@runuai/host 0.9.163 → 0.9.164

package/lib/agent-cli.ts

@@ -321,6 +321,7 @@ async function main() {
     const handleOf = (v) => (typeof v === "string" && v.startsWith("@") ? v.slice(1) : v);
     const launch = (a) => a.kind + (a.model ? "/" + a.model : "") + (a.effort ? "/" + a.effort : "");
     if (action === "list") { out(await api("GET", "/api/agent/crew")); return; }
+    if (action === "status") { out(await api("GET", "/api/agent/crew-status")); return; }
     if (action === "add") {
       const personaId = pos[0];
       if (!personaId || !flags.why) {
@@ -332,14 +333,15 @@ async function main() {
       if (flags.engine) body.kind = flags.engine;
       if (flags.model) body.model = flags.model;
       if (flags.effort) body.effort = flags.effort;
+      if (flags.account) body.account = flags.account === "default" ? null : flags.account;
       const r = await api("POST", "/api/agent/crew", body);
       out("added @" + r.agent.id + " (" + r.agent.label + ") on " + launch(r.agent) + ". It stays idle until you dispatch work to it.");
       return;
     }
     if (action === "model") {
       const id = handleOf(pos[0] || "");
-      if (!id || !flags.why || !(flags.model || flags.engine || flags.effort)) {
-        console.error('uai: crew model needs @agent, at least one of --engine, --model and --effort, and --why "<reason>"');
+      if (!id || !flags.why || !(flags.model || flags.engine || flags.effort || flags.account)) {
+        console.error('uai: crew model needs @agent, at least one of --engine, --model, --effort and --account, and --why "<reason>"');
         process.exit(1);
       }
       // "default" clears the setting back to the engine's own default (null).
@@ -348,6 +350,7 @@ async function main() {
       if (flags.engine) body.kind = flags.engine;
       if (flags.model) body.model = cleared(flags.model);
       if (flags.effort) body.effort = cleared(flags.effort);
+      if (flags.account) body.account = cleared(flags.account);
       const r = await api("PATCH", "/api/agent/crew/" + encodeURIComponent(id), body);
       out(r.changed
         ? "@" + id + " now runs on " + launch(r.agent) + "; its session restarts after its current turn"
@@ -364,7 +367,7 @@ async function main() {
       out("removed @" + id);
       return;
     }
-    console.error("uai: crew commands are list, add, model and remove (Astronaut only)");
+    console.error("uai: crew commands are list, status, add, model and remove (Astronaut only)");
     process.exit(1);
   }
   const key = group + " " + (action || "");
@@ -570,8 +573,9 @@ async function main() {
         "  uai task read <taskId>             (full chat of a past task you were on)",
         '  uai dispatch @agent [@agent…] "instruction"   (Secretary only)',
         "  uai crew list                      (Astronaut only: personas, engines, models, limits, roster)",
-        '  uai crew add <personaId> [--as <handle>] [--engine <kind>] [--model <m>] [--effort <e>] --why "<reason>"',
-        '  uai crew model @agent [--engine <kind>] [--model <m|default>] [--effort <e|default>] --why "<reason>"   (at least one of the three)',
+        "  uai crew status                    (Astronaut only: each agent's engine, model, account; account usage; credits)",
+        '  uai crew add <personaId> [--as <handle>] [--engine <kind>] [--model <m>] [--effort <e>] [--account <id|label|default>] --why "<reason>"',
+        '  uai crew model @agent [--engine <kind>] [--model <m|default>] [--effort <e|default>] [--account <id|label|default>] --why "<reason>"',
         '  uai crew remove @agent --why "<reason>"',
         "  uai react <heart|check|x> [--msg #id]   (no --msg = the message you were last handed)",
         "  uai whoami",

