@runuai/host 0.9.170 → 0.9.172

package/lib/custom-connection-launch.ts

@@ -0,0 +1,299 @@
+/** ADR-164: compile one validated, hard-pinned connection into a CLI launch.
+ * Only the runner calls these builders. No caller may supply arbitrary TOML,
+ * environment keys, credential-helper commands or a second destination. */
+import { createHash } from "node:crypto";
+
+import {
+  customConnectionEnabled,
+  isCustomConnectionReason,
+  parseCustomConnectionLease,
+  parseCustomConnectionMaterial,
+  validConnectionModels,
+  type CustomConnectionCombination,
+  type CustomConnectionLease,
+  type CustomConnectionMaterial,
+  type CustomConnectionReason,
+} from "../src/custom-connections";
+import { isOwnedInternalConnectionRuntime } from "./internal-connections";
+import { isPublicAddress, isInternalConnectionAddress } from "./secrets-proxy/address";
+
+export class CustomConnectionLaunchError extends Error {
+  constructor(readonly reason: CustomConnectionReason) {
+    super(reason);
+    this.name = "CustomConnectionLaunchError";
+  }
+}
+
+/** JSON string escaping is also valid for TOML basic string values. Never
+ * interpolate an unquoted model id, URL or label into a -c argument. */
+export function tomlString(value: string): string {
+  return JSON.stringify(value).replace(/\u007f/g, "\\u007f");
+}
+
+/** A native account must not inherit a previous connection's route, token or
+ * model aliases. Native credentials are applied AFTER these blanks. AWS's
+ * ordinary identity is isolated below only for a connection launch. */
+const CONNECTION_ENV_NAMES = [
+  "ANTHROPIC_BASE_URL", "ANTHROPIC_CUSTOM_HEADERS", "ANTHROPIC_MODEL",
+  "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST",
+  "ANTHROPIC_DEFAULT_MODEL", "ANTHROPIC_DEFAULT_FABLE_MODEL",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL", "ANTHROPIC_SMALL_FAST_MODEL",
+  "ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION", "CLAUDE_CODE_SUBAGENT_MODEL",
+  "CLAUDE_CODE_SUBAGENT_MODEL_FORCE", "CLAUDE_CODE_EXTRA_BODY",
+  "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_MANTLE", "CLAUDE_CODE_USE_GATEWAY",
+  "CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD", "CLAUDE_CODE_API_BASE_URL",
+  "ANTHROPIC_UNIX_SOCKET", "_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL",
+  "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY",
+  "CLAUDE_CODE_USE_ANTHROPIC_AWS", "CLAUDE_CODE_SKIP_BEDROCK_AUTH",
+  "CLAUDE_CODE_SKIP_MANTLE_AUTH", "CLAUDE_CODE_SKIP_VERTEX_AUTH",
+  "CLAUDE_CODE_SKIP_FOUNDRY_AUTH", "ANTHROPIC_BEDROCK_BASE_URL",
+  "ANTHROPIC_BEDROCK_MANTLE_BASE_URL", "ANTHROPIC_BEDROCK_REGION_PREFIX",
+  "ANTHROPIC_VERTEX_BASE_URL", "ANTHROPIC_VERTEX_PROJECT_ID",
+  "ANTHROPIC_FOUNDRY_BASE_URL", "ANTHROPIC_FOUNDRY_RESOURCE",
+  "ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_FOUNDRY_AUTH_TOKEN",
+  "ANTHROPIC_AWS_API_KEY", "ANTHROPIC_AWS_BASE_URL", "ANTHROPIC_AWS_WORKSPACE_ID",
+  "ANTHROPIC_GOOGLE_CLOUD_BASE_URL", "CLAUDE_CODE_AUTO_MODE_MODEL",
+  "CLAUDE_CODE_BG_CLASSIFIER_MODEL", "CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL",
+  "ANTHROPIC_PROFILE", "ANTHROPIC_ORGANIZATION_ID",
+  "ANTHROPIC_WORKSPACE_ID", "ANTHROPIC_FEDERATION_RULE_ID",
+  "CLAUDE_CODE_DISABLE_MODEL_ACCESS_FALLBACK",
+  "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC",
+  "OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORGANIZATION", "OPENAI_PROJECT",
+  "UAI_CUSTOM_API_KEY", "UAI_INFERENCE_TOKEN", "AWS_BEARER_TOKEN_BEDROCK",
+] as const;
+
+const ENGINE_AUTH_BLANKS = {
+  CLAUDE_CODE_OAUTH_TOKEN: "", CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR: "", CCR_OAUTH_TOKEN_FILE: "",
+  CLAUDE_CODE_HOST_AUTH_ENV_VAR: "", CLAUDE_CODE_HOST_CREDS_FILE: "",
+  ANTHROPIC_API_KEY: "", ANTHROPIC_AUTH_TOKEN: "", OPENAI_API_KEY: "",
+};
+
+export const CONNECTION_NATIVE_BLANKS: Readonly<Record<string, string>> = Object.freeze(
+  Object.fromEntries(CONNECTION_ENV_NAMES.map(name => [name, ""])),
+);
+
+export function connectionNativeBlanks(): Record<string, string> {
+  return { ...CONNECTION_NATIVE_BLANKS };
+}
+
+/** The AWS SDK must never consult an ambient credential provider or endpoint.
+ * Empty files, not a nonexistent path, make profile/process lookup inert. */
+export const CONNECTION_AWS_BLANKS: Readonly<Record<string, string>> = Object.freeze(
