@runuai/host 0.9.47 → 0.9.49

package/lib/engine-accounts.ts

@@ -592,6 +592,69 @@ export function addEngineAccount(
   };
 }
 
+/**
+ * ADR-116: register an EXTRA Codex account from a browser-login capture — the
+ * verbatim `auth.json` a `codex login` flow produced (OAuth tokens, not an
+ * API key), written into the same isolated `~/.codex-acct-<id>` layout the
+ * pasted-key path uses. Callers pass the file CONTENTS; nothing is logged.
+ */
+export function addCodexAccountFromAuthJson(
+  label: string,
+  authJson: string,
+  seams: Partial<AccountSeams> = {},
+): AddAccountResult {
+  const s = withDefaults(seams);
+  const trimmedLabel = label.trim();
+  if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
+  try {
+    const parsed: unknown = JSON.parse(authJson);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("not an object");
+    }
+  } catch {
+    return { ok: false, message: "The captured Codex credential is not valid." };
+  }
+
+  const id = newId();
+  const d = KINDS.codex as KindDescriptor;
+  const hostDir = (d.extraHostDir as (o: string, i: string) => string)(
+    s.ownerHome(),
+    id,
+  );
+  try {
+    const file = join(hostDir, "auth.json");
+    mkdirSync(hostDir, { recursive: true });
+    writeFileSync(file, authJson.endsWith("\n") ? authJson : `${authJson}\n`, {
+      mode: 0o600,
+    });
+    try {
+      chmodSync(file, 0o600);
+    } catch {
+      /* best effort */
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      message: `Could not write the account config: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+  getDb()
+    .insert(schema.engineAccounts)
+    .values({
+      id,
+      kind: "codex",
+      label: trimmedLabel,
+      authKind: "config-dir",
+      secretEnc: null,
+      configDir: hostDir,
+      createdAt: Date.now(),
+    })
+    .run();
+  return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
+}
+
 /** Remove an EXTRA account (idempotent). The synthesized default can't be
  *  removed here (use the engine disconnect flow for the legacy slot). The
  *  isolated host config dir of a config-dir account is deleted too. */

package/lib/engine-login.ts

@@ -17,6 +17,7 @@ import {
   mkdtemp,
   open,
   readdir,
+  readFile,
   realpath,
   rename,
   rm,
@@ -26,6 +27,7 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 
 import {
+  isEngineAccountLabel,
   isHostOpId,
   MAX_ENGINE_LOGIN_QUERY_CHARS,
   MAX_ENGINE_LOGIN_TEXT_CHARS,
@@ -35,6 +37,10 @@ import {
   type EngineLoginEventFrame,
   type EngineLoginKind,
 } from "../src/protocol";
+import {
+  addCodexAccountFromAuthJson,
+  addEngineAccount,
+} from "./engine-accounts";
 import { reinjectCodexRunningTasks } from "./codex-auth";
 import {
   appleContainerRuntimeBinding,
@@ -125,6 +131,9 @@ export interface EngineLoginSeams {
   reconcileStaleContainers(): Promise<void>;
   persistClaudeToken(token: string): Promise<void>;
   persistCodexAuth(sourceFile: string): Promise<void>;
+  /** ADR-116: labeled extra-account captures (never the default slots). */
+  addClaudeAccount(label: string, token: string): { ok: boolean; message: string };
+  addCodexAccount(label: string, authJson: string): { ok: boolean; message: string };
   refreshEngineAccountAgents(engine: "claude"): Promise<void>;
   reinjectCodexRunningTasks(): Promise<void>;
   ownerHome(): string;
@@ -178,6 +187,9 @@ interface LoginOperation {
   callbackUsed: boolean;
   pendingInput: string | null;
   callbackTarget: CodexCallbackTarget | null;
+  /** ADR-116: when set, the captured credential lands in a labeled extra
+   * account instead of the default slot. */
+  accountLabel: string | null;
 }
 
 const defaultTimers: EngineLoginTimers = {
@@ -253,6 +265,10 @@ function defaultSeams(options: EngineLoginManagerOptions): EngineLoginSeams {
       reconcileStaleEngineLoginResources({ tempRoot }),
     persistClaudeToken: (token) => persistClaudeTokenAtomic(token),
     persistCodexAuth: (sourceFile) => persistCodexAuthAtomic(sourceFile),
+    addClaudeAccount: (label, token) =>
+      addEngineAccount("claude", label, { token }),
+    addCodexAccount: (label, authJson) =>
+      addCodexAccountFromAuthJson(label, authJson),
     refreshEngineAccountAgents: options.refreshEngineAccountAgents,
     reinjectCodexRunningTasks: () => reinjectCodexRunningTasks(),
     ownerHome,
@@ -319,8 +335,16 @@ export class EngineLoginManager {
     opId: string,
     engine: EngineLoginKind,
     emit: EmitEngineLoginEvent,
+    label?: string,
   ): boolean {
     if (!isHostOpId(opId)) return false;
+    if (label !== undefined && !isEngineAccountLabel(label)) {
+      safeEmit(
+        emit,
+        failedEvent(opId, engine, "start_failed", "The account label is invalid."),
+      );
+      return false;
+    }
     if (this.operations.has(opId)) {
       safeEmit(emit, failedEvent(opId, engine, "unavailable", "Login operation already exists."));
       return false;
@@ -366,6 +390,7 @@ export class EngineLoginManager {
       callbackUsed: false,
       pendingInput: null,
       callbackTarget: null,
+      accountLabel: label ?? null,
     };
     this.operations.set(opId, operation);
     this.engineOperations.set(engine, operation);
@@ -408,7 +433,13 @@ export class EngineLoginManager {
     }
     operation.inputUsed = true;
     operation.outputTail = "";
-    const value = `${text}\n`;
+    // CARRIAGE RETURN, not newline: `claude setup-token` is an Ink raw-mode
+    // TUI whose code prompt submits only on \r. A trailing \n types the code
+    // and then sits forever — reproduced live 2026-08-20 (fake code + \n →
+    // masked input, no response; the same code + \r → immediate "OAuth
+    // error: Invalid code"). Every cloud-pane Claude login ever attempted
+    // hung on exactly this.
+    const value = `${text}\r`;
     if (!operation.process) {
       operation.pendingInput = value;
       return true;
@@ -687,6 +718,28 @@ export class EngineLoginManager {
     token: string,
   ): Promise<void> {
     let terminal: EngineLoginEventFrame;
+    if (operation.accountLabel !== null) {
+      // ADR-116: labeled capture — an extra account, not the default slot.
+      // Extras are picked up at the next agent spawn / rotation, so no
+      // running-agent refresh is needed (mirrors the local accounts API).
+      const added = this.seams.addClaudeAccount(operation.accountLabel, token);
+      terminal = added.ok
+        ? {
+            kind: "engine.login.event",
+            opId: operation.opId,
+            engine: operation.engine,
+            phase: "succeeded",
+            message: added.message,
+          }
+        : failedEvent(
+            operation.opId,
+            operation.engine,
+            "persist_failed",
+            added.message,
+          );
+      await this.finishCommit(operation, terminal);
+      return;
+    }
     try {
       await this.seams.persistClaudeToken(token);
     } catch {
@@ -730,6 +783,39 @@ export class EngineLoginManager {
     const tempDir = operation.tempDir;
     if (!tempDir) return;
     let terminal: EngineLoginEventFrame;
+    if (operation.accountLabel !== null) {
+      // ADR-116: labeled capture — the auth.json this login produced becomes
+      // an isolated extra account instead of overwriting ~/.codex.
+      let added: { ok: boolean; message: string };
+      try {
+        const contents = await readFile(
+          join(tempDir, "codex", "auth.json"),
+          "utf8",
+        );
+        added = this.seams.addCodexAccount(operation.accountLabel, contents);
+      } catch {
+        added = {
+          ok: false,
+          message: "Codex authorized, but its credential could not be read.",
+        };
+      }
+      terminal = added.ok
+        ? {
+            kind: "engine.login.event",
+            opId: operation.opId,
+            engine: operation.engine,
+            phase: "succeeded",
+            message: added.message,
+          }
+        : failedEvent(
+            operation.opId,
+            operation.engine,
+            "persist_failed",
+            added.message,
+          );
+      await this.finishCommit(operation, terminal);
+      return;
+    }
     try {
       await this.seams.persistCodexAuth(
         join(tempDir, "codex", "auth.json"),
@@ -770,6 +856,10 @@ export class EngineLoginManager {
       await operation.finishPromise;
       return;
     }
+    // ADR-116: attach the CLI's last visible line — a remote operator staring
+    // at "Waiting for the host…" (live 2026-08-20, apple-container) otherwise
+    // has zero evidence of where the flow died.
+    const evidence = lastSignificantOutputLine(operation.outputTail);
     this.detach(operation);
     safeEmit(operation.emit, {
       kind: "engine.login.event",
@@ -777,7 +867,9 @@ export class EngineLoginManager {
       engine: operation.engine,
       phase: "timed_out",
       errorCode: "timeout",
-      message: "Login timed out.",
+      message: evidence
+        ? `Login timed out. Last output: ${evidence}`
+        : "Login timed out.",
     });
     await this.ensureSettlement(operation);
   }
@@ -916,6 +1008,22 @@ export function createEngineLoginManager(
   return new EngineLoginManager(options);
 }
 
+/** The last visible, sanitized line of the login CLI's output — bounded and
+ * secret-checked so it can ride a terminal event message (ADR-116). Anything
+ * token-shaped disqualifies the whole line rather than risking a partial. */
+function lastSignificantOutputLine(tail: string): string | null {
+  const lines = tail
+    .replace(/\u001b\[[0-9;?]*[ -\/]*[@-~]/g, "")
+    .replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 3);
+  const last = lines.at(-1);
+  if (!last) return null;
+  if (/sk-ant-|Bearer |[A-Za-z0-9_-]{40,}/.test(last)) return null;
+  return last.slice(0, 200);
+}
+
 function safeEmit(
   emit: EmitEngineLoginEvent,
   event: EngineLoginEventFrame,

package/lib/standard-image-pin.ts

@@ -49,6 +49,14 @@ export interface StandardImagePin {
   readonly ref: string;
   readonly digest: string;
   readonly contextHash: string;
+  /**
+   * Per-architecture image digests. A host pulls ITS OWN architecture's
+   * digest — pulling the manifest-list digest stores a two-variant image on
+   * the Apple runtime, and task-up's apple guard refuses any task image with
+   * more than one variant (found live on the Air's first task, 2026-08-20).
+   * Optional so a list-only pin still works on Docker via `digest`.
+   */
+  readonly platforms?: { readonly arm64?: string; readonly x64?: string };
 }
 
 // The pin arrives inside a signature-verified payload; this grammar is
@@ -67,7 +75,10 @@ export function parseStandardImagePin(raw: string): StandardImagePin | null {
     return null;
   }
   if (typeof parsed !== "object" || parsed === null) return null;
-  const { ref, digest, contextHash } = parsed as Record<string, unknown>;
+  const { ref, digest, contextHash, platforms } = parsed as Record<
+    string,
+    unknown
+  >;
   if (
     typeof ref !== "string" ||
     typeof digest !== "string" ||
@@ -78,7 +89,40 @@ export function parseStandardImagePin(raw: string): StandardImagePin | null {
   ) {
     return null;
   }
-  return { ref, digest, contextHash };
+  let parsedPlatforms: { arm64?: string; x64?: string } | undefined;
+  if (platforms !== undefined) {
+    if (typeof platforms !== "object" || platforms === null) return null;
+    parsedPlatforms = {};
+    for (const arch of ["arm64", "x64"] as const) {
+      const value = (platforms as Record<string, unknown>)[arch];
+      if (value === undefined) continue;
+      if (typeof value !== "string" || !DIGEST_PATTERN.test(value)) return null;
+      parsedPlatforms[arch] = value;
+    }
+  }
+  return {
+    ref,
+    digest,
+    contextHash,
+    ...(parsedPlatforms ? { platforms: parsedPlatforms } : {}),
+  };
+}
+
+/**
+ * The digest a given host should pull: its own architecture's single-variant
+ * image when the pin carries one, else the manifest list. Docker resolves a
+ * list to the native variant; the Apple runtime stores the whole index, which
+ * task-up's one-variant guard then refuses — so arch digests win.
+ */
+export function standardImagePullDigest(
+  pin: StandardImagePin,
+  arch: string = process.arch,
+): string {
+  if (arch === "arm64" || arch === "x64") {
+    const platformDigest = pin.platforms?.[arch];
+    if (platformDigest !== undefined) return platformDigest;
+  }
+  return pin.digest;
 }
 
 /** The exact engine argv for pulling and tagging the pinned image. Docker
@@ -87,8 +131,9 @@ export function standardImagePullCommands(
   pin: StandardImagePin,
   targetTag: string,
   apple: boolean,
+  arch: string = process.arch,
 ): { pull: string[]; tag: string[] } {
-  const source = `${pin.ref}@${pin.digest}`;
+  const source = `${pin.ref}@${standardImagePullDigest(pin, arch)}`;
   return apple
     ? {
         pull: ["image", "pull", source],

package/lib/standard-image.ts

@@ -42,6 +42,7 @@ import {
   STANDARD_IMAGE_PIN_BASENAME,
   type StandardImagePin,
   standardImagePullCommands,
+  standardImagePullDigest,
 } from "./standard-image-pin";
 
 /** Pinned, host-wide constants (must match task-up.sh and the compose gen). */
@@ -1259,8 +1260,9 @@ async function ensureStandardImageInner(
       );
       imageReady = true;
     } else {
+      const pullDigest = standardImagePullDigest(pin);
       console.log(
-        `[host-agent] pulling standard image ${pin.ref}@${pin.digest}`,
+        `[host-agent] pulling standard image ${pin.ref}@${pullDigest}`,
       );
       const commands = standardImagePullCommands(
         pin,
@@ -1276,7 +1278,7 @@ async function ensureStandardImageInner(
         const tagged = await run(engine.command, commands.tag);
         if (tagged.code === 0) {
           console.log(
-            `[host-agent] pulled standard image ${STANDARD_IMAGE_TAG} (${pin.digest.slice(0, 19)}…)`,
+            `[host-agent] pulled standard image ${STANDARD_IMAGE_TAG} (${pullDigest.slice(0, 19)}…)`,
           );
           imageReady = true;
         } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.47",
+  "version": "0.9.49",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -667,9 +667,10 @@ git_host_control() (
   # This helper is for local repository bookkeeping and public/local remotes.
   # It must never inherit the operator's SSH agent or credential helper. Every
   # authenticated GitHub fetch goes through one of the explicit helpers above.
-  GIT_CONFIG_COUNT=2 \
+  GIT_CONFIG_COUNT=3 \
   GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/dev/null \
   GIT_CONFIG_KEY_1=core.fsmonitor GIT_CONFIG_VALUE_1=false \
+  GIT_CONFIG_KEY_2=advice.defaultBranchName GIT_CONFIG_VALUE_2=false \
   GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
     -c credential.helper= \
     "$@"

package/src/index.ts

@@ -101,6 +101,8 @@ export type {
   TaskUpResult,
 } from "../lib/agent";
 
+import { removeEngineAccount } from "../lib/engine-accounts";
+
 export {
   parseMentions,
   resolveAddressing,
@@ -1029,6 +1031,22 @@ export const hostCommands: HostCommands = {
     });
   },
 
+  // ADR-116: remove a labeled engine account. Delegates to the same internals
+  // the local UI uses; `default:*` refusal and idempotency live there. The
+  // dispatcher re-advertises capabilities after an ok result.
+  async engineAccountRemove(ctx, input) {
+    logCommand(ctx, "engineAccountRemove", input.id);
+    try {
+      const result = removeEngineAccount(input.id);
+      if (!result.ok) {
+        return ok({ removed: false, message: result.message });
+      }
+      return ok({ removed: true });
+    } catch (err) {
+      return failFromUnknown(err);
+    }
+  },
+
   async channelResolvePermission(ctx, taskId, agentId, requestId, decision) {
     logCommand(ctx, "channelResolvePermission", taskId, agentId, requestId);
     try {

package/src/main.ts

@@ -143,6 +143,7 @@ import {
   patchHostConfig,
   type HostConfigResult,
 } from "../lib/host-config";
+import { listEngineAccounts } from "../lib/engine-accounts";
 import { createEngineLoginManager } from "../lib/engine-login";
 // Importing the real factory triggers the built-in adapters' register()
 // calls (claude, codex), so the registry is populated before we advertise.
@@ -164,9 +165,13 @@ import {
   GITHUB_REPOSITORY_ACCESS_PROTOCOL_FEATURE,
   HOST_MAINTENANCE_READINESS_PROTOCOL_FEATURE,
   HOST_CONFIG_PROTOCOL_FEATURE,
+  HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
   HOST_LOGS_PROTOCOL_FEATURE,
   HOST_TASK_INVENTORY_PROTOCOL_FEATURE,
+  MAX_ENGINE_ACCOUNT_LABEL_CHARS,
+  MAX_ENGINE_ACCOUNTS_ADVERTISED,
+  type EngineAccountSummary,
   MAX_HOST_TASK_INVENTORY_PAGE_SIZE,
   MCP_GATEWAY_HEALTH_PROTOCOL_FEATURE,
   SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE,
@@ -543,6 +548,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_LOGS_PROTOCOL_FEATURE,
       HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
       HOST_CONFIG_PROTOCOL_FEATURE,
+      HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
       // dispatch in mock mode would let the composer create a Secretary that
       // has no way to wake crew.
@@ -558,10 +564,34 @@ function buildCapabilities(): HostCapabilities {
     maintenanceReady: areAgentClisReady(),
     mcpGateway: mcpGateway.state(),
     engineLogins: engineLoginManager.capabilities(),
+    engineAccounts: engineAccountSummaries(),
     githubUsers: connectedUserIds(),
   };
 }
 
+/** ADR-116: the labeled-accounts advertisement — bounded, labels-only. */
+function engineAccountSummaries(): EngineAccountSummary[] {
+  const summaries: EngineAccountSummary[] = [];
+  for (const kind of ["claude", "codex", "opencode"] as const) {
+    try {
+      for (const account of listEngineAccounts(kind)) {
+        summaries.push({
+          id: account.id,
+          kind,
+          label: account.label.slice(0, MAX_ENGINE_ACCOUNT_LABEL_CHARS),
+          authKind: account.authKind,
+          isDefault: account.isDefault,
+        });
+      }
+    } catch (error) {
+      console.warn(
+        `[host-agent] listing ${kind} accounts for capabilities failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+  return summaries.slice(0, MAX_ENGINE_ACCOUNTS_ADVERTISED);
+}
+
 /**
  * Re-advertise capabilities on the active connection. Safe to call any time;
  * a no-op when no socket is connected/open (the next `connect()` re-sends on
@@ -1074,6 +1104,7 @@ async function connect(): Promise<void> {
           frame.opId,
           frame.engine,
           emitEngineLoginEvent,
+          frame.label,
         );
         break;
       case "engine.login.input":
@@ -2093,7 +2124,7 @@ function sendTunnelData(
   }
 }
 
-function dispatchCommand(
+async function dispatchCommand(
   ctx: CommandContext,
   command: keyof HostCommands,
   args: unknown[],
@@ -2163,7 +2194,34 @@ function dispatchCommand(
         expectString(args, 1),
         expectNumberArg(args, 2),
       );
+    case "engineAccountRemove": {
+      // ADR-116: mirror the local API's post-mutation behavior — the cloud's
+      // account list self-heals through the capability re-advertisement.
+      const removal = await hostCommands.engineAccountRemove(
+        ctx,
+        expectEngineAccountRemoveInput(args, 0),
+      );
+      if (removal.ok) sendCapabilities();
+      return removal;
+    }
+  }
+}
+
+function expectEngineAccountRemoveInput(
+  args: unknown[],
+  index: number,
+): { id: string } {
+  const value = args[index];
+  if (
+    !value ||
+    typeof value !== "object" ||
+    typeof (value as { id?: unknown }).id !== "string" ||
+    (value as { id: string }).id.length === 0 ||
+    (value as { id: string }).id.length > 256
+  ) {
+    throw new Error(`invalid command args: expected account id at ${index}`);
   }
+  return { id: (value as { id: string }).id };
 }
 
 function expectNumberArg(args: unknown[], index: number): number {
@@ -2655,6 +2713,7 @@ function isHostCommand(command: string): command is keyof HostCommands {
     "channelInterrupt",
     "appendTranscript",
     "previewEnsure",
+    "engineAccountRemove",
   ].includes(command);
 }
 

package/src/protocol.ts

@@ -86,6 +86,12 @@ export const MCP_GATEWAY_HEALTH_PROTOCOL_FEATURE = "mcp-gateway-health-v1";
 export const HOST_LOGS_PROTOCOL_FEATURE = "host-logs-v1";
 export const HOST_ENGINE_LOGIN_PROTOCOL_FEATURE = "host-engine-login-v1";
 export const HOST_CONFIG_PROTOCOL_FEATURE = "host-config-v1";
+/** ADR-116: labeled engine accounts on the cloud host page — account list in
+ * capabilities, account-targeted login (`label` on engine.login.start), and
+ * the engineAccountRemove command. */
+export const HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE = "host-engine-accounts-v1";
+export const MAX_ENGINE_ACCOUNT_LABEL_CHARS = 64;
+export const MAX_ENGINE_ACCOUNTS_ADVERTISED = 48;
 export const MAX_HOST_OP_ID_CHARS = 128;
 export const MAX_HOST_LOG_LINES = 1_000;
 export const MAX_HOST_LOG_LINE_BYTES = 4 * 1_024;
@@ -282,6 +288,10 @@ export interface EngineLoginStartFrame {
   kind: "engine.login.start";
   opId: HostOpId;
   engine: EngineLoginKind;
+  /** ADR-116: capture into a labeled extra account instead of the default
+   * slot. Only sent to hosts advertising `host-engine-accounts-v1`; the v1
+   * exact-shape guard on older hosts rejects frames carrying it. */
+  label?: string;
 }
 
 /** The only generic one-time response channel. Long-lived tokens must never
@@ -343,6 +353,16 @@ export interface EngineLoginCapability {
   loginSupported: true;
 }
 
+/** ADR-116: one labeled engine account, as advertised in capabilities.
+ * Operator-chosen label + shape metadata only — never credentials. */
+export interface EngineAccountSummary {
+  id: string;
+  kind: "claude" | "codex" | "opencode";
+  label: string;
+  authKind: "env" | "config-dir";
+  isDefault: boolean;
+}
+
 /** The exact local host settings ADR-100 permits over the bridge. */
 export interface HostConfigState {
   agentCliAutoupdate: boolean;
@@ -530,12 +550,26 @@ export function isHostLogsEndFrame(value: unknown): value is HostLogsEndFrame {
 export function isEngineLoginStartFrame(
   value: unknown,
 ): value is EngineLoginStartFrame {
-  const frame = exactWireObject(value, ["kind", "opId", "engine"]);
+  const frame = exactWireObject(value, ["kind", "opId", "engine"], ["label"]);
   return Boolean(
     frame &&
       frame.kind === "engine.login.start" &&
       isHostOpId(frame.opId) &&
-      isEngineLoginKind(frame.engine),
+      isEngineLoginKind(frame.engine) &&
+      (frame.label === undefined || isEngineAccountLabel(frame.label)),
+  );
+}
+
+/** ADR-116 account labels: operator-chosen display names, never secrets.
+ * Single-line, bounded, and visibly printable so they render safely in every
+ * surface (capability frames, UI chips, log lines). */
+export function isEngineAccountLabel(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length >= 1 &&
+    value.length <= MAX_ENGINE_ACCOUNT_LABEL_CHARS &&
+    value.trim() === value &&
+    !/[\u0000-\u001f\u007f]/.test(value)
   );
 }
 
@@ -766,6 +800,9 @@ export interface HostCapabilities {
   mcpGateway?: McpGatewayCapability;
   /** ADR-100: feature-gated, secret-free remote login availability. */
   engineLogins?: EngineLoginCapability[];
+  /** ADR-116: labeled engine accounts (default + extras), re-advertised on
+   * every account mutation. Labels only — credentials never leave the host. */
+  engineAccounts?: EngineAccountSummary[];
   // ADR-033: cloud user ids that currently have a GitHub token ON THIS HOST —
   // the per-host gh-connected state shown on the host detail page. Re-advertised
   // whenever a token is added/removed. Optional: older hosts omit it.
@@ -1109,6 +1146,12 @@ export interface HostCommands {
     name: string,
     containerPort: number,
   ): Promise<HostCommandResult<{ hostPort: number | null }>>;
+  /** ADR-116: remove a labeled engine account by id. Refuses `default:*`
+   * exactly like the local API; re-advertises capabilities on success. */
+  engineAccountRemove(
+    ctx: CommandContext,
+    input: { id: string },
+  ): Promise<HostCommandResult<{ removed: boolean; message?: string }>>;
   cloneRepo(
     ctx: CommandContext,
     input: CloneRepoInput,