package/lib/agents/claude.ts

@@ -25,6 +25,7 @@ import { newId } from "../ulid";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { rateLimitErrorUsage, resetSecondsToEpochMs } from "./rate-limit";
 import { register } from "./registry";
+import { CLAUDE_MODELS } from "../../src/engine-models";
 import {
   DISPATCH_INPUT_SCHEMA,
   DISPATCH_RECIPIENT_ID_PATTERN,
@@ -49,7 +50,7 @@ import type {
 // resolves these aliases to the current dated snapshots, so this list is
 // stable across point releases. UPDATE WHEN MODELS CHANGE (new family or a
 // retired alias). Order is display order in the cloud picker.
-const CLAUDE_MODELS = ["fable", "opus", "sonnet", "haiku"];
+// The model list is host-agent/src/engine-models.ts (CLAUDE_MODELS).
 
 // Opus ("opus" alias = Opus 4.8) stays the default; "fable" (Claude
 // Fable 5, the Mythos-class flagship) is opt-in per agent. Update

package/lib/agents/codex.ts

@@ -42,6 +42,7 @@ import { attachCompatibilityKeysMatch } from "./attach-compatibility";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { rateLimitErrorUsage, resetSecondsToEpochMs } from "./rate-limit";
 import { register } from "./registry";
+import { CODEX_MODELS } from "../../src/engine-models";
 import type {
   AgentEvent,
   AgentAccountUsage,
@@ -51,23 +52,7 @@ import type {
   RosterAgent,
 } from "./types";
 
-// Codex model slugs accepted via `-c model=<slug>`. Hardcoded: Codex has no
-// machine-readable "list models" command — the canonical list is the
-// interactive `codex` model picker (and `codex -m <slug>` / config.toml).
-// Sourced from that picker; UPDATE WHEN MODELS CHANGE. Order = display order
-// in the cloud picker. Legacy models remain reachable via config.toml.
-const CODEX_MODELS = [
-  "gpt-6-astra",
-  "gpt-5.6-sol",
-  "gpt-5.6-terra",
-  "gpt-5.6-luna",
-  "gpt-5.5",
-  "gpt-5.4",
-  "gpt-5.4-mini",
-  "gpt-5.3-codex",
-  "gpt-5.3-codex-spark",
-  "gpt-5.2",
-];
+// The model list is host-agent/src/engine-models.ts (CODEX_MODELS).
 
 // gpt-5.6-sol is Codex's current frontier coding model (the CLI default).
 // Update alongside CODEX_MODELS. When an agent's model is null the adapter

package/lib/agents/grok.ts

@@ -43,6 +43,7 @@ import {
   type AgentEnvironmentProcess,
 } from "./proc";
 import { register } from "./registry";
+import { GROK_MODELS } from "../../src/engine-models";
 import type {
   AgentEvent,
   AgentEventHandler,
@@ -56,7 +57,7 @@ export const GROK_LOADER_LOGIN_ENV = "0";
 
 // `grok models` lists what the account can run. grok-4.5 is the current
 // default; UPDATE WHEN xAI CHANGES the lineup.
-const GROK_MODELS = ["grok-4.5"];
+// The model list is host-agent/src/engine-models.ts (GROK_MODELS).
 const GROK_DEFAULT_MODEL = "grok-4.5";
 // Grok has no per-invocation reasoning-effort flag.
 const GROK_EFFORTS: string[] = [];

package/lib/agents/types.ts

@@ -51,6 +51,13 @@ export const RosterAgent = z.object({
   kind: AgentKind,
   model: z.string().min(1).optional(),
   effort: z.string().min(1).optional(), // CLI reasoning level, passed through
+  // ADR-157 addendum §7: preferred cloud-leased AI account.
+  accountId: z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[A-Za-z0-9_.:-]+$/)
+    .optional(),
   defaultPrompt: z.string().optional(), // persona
   initialPrompt: z.string().optional(), // first-turn instructions, this task only
   skills: z.array(RosterSkill).optional(), // ADR-046 reference material