+  Object.fromEntries([
+    "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_SECURITY_TOKEN",
+    "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_ROLE_ARN", "AWS_ROLE_SESSION_NAME",
+    "AWS_WEB_IDENTITY_TOKEN_FILE", "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+    "AWS_CONTAINER_CREDENTIALS_FULL_URI", "AWS_CONTAINER_AUTHORIZATION_TOKEN",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", "AWS_ENDPOINT_URL",
+    "AWS_ENDPOINT_URL_BEDROCK", "AWS_ENDPOINT_URL_BEDROCK_RUNTIME",
+    "AWS_EC2_METADATA_SERVICE_ENDPOINT", "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE",
+    "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_SDK_LOAD_CONFIG",
+  ].map(name => [name, ""])),
+);
+
+/** Shared by connection launches and the Managed Engine delegation. */
+export function endpointAuthEnv(
+  provider: "anthropic" | "openai",
+  baseUrl: string,
+  token: string,
+  authMode: "bearer" | "x-api-key" = "bearer",
+  tokenVariable = "UAI_CUSTOM_API_KEY",
+): Record<string, string> {
+  return provider === "anthropic"
+    ? { ...connectionNativeBlanks(), ...ENGINE_AUTH_BLANKS, ANTHROPIC_BASE_URL: baseUrl,
+        [authMode === "bearer" ? "ANTHROPIC_AUTH_TOKEN" : "ANTHROPIC_API_KEY"]: token }
+    : { ...connectionNativeBlanks(), ...ENGINE_AUTH_BLANKS,
+        ...(tokenVariable === "UAI_INFERENCE_TOKEN" ? { OPENAI_BASE_URL: baseUrl, OPENAI_API_KEY: token } : {}),
+        [tokenVariable]: token };
+}
+
+/** baseUrl is already the provider's Responses root, including /v1 where
+ * appropriate. Only Managed Engine's caller appends its own /v1. */
+export function codexProviderOverrides(
+  baseUrl: string,
+  options: { provider?: "uai" | "uai_custom"; name?: string; envKey?: "UAI_INFERENCE_TOKEN" | "UAI_CUSTOM_API_KEY" } = {},
+): string[] {
+  const provider = options.provider ?? "uai_custom";
+  return [
+    `model_provider=${provider}`,
+    `model_providers.${provider}.name=${tomlString(options.name ?? "Custom connection")}`,
+    `model_providers.${provider}.base_url=${tomlString(baseUrl)}`,
+    `model_providers.${provider}.env_key=${tomlString(options.envKey ?? "UAI_CUSTOM_API_KEY")}`,
+    `model_providers.${provider}.wire_api="responses"`,
+    `model_providers.${provider}.requires_openai_auth=false`,
+    `model_providers.${provider}.supports_websockets=false`,
+  ];
+}
+
+export interface CustomConnectionLaunch {
+  model: string;
+  agentEnv: Record<string, string>;
+  cliConfigOverrides: string[];
+  claudeSettings?: Record<string, unknown>;
+}
+
+export function buildCustomConnectionLaunch(args: {
+  material: CustomConnectionMaterial;
+  connection: CustomConnectionLease;
+  model?: string;
+  enabled: readonly CustomConnectionCombination[];
+  /** A connection-owned home prepared without copying a native account. */
+  home: string;
+  now?: number;
+  /** Actual destination provider, never inferred from sealed settings. */
+  runtimeProvider?: string;
+}): CustomConnectionLaunch {
+  const material = parseCustomConnectionMaterial(args.material);
+  const connection = parseCustomConnectionLease(args.connection, args.material.engine);
+  if (!material || !connection || !customConnectionEnabled(material, args.enabled)) throw new CustomConnectionLaunchError("unsupported");
+  if (material.internal === true && !isOwnedInternalConnectionRuntime(args.runtimeProvider)) throw new CustomConnectionLaunchError("unsupported");
+  if ((material.internal === true) !== (connection.internal === true)) throw new CustomConnectionLaunchError("unsupported");
+  if (new URL(material.baseUrl).host !== connection.host || material.providerType !== connection.providerType || material.authMode !== connection.authMode || material.region !== connection.region || material.transport !== connection.transport || (material.expiresAt ?? null) !== (connection.expiresAt ?? null)) throw new CustomConnectionLaunchError("unsupported");
+  if (material.expiresAt !== undefined && material.expiresAt !== null && material.expiresAt <= (args.now ?? Date.now())) throw new CustomConnectionLaunchError("expired");
+  if (!validConnectionModels(connection.models, connection.defaultModel, connection.backgroundModel, material.engine, material.apiKey)) throw new CustomConnectionLaunchError("invalid-models");
+  const model = args.model ?? connection.defaultModel;
