@runuai/host 0.9.60 → 0.9.62

package/lib/engine-login.ts

@@ -169,7 +169,11 @@ export interface EngineLoginManagerOptions {
   seams?: Partial<EngineLoginSeams>;
 }
 
-type OperationStage = "starting" | "awaiting_input" | "awaiting_callback";
+type OperationStage =
+  | "starting"
+  | "awaiting_input"
+  | "awaiting_callback"
+  | "awaiting_confirmation";
 
 interface CodexCallbackTarget {
   readonly origin: string;
@@ -819,6 +823,25 @@ export class EngineLoginManager {
     }
 
     if (operation.stage === "starting") {
+      const device = findCodexDeviceAuthorization(operation.outputTail);
+      if (device) {
+        console.log(
+          `[engine-login] codex device authorization found for ${operation.opId}; awaiting operator confirmation`,
+        );
+        operation.stage = "awaiting_confirmation";
+        safeEmit(
+          operation.emit,
+          authorizeEvent(operation, device.verificationUrl),
+        );
+        safeEmit(operation.emit, {
+          kind: "engine.login.event",
+          opId: operation.opId,
+          engine: operation.engine,
+          phase: "awaiting_confirmation",
+          message: `Enter code ${device.userCode} on the verification page. Nothing to paste here — this completes on its own.`,
+        });
+        return;
+      }
       const authorization = findCodexAuthorization(operation.outputTail);
       if (authorization) {
         // Symmetric with the claude branch: this breadcrumb's ABSENCE was
@@ -1489,6 +1512,24 @@ export function findSafeHttpsUrl(value: string): string | null {
   return null;
 }
 
+/**
+ * Codex `--device-auth` banner: a verification URL plus a short one-time
+ * code ("AC57-MDV9G" shape). Both the phrase gate and the code shape are
+ * required so container names, hashes, or URL fragments cannot fake a
+ * device prompt. Reads the merged tail — codex prints to stderr.
+ */
+export function findCodexDeviceAuthorization(
+  value: string,
+): { verificationUrl: string; userCode: string } | null {
+  const plain = stripTerminalControl(value);
+  if (!/one-time code|device code/i.test(plain)) return null;
+  const verificationUrl = findSafeHttpsUrl(plain);
+  if (!verificationUrl) return null;
+  const code = /(?:^|\s)([A-Z0-9]{4,8}-[A-Z0-9]{4,10})(?:\s|$)/m.exec(plain);
+  if (!code) return null;
+  return { verificationUrl, userCode: code[1]! };
+}
+
 export function extractClaudeOAuthToken(value: string): string | null {
   const plain = stripTerminalControl(value);
   // The FULL `sk-ant-oat01-` prefix and a realistic minimum length are both
@@ -1921,7 +1962,12 @@ export function engineLoginContainerArgs(
           // because the typescript went to /dev/null.
           `${LOGIN_MOUNT}/typescript`,
         ]
-      : ["codex", "login"];
+      : // Device-code flow: no localhost callback, no paste — the CLI prints
+        // a verification URL + one-time code, the operator confirms on the
+        // provider's page, and the CLI polls to completion (ADR-116 v2,
+        // 2026-08-24). The callback machinery below stays as the fallback
+        // for CLIs that still print the localhost authorize URL.
+        ["codex", "login", "--device-auth"];
   if (engineLoginBackend().apple) {
     // Same containment contract, Apple dialect: read-only root, all caps
     // dropped, a plain tmpfs at /tmp (the Apple CLI takes no mount options —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.60",
+  "version": "0.9.62",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -168,7 +168,68 @@ export const hostEvents: HostEventStream = {
   },
 };
 
+/** Set by main.ts at boot: the drain-then-supervisor-respawn used for
+ * staged activation. A hook (not an import) because main imports this
+ * module. */
+let managedHostRestartHook: (() => void) | null = null;
+export function setManagedHostRestartHook(hook: () => void): void {
+  managedHostRestartHook = hook;
+}
+
 export const hostCommands: HostCommands = {
+  async hostUpdate(ctx) {
+    logCommand(ctx, "hostUpdate");
+    try {
+      const { updateManagedRuntime } = await import("../lib/managed-runtime");
+      const outcome = await updateManagedRuntime();
+      