@runuai/host 0.9.171 → 0.9.172

package/lib/secrets-proxy/address.ts

@@ -70,3 +70,26 @@ export function isPublicAddress(ip: string): boolean {
     return false;
   }
 }
+
+// Internal custom connections add only these explicitly approved destinations.
+// Do not change the public proxy's policy or unwrap IPv4 embedded in IPv6.
+const internalIpv4 = new BlockList();
+for (const [network, prefix] of [["10.0.0.0", 8], ["172.16.0.0", 12], ["192.168.0.0", 16], ["100.64.0.0", 10]] as const) internalIpv4.addSubnet(network, prefix, "ipv4");
+const metadataIpv4 = new BlockList();
+metadataIpv4.addAddress("100.100.100.200", "ipv4"); // Alibaba Cloud metadata within CGNAT
+const internalIpv6 = new BlockList();
+internalIpv6.addSubnet("fc00::", 7, "ipv6");
+const metadataIpv6 = new BlockList();
+metadataIpv6.addAddress("fd00:ec2::254", "ipv6");
+export function isInternalConnectionAddress(ip: string): boolean {
+  if (typeof ip !== "string" || !/^[0-9a-fA-FxX:.]+$/.test(ip)) return false;
+  // WHATWG URL canonicalization normalizes decimal/octal/hex IPv4 spellings.
+  let normalized: string;
+  try { normalized = new URL(`http://${ip.includes(":") ? `[${ip}]` : ip}`).hostname.replace(/^\[|\]$/g, ""); } catch { return false; }
+  if (isPublicAddress(normalized)) return true;
+  switch (isIP(normalized)) {
+    case 4: return internalIpv4.check(normalized, "ipv4") && !metadataIpv4.check(normalized, "ipv4");
+    case 6: return internalIpv6.check(normalized, "ipv6") && !metadataIpv6.check(normalized, "ipv6");
+    default: return false;
+  }
+}

package/lib/task-credential-cleanup.ts

@@ -120,8 +120,11 @@ async function execCleanup(
 export const CREDENTIAL_UNLINK_HELPER = String.raw`
 import os
 import sys
+import shutil
+import stat
 
 root, absolute = sys.argv[1:3]
+directory = len(sys.argv) == 4 and sys.argv[3] == "directory"
 prefix = root.rstrip("/") + "/"
 if not absolute.startswith(prefix):
     raise RuntimeError("credential path escaped its root")
@@ -145,7 +148,13 @@ try:
         opened.append(current)
     leaf = parts[-1]
     try:
-        os.unlink(leaf, dir_fd=current)
+        if directory:
+            info = os.stat(leaf, dir_fd=current, follow_symlinks=False)
+            if not stat.S_ISDIR(info.st_mode) or not shutil.rmtree.avoids_symlink_attacks:
+                raise RuntimeError("credential directory cannot be traversed safely")
+            shutil.rmtree(leaf, dir_fd=current)
+        else:
+            os.unlink(leaf, dir_fd=current)
     except FileNotFoundError:
         pass
     try:
@@ -212,7 +221,8 @@ export async function removeRuntimeCredentialFile(
   }
   const removed = await execCleanup(
     environment,
-    ["/usr/bin/python3", "-I", "-", "/home/node", path],
+    ["/usr/bin/python3", "-I", "-", "/home/node", path,
+      ...(/^\/home\/node\/\.uai-connection\/[a-f0-9]{64}$/.test(path) ? ["directory"] : [])],
     Buffer.from(CREDENTIAL_UNLINK_HELPER, "utf8"),
   );
   if (removed.exitCode !== 0) {
@@ -220,7 +230,7 @@ export async function removeRuntimeCredentialFile(
   }
 }
 
-/** Exact, non-recursive deletion for one validated inventory row. */
+/** Delete one validated file, or the confined connection home owning it. */
 export async function removeCredentialCleanupPath(
   row: HostCredentialCleanupPath,
 ): Promise<void> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.171",
+  "version": "0.9.172",
   "description": "Uai host \u2014 runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/runner/runner.mjs