+  if (!connection.models.includes(model)) throw new CustomConnectionLaunchError("model-not-found");
+  assertConnectionHome(args.home);
+  const aws = { ...CONNECTION_AWS_BLANKS, AWS_EC2_METADATA_DISABLED: "true",
+    AWS_CONFIG_FILE: `${args.home}/aws-config`, AWS_SHARED_CREDENTIALS_FILE: `${args.home}/aws-credentials` };
+  const agentEnv: Record<string, string> = {
+    ...connectionNativeBlanks(), ...ENGINE_AUTH_BLANKS, ...aws,
+    // Bound Claude's SDK attempts as well as its CLI retry loop. The
+    // host applies the connection's separate rate-limit recovery backoff.
+    AWS_MAX_ATTEMPTS: "1",
+    UAI_CUSTOM_CONNECTION: "1",
+  };
+  if (material.providerType === "bedrock") {
+    agentEnv.AWS_REGION = material.region!;
+    agentEnv.AWS_BEARER_TOKEN_BEDROCK = material.apiKey;
+    if (material.engine === "claude") agentEnv.CLAUDE_CODE_USE_BEDROCK = "1";
+  } else {
+    Object.assign(agentEnv, endpointAuthEnv(material.engine === "claude" ? "anthropic" : "openai", material.baseUrl, material.apiKey, material.authMode));
+  }
+  if (material.engine === "claude") {
+    Object.assign(agentEnv, {
+      // Claude 2.1.312 ignores settings-sourced provider/auth/headers when
+      // its embedding host owns routing. Keep project hooks/plugins intact.
+      CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST: "1",
+      // Verified on 2.1.312: replaces its ten-retry cloud-auth loop while
+      // retaining one retry for a transient 429/5xx response.
+      CLAUDE_CODE_MAX_RETRIES: "1",
+      ANTHROPIC_MODEL: model, ANTHROPIC_DEFAULT_FABLE_MODEL: model,
+      ANTHROPIC_DEFAULT_OPUS_MODEL: model, ANTHROPIC_DEFAULT_SONNET_MODEL: model,
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: connection.backgroundModel!, CLAUDE_CODE_SUBAGENT_MODEL: model,
+      CLAUDE_CODE_AUTO_MODE_MODEL: connection.backgroundModel!, CLAUDE_CODE_BG_CLASSIFIER_MODEL: connection.backgroundModel!,
+      CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL: model,
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1", CLAUDE_CODE_DISABLE_MODEL_ACCESS_FALLBACK: "1",
+    });
+    return { model, agentEnv, cliConfigOverrides: [], claudeSettings: {
+      apiKeyHelper: "", awsAuthRefresh: "", awsCredentialExport: "", fallbackModel: [],
+    } };
+  }
+  agentEnv.CODEX_HOME = args.home;
+  const cliConfigOverrides = material.providerType === "bedrock"
+    ? [`model_provider=${tomlString(material.transport === "runtime" ? "amazon-bedrock-runtime" : "amazon-bedrock")}`,
+        `model_providers.${material.transport === "runtime" ? "amazon-bedrock-runtime" : "amazon-bedrock"}.aws.region=${tomlString(material.region!)}`]
+    : codexProviderOverrides(material.baseUrl);
+  const provider = material.providerType === "bedrock"
+    ? material.transport === "runtime" ? "amazon-bedrock-runtime" : "amazon-bedrock"
+    : "uai_custom";
+  // Codex 0.164 rejects retry overrides on its built-in AWS providers.
+  // The connection runner bounds their streamed retries instead.
+  const retryOverrides = material.providerType === "bedrock" ? [] : [
+    `model_providers.${provider}.request_max_retries=1`,
+    `model_providers.${provider}.stream_max_retries=1`,
+  ];
+  return { model, agentEnv, cliConfigOverrides: [...cliConfigOverrides, ...retryOverrides,
+    'web_search="disabled"'] };
+}
+
+const HOME_ROOT = "/home/node/.uai-connection";
+function assertConnectionHome(home: string): void {
+  if (!new RegExp(`^${HOME_ROOT.replaceAll(".", "\\.")}/[A-Za-z0-9_-]{1,128}$`).test(home)) throw new CustomConnectionLaunchError("unsupported");
+}
+export function newConnectionHome(credentialId: string, revision: string, agentId: string, settingsHash: string): string {
+  const segment = createHash("sha256").update(JSON.stringify([credentialId, revision, agentId, settingsHash])).digest("hex");
+  return `${HOME_ROOT}/${segment}`;
+}
+
+const HOME_PREPARE = String.raw`
+import os, stat, sys
+home = sys.argv[1]
+parent, name = home.rsplit("/", 1)
+fd = os.open("/", os.O_RDONLY | os.O_DIRECTORY)
+try:
+    for part in parent.split("/"):
+        if not part: continue
+        try: os.mkdir(part, 0o700, dir_fd=fd)
+        except FileExistsError: pass
+        child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=fd)
+        os.close(fd)