package/lib/engine-accounts.ts

@@ -558,7 +558,7 @@ export function noteEngineAccountUsed(id: string, now: number = Date.now()): voi
  */
 export function selectAccount(
   accounts: ResolvedEngineAccount[],
-  opts: { exclude?: Set<string>; now?: number } = {},
+  opts: { exclude?: Set<string>; now?: number; preferredId?: string } = {},
 ): ResolvedEngineAccount | null {
   const now = opts.now ?? Date.now();
   const exclude = opts.exclude ?? new Set<string>();
@@ -566,6 +566,10 @@ export function selectAccount(
   if (candidates.length === 0) return null;
   const lru = (a: ResolvedEngineAccount): number => state(a.id).lastUsedAt;
   const healthy = candidates.filter((a) => accountCooldownUntil(a.id) <= now);
+  const preferred = opts.preferredId
+    ? healthy.find((account) => account.id === opts.preferredId)
+    : undefined;
+  if (preferred) return preferred;
   // Manage-v1: the list arrives in PRIORITY order (default slot, then extras
   // by position) — the first healthy account wins, so the operator's
   // ordering decides which account a task uses and which are fallbacks.
@@ -585,6 +589,8 @@ export function pickEngineAccount(
     exclude?: Set<string>;
     seams?: Partial<AccountSeams>;
     now?: number;
+    /** One agent's durable preference; cooling or absent falls through. */
+    preferredId?: string;
     /** ADR-131 D3: the task's scope; default = the host's own accounts. */
     scope?: string;
   } = {},
@@ -594,7 +600,11 @@ export function pickEngineAccount(
     opts.seams ?? {},
     opts.scope ?? HOST_ACCOUNT_SCOPE,
   );
-  return selectAccount(accounts, { exclude: opts.exclude, now: opts.now });
+  return selectAccount(accounts, {
+    exclude: opts.exclude,
+    now: opts.now,
+    preferredId: opts.preferredId,
+  });
 }
 
 /**

package/lib/orchestrator.ts

@@ -166,6 +166,7 @@ import {
   selectAccount,
   type ResolvedEngineAccount,
 } from "./engine-accounts";
+import { buildEngineUsageFrame } from "../src/engine-usage";
 import {
   ENGINE_ACCOUNT_HOMES,
   EngineCredentialWriteRefused,
@@ -1746,11 +1747,19 @@ export class Orchestrator {
     channel: Channel,
     kind: string,
     exclude?: Set<string>,
+    preferredId?: string,
   ): ResolvedEngineAccount | null {
     if (!this.isLeasedChannel(channel)) {
-      return pickEngineAccount(kind, { scope: channel.engineAccountScope, exclude });
+      return pickEngineAccount(kind, {
+        scope: channel.engineAccountScope,
+        exclude,
+        preferredId,
+      });
     }
-    return selectAccount(this.engineAccounts(channel, kind), { exclude });
+    return selectAccount(this.engineAccounts(channel, kind), {
+      exclude,
+      preferredId,
+    });
   }
 