@@ -6,7 +6,7 @@
  * bind mount (no sockets/FIFOs — they don't cross the macOS↔VM boundary):
  *
  *   <sessionDir>/inbox.jsonl   host appends; runner tails → CLI stdin
- *   <sessionDir>/outbox.jsonl  CLI stdout lines verbatim + __uai meta lines
+ *   <sessionDir>/outbox.jsonl  CLI stdout protocol + __uai meta (connections redacted)
  *   <sessionDir>/heartbeat     rewritten every HEARTBEAT_MS (host checks mtime)
  *   <sessionDir>/runner.json   pid, protocol, argv, startedAt
  *
@@ -31,6 +31,232 @@ const POLL_MS = 50;
 const HEARTBEAT_MS = 5_000;
 const STDERR_CAP = 8 * 1024;
 const STOP_GRACE_MS = 5_000;
+const customConnection = process.env.UAI_CUSTOM_CONNECTION === "1";
+const connectionKeys = [...new Set([
+  process.env.ANTHROPIC_AUTH_TOKEN,
+  process.env.ANTHROPIC_API_KEY,
+  process.env.UAI_CUSTOM_API_KEY,
+  process.env.AWS_BEARER_TOKEN_BEDROCK,
+].filter((key) => typeof key === "string" && key.length > 0))]
+  .sort((a, b) => b.length - a.length);
+
+function redactConnectionKeys(text) {
+  for (const key of connectionKeys) {
+    text = text.split(key).join("[redacted]".includes(key) ? "" : "[redacted]");
+  }
+  return text;
+}
+
+// Never persist upstream diagnostics from a custom endpoint: these can contain
+// credentials, request bodies or arbitrary provider responses, beyond known keys.
+function connectionReason(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value) ?? "";
+  if (/401|unauthorized|authentication_failed|unrecognized.?client|expired.?token|token.{0,80}(?:expired|revoked)|invalid.?api.?key/i.test(text)) return "unauthorized";
+  if (/403|forbidden|access.?denied/i.test(text)) return "forbidden";
+  if (/404|model.{0,30}not.found/i.test(text)) return "model-not-found";
+  if (/429|rate.?limit|throttl/i.test(text)) return "rate-limited";
+  if (/expired/i.test(text)) return "expired";
+  if (/408|timeout|timed.out/i.test(text)) return "timeout";
+  return "upstream-error";
+}
+
+function connectionError(value) {
+  const reason = connectionReason(value);
+  // JSON-RPC error responses must retain their error object and numeric code.
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? { ...(typeof value.code === "number" ? { code: value.code } : {}), message: reason }
+    : reason;
+}
+
+// Tool/model payloads can contain fields named error, result or stderrTail.
+// Preserve their meaning; only exact credentials are redacted recursively.
+function redactConnectionValue(value) {
+  if (typeof value === "string") return redactConnectionKeys(value);
+  if (Array.isArray(value)) return value.map(redactConnectionValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) =>
+    [redactConnectionKeys(key), redactConnectionValue(item)]));
+}
+
+// Suppress provider diagnostics only in the CLI's protocol-level failures,
+// never an error object nested in a completed tool item or model output.
+function redactConnectionRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return redactConnectionValue(value);
+  const claudeApiError = value.type === "assistant" && value.is_api_error_message === true;
+  const claudeResultError = value.type === "result" && value.is_error === true;
+  const protocolError = claudeApiError || claudeResultError ||
+    (value.type === "system" && value.subtype === "api_retry") ||
+    value.type === "error" || value.type === "turn.failed" ||
+    (Object.hasOwn(value, "id") && value.error);
+  if (claudeApiError) {
+    value = { ...value, message: { ...value.message,
+      content: [{ type: "text", text: connectionReason(value) }] } };
+  }
+  if (protocolError) {
+    value = { ...value };
+    if (Object.hasOwn(value, "error")) value.error = connectionError(value.error);
+    if (Array.isArray(value.errors)) value.errors = value.errors.map(connectionError);
+    if (claudeResultError && Object.hasOwn(value, "result")) value.result = connectionReason(value.result);
+    if (value.type === "error") {
+      for (const key of ["message", "detail", "body"]) {
+        if (Object.hasOwn(value, key)) value[key] = connectionReason(value[key]);
+      }
+    }
+  }
+  if (value.method === "error" && value.params?.error) {
+    value = { ...value, params: { ...value.params, error: connectionError(value.params.error) } };
+  }
+  if (value.method === "turn/completed" && value.params?.turn?.status === "failed" && value.params.turn.error) {
+    value = { ...value, params: { ...value.params,
+      turn: { ...value.params.turn, error: connectionError(value.params.turn.error) } } };
+  }
+  if (value.__uai === "exit" && Object.hasOwn(value, "stderrTail")) {
+    value = { ...value, stderrTail: value.stderrTail ? connectionReason(value.stderrTail) : "" };
+  }
+  return redactConnectionValue(value);
+}
+
+function safeOutboxLine(line) {
+  if (!customConnection) return line;
+  // Wait for a complete JSON line, decode its strings before redacting, then
+  // serialize again. Replacing raw JSON bytes would miss escaped keys or corrupt
+  // quote/backslash-containing keys. Separate protocol deltas retain their shape;
+  // the host also redacts across assembled message deltas before publication.
+  try {
+    return JSON.stringify(redactConnectionRecord(JSON.parse(line)));
+  } catch {
+    return JSON.stringify({ type: "error", error: connectionReason(line) });
+  }
+}
+
+// SDK/app-server retries must not hide a rejected connection credential.
+// Restrict classification to CLI error records, never generated model text.
+let connectionFailureSeen = false;
+let connectionTransientRetries = 0;
+// Codex's built-in AWS backend has a fixed HTTP retry budget and rejects
+// retry overrides. Do not multiply that budget with another stream cycle.
+const connectionStreamRetryBudget = process.env.AWS_BEARER_TOKEN_BEDROCK &&
+  process.env.CLAUDE_CODE_USE_BEDROCK !== "1" ? 0 : 1;
+function connectionFailureFrame(value) {
+  if (!customConnection) return value;
+  if (value.method === "turn/started" || value.type === "turn.started" ||
+    (value.type === "result" && value.is_error === false)) connectionTransientRetries = 0;
+  const claudeRetry = value.type === "system" && value.subtype === "api_retry";
+  const rpcError = value.error && Object.hasOwn(value, "id");
+  const failed = claudeRetry || rpcError || value.type === "error" || value.type === "turn.failed" ||
+    (value.type === "assistant" && value.is_api_error_message === true) ||
+    (value.type === "result" && value.is_error === true) || value.method === "error" ||
+    (value.method === "turn/completed" && value.params?.turn?.status === "failed");
+  if (!failed) return value;
+  const detail = value.params?.error ?? value.params?.turn?.error ?? value.error ?? value.message ?? value.result ?? "";
+  const text = typeof detail === "string" ? detail : JSON.stringify(detail);
+  const status = value.error_status ?? detail?.status ?? detail?.statusCode ??
+    ([401, 403].includes(detail?.code) ? detail.code : undefined);
+  const auth = status === 401 || status === 403 ||
+    /\b(?:status|code|API Error:)\s*[:=]?\s*(?:401|403)\b|\b401 Unauthorized\b|\b403 Forbidden\b|authentication_failed|unrecognized.?client|access.?denied|expired.?token|invalid.?api.?key|invalid.?bearer.?token|security token.{0,80}(?:expired|invalid)/i.test(text);
+  const retry = claudeRetry || value.params?.willRetry === true ||
+    (value.type === "error" && /^Reconnecting\.\.\./.test(text));
+  if (!auth && (!retry || ++connectionTransientRetries <= connectionStreamRetryBudget)) return value;
+  const reason = auth ? (status === 403 && !/authentication_failed/i.test(text) ? "forbidden" : connectionReason(text)) : connectionReason(value);
+  const safeReason = auth && !["unauthorized", "forbidden", "expired"].includes(reason) ? "unauthorized" : reason;
+  connectionFailureSeen = true;
+  stopCli();
+  if (rpcError) return { jsonrpc: value.jsonrpc, id: value.id, error: { ...(typeof value.error.code === "number" ? { code: value.error.code } : {}), message: safeReason } };
+  if (value.method) return { method: "error", params: { threadId: value.params?.threadId,
+    turnId: value.params?.turnId, willRetry: false, error: { message: safeReason } } };
+  if (["system", "assistant", "result"].includes(value.type)) return {
+    type: "result", subtype: "error_during_execution", is_error: true,
+    result: safeReason, errors: [safeReason],
+  };
+  return { type: "error", message: safeReason };
+}
+
+// Retain only a possible credential prefix across protocol deltas. Every
+// persisted text fragment is safe when concatenated with earlier fragments.
+const deltaTails = new Map();
+let deltaTailBytes = 0;
+// Bound retained bytes, rather than stopping a healthy multi-item turn at
+// an arbitrary item count. Completed items release their state immediately.
+const DELTA_TAIL_MAX_BYTES = 4 * 1024 * 1024;
+function forgetDeltaTail(stream) {
+  const pending = deltaTails.get(stream);
+  if (pending) deltaTailBytes -= pending.bytes;
+  deltaTails.delete(stream);
+}
+function streamingDelta(value) {
+  if (value.type === "stream_event" && value.event?.type === "content_block_delta") {
+    for (const field of ["text", "thinking", "partial_json", "signature"]) {
+      if (typeof value.event.delta?.[field] === "string") {
+        return { stream: `claude:${value.event.index ?? 0}:${field}`, target: value.event.delta, field };
+      }
+    }
+  }
+  if (typeof value.method === "string" && /delta$/i.test(value.method) && typeof value.params?.delta === "string") {
+    return { stream: `codex:${value.method}:${value.params.threadId ?? ""}:${value.params.turnId ?? ""}:${value.params.itemId ?? ""}`,
+      target: value.params, field: "delta" };
+  }
+  return null;
+}
+function safeOutboxLines(line) {
+  if (!customConnection) return [line];
+  let value;
+  try { value = JSON.parse(line); } catch { return [safeOutboxLine(line)]; }
+  if (!value || typeof value !== "object") return [safeOutboxLine(line)];
+  if (connectionFailureSeen && value.__uai !== "exit") return [];
+  value = connectionFailureFrame(value);
+  const delta = streamingDelta(value);
+  if (delta) {
+    const text = redactConnectionKeys((deltaTails.get(delta.stream)?.tail ?? "") + delta.target[delta.field]);
+    let keep = 0;
+    for (const key of connectionKeys) {
+      for (let n = Math.min(key.length - 1, text.length); n > keep; n--) {
+        if (text.endsWith(key.slice(0, n))) { keep = n; break; }
+      }
+    }
+    const tail = keep ? text.slice(-keep) : "";
+    delta.target[delta.field] = keep ? text.slice(0, -keep) : text;
+    forgetDeltaTail(delta.stream);
+    if (tail) {
+      // Only retain the protocol envelope, not a potentially large provider
+      // payload or the already-persisted text.
+      const frame = value.type === "stream_event"
+        ? { type: value.type, event: { type: value.event.type, index: value.event.index,
+            delta: { type: value.event.delta.type, [delta.field]: "" } } }
+        : { method: value.method, params: { threadId: value.params.threadId,
+            turnId: value.params.turnId, itemId: value.params.itemId, delta: "" } };
+      const bytes = Buffer.byteLength(delta.stream) + Buffer.byteLength(tail) + Buffer.byteLength(JSON.stringify(frame));
+      if (deltaTailBytes + bytes > DELTA_TAIL_MAX_BYTES) {
+        stopCli();
+        return [JSON.stringify({ type: "error", error: "upstream-error" })];
+      }
+      deltaTails.set(delta.stream, { tail, frame, bytes });
+      deltaTailBytes += bytes;
+    }
+  }
+  const lines = [];
+  for (const [stream, pending] of deltaTails) {
+    const threadMatches = value.params?.threadId === undefined || pending.frame.params?.threadId === value.params.threadId;
+    const completedTurn = value.params?.turnId ?? value.params?.turn?.id;
+    const turnMatches = completedTurn === undefined || pending.frame.params?.turnId === completedTurn;
+    const terminal = value.__uai === "exit" ||
+      (value.type === "result" && pending.frame.type === "stream_event") ||
+      (value.method === "turn/completed" && pending.frame.params && threadMatches && turnMatches);
+    const claudeEnd = value.type === "stream_event" && value.event?.type === "content_block_stop" &&
+      pending.frame.type === "stream_event" && pending.frame.event.index === value.event.index;
+    const codexEnd = value.method === "item/completed" && pending.frame.params &&
+      typeof (value.params?.item?.id ?? value.params?.itemId) === "string" &&
+      pending.frame.params.itemId === (value.params.item?.id ?? value.params.itemId) &&
+      (value.params.threadId === undefined || pending.frame.params.threadId === value.params.threadId) &&
+      (value.params.turnId === undefined || pending.frame.params.turnId === value.params.turnId);
+    if (!terminal && !claudeEnd && !codexEnd) continue;
+    const d = streamingDelta(pending.frame);
+    d.target[d.field] = pending.tail;
+    lines.push(JSON.stringify(redactConnectionRecord(pending.frame)));
+    forgetDeltaTail(stream);
+  }
+  lines.push(JSON.stringify(redactConnectionRecord(value)));
+  return lines;
+}
 
 // ---- argv ------------------------------------------------------------------
 
@@ -52,7 +278,9 @@ const runnerJsonPath = join(sessionDir, "runner.json");
 // Single append point — appendFileSync with O_APPEND keeps lines atomic for
 // the sizes we write; the runner is the outbox's only writer.
 function outbox(line) {
-  appendFileSync(outboxPath, line.endsWith("\n") ? line : `${line}\n`);
+  for (const safe of safeOutboxLines(line)) {
+    appendFileSync(outboxPath, safe.endsWith("\n") ? safe : `${safe}\n`);
+  }
 }
 function meta(kind, extra = {}) {
   outbox(JSON.stringify({ __uai: kind, ts: Date.now(), ...extra }));
@@ -117,7 +345,7 @@ child.on("exit", (code, signal) => {
   if (exiting) return;
   exiting = true;
   if (stdoutBuf.trim().length > 0) outbox(stdoutBuf); // flush the partial tail
-  meta("exit", { code, signal: signal ?? null, stderrTail });
+  meta("exit", { code: connectionFailureSeen ? 1 : code, signal: signal ?? null, stderrTail });
   process.exit(0);
 });
 child.on("error", (err) => {

package/src/capture-wire.ts

@@ -0,0 +1,102 @@
+/** Pure capture contract, independent of leases and custom connections. */
+import { parseLeaseParameterName, parseBrokerParameterName, sameLocation, isIdValue, isTagValue, type CredentialLocation } from "./credential-location";
+import { exactObject, isPositiveInteger, isEpochMs } from "./credential-wire-validation";
+
+/**
+ * What the cloud tells the sign-in box to write for one capture: the
+ * revision's parameters (the box never chooses a name) and the ids it tags
+ * them with. The box checks every field against the others before it writes.
+ */
+export interface CaptureFlowWire {
+  credentialId: string;
+  revision: string;
+  leaseParameter: string;
+  /** Null for a static credential. */
+  brokerParameter: string | null;
+  /** The workspace tag: required except for GitHub and SSH. */
+  orgId: string | null;
+  /** The person, for a personal credential. */
+  userId: string | null;
+}
+
+/** What the box answers once both parts are written: never material. */
+export interface CaptureResultWire {
+  credentialId: string;
+  revision: string;
+  /** The lease-readable parameter's Parameter Store version. */
+  leaseVersion: number;
+  /** The access token's expiry when the box could read it. */
+  expiresAt: number | null;
+}
+
+/**
+ * A capture flow, rebuilt and checked, with the location its parameters name,
+ * or null. The two parameters must name the same credential and revision under
+ * their own roots, and the tags must be the parameter's owner: a workspace
+ * credential's `orgId` is its owner and it has no `userId`; a personal AI
+ * account or MCP connection names both its person and its workspace; GitHub
+ * and SSH name their person alone.
+ */
+export function parseCaptureFlowWire(
+  value: unknown,
+): (CaptureFlowWire & { location: CredentialLocation }) | null {
+  const o = exactObject(value, [
+    "credentialId",
+    "revision",
+    "leaseParameter",
+    "brokerParameter",
+    "orgId",
+    "userId",
+  ]);
+  if (
+    !o ||
+    !isIdValue(o.credentialId) ||
+    !isIdValue(o.revision) ||
+    typeof o.leaseParameter !== "string" ||
+    !(o.brokerParameter === null || typeof o.brokerParameter === "string") ||
+    !(o.orgId === null || (isIdValue(o.orgId) && isTagValue(o.orgId))) ||
+    !(o.userId === null || (isIdValue(o.userId) && isTagValue(o.userId)))
+  ) {
+    return null;
+  }
+  const location = parseLeaseParameterName(o.leaseParameter);
+  if (!location || location.revision !== o.revision) return null;
+  const isPerson = location.class === "github" || location.class === "ssh";
+  if (!isPerson && location.credentialId !== o.credentialId) return null;
+  if (o.brokerParameter !== null) {
+    const broker = parseBrokerParameterName(o.brokerParameter);
+    if (!broker || !sameLocation(broker, location)) return null;
+  }
+  if (isPerson && o.brokerParameter !== null) return null;
+  const ownerOk =
+    location.scope === "org"
+      ? o.orgId === location.ownerId && o.userId === null
+      : o.userId === location.ownerId && (isPerson ? o.orgId === null : o.orgId !== null);
+  if (!ownerOk) return null;
+  return {
+    credentialId: o.credentialId,
+    revision: o.revision,
+    leaseParameter: o.leaseParameter,
+    brokerParameter: o.brokerParameter,
+    orgId: o.orgId,
+    userId: o.userId,
+    location,
+  };
+}
+
+export function parseCaptureResultWire(value: unknown): CaptureResultWire | null {
+  const o = exactObject(value, ["credentialId", "revision", "leaseVersion", "expiresAt"]);
+  return o &&
+    isIdValue(o.credentialId) &&
+    isIdValue(o.revision) &&
+    isPositiveInteger(o.leaseVersion) &&
+    (o.expiresAt === null || isEpochMs(o.expiresAt))
+    ? {
+        credentialId: o.credentialId,
+        revision: o.revision,
+        leaseVersion: o.leaseVersion,
+        expiresAt: o.expiresAt,
+      }
+    : null;
+}
+