+        fd = child
+    info = os.fstat(fd)
+    if info.st_uid != os.getuid() or (info.st_mode & 0o077): raise PermissionError()
+    try: os.mkdir(name, 0o700, dir_fd=fd)
+    except FileExistsError: pass
+    child = os.open(name, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=fd)
+    try:
+        info = os.fstat(child)
+        if info.st_uid != os.getuid() or (info.st_mode & 0o077): raise PermissionError()
+        # This provider authenticates through its scoped env key. A saved
+        # interactive login is never accepted when resuming the same home.
+        try: os.stat("auth.json", dir_fd=child, follow_symlinks=False)
+        except FileNotFoundError: pass
+        else: raise PermissionError()
+        # Provider/model/tool settings are generated as CLI overrides. The
+        # only config.toml we generate is empty; reject planted commands.
+        for filename in ["config.toml", "aws-config", "aws-credentials"]:
+            file = os.open(filename, os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600, dir_fd=child)
+            try:
+                info = os.fstat(file)
+                if not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid() or info.st_nlink != 1 or info.st_size or (info.st_mode & 0o077): raise PermissionError()
+            finally: os.close(file)
+    finally: os.close(child)
+finally: os.close(fd)
+`;
+
+/** Execute as the task user. Nonzero exit fails the launch; there is no
+ * fallback home. Reuses only a private home with the empty generated config
+ * and empty AWS credential files. */
+export function connectionHomePreparation(home: string): [string, ...string[]] {
+  assertConnectionHome(home);
+  return ["/usr/bin/python3", "-I", "-c", HOME_PREPARE, home];
+}
+
+const DNS_LOOKUP = String.raw`require("node:dns").lookup(process.argv[1],{all:true,verbatim:true},(error,answers)=>{if(error||!answers.length||answers.length>64){process.exitCode=1;return;}process.stdout.write(JSON.stringify(answers.map(x=>x.address)));});`;
+export function connectionDnsLookupArgv(baseUrl: string): [string, ...string[]] {
+  const hostname = new URL(baseUrl).hostname.replace(/^\[|\]$/g, "");
+  return ["node", "-e", DNS_LOOKUP, "--", hostname];
+}
+/** Evaluate all DNS answers from inside the task runtime, not the runner's
+ * own resolver. The caller bounds exec output/time and rejects nonzero exit. */
+export function validateConnectionAddresses(raw: string, internal = false): void {
+  let addresses: unknown;
+  try { addresses = JSON.parse(raw); } catch { throw new CustomConnectionLaunchError("unreachable"); }
+  if (!Array.isArray(addresses) || !addresses.length || addresses.length > 64 || !addresses.every(x => typeof x === "string")) throw new CustomConnectionLaunchError("unreachable");
+  if (!addresses.every(internal ? isInternalConnectionAddress : isPublicAddress)) throw new CustomConnectionLaunchError("private-address");
+}
+
+export function redactConnectionText(value: string, key: string): string {
+  if (!key) return value;
+  return value.split(key).join("[redacted]".includes(key) ? "" : "[redacted]");
+}
+/** A diagnostic may be inspected to choose a reason, never sent back. */
+export function connectionFailureReason(error: unknown): CustomConnectionReason {
+  if (error instanceof CustomConnectionLaunchError) return error.reason;
+  const o = error && typeof error === "object" ? error as Record<string, unknown> : {};
+  if (isCustomConnectionReason(o.reason)) return o.reason;
+  const status = o.statusCode ?? o.status;
+  const text = typeof error === "string" ? error : error instanceof Error ? error.message : "";
+  if (isCustomConnectionReason(text)) return text;
+  if (status === 401 || /\b401\b|unauthori[sz]ed|authentication_failed|unrecognized.?client|expired.?token|token.{0,80}(?:expired|revoked)|invalid api.?key/i.test(text)) return "unauthorized";
+  if (status === 403 || /\b403\b|forbidden|access.?denied/i.test(text)) return "forbidden";
+  if (status === 404 || /\b404\b|model.{0,30}not.found/i.test(text)) return "model-not-found";
+  if (status === 429 || /\b429\b|rate.?limit|throttl/i.test(text)) return "rate-limited";
+  if (/expired/i.test(text)) return "expired";
+  if (status === 408 || /timeout|timed.out/i.test(text)) return "timeout";
+  return "upstream-error";
+}