   private noteProvisionMutation(
@@ -2789,6 +2798,7 @@ export class Orchestrator {
     if (this.isLeasedChannel(channel)) return { ...floor, ...base };
     const account = pickEngineAccount(agent.kind, {
       scope: channel.engineAccountScope,
+      preferredId: agent.accountId,
     });
     if (!account) {
       channel.accountByAgent.delete(agent.id);
@@ -3381,8 +3391,14 @@ export class Orchestrator {
         account.engineKind === kind && isLeasedEngineAccount(account),
     );
     const bound = channel.accountByAgent.get(agentId);
+    const preferredId = channel.roster.find(
+      (candidate) => candidate.id === agentId,
+    )?.accountId;
     const kept = accounts.find((account) => account.credentialId === bound);
-    if (kept) return kept;
+    // Without a pin, preserve the live binding. With one, every fresh session
+    // re-evaluates it: a cooling/missing pin falls through now, and wins again
+    // automatically after its bench lifts.
+    if (!preferredId && kept) return kept;
     const picked = selectAccount(
       accounts.map((account) => ({
         id: account.credentialId,
@@ -3393,6 +3409,7 @@ export class Orchestrator {
         authKind: account.authKind,
         execEnv: {},
       })),
+      { preferredId },
     );
     return accounts.find((account) => account.credentialId === picked?.id);
   }
@@ -5002,6 +5019,24 @@ export class Orchestrator {
         if (!identity || identity.subject !== "account") break;
         const agent = channel.roster.find((candidate) => candidate.id === agentId);
         if (!agent || !isEngineUsageKind(agent.kind)) break;
+        // The session's own revision: a refreshed lease may already hold a
+        // newer one, and its variable name says nothing about this session.
+        const leasedAccount = leasedEnginesFor(channel.taskId)?.accounts.find(
+          (candidate): candidate is LeasedEngineAccount =>
+            candidate.credentialId === identity.credentialId &&
+            candidate.revision === identity.revision &&
+            isLeasedEngineAccount(candidate),
+        );
+        const frame = buildEngineUsageFrame({
+          reportId: newId(),
+          taskId: channel.taskId,
+          agentId,
+          engine: agent.kind,
+          credentialId: identity.credentialId,
+          revision: identity.revision,
+          usage: event.usage,
+          leasedAccount,
+        });
 
         const coverage = event.usage.coverage;
         if (event.usage.status === "limited") {
@@ -5048,6 +5083,8 @@ export class Orchestrator {
           taskId: channel.taskId,
           engine: agent.kind,
           credentialId: identity.credentialId,
+          billing: frame.billing,
+          revision: frame.revision,
           status: event.usage.status,
           resetsAt: event.usage.resetsAt,
           usingOverage: event.usage.usingOverage,
@@ -5062,24 +5099,7 @@ export class Orchestrator {
         ) {
           break;
         }
-        const delivered = this.emitEngineUsage({
-          kind: "engine.usage",
-          reportId: newId(),
-          taskId: channel.taskId,
-          agentId,
-          engine: agent.kind,
-          credentialId: identity.credentialId,
-          status: event.usage.status,
-          ...(event.usage.resetsAt === undefined
-            ? {}
-            : { resetsAt: event.usage.resetsAt }),
-          ...(event.usage.usingOverage === undefined
-            ? {}
-            : { usingOverage: event.usage.usingOverage }),
-          windows: event.usage.windows,
-          source: event.usage.source,
-          observedAt: event.usage.observedAt,
-        });
+        const delivered = this.emitEngineUsage(frame);
         // A disconnected bridge returns false. Do not suppress the next
         // identical observation unless this one actually reached the socket.
         if (delivered) {
@@ -5779,6 +5799,7 @@ export class Orchestrator {
       channel,
       agent.kind,
       current ? new Set([current]) : undefined,
+      agent.accountId,
     );
     if (!next) return false;
 
@@ -6646,6 +6667,9 @@ function rosterLaunchChangeReason(
   if (previous.kind !== next.kind) changed.push("engine");
   if ((previous.model ?? "") !== (next.model ?? "")) changed.push("model");
   if ((previous.effort ?? "") !== (next.effort ?? "")) changed.push("effort");
+  if ((previous.accountId ?? "") !== (next.accountId ?? "")) {
+    changed.push("account");
+  }
   // ADR-157 §3: the session holds a token minted for its generation, so a new
   // one is a new agent under the handle (or one an older cloud release lost),
   // and only a fresh launch carries a token the cloud accepts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.163",
+  "version": "0.9.164",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",
@@ -72,6 +72,14 @@
     "./project-env-wording": {
       "types": "./src/project-env-wording.ts",
       "default": "./src/project-env-wording.ts"
+    },
+    "./engine-models": {
+      "types": "./src/engine-models.ts",
+      "default": "./src/engine-models.ts"
+    },
+    "./engine-usage": {
+      "types": "./src/engine-usage.ts",
+      "default": "./src/engine-usage.ts"
     }
   },
   "scripts": {

