Selective removal must never take this broader action.
+    // runtime instead, but ONLY inside the cloud's taskDown of this run (the
+    // durable reason `teardown` has no other source). Every other cleanup —
+    // boot recovery, a fence escalation, stop, park, assignment — defers: the
+    // gate stays closed, the pending witness and inventory rows stay, and the
+    // registry's retry tries the exact paths again later. A failed exec is
+    // not proof of absence; Docker briefly gone (an OrbStack update,
+    // 2026-10-20) once turned this fallback into task-down.sh on every live
+    // task, deleting their worktrees. Selective removal must never take this
+    // broader action either.
     if (
       !consumersFailed &&
+      request.reason === "teardown" &&
       request.credentialIds === undefined &&
       failed.length > 0
     ) {

package/lib/task-environment/machine-task-up.ts

@@ -1015,7 +1015,8 @@ export function createMachineHostTaskEnvironmentProvider(
           // timeouts bound the wait). A teardown left for later could take a
           // replacement, which reuses the task's machine name.
           const late = await provisioning.catch(() => null);
-          if (late) await late.handle.teardown().catch(() => {});
+          // A reused machine holds the task's work: stopped, never destroyed.
+          if (late) await (late.reused ? late.handle.stop() : late.handle.teardown()).catch(() => {});
         }
         throw error;
       }
@@ -1043,7 +1044,10 @@ export function createMachineHostTaskEnvironmentProvider(
       const abandon = (): Promise<void> => {
         over = true;
         abandoning ??= (async () => {
-          await handle.teardown().catch(() => {});
+          // Only a machine this start launched is destroyed. One it reused (a
+          // Resume of a stopped machine) holds the task's work on its disk, so
+          // a failed start stops it again and the next Resume tries afresh.
+          await (provisioned.reused ? handle.stop() : handle.teardown()).catch(() => {});
           await joinBounded(begun, deps.abandonJoinMs ?? ABANDON_JOIN_MS);
         })();
         return abandoning;

package/lib/task-environment/machine.ts

@@ -862,6 +862,7 @@ export function createMachineTaskEnvironmentProvider(
           `machine ${machineId} state is unknown: ${existing.detail ?? "no detail"}`,
         );
       }
+      const reused = existing.state !== "absent";
       if (existing.state === "absent") {
         const launched = await deps.machines.launch({
           taskId,
@@ -935,7 +936,7 @@ export function createMachineTaskEnvironmentProvider(
           );
         }
       }
-      return { handle, result: handle.descriptor };
+      return { handle, result: handle.descriptor, reused };
     },
 
     async reconstruct(

package/lib/task-environment/types.ts

@@ -349,6 +349,10 @@ export interface TaskEnvironmentProvisioned<TResult, TTeardownResult = void> {
   handle: TaskEnvironmentHandle<TTeardownResult>;
   /** Provider launch result retained for rolling wire compatibility. */
   result: TResult;
+  /** The provider reused an environment that already existed — a Resume's
+   *  stopped machine, whose disk holds the task's work — rather than creating
+   *  it. A failed start stops such an environment; it never destroys it. */
+  reused?: boolean;
 }
 
 export interface TaskEnvironmentProvider<

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.160",
+  "version": "0.9.162",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-down.sh

@@ -5,6 +5,13 @@
 # 2. rm -rf the whole task dir — workspace + task-private Git repositories.
 #    Host caches under projects/<id>/host-cache.git persist.
 # 3. Persist final state: status=killed (unless already error/shipped).
+#
+# Destruction needs explicit terminal intent: the runner sets
+# UAI_TASK_DOWN_TERMINAL=1 only on the cloud taskDown path (a task close or
+# orphan GC). Without it the script refuses before touching Docker or disk —
+# a stray caller (recovery, a credential-cleanup fallback, an operator
+# running the script by hand) must never delete a live task's worktree
+# (2026-10-20: a cleanup fallback did, while Docker was briefly gone).
 
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -20,6 +27,12 @@ if [ "${#task_id}" -gt 128 ] ||
    [[ ! "$task_id" =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then
   emit_err "BAD_ARGS" "invalid task id" "task identity validation"
 fi
+# Before UAI_TASK_ID is set: a refusal must not mark the live task errored.
+if [ "${UAI_TASK_DOWN_TERMINAL:-}" != "1" ]; then
+  emit_err "BAD_ARGS" \
+    "task-down requires terminal intent (UAI_TASK_DOWN_TERMINAL=1, set only by the cloud taskDown); refusing to destroy task $task_id" \
+    "terminal intent"
+fi
 UAI_TASK_ID="$task_id"
 setup_err_trap
 validate_task_runtime_selection

package/scripts/agent/task-up.sh

@@ -1453,9 +1453,39 @@ while IFS= read -r project_obj; do
       git_host_control -C "$worktree_repo_dir" worktree repair \
         "$worktree_target" 2>/dev/null || true
     fi
+  elif [ -n "$task_branch" ] && [ "$task_branch" != "null" ] \
+       && [ "$task_branch" != "$project_default" ] \
+       && ! git_host_control -C "$worktree_repo_dir" rev-parse --verify --quiet \
+            "refs/heads/$task_branch" >/dev/null 2>&1 \
+       && git_host_control -C "$worktree_repo_dir" rev-parse --verify --quiet \
+            "refs/remotes/origin/$task_branch^{commit}" >/dev/null 2>&1; then
+    # The worktree is gone but the task's branch is on the remote (a lost
+    # task directory, 2026-10-20: Resume rebuilt from the base, putting the
+    # agents on the wrong code with the pushed commits out of sight). The
+    # fetch above is fresh — a missing worktree makes a failed fetch fatal —
+    # so continue from the pushed branch, never the base.
+    step "WORKTREE_FAILED" "git worktree add from origin/$task_branch ($project_id)"
+    log "worktree for $project_slug missing — restoring it from origin/$task_branch"
+    # The base this task branched from, as nearly as the remote can tell:
+    # where the task branch leaves the default branch.
+    env_schema_oid=$(git_host_control -C "$mirror_dir" merge-base \
+      "refs/remotes/origin/$task_branch" "refs/remotes/origin/$project_default" \
+      2>/dev/null || true)
+    if [ -n "$env_schema_oid" ]; then
+      record_env_schema_base "$project_id" "oid $env_schema_oid" \
+        || log "warning: could not record the .env.schema base for $project_id; its keys without a binding are withheld"
+    fi
+    # --no-track: the sanitizer above already wrote this branch's upstream.
+    if ! git_host_control -C "$worktree_repo_dir" worktree add --no-track \
+      "$worktree_target" -b "$task_branch" "refs/remotes/origin/$task_branch"; then
+      emit_err "WORKTREE_FAILED" \
+        "could not restore the task worktree from origin/$task_branch for $repo_url" \
+        "git worktree add from origin/$task_branch ($project_id)"
+    fi
   elif git_host_control -C "$worktree_repo_dir" rev-parse --verify --quiet \
        "refs/remotes/origin/$project_default" >/dev/null 2>&1; then
     # Normal case: branch the task worktree off origin/<defaultBranch>.
+    # Only when the remote has no branch of this task's yet.
     step "WORKTREE_FAILED" "git worktree add ($project_id)"
     # The same commit the task repository just copied, read where the task
     # never writes: the host cache, under this project's lock.