package/lib/custom-connection-runtime.ts

@@ -0,0 +1,70 @@
+import type { AgentEvent } from "./agents/types";
+
+import { connectionFailureReason, redactConnectionText } from "./custom-connection-launch";
+export { connectionFailureReason } from "./custom-connection-launch";
+
+/** Redact literal secrets recursively, including tool arguments and notices. */
+export function redactConnectionValue<T>(value: T, key: string): T {
+  if (typeof value === "string") return redactConnectionText(value, key) as T;
+  if (Array.isArray(value)) return value.map(v => redactConnectionValue(v, key)) as T;
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [redactConnectionValue(k, key), redactConnectionValue(v, key)])) as T;
+  return value;
+}
+
+export function sanitizeConnectionEvent(event: AgentEvent, key: string): AgentEvent {
+  const redacted = redactConnectionValue(event, key);
+  if (event.type === "error") {
+    const diagnostic = event.diagnosticMessage ?? event.message;
+    const message = connectionFailureReason(diagnostic);
+    let resetsAt = Number.isSafeInteger(event.resetsAt) && event.resetsAt! > 0 ? event.resetsAt : undefined;
+    if (message === "rate-limited") {
+      // Preserve only a numeric retry deadline, never provider text/headers.
+      const retryAfter = /retry-after\s*[:=]\s*([^\r\n]+)/i.exec(diagnostic)?.[1]?.trim();
+      const deadline = retryAfter && /^\d+(?:\.\d+)?$/.test(retryAfter)
+        ? Date.now() + Math.ceil(Number(retryAfter) * 1000)
+        : retryAfter ? Date.parse(retryAfter) : NaN;
+      if (Number.isSafeInteger(deadline) && deadline > 0) resetsAt = Math.max(resetsAt ?? 0, deadline);
+    }
+    return { type: "error", message, aborted: event.aborted, code: event.code,
+      ...(message === "rate-limited" && resetsAt !== undefined ? { resetsAt } : {}) };
+  }
+  if (event.type === "notice") return { type: "notice", message: connectionFailureReason(event.message) };
+  if (event.type === "turn_complete" && event.usage) {
+    const usage = { ...event.usage };
+    delete usage.costUsd;
+    return redactConnectionValue({ ...event, usage }, key);
+  }
+  return redacted;
+}
+
+/** A delta may end inside a credential. Retain only a possible credential
+ * prefix; no byte of a complete key can cross the output boundary. */
+export class ConnectionEventSanitizer {
+  private tail = "";
+  constructor(private readonly key: string) {}
+
+  push(event: AgentEvent): AgentEvent[] {
+    if (event.type === "message_delta") {
+      const text = this.tail + event.text;
+      let keep = 0;
+      for (let n = Math.min(this.key.length - 1, text.length); n > 0; n--) {
+        if (text.endsWith(this.key.slice(0, n))) { keep = n; break; }
+      }
+      // Replace first: a complete key may itself end in a key prefix.
+      const safe = redactConnectionText(text, this.key);
+      keep = Math.min(keep, safe.length);
+      if (keep && !safe.endsWith(this.key.slice(0, keep))) keep = 0;
+      this.tail = keep ? safe.slice(-keep) : "";
+      const emitted = keep ? safe.slice(0, -keep) : safe;
+      return emitted ? [{ type: "message_delta", text: emitted }] : [];
+    }
+    if (event.type === "message_complete") {
+      this.tail = ""; // The complete assembled message replaces the deltas.
+      return [sanitizeConnectionEvent(event, this.key)];
+    }
+    const final = event.type === "turn_complete" || event.type === "error" || event.type === "exit";
+    const pending: AgentEvent[] = final && this.tail ? [{ type: "message_delta", text: this.tail }] : [];
+    if (final) this.tail = "";
+    return [...pending, sanitizeConnectionEvent(event, this.key)];
+  }
+}