package/src/engine-models.ts

@@ -0,0 +1,31 @@
+/**
+ * The models each engine adapter offers, by the id the runner passes its
+ * CLI: one list per engine, read by the adapters (`supportedModels`) and by
+ * the cloud's model guide (lib/model-guide.ts), whose test fails when a model
+ * here has no guide entry. Pure data: no runtime imports.
+ */
+
+// Claude Code's aliases, which follow its own model table (2.1.307:
+// fable = Claude Fable 5.1, opus = Opus 5.5, sonnet = Sonnet 5.5,
+// haiku = Haiku 5.5). Update alongside the CLI.
+export const CLAUDE_MODELS: readonly string[] = ["fable", "opus", "sonnet", "haiku"];
+
+// Codex model slugs accepted via `-c model=<slug>`. Hardcoded: Codex has no
+// machine-readable "list models" command — the canonical list is the
+// interactive `codex` model picker (and `codex -m <slug>` / config.toml).
+// Sourced from that picker; UPDATE WHEN MODELS CHANGE. Order = display order
+// in the cloud picker. Legacy models remain reachable via config.toml.
+export const CODEX_MODELS: readonly string[] = [
+  "gpt-6-astra",
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+  "gpt-5.4",
+  "gpt-5.4-mini",
+  "gpt-5.3-codex",
+  "gpt-5.3-codex-spark",
+  "gpt-5.2",
+];
+
+export const GROK_MODELS: readonly string[] = ["grok-4.5"];

package/src/engine-usage.ts

@@ -0,0 +1,104 @@
+/**
+ * Build the secret-free account usage report sent to Uai Cloud.
+ *
+ * A leased env account carries both a variable name and its secret value in
+ * runner memory. Billing is deliberately inferred from the NAME alone. Some
+ * file-backed accounts use the same `auth.json` name for a subscription and
+ * an API key, so they carry no hint.
+ *
+ * The hint names the revision it was read from, and is given only when that is
+ * the revision the reporting session runs on: after a re-paste, a lease
+ * refresh can hand the runner newer material than an agent is still using.
+ */
+
+import type { EngineUsageFrame, EngineUsageWindow } from "./protocol";
+
+type EngineUsageBilling = NonNullable<EngineUsageFrame["billing"]>;
+
+export interface LeasedBillingAccount {
+  credentialId: string;
+  revision: string;
+  engineKind: string;
+  authKind: "env" | "config-dir";
+  env: Readonly<Record<string, string>> | null;
+}
+
+export interface EngineUsageObservation {
+  status: EngineUsageFrame["status"];
+  resetsAt?: number;
+  usingOverage?: boolean;
+  windows: EngineUsageWindow[];
+  source: EngineUsageFrame["source"];
+  observedAt: number;
+}
+
+const BILLING_BY_VARIABLE: Readonly<
+  Record<string, Readonly<Record<string, EngineUsageBilling>>>
+> = Object.freeze({
+  claude: Object.freeze({
+    // Capture files every pasted Claude secret that is NOT `sk-ant-api…` under
+    // this name (engine-accounts.ts `pastedSecretMaterial`), so the name alone
+    // also covers a token whose prefix told capture nothing, which the cloud
+    // left unknown. Subscription is still right for a report: usage is read
+    // from a session that worked, and Claude Code authenticates this variable
+    // only as an OAuth (subscription) token, so a session that ran on it was
+    // one. Do not "correct" it to unknown.
+    CLAUDE_CODE_OAUTH_TOKEN: "subscription",
+    ANTHROPIC_API_KEY: "api-key",
+  }),
+  cursor: Object.freeze({ CURSOR_API_KEY: "api-key" }),
+  grok: Object.freeze({ XAI_API_KEY: "api-key" }),
+});
+
+/** The billing lane when one leased variable name tells it unambiguously. */
+export function billingFromLeasedVariableName(
+  account: LeasedBillingAccount | null | undefined,
+): EngineUsageBilling | undefined {
+  if (!account || account.authKind !== "env" || account.env === null) {
+    return undefined;
+  }
+  const names = Object.keys(account.env);
+  if (names.length !== 1) return undefined;
+  return BILLING_BY_VARIABLE[account.engineKind]?.[names[0]!];
+}
+
+/** Construct the exact wire frame for one adapter usage observation.
+ *  `revision` is the one the reporting session runs on; a leased account at
+ *  any other revision gives no hint. */
+export function buildEngineUsageFrame(input: {
+  reportId: string;
+  taskId: string;
+  agentId: string;
+  engine: EngineUsageFrame["engine"];
+  credentialId: string;
+  revision?: string;
+  usage: EngineUsageObservation;
+  leasedAccount?: LeasedBillingAccount | null;
+}): EngineUsageFrame {
+  const { usage } = input;
+  const account =
+    input.revision !== undefined &&
+    input.leasedAccount?.credentialId === input.credentialId &&
+    input.leasedAccount.revision === input.revision &&
+    input.leasedAccount.engineKind === input.engine
+      ? input.leasedAccount
+      : null;
+  const billing = billingFromLeasedVariableName(account);
+  return {
+    kind: "engine.usage",
+    reportId: input.reportId,
+    taskId: input.taskId,
+    agentId: input.agentId,
+    engine: input.engine,
+    credentialId: input.credentialId,
+    ...(billing === undefined ? {} : { billing, revision: account!.revision }),
+    status: usage.status,
+    ...(usage.resetsAt === undefined ? {} : { resetsAt: usage.resetsAt }),
+    ...(usage.usingOverage === undefined
+      ? {}
+      : { usingOverage: usage.usingOverage }),
+    windows: usage.windows,
+    source: usage.source,
+    observedAt: usage.observedAt,
+  };
+}

