@runuai/host 0.9.46 → 0.9.48

package/lib/engine-accounts.ts

@@ -592,6 +592,69 @@ export function addEngineAccount(
   };
 }
 
+/**
+ * ADR-116: register an EXTRA Codex account from a browser-login capture — the
+ * verbatim `auth.json` a `codex login` flow produced (OAuth tokens, not an
+ * API key), written into the same isolated `~/.codex-acct-<id>` layout the
+ * pasted-key path uses. Callers pass the file CONTENTS; nothing is logged.
+ */
+export function addCodexAccountFromAuthJson(
+  label: string,
+  authJson: string,
+  seams: Partial<AccountSeams> = {},
+): AddAccountResult {
+  const s = withDefaults(seams);
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  try {
+    const parsed: unknown = JSON.parse(authJson);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("not an object");
+    }
+  } catch {
+    return { ok: false, message: "The captured Codex credential is not valid." };
+  }
+
+  const id = newId();
+  const d = KINDS.codex as KindDescriptor;
+  const hostDir = (d.extraHostDir as (o: string, i: string) => string)(
+    s.ownerHome(),
+    id,
+  );
+  try {
+    const file = join(hostDir, "auth.json");
+    mkdirSync(hostDir, { recursive: true });
+    writeFileSync(file, authJson.endsWith("\n") ? authJson : `${authJson}\n`, {
+      mode: 0o600,
+    });
+    try {
+      chmodSync(file, 0o600);
+    } catch {
+      /* best effort */
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      message: `Could not write the account config: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind: "codex",
+      label: trimmedLabel,
+      authKind: "config-dir",
+      secretEnc: null,
+      configDir: hostDir,
+      createdAt: Date.now(),
+    })
+    .run();
+  return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
+}
+
 /** Remove an EXTRA account (idempotent). The synthesized default can't be
  *  removed here (use the engine disconnect flow for the legacy slot). The
  *  isolated host config dir of a config-dir account is deleted too. */

package/lib/engine-login.ts

@@ -17,6 +17,7 @@ import {
   mkdtemp,
   open,
   readdir,
+  readFile,
   realpath,
   rename,
   rm,
@@ -26,6 +27,7 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 
 import {
+  isEngineAccountLabel,
   isHostOpId,
   MAX_ENGINE_LOGIN_QUERY_CHARS,
   MAX_ENGINE_LOGIN_TEXT_CHARS,
@@ -35,6 +37,10 @@ import {
   type EngineLoginEventFrame,
   type EngineLoginKind,
 } from "../src/protocol";
+import {
+  addCodexAccountFromAuthJson,
+  addEngineAccount,
+} from "./engine-accounts";
 import { reinjectCodexRunningTasks } from "./codex-auth";
 import {
   appleContainerRuntimeBinding,
@@ -125,6 +131,9 @@ export interface EngineLoginSeams {
   reconcileStaleContainers(): Promise<void>;
   persistClaudeToken(token: string): Promise<void>;
   persistCodexAuth(sourceFile: string): Promise<void>;
+  /** ADR-116: labeled extra-account captures (never the default slots). */
+  addClaudeAccount(label: string, token: string): { ok: boolean; message: string };
+  addCodexAccount(label: string, authJson: string): { ok: boolean; message: string };
   refreshEngineAccountAgents(engine: "claude"): Promise<void>;
   reinjectCodexRunningTasks(): Promise<void>;
   ownerHome(): string;
@@ -178,6 +187,9 @@ interface LoginOperation {
   callbackUsed: boolean;
   pendingInput: string | null;
   callbackTarget: CodexCallbackTarget | null;
+  /** ADR-116: when set, the captured credential lands in a labeled extra
+   * account instead of the default slot. */
+  accountLabel: string | null;
 }
 
 const defaultTimers: EngineLoginTimers = {
@@ -253,6 +265,10 @@ function defaultSeams(options: EngineLoginManagerOptions): EngineLoginSeams {
       reconcileStaleEngineLoginResources({ tempRoot }),
     persistClaudeToken: (token) => persistClaudeTokenAtomic(token),
     persistCodexAuth: (sourceFile) => persistCodexAuthAtomic(sourceFile),
+    addClaudeAccount: (label, token) =>
+      addEngineAccount("claude", label, { token }),
+    addCodexAccount: (label, authJson) =>
+      addCodexAccountFromAuthJson(label, authJson),
     refreshEngineAccountAgents: options.refreshEngineAccountAgents,
     reinjectCodexRunningTasks: () => reinjectCodexRunningTasks(),
     ownerHome,
@@ -319,8 +335,16 @@ export class EngineLoginManager {
     opId: string,
     engine: EngineLoginKind,
     emit: EmitEngineLoginEvent,
+    label?: string,
   ): boolean {
     if (!isHostOpId(opId)) return false;
+    if (label !== undefined && !isEngineAccountLabel(label)) {
+      safeEmit(
+        emit,
+        failedEvent(opId, engine, "start_failed", "The account label is invalid."),
+      );
+      return false;
+    }
     if (this.operations.has(opId)) {
       safeEmit(emit, failedEvent(opId, engine, "unavailable", "Login operation already exists."));
       return false;
@@ -366,6 +390,7 @@ export class EngineLoginManager {
       callbackUsed: false,
       pendingInput: null,
       callbackTarget: null,
+      accountLabel: label ?? null,
     };
     this.operations.set(opId, operation);
     this.engineOperations.set(engine, operation);
@@ -687,6 +712,28 @@ export class EngineLoginManager {
     token: string,
   ): Promise<void> {
     let terminal: EngineLoginEventFrame;
+    if (operation.accountLabel !== null) {
+      // ADR-116: labeled capture — an extra account, not the default slot.
+      // Extras are picked up at the next agent spawn / rotation, so no
+      // running-agent refresh is needed (mirrors the local accounts API).
+      const added = this.seams.addClaudeAccount(operation.accountLabel, token);
+      terminal = added.ok
+        ? {
+            kind: "engine.login.event",
+            opId: operation.opId,
+            engine: operation.engine,
+            phase: "succeeded",
+            message: added.message,
+          }
+        : failedEvent(
+            operation.opId,
+            operation.engine,
+            "persist_failed",
+            added.message,
+          );
+      await this.finishCommit(operation, terminal);
+      return;
+    }
     try {
       await this.seams.persistClaudeToken(token);
     } catch {
@@ -730,6 +777,39 @@ export class EngineLoginManager {
     const tempDir = operation.tempDir;
     if (!tempDir) return;
     let terminal: EngineLoginEventFrame;
+    if (operation.accountLabel !== null) {
+      // ADR-116: labeled capture — the auth.json this login produced becomes
+      // an isolated extra account instead of overwriting ~/.codex.
+      let added: { ok: boolean; message: string };
+      try {
+        const contents = await readFile(
+          join(tempDir, "codex", "auth.json"),
+          "utf8",
+        );
+        added = this.seams.addCodexAccount(operation.accountLabel, contents);
+      } catch {
+        added = {
+          ok: false,
+          message: "Codex authorized, but its credential could not be read.",
+        };
+      }
+      terminal = added.ok
+        ? {
+            kind: "engine.login.event",
+            opId: operation.opId,
+            engine: operation.engine,
+            phase: "succeeded",
+            message: added.message,
+          }
+        : failedEvent(
+            operation.opId,
+            operation.engine,
+            "persist_failed",
+            added.message,
+          );
+      await this.finishCommit(operation, terminal);
+      return;
+    }
     try {
       await this.seams.persistCodexAuth(
         join(tempDir, "codex", "auth.json"),
@@ -770,6 +850,10 @@ export class EngineLoginManager {
       await operation.finishPromise;
       return;
     }
+    // ADR-116: attach the CLI's last visible line — a remote operator staring
+    // at "Waiting for the host…" (live 2026-08-20, apple-container) otherwise
+    // has zero evidence of where the flow died.
+    const evidence = lastSignificantOutputLine(operation.outputTail);
     this.detach(operation);
     safeEmit(operation.emit, {
       kind: "engine.login.event",
@@ -777,7 +861,9 @@ export class EngineLoginManager {
       engine: operation.engine,
       phase: "timed_out",
       errorCode: "timeout",
-      message: "Login timed out.",
+      message: evidence
+        ? `Login timed out. Last output: ${evidence}`
+        : "Login timed out.",
     });
     await this.ensureSettlement(operation);
   }
@@ -916,6 +1002,22 @@ export function createEngineLoginManager(
   return new EngineLoginManager(options);
 }
 
+/** The last visible, sanitized line of the login CLI's output — bounded and
+ * secret-checked so it can ride a terminal event message (ADR-116). Anything
+ * token-shaped disqualifies the whole line rather than risking a partial. */
+function lastSignificantOutputLine(tail: string): string | null {
+  const lines = tail
+    .replace(/\u001b\[[0-9;?]*[ -\/]*[@-~]/g, "")
+    .replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 3);
+  const last = lines.at(-1);
+  if (!last) return null;
+  if (/sk-ant-|Bearer |[A-Za-z0-9_-]{40,}/.test(last)) return null;
+  return last.slice(0, 200);
+}
+
 function safeEmit(
   emit: EmitEngineLoginEvent,
   event: EngineLoginEventFrame,

package/lib/standard-image-pin.ts

@@ -0,0 +1,204 @@
+/**
+ * ADR-114: the standard image is prebuilt in CI and pulled by digest.
+ *
+ * This module is the shared identity/grammar core, deliberately free of any
+ * host runtime import so the release-side identity script and the unit tests
+ * can load it without dragging the container-runtime graph along. Everything
+ * here is consumed from three places:
+ *
+ *   - CI (`host-agent/scripts/release/standard-image-identity.ts`) computes
+ *     the superset context hash and the registry tag to build/push.
+ *   - Release packaging (`scripts/host-runtime/stage.mjs`) embeds a validated
+ *     pin file in the signed payload (its .mjs copy of the grammar cites this
+ *     module as authoritative).
+ *   - The host (`standard-image.ts`) reads the packaged pin and pulls by
+ *     digest instead of building, falling back to the local build.
+ */
+
+import { createHash } from "node:crypto";
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+/** Image label carrying the build-context content hash (rebuild trigger). */
+export const CONTEXT_HASH_LABEL = "com.runuai.context-hash";
+
+/** The public registry repository CI publishes the prebuilt image to. */
+export const STANDARD_IMAGE_RELEASE_REF = "ghcr.io/runuai/uai-standard";
+
+/** Pin file basename; packaged at `agent/images/<basename>` in the payload,
+ * one directory above the build context so it never perturbs the hash. */
+export const STANDARD_IMAGE_PIN_BASENAME = "standard-image.pin.json";
+
+/**
+ * The prebuilt image is the SUPERSET: every optional engine baked in. The
+ * layers are additive and non-fatal, a disabled engine is simply never
+ * invoked, and superset-vs-config means one published image serves every
+ * host — and toggling an engine on stops forcing a host-side rebuild.
+ */
+export const STANDARD_IMAGE_SUPERSET_EXTRA =
+  "kimi=1;grok=1;cursor=1;opencode=1";
+
+export const STANDARD_IMAGE_SUPERSET_BUILD_ARGS: readonly string[] = [
+  "INSTALL_KIMI=1",
+  "INSTALL_GROK=1",
+  "INSTALL_CURSOR=1",
+  "INSTALL_OPENCODE=1",
+];
+
+export interface StandardImagePin {
+  readonly ref: string;
+  readonly digest: string;
+  readonly contextHash: string;
+  /**
+   * Per-architecture image digests. A host pulls ITS OWN architecture's
+   * digest — pulling the manifest-list digest stores a two-variant image on
+   * the Apple runtime, and task-up's apple guard refuses any task image with
+   * more than one variant (found live on the Air's first task, 2026-08-20).
+   * Optional so a list-only pin still works on Docker via `digest`.
+   */
+  readonly platforms?: { readonly arm64?: string; readonly x64?: string };
+}
+
+// The pin arrives inside a signature-verified payload; this grammar is
+// defense-in-depth so no parsed field can smuggle registry ports, tags,
+// or shell-significant bytes into an engine command line.
+const REF_PATTERN = /^[a-z0-9]+(?:[a-z0-9._-]*[a-z0-9])?(?:\/[a-z0-9]+(?:[a-z0-9._-]*[a-z0-9])?)+$/;
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const CONTEXT_HASH_PATTERN = /^[a-f0-9]{32}$/;
+
+/** Strict parse of a pin document; null on ANY deviation. */
+export function parseStandardImagePin(raw: string): StandardImagePin | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const { ref, digest, contextHash, platforms } = parsed as Record<
+    string,
+    unknown
+  >;
+  if (
+    typeof ref !== "string" ||
+    typeof digest !== "string" ||
+    typeof contextHash !== "string" ||
+    !REF_PATTERN.test(ref) ||
+    !DIGEST_PATTERN.test(digest) ||
+    !CONTEXT_HASH_PATTERN.test(contextHash)
+  ) {
+    return null;
+  }
+  let parsedPlatforms: { arm64?: string; x64?: string } | undefined;
+  if (platforms !== undefined) {
+    if (typeof platforms !== "object" || platforms === null) return null;
+    parsedPlatforms = {};
+    for (const arch of ["arm64", "x64"] as const) {
+      const value = (platforms as Record<string, unknown>)[arch];
+      if (value === undefined) continue;
+      if (typeof value !== "string" || !DIGEST_PATTERN.test(value)) return null;
+      parsedPlatforms[arch] = value;
+    }
+  }
+  return {
+    ref,
+    digest,
+    contextHash,
+    ...(parsedPlatforms ? { platforms: parsedPlatforms } : {}),
+  };
+}
+
+/**
+ * The digest a given host should pull: its own architecture's single-variant
+ * image when the pin carries one, else the manifest list. Docker resolves a
+ * list to the native variant; the Apple runtime stores the whole index, which
+ * task-up's one-variant guard then refuses — so arch digests win.
+ */
+export function standardImagePullDigest(
+  pin: StandardImagePin,
+  arch: string = process.arch,
+): string {
+  if (arch === "arm64" || arch === "x64") {
+    const platformDigest = pin.platforms?.[arch];
+    if (platformDigest !== undefined) return platformDigest;
+  }
+  return pin.digest;
+}
+
+/** The exact engine argv for pulling and tagging the pinned image. Docker
+ * and the Apple `container` CLI differ only in the `image` subcommand prefix. */
+export function standardImagePullCommands(
+  pin: StandardImagePin,
+  targetTag: string,
+  apple: boolean,
+  arch: string = process.arch,
+): { pull: string[]; tag: string[] } {
+  const source = `${pin.ref}@${standardImagePullDigest(pin, arch)}`;
+  return apple
+    ? {
+        pull: ["image", "pull", source],
+        tag: ["image", "tag", source, targetTag],
+      }
+    : { pull: ["pull", source], tag: ["tag", source, targetTag] };
+}
+
+/**
+ * Content-hash a standard-image build context: every file under the context
+ * dir, sorted by relative path, plus an `extra` string carrying the build-arg
+ * configuration (part of the image identity). Null when the context can't be
+ * read — callers keep whatever image exists.
+ */
+export async function hashStandardImageContext(
+  contextDir: string,
+  extra = "",
+): Promise<string | null> {
+  try {
+    const files: string[] = [];
+    const walk = async (dir: string, prefix: string): Promise<void> => {
+      for (const entry of await readdir(dir, { withFileTypes: true })) {
+        const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) await walk(join(dir, entry.name), rel);
+        else files.push(rel);
+      }
+    };
+    await walk(contextDir, "");
+    files.sort();
+    const hash = createHash("sha256");
+    for (const rel of files) {
+      hash.update(rel);
+      hash.update("\0");
+      hash.update(await readFile(join(contextDir, rel)));
+      hash.update("\0");
+    }
+    hash.update(extra);
+    hash.update("\0");
+    return hash.digest("hex").slice(0, 32);
+  } catch {
+    return null;
+  }
+}
+
+/** Everything CI needs to build/push/pin one release image, or null when the
+ * context is unreadable (a broken checkout must fail the release loudly). */
+export async function standardImageReleaseIdentity(
+  contextDir: string,
+): Promise<{
+  ref: string;
+  tag: string;
+  contextHash: string;
+  label: string;
+  buildArgs: readonly string[];
+} | null> {
+  const contextHash = await hashStandardImageContext(
+    contextDir,
+    STANDARD_IMAGE_SUPERSET_EXTRA,
+  );
+  if (contextHash === null) return null;
+  return {
+    ref: STANDARD_IMAGE_RELEASE_REF,
+    tag: `ctx-${contextHash}`,
+    contextHash,
+    label: `${CONTEXT_HASH_LABEL}=${contextHash}`,
+    buildArgs: STANDARD_IMAGE_SUPERSET_BUILD_ARGS,
+  };
+}

package/lib/standard-image.ts

@@ -17,9 +17,8 @@
  */
 
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
-import { readdir, readFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -36,6 +35,15 @@ import {
   pinnedContainerRuntimeProvider,
 } from "./container-runtime";
 import { KeyedPromiseTail } from "./keyed-promise-tail";
+import {
+  CONTEXT_HASH_LABEL,
+  hashStandardImageContext,
+  parseStandardImagePin,
+  STANDARD_IMAGE_PIN_BASENAME,
+  type StandardImagePin,
+  standardImagePullCommands,
+  standardImagePullDigest,
+} from "./standard-image-pin";
 
 /** Pinned, host-wide constants (must match task-up.sh and the compose gen). */
 export const STANDARD_IMAGE_TAG = "uai-standard:dev";
@@ -90,14 +98,6 @@ export function standardRuntimes(): Array<{
   }));
 }
 
-/** Image label carrying the build-context content hash (rebuild trigger). */
-const CONTEXT_HASH_LABEL = "com.runuai.context-hash";
-
-/**
- * Content-hash the build context (every file under images/standard, sorted
- * by relative path). Null when the context can't be read — the caller then
- * keeps whatever image exists.
- */
 /**
  * Which OPTIONAL agent CLIs the operator has actually configured — so the
  * image installs only those, not every engine on every host. Delegates to
@@ -130,34 +130,36 @@ function optionalEngineConfigurationKey(
   return JSON.stringify(engines);
 }
 
-async function hashBuildContext(extra = ""): Promise<string | null> {
+// Build args (which optional engines are installed) are part of the image
+// identity — a config change must invalidate the label so it rebuilds. The
+// walk-and-hash itself lives in standard-image-pin.ts so CI computes the
+// identical identity (ADR-114).
+function hashBuildContext(extra = ""): Promise<string | null> {
+  return hashStandardImageContext(standardImageDir(), extra);
+}
+
+/** The packaged digest pin (ADR-114) at `agent/images/standard-image.pin.json`,
+ * one level above the build context so it never perturbs the context hash.
+ * Absent in dev checkouts and npm installs — those keep the local build.
+ * `UAI_IMAGE_PULL=0` is the operator kill switch back to local semantics. */
+async function readStandardImagePin(): Promise<StandardImagePin | null> {
+  if (process.env.UAI_IMAGE_PULL === "0") return null;
+  let raw: string;
   try {
-    const root = standardImageDir();
-    const files: string[] = [];
-    const walk = async (dir: string, prefix: string): Promise<void> => {
-      for (const entry of await readdir(dir, { withFileTypes: true })) {
-        const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-        if (entry.isDirectory()) await walk(join(dir, entry.name), rel);
-        else files.push(rel);
-      }
-    };
-    await walk(root, "");
-    files.sort();
-    const hash = createHash("sha256");
-    for (const rel of files) {
-      hash.update(rel);
-      hash.update("\0");
-      hash.update(await readFile(join(root, rel)));
-      hash.update("\0");
-    }
-    // Build args (which optional engines are installed) are part of the image
-    // identity — a config change must invalidate the label so it rebuilds.
-    hash.update(extra);
-    hash.update("\0");
-    return hash.digest("hex").slice(0, 32);
+    raw = await readFile(
+      resolve(standardImageDir(), "..", STANDARD_IMAGE_PIN_BASENAME),
+      "utf8",
+    );
   } catch {
     return null;
   }
+  const pin = parseStandardImagePin(raw);
+  if (pin === null) {
+    console.warn(
+      "[host-agent] packaged standard-image pin is malformed; using the local build path",
+    );
+  }
+  return pin;
 }
 
 /** Absolute path to the standard image build context. */
@@ -201,7 +203,18 @@ interface RunResult {
 
 const SHORT_DOCKER_TIMEOUT_MS = 30_000;
 const CLI_MAINTENANCE_TIMEOUT_MS = 10 * 60_000;
-const IMAGE_BUILD_TIMEOUT_MS = 15 * 60_000;
+// Overridable ceiling: the hard-coded 15 minutes looped a fanless Air forever
+// (live 2026-08-19 — every attempt died at 15:00 and the activation driver
+// silently restarted it). Slow hardware needs a bigger window, not a loop.
+const IMAGE_BUILD_TIMEOUT_MS = imageBuildTimeoutMs();
+function imageBuildTimeoutMs(): number {
+  const minutes = Number(process.env.UAI_IMAGE_BUILD_TIMEOUT_MINUTES ?? "");
+  if (Number.isFinite(minutes) && minutes >= 1) {
+    return Math.min(minutes, 240) * 60_000;
+  }
+  return 15 * 60_000;
+}
+const IMAGE_PULL_TIMEOUT_MS = 15 * 60_000;
 const TERMINATE_GRACE_MS = 5_000;
 export const ASDF_MAINTENANCE_LOCK_PATH =
   "/opt/asdf-data/.uai-maintenance.lock";
@@ -1233,7 +1246,59 @@ async function ensureStandardImageInner(
     };
   }
   if (inspect.code !== 0) labeledHash = null;
-  if (inspect.code === 0 && contextHash !== null && labeledHash === contextHash) {
+
+  // ADR-114: when the payload pins a prebuilt digest, the pin decides image
+  // identity — the label must equal the PIN's context hash (the CI superset
+  // hash, not this host's per-config hash, which would disagree by design
+  // and rebuild forever). Any pull-path failure falls through to the local
+  // build below, so offline and registry-down hosts behave exactly as today.
+  const pin = await readStandardImagePin();
+  if (pin !== null) {
+    if (inspect.code === 0 && labeledHash === pin.contextHash) {
+      console.log(
+        `[host-agent] standard image ${STANDARD_IMAGE_TAG} current (pinned)`,
+      );
+      imageReady = true;
+    } else {
+      const pullDigest = standardImagePullDigest(pin);
+      console.log(
+        `[host-agent] pulling standard image ${pin.ref}@${pullDigest}`,
+      );
+      const commands = standardImagePullCommands(
+        pin,
+        STANDARD_IMAGE_TAG,
+        engine.apple,
+      );
+      const pulled = await run(
+        engine.command,
+        commands.pull,
+        IMAGE_PULL_TIMEOUT_MS,
+      );
+      if (pulled.code === 0) {
+        const tagged = await run(engine.command, commands.tag);
+        if (tagged.code === 0) {
+          console.log(
+            `[host-agent] pulled standard image ${STANDARD_IMAGE_TAG} (${pullDigest.slice(0, 19)}…)`,
+          );
+          imageReady = true;
+        } else {
+          console.warn(
+            "[host-agent] pulled standard image could not be tagged; " +
+              `falling back to a local build. ${tagged.stderr.trim()}`,
+          );
+        }
+      } else {
+        console.warn(
+          "[host-agent] standard image pull failed; falling back to a " +
+            `local build. ${pulled.stderr.trim()}`,
+        );
+      }
+    }
+  }
+
+  if (imageReady) {
+    // Pinned image adopted — skip the local-hash decision entirely.
+  } else if (inspect.code === 0 && contextHash !== null && labeledHash === contextHash) {
     console.log(`[host-agent] standard image ${STANDARD_IMAGE_TAG} current`);
     imageReady = true;
   } else if (inspect.code === 0 && contextHash === null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.46",
+  "version": "0.9.48",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -667,9 +667,10 @@ git_host_control() (
   # This helper is for local repository bookkeeping and public/local remotes.
   # It must never inherit the operator's SSH agent or credential helper. Every
   # authenticated GitHub fetch goes through one of the explicit helpers above.
-  GIT_CONFIG_COUNT=2 \
+  GIT_CONFIG_COUNT=3 \
   GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/dev/null \
   GIT_CONFIG_KEY_1=core.fsmonitor GIT_CONFIG_VALUE_1=false \
+  GIT_CONFIG_KEY_2=advice.defaultBranchName GIT_CONFIG_VALUE_2=false \
   GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
     -c credential.helper= \
     "$@"

package/src/index.ts

@@ -101,6 +101,8 @@ export type {
   TaskUpResult,
 } from "../lib/agent";
 
+import { removeEngineAccount } from "../lib/engine-accounts";
+
 export {
   parseMentions,
   resolveAddressing,
@@ -1029,6 +1031,22 @@ export const hostCommands: HostCommands = {
     });
   },
 
+  // ADR-116: remove a labeled engine account. Delegates to the same internals
+  // the local UI uses; `default:*` refusal and idempotency live there. The
+  // dispatcher re-advertises capabilities after an ok result.
+  async engineAccountRemove(ctx, input) {
+    logCommand(ctx, "engineAccountRemove", input.id);
+    try {
+      const result = removeEngineAccount(input.id);
+      if (!result.ok) {
+        return ok({ removed: false, message: result.message });
+      }
+      return ok({ removed: true });
+    } catch (err) {
+      return failFromUnknown(err);
+    }
+  },
+
   async channelResolvePermission(ctx, taskId, agentId, requestId, decision) {
     logCommand(ctx, "channelResolvePermission", taskId, agentId, requestId);
     try {

package/src/main.ts

@@ -143,6 +143,7 @@ import {
   patchHostConfig,
   type HostConfigResult,
 } from "../lib/host-config";
+import { listEngineAccounts } from "../lib/engine-accounts";
 import { createEngineLoginManager } from "../lib/engine-login";
 // Importing the real factory triggers the built-in adapters' register()
 // calls (claude, codex), so the registry is populated before we advertise.
@@ -164,9 +165,13 @@ import {
   GITHUB_REPOSITORY_ACCESS_PROTOCOL_FEATURE,
   HOST_MAINTENANCE_READINESS_PROTOCOL_FEATURE,
   HOST_CONFIG_PROTOCOL_FEATURE,
+  HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
   HOST_LOGS_PROTOCOL_FEATURE,
   HOST_TASK_INVENTORY_PROTOCOL_FEATURE,
+  MAX_ENGINE_ACCOUNT_LABEL_CHARS,
+  MAX_ENGINE_ACCOUNTS_ADVERTISED,
+  type EngineAccountSummary,
   MAX_HOST_TASK_INVENTORY_PAGE_SIZE,
   MCP_GATEWAY_HEALTH_PROTOCOL_FEATURE,
   SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE,
@@ -543,6 +548,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_LOGS_PROTOCOL_FEATURE,
       HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
       HOST_CONFIG_PROTOCOL_FEATURE,
+      HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
       // dispatch in mock mode would let the composer create a Secretary that
       // has no way to wake crew.
@@ -558,10 +564,34 @@ function buildCapabilities(): HostCapabilities {
     maintenanceReady: areAgentClisReady(),
     mcpGateway: mcpGateway.state(),
     engineLogins: engineLoginManager.capabilities(),
+    engineAccounts: engineAccountSummaries(),
     githubUsers: connectedUserIds(),
   };
 }
 
+/** ADR-116: the labeled-accounts advertisement — bounded, labels-only. */
+function engineAccountSummaries(): EngineAccountSummary[] {
+  const summaries: EngineAccountSummary[] = [];
+  for (const kind of ["claude", "codex", "opencode"] as const) {
+    try {
+      for (const account of listEngineAccounts(kind)) {
+        summaries.push({
+          id: account.id,
+          kind,
+          label: account.label.slice(0, MAX_ENGINE_ACCOUNT_LABEL_CHARS),
+          authKind: account.authKind,
+          isDefault: account.isDefault,
+        });
+      }
+    } catch (error) {
+      console.warn(
+        `[host-agent] listing ${kind} accounts for capabilities failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+  return summaries.slice(0, MAX_ENGINE_ACCOUNTS_ADVERTISED);
+}
+
 /**
  * Re-advertise capabilities on the active connection. Safe to call any time;
  * a no-op when no socket is connected/open (the next `connect()` re-sends on
@@ -1074,6 +1104,7 @@ async function connect(): Promise<void> {
           frame.opId,
           frame.engine,
           emitEngineLoginEvent,
+          frame.label,
         );
         break;
       case "engine.login.input":
@@ -2093,7 +2124,7 @@ function sendTunnelData(
   }
 }
 
-function dispatchCommand(
+async function dispatchCommand(
   ctx: CommandContext,
   command: keyof HostCommands,
   args: unknown[],
@@ -2163,7 +2194,34 @@ function dispatchCommand(
         expectString(args, 1),
         expectNumberArg(args, 2),
       );
+    case "engineAccountRemove": {
+      // ADR-116: mirror the local API's post-mutation behavior — the cloud's
+      // account list self-heals through the capability re-advertisement.
+      const removal = await hostCommands.engineAccountRemove(
+        ctx,
+        expectEngineAccountRemoveInput(args, 0),
+      );
+      if (removal.ok) sendCapabilities();
+      return removal;
+    }
+  }
+}
+
+function expectEngineAccountRemoveInput(
+  args: unknown[],
+  index: number,
+): { id: string } {
+  const value = args[index];
+  if (
+    !value ||
+    typeof value !== "object" ||
+    typeof (value as { id?: unknown }).id !== "string" ||
+    (value as { id: string }).id.length === 0 ||
+    (value as { id: string }).id.length > 256
+  ) {
+    throw new Error(`invalid command args: expected account id at ${index}`);
   }
+  return { id: (value as { id: string }).id };
 }
 
 function expectNumberArg(args: unknown[], index: number): number {
@@ -2655,6 +2713,7 @@ function isHostCommand(command: string): command is keyof HostCommands {
     "channelInterrupt",
     "appendTranscript",
     "previewEnsure",
+    "engineAccountRemove",
   ].includes(command);
 }
 

package/src/protocol.ts

@@ -86,6 +86,12 @@ export const MCP_GATEWAY_HEALTH_PROTOCOL_FEATURE = "mcp-gateway-health-v1";
 export const HOST_LOGS_PROTOCOL_FEATURE = "host-logs-v1";
 export const HOST_ENGINE_LOGIN_PROTOCOL_FEATURE = "host-engine-login-v1";
 export const HOST_CONFIG_PROTOCOL_FEATURE = "host-config-v1";
+/** ADR-116: labeled engine accounts on the cloud host page — account list in
+ * capabilities, account-targeted login (`label` on engine.login.start), and
+ * the engineAccountRemove command. */
+export const HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE = "host-engine-accounts-v1";
+export const MAX_ENGINE_ACCOUNT_LABEL_CHARS = 64;
+export const MAX_ENGINE_ACCOUNTS_ADVERTISED = 48;
 export const MAX_HOST_OP_ID_CHARS = 128;
 export const MAX_HOST_LOG_LINES = 1_000;
 export const MAX_HOST_LOG_LINE_BYTES = 4 * 1_024;
@@ -282,6 +288,10 @@ export interface EngineLoginStartFrame {
   kind: "engine.login.start";
   opId: HostOpId;
   engine: EngineLoginKind;
+  /** ADR-116: capture into a labeled extra account instead of the default
+   * slot. Only sent to hosts advertising `host-engine-accounts-v1`; the v1
+   * exact-shape guard on older hosts rejects frames carrying it. */
+  label?: string;
 }
 
 /** The only generic one-time response channel. Long-lived tokens must never
@@ -343,6 +353,16 @@ export interface EngineLoginCapability {
   loginSupported: true;
 }
 
+/** ADR-116: one labeled engine account, as advertised in capabilities.
+ * Operator-chosen label + shape metadata only — never credentials. */
+export interface EngineAccountSummary {
+  id: string;
+  kind: "claude" | "codex" | "opencode";
+  label: string;
+  authKind: "env" | "config-dir";
+  isDefault: boolean;
+}
+
 /** The exact local host settings ADR-100 permits over the bridge. */
 export interface HostConfigState {
   agentCliAutoupdate: boolean;
@@ -530,12 +550,26 @@ export function isHostLogsEndFrame(value: unknown): value is HostLogsEndFrame {
 export function isEngineLoginStartFrame(
   value: unknown,
 ): value is EngineLoginStartFrame {
-  const frame = exactWireObject(value, ["kind", "opId", "engine"]);
+  const frame = exactWireObject(value, ["kind", "opId", "engine"], ["label"]);
   return Boolean(
     frame &&
       frame.kind === "engine.login.start" &&
       isHostOpId(frame.opId) &&
-      isEngineLoginKind(frame.engine),
+      isEngineLoginKind(frame.engine) &&
+      (frame.label === undefined || isEngineAccountLabel(frame.label)),
+  );
+}
+
+/** ADR-116 account labels: operator-chosen display names, never secrets.
+ * Single-line, bounded, and visibly printable so they render safely in every
+ * surface (capability frames, UI chips, log lines). */
+export function isEngineAccountLabel(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length >= 1 &&
+    value.length <= MAX_ENGINE_ACCOUNT_LABEL_CHARS &&
+    value.trim() === value &&
+    !/[\u0000-\u001f\u007f]/.test(value)
   );
 }
 
@@ -766,6 +800,9 @@ export interface HostCapabilities {
   mcpGateway?: McpGatewayCapability;
   /** ADR-100: feature-gated, secret-free remote login availability. */
   engineLogins?: EngineLoginCapability[];
+  /** ADR-116: labeled engine accounts (default + extras), re-advertised on
+   * every account mutation. Labels only — credentials never leave the host. */
+  engineAccounts?: EngineAccountSummary[];
   // ADR-033: cloud user ids that currently have a GitHub token ON THIS HOST —
   // the per-host gh-connected state shown on the host detail page. Re-advertised
   // whenever a token is added/removed. Optional: older hosts omit it.
@@ -1109,6 +1146,12 @@ export interface HostCommands {
     name: string,
     containerPort: number,
   ): Promise<HostCommandResult<{ hostPort: number | null }>>;
+  /** ADR-116: remove a labeled engine account by id. Refuses `default:*`
+   * exactly like the local API; re-advertises capabilities on success. */
+  engineAccountRemove(
+    ctx: CommandContext,
+    input: { id: string },
+  ): Promise<HostCommandResult<{ removed: boolean; message?: string }>>;
   cloneRepo(
     ctx: CommandContext,
     input: CloneRepoInput,