package/lib/engine-accounts.ts

@@ -941,7 +941,7 @@ type PlannedAccount = { ok: false; message: string } | { ok: true; plan: Labeled
 export function pastedSecretMaterial(
   kind: string,
   rawSecret: string,
-): { ok: true; material: EngineCaptureMaterial } | { ok: false; message: string } {
+): { ok: true; material: Exclude<EngineCaptureMaterial, { authKind: "custom-connection" }> } | { ok: false; message: string } {
   const secret = rawSecret.trim();
   if (!secret) return { ok: false, message: "Paste a token or API key." };
   if (/\s/.test(secret) || secret.length < 12) {

package/lib/engine-credential-env.ts

@@ -30,6 +30,8 @@ export const TASK_SECRET_ENV_NAMES: ReadonlySet<string> = new Set([
   "UAI_INFERENCE_TOKEN",
   "OPENAI_API_KEY",
   "ANTHROPIC_AUTH_TOKEN",
+  "UAI_CUSTOM_API_KEY",
+  "AWS_BEARER_TOKEN_BEDROCK",
 ]);
 
 /** Every name whose value never rides a runner's command line. */

package/lib/internal-connections.ts

@@ -0,0 +1,5 @@
+/** ADR-164: the workspace switch is cloud-only. The host independently
+ * checks the concrete runtime identity; unknown and task machines refuse. */
+export function isOwnedInternalConnectionRuntime(provider: string | null | undefined): boolean {
+  return provider === "docker-compose" || provider === "apple-container";
+}

package/lib/legacy-runtime-retirement.ts

@@ -22,7 +22,12 @@
  *   isolation), and which the operator removes or renames. A row with no
  *   runtime (a task that went down keeps its row, its runtime fields
  *   cleared) neither blocks nor vouches for anything. The plan records the
- *   engine it was made against.
+ *   engine it was made against. Its rejection is a `RetirementBlockedError`:
+ *   each blocker apart, and every unproven project named, so the cloud can
+ *   show the operator all of them with the command that clears each
+ *   (ADR-154 §13 build notes, 2026-10-27). Such a project is never removed
+ *   here: a Compose label proves neither who made a stack nor that nothing
+ *   uses it now (another runner may share this Docker and workspace root).
  * - `retireLegacyTaskRuntimes` carries a plan out, only after the runner has
  *   committed to the switch. Each task's check, Stop and removal share its
  *   lifecycle slot: before its assignment closes and again before anything
@@ -117,6 +122,26 @@ export interface RetirementDeps extends RetirementPlanDeps {
   log: (line: string) => void;
 }
 