package/src/main.ts

@@ -5536,6 +5536,14 @@ function expectTaskAgents(value: unknown): TaskAgent[] {
     // effort was previously dropped here even though the protocol + adapters
     // carry it — fixed alongside skills (ADR-046).
     if (typeof row.effort === "string") out.effort = row.effort;
+    if (
+      typeof row.accountId === "string" &&
+      row.accountId.length > 0 &&
+      row.accountId.length <= 128 &&
+      /^[A-Za-z0-9_.:-]+$/.test(row.accountId)
+    ) {
+      out.accountId = row.accountId;
+    }
     if (row.uaiProvider === "anthropic" || row.uaiProvider === "openai") {
       out.uaiProvider = row.uaiProvider;
     }

package/src/protocol.ts

@@ -194,6 +194,14 @@ export interface EngineUsageFrame {
   engine: "claude" | "codex" | "grok" | "cursor" | "opencode";
   /** The `uai_credentials` id the agent's session runs on. */
   credentialId: string;
+  /** How this account is paid for, when the leased variable's NAME tells the
+   *  runner unambiguously. Derived only from that name, never from its value. */
+  billing?: "subscription" | "api-key";
+  /** The credential revision whose variable name gave `billing`: the one the
+   *  agent's session runs on. Sent only with `billing`; an id, not a secret.
+   *  The cloud records the hint only while this is still the account's active
+   *  revision, so a task on an older lease cannot describe newer material. */
+  revision?: string;
   /** `allowed`: working; `warning`: the engine says it is close to a limit;
    *  `limited`: cut off until `resetsAt` (or an unknown time). */
   status: "allowed" | "warning" | "limited";
@@ -3121,6 +3129,8 @@ export interface TaskAgent {
   kind: string;
   model?: string;
   effort?: string;
+  /** ADR-157 addendum §7: preferred cloud-leased AI account. */
+  accountId?: string;
   defaultPrompt?: string;
   initialPrompt?: string;
   /** ADR-046 reference material resolved from the agent's persona + team.