@runuai/host 0.9.2 → 0.9.4

package/images/standard/container/uai-init

@@ -207,14 +207,26 @@ fi
 editor_root="$WORKSPACE"
 [ -d "$editor_root" ] || editor_root="/home/node"
 
-# Seed the curated code-server defaults (slim chrome, telemetry off, trust
-# off) into the User settings dir when the task hasn't written its own yet.
-cs_user_dir="$HOME/.local/share/code-server/User"
+# Keep code-server on Uai's managed data path even when a project declares
+# XDG_DATA_HOME. Otherwise code-server starts with a fresh profile elsewhere,
+# which restores the light theme and Workspace Trust prompt.
+cs_data_dir="$HOME/.local/share/code-server"
+cs_user_dir="$cs_data_dir/User"
 cs_seed="/usr/local/share/uai/code-server-settings.json"
-if [ -f "$cs_seed" ] && [ ! -f "$cs_user_dir/settings.json" ]; then
-  mkdir -p "$cs_user_dir"
-  cp "$cs_seed" "$cs_user_dir/settings.json"
-  log "seeded code-server settings"
+# The source-tree sibling keeps direct smoke tests and development runs on the
+# same seed as the packaged image; the image always uses the root-owned path.
+cs_source_seed="$(dirname "${BASH_SOURCE[0]}")/code-server-settings.json"
+if [ ! -f "$cs_seed" ] && [ -f "$cs_source_seed" ]; then
+  cs_seed="$cs_source_seed"
+fi
+if [ ! -f "$cs_user_dir/settings.json" ]; then
+  if [ ! -f "$cs_seed" ]; then
+    log "warning: code-server settings seed missing at $cs_seed"
+  elif mkdir -p "$cs_user_dir" && cp "$cs_seed" "$cs_user_dir/settings.json"; then
+    log "seeded code-server settings"
+  else
+    log "warning: could not seed code-server settings at $cs_user_dir/settings.json"
+  fi
 fi
 
 if pgrep -f 'code-server.*--bind-addr' >/dev/null 2>&1; then
@@ -222,6 +234,8 @@ if pgrep -f 'code-server.*--bind-addr' >/dev/null 2>&1; then
 else
   log "launching code-server on 0.0.0.0:8080"
   nohup code-server \
+    --user-data-dir "$cs_data_dir" \
+    --disable-workspace-trust \
     --auth none \
     --disable-telemetry \
     --bind-addr 0.0.0.0:8080 \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/scripts/agent/task-up.sh

@@ -89,6 +89,31 @@ task_json=$(db_get_task "$task_id")
 
 task_branch=$(jq -r '.[0].branch' <<<"$task_json")
 
+# The standard container runs as node:node (1000:1000), while Docker Desktop
+# hosts commonly run as 501:20 and Linux hosts may use another uid/gid. Share
+# only this task's writable trees through the host's effective group. A root
+# host is the exception: never add the unprivileged container user to gid 0;
+# root can chgrp the task trees directly to node's gid instead.
+task_container_gid=$(id -g)
+if [ "$(id -u)" = "0" ]; then
+  task_container_gid=1000
+elif [ "$task_container_gid" = "0" ]; then
+  task_container_gid=""
+  for candidate_gid in $(id -G); do
+    if [ "$candidate_gid" != "0" ]; then
+      task_container_gid="$candidate_gid"
+      break
+    fi
+  done
+fi
+case "$task_container_gid" in
+  ''|*[!0-9]*)
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not resolve a safe host group for the task container" \
+      "resolve task container filesystem group"
+    ;;
+esac
+
 step "PROJECT_NOT_FOUND" "read task projects"
 projects_json=$(db_get_projects_for_task "$task_id")
 project_count=$(jq 'length' <<<"$projects_json")
@@ -280,6 +305,55 @@ assert_bare_repo_tree_safe() {
   fi
 }
 
+# Make a host-created task tree writable by the container's uid-1000 node user
+# without making it world-writable or changing ownership away from the host.
+# `find` deliberately does not follow repository symlinks. Setgid directories
+# keep Git-created descendants in the shared group; core.sharedRepository
+# below makes Git's own files group-writable as well.
+set_task_entry_container_access() {
+  local entry="$1"
+  chgrp "$task_container_gid" "$entry" || return 1
+  if [ -d "$entry" ]; then
+    chmod ug+rwx,g+s "$entry" || return 1
+  else
+    chmod ug+rw "$entry" || return 1
+  fi
+}
+
+share_task_entry_with_container() {
+  local entry="$1" label="$2"
+  if ! set_task_entry_container_access "$entry"; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not share the $label with the task container" \
+      "set task filesystem permissions"
+  fi
+}
+
+share_task_tree_with_container() {
+  local root="$1" label="$2" entry entry_list failed_entry=""
+  [ -d "$root" ] || return 0
+
+  entry_list=$(mktemp "/tmp/uai-task-tree.XXXXXX")
+  if ! find "$root" \( -type d -o -type f \) -print0 > "$entry_list"; then
+    rm -f "$entry_list"
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not enumerate the complete $label before sharing it with the task container" \
+      "enumerate task filesystem"
+  fi
+  while IFS= read -r -d '' entry; do
+    if ! set_task_entry_container_access "$entry"; then
+      failed_entry="$entry"
+      break
+    fi
+  done < "$entry_list"
+  rm -f "$entry_list"
+  if [ -n "$failed_entry" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not share the complete $label with the task container" \
+      "set task filesystem permissions"
+  fi
+}
+
 sanitize_mirror_control_plane() {
   local mirror="$1" origin="$2" config_tmp
   assert_bare_repo_tree_safe "$mirror" "FETCH_FAILED" "host repository cache"
@@ -328,6 +402,7 @@ sanitize_task_repo_control_plane() {
   git_host_control config --file "$config_tmp" core.repositoryformatversion 0
   git_host_control config --file "$config_tmp" core.filemode true
   git_host_control config --file "$config_tmp" core.bare "$bare"
+  git_host_control config --file "$config_tmp" core.sharedRepository group
   git_host_control config --file "$config_tmp" remote.origin.url "$origin"
   git_host_control config --file "$config_tmp" remote.origin.fetch \
     '+refs/heads/*:refs/remotes/origin/*'
@@ -340,6 +415,13 @@ sanitize_task_repo_control_plane() {
   mv -f "$config_tmp" "$repo/config"
   rm -rf "$repo/hooks"
   mkdir -p "$repo/hooks"
+  # mktemp is intentionally 0600. Once its trusted contents are atomically in
+  # place, grant only the selected task group access; this must run on every
+  # resume even after the one-time tree migration marker exists.
+  share_task_entry_with_container "$repo/config" \
+    "task-private Git config"
+  share_task_entry_with_container "$repo/hooks" \
+    "task-private Git hooks directory"
 }
 
 # ADR-062 shared files: two host-resident roots mounted into the container
@@ -758,6 +840,8 @@ while IFS= read -r project_obj; do
       || { git_host_control -C "$worktree_target" init -q \
            && git_host_control -C "$worktree_target" symbolic-ref HEAD "refs/heads/$project_default"; }
     git_host_control -C "$worktree_target" remote add origin "$repo_url" 2>/dev/null || true
+    sanitize_task_repo_control_plane "$worktree_target/.git" "$repo_url" \
+      "$project_default" false
     printf '%s\n' \
       "# Empty repository" \
       "" \
@@ -785,10 +869,59 @@ while IFS= read -r project_obj; do
      && [ -n "$tool_versions" ] && [ "$tool_versions" != "null" ]; then
     printf '%s\n' "$tool_versions" > "$worktree_target/.tool-versions"
   fi
+  if [ -d "$worktree_target/.git" ] && [ ! -L "$worktree_target/.git" ]; then
+    share_task_tree_with_container "$worktree_target/.git" \
+      "standalone task Git repository"
+  fi
 
   release_project_lock
 done < <(jq -c '.[]' <<<"$projects_json")
 
+# Git and the checked-out files were created by the host. Reconcile their
+# group/modes only after every host Git operation and before Compose exposes
+# them to uid 1000. The host-only marker avoids recursively walking a large
+# workspace (for example node_modules) on every resume, while its gid payload
+# forces a fresh pass if the task moves to a differently-grouped host. This
+# first pass self-heals 0.9.2 task repos whose mktemp config was mode 0600 on a
+# uid-501 macOS host. The sanitizer above repairs its rewritten control files
+# on every later resume.
+step "WORKTREE_FAILED" "share task files with container"
+mkdir -p "$task_uai_dir"
+# The shared group may be a broad host group (for example macOS `staff`). Keep
+# its writable leaves behind host-only parents; Docker bind-mounts the exact
+# workspace/repository roots, so node does not need host-path traversal here.
+chmod 700 "$task_dir" "$task_uai_dir"
+filesystem_group_marker="$task_uai_dir/container-filesystem-group-v1"
+marked_container_gid=""
+if [ -L "$filesystem_group_marker" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Uai refused a symbolic-link task filesystem marker" \
+    "share task files with container"
+elif [ -f "$filesystem_group_marker" ]; then
+  marked_container_gid=$(cat "$filesystem_group_marker" 2>/dev/null || true)
+elif [ -e "$filesystem_group_marker" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Uai refused a non-file task filesystem marker" \
+    "share task files with container"
+fi
+if [ "$marked_container_gid" != "$task_container_gid" ]; then
+  share_task_tree_with_container "$task_workspace" "task workspace"
+  filesystem_group_marker_tmp=$(mktemp \
+    "$task_uai_dir/.container-filesystem-group.XXXXXX")
+  printf '%s\n' "$task_container_gid" > "$filesystem_group_marker_tmp"
+  chmod 600 "$filesystem_group_marker_tmp"
+  mv -f "$filesystem_group_marker_tmp" "$filesystem_group_marker"
+else
+  # A container may have changed a mount root's mode. These two O(1) repairs
+  # keep entry into the already-normalized trees reliable without walking them.
+  share_task_entry_with_container "$task_workspace" "task workspace root"
+fi
+# Task repos are repacked, so this tree stays small; normalize it every time.
+# Unlike the workspace pass, this covers Git metadata created during the host
+# refresh and any loose objects/locks written by the prior container.
+share_task_tree_with_container "$task_uai_dir/repos" \
+  "task-private Git repositories"
+
 if [ -z "$github_credential_socket" ] && [ "$uai_used_ssh_transport" = "1" ]; then
   uai_git_transport="ssh"
 fi
@@ -872,6 +1005,11 @@ fi
     printf '    pull_policy: never\n'
   fi
   printf '    init: true\n'
+  # Give node the one host group that owns this task's bind-mounted files.
+  # Numeric group_add works even when the group has a different name (or no
+  # name) in the image. Root hosts use node's existing gid 1000 above.
+  printf '    group_add:\n'
+  printf '      - "%s"\n' "$task_container_gid"
   printf '    working_dir: /workspace\n'
   printf '    volumes:\n'
   printf '      - "%s:/workspace"\n' "$task_workspace"
@@ -953,7 +1091,7 @@ fi
       GIT_CONFIG* | GIT_DIR | GIT_WORK_TREE | GIT_COMMON_DIR | \
       GIT_OBJECT_DIRECTORY | GIT_ALTERNATE_OBJECT_DIRECTORIES | \
       GIT_INDEX_FILE | GIT_EXEC_PATH | GIT_ASKPASS | SSH_ASKPASS | \
-      GIT_SSH | GIT_SSH_COMMAND | HOME | XDG_CONFIG_HOME | \
+      GIT_SSH | GIT_SSH_COMMAND | HOME | XDG_CONFIG_HOME | XDG_DATA_HOME | \
       BASH_ENV | ENV | UAI_GIT_TRANSPORT | \
       CLAUDE_CODE_OAUTH_TOKEN | ANTHROPIC_API_KEY | \
       ANTHROPIC_AUTH_TOKEN | XAI_API_KEY | PLAYWRIGHT_BROWSERS_PATH) continue ;;
@@ -1042,6 +1180,7 @@ compose_env_override=$(printf '%s' "$project_env_json" | jq -c \
         .GIT_SSH_COMMAND,
         .HOME,
         .XDG_CONFIG_HOME,
+        .XDG_DATA_HOME,
         .BASH_ENV,
         .ENV,
         .UAI_GIT_TRANSPORT,
@@ -1078,6 +1217,7 @@ managed_exec_env=(
   -e "GH_CONFIG_DIR=$managed_gh_config_dir"
   -e "PATH=/usr/bin:/bin"
   -e "XDG_CONFIG_HOME="
+  -e "XDG_DATA_HOME="
   -e "LD_PRELOAD="
   -e "LD_LIBRARY_PATH="
   -e "DYLD_INSERT_LIBRARIES="
@@ -1104,6 +1244,36 @@ managed_clean_env=(
   "PATH=/usr/bin:/bin"
 )
 
+# Git rejects a repository owned by another uid even when its shared group is
+# writable. Trust only the selected worktrees in this task container—never `*`
+# and never the host cache. The task-private ~/.gitconfig makes these entries
+# local to this container, and the read-before-add keeps resumes idempotent.
+step "CONTAINER_INIT_FAILED" "trust task Git worktrees"
+container_safe_dirs=$(docker exec -u node "${managed_exec_env[@]}" \
+  "$app_container" "${managed_clean_env[@]}" /usr/bin/git config --global \
+  --get-all safe.directory 2>/dev/null || true)
+while IFS= read -r safe_project; do
+  [ -n "$safe_project" ] || continue
+  safe_project_id=$(jq -r '.id' <<<"$safe_project")
+  safe_project_slug=$(jq -r '.slug' <<<"$safe_project")
+  for safe_worktree in \
+    "/workspace/$safe_project_slug" \
+    "$task_workspace/$safe_project_slug" \
+    "$task_uai_dir/repos/$safe_project_id.git"; do
+    if ! printf '%s\n' "$container_safe_dirs" \
+      | grep -Fqx -- "$safe_worktree"; then
+      if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
+        "${managed_clean_env[@]}" /usr/bin/git config --global --add \
+        safe.directory "$safe_worktree" >/dev/null; then
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Uai could not mark $safe_worktree as this task's trusted Git path" \
+          "trust task Git worktrees"
+      fi
+      container_safe_dirs="${container_safe_dirs}"$'\n'"${safe_worktree}"
+    fi
+  done
+done < <(jq -c '.[]' <<<"$projects_json")
+
 # A failed/retried start can preserve a container that still holds a previous
 # account. Erase that Uai-managed state first for both connected and
 # disconnected starts; otherwise a no-credential resume could briefly reuse a