+/**
+ * The plan's refusal: every blocker apart (`blockers`), and apart from them
+ * the `task-*` Compose projects nothing proves Uai's (all of them, for the
+ * operator to remove or rename). The message names both, as the log has.
+ * `transient`: nothing is wrong yet, the runner only cannot look now (its
+ * container runtime is still preparing); the next attempt looks again.
+ */
+export class RetirementBlockedError extends Error {
+  readonly blockers: string[];
+  readonly unprovenProjects: string[];
+  readonly transient: boolean;
+  constructor(message: string, options: { blockers?: string[]; unprovenProjects?: string[]; transient?: boolean } = {}) {
+    super(message);
+    this.name = "RetirementBlockedError";
+    this.blockers = options.blockers ?? [];
+    this.unprovenProjects = options.unprovenProjects ?? [];
+    this.transient = options.transient === true;
+  }
+}
+
 export interface RetirementReport {
   /** Tasks whose runtime is gone (or was already). */
   retired: string[];
@@ -136,8 +161,9 @@ export async function planLegacyTaskRuntimeRetirement(deps: RetirementPlanDeps):
   const blockers: string[] = [];
   const snapshot = deps.snapshot();
   if (snapshot.runtimeProblem !== null || snapshot.machine === null) {
-    throw new Error(
+    throw new RetirementBlockedError(
       `task runtimes cannot be retired now: the container runtime is not ready (${snapshot.runtimeProblem ?? "no engine is pinned"})`,
+      { transient: true },
     );
   }
   if (!snapshot.fence.ok) blockers.push(snapshot.fence.detail ?? "the task rows do not match the pinned container runtime");
@@ -183,6 +209,7 @@ export async function planLegacyTaskRuntimeRetirement(deps: RetirementPlanDeps):
   }
 
   const appleOrphans: string[] = [];
+  const unprovenProjects: string[] = [];
   try {
     if (deps.apple) {
       const named = new Set(rows.map((task) => `task-${task.taskId}-app`));
@@ -193,18 +220,26 @@ export async function planLegacyTaskRuntimeRetirement(deps: RetirementPlanDeps):
       const named = new Set(rows.map((task) => `task-${task.taskId}`));
       for (const project of await listTaskProjects(deps.docker)) {
         if (named.has(project)) continue;
-        blockers.push(
-          `Compose project ${project} has containers but no task on this runner: nothing proves it Uai's, so it is not removed. ` +
-            `If it was a task's, remove it (docker compose -p ${project} down); otherwise rename it`,
-        );
+        unprovenProjects.push(project);
       }
     }
   } catch (error) {
     blockers.push(`the task runtime inventory failed: ${message(error)}`);
   }
 
-  if (blockers.length > 0) {
-    throw new Error(`task runtimes cannot all be retired: ${blockers.join("; ").slice(0, 1500)}`);
+  if (blockers.length > 0 || unprovenProjects.length > 0) {
+    const all = [
+      ...blockers,
+      ...unprovenProjects.map(
+        (project) =>
+          `Compose project ${project} has containers but no task on this runner: nothing proves it Uai's, so it is not removed. ` +
+          `If it was a task's, remove it (docker compose -p ${project} down); otherwise rename it`,
+      ),
+    ];
+    throw new RetirementBlockedError(`task runtimes cannot all be retired: ${all.join("; ").slice(0, 1500)}`, {
+      blockers,
+      unprovenProjects,
+    });
   }
   return { machine: snapshot.machine, removals, appleOrphans };
 }

package/lib/obs.ts

@@ -41,6 +41,7 @@ import { join } from "node:path";
 import * as Sentry from "@sentry/node";
 
 import { env } from "./env";
+import { redactActiveConnectionSecrets } from "./connection-secret-redaction";
 import { isDevelopmentLaunch } from "./launch-mode";
 
 /**
@@ -216,7 +217,7 @@ const TASK_WORKSPACE_SLUG_RE =
   /([/\\]tasks[/\\][A-Za-z0-9_-]+[/\\]workspace[/\\])[^/\\\s"']+/g;
 
 export function scrubHostString(value: string): string {
-  let out = value;
+  let out = redactActiveConnectionSecrets(value);
   out = out.replace(URL_CREDENTIALS_RE, "$1[redacted]@");
   out = out.replace(URL_TAIL_RE, "$1$2[redacted]");
   out = out.replace(RELATIVE_URL_TAIL_RE, "$1$2$3[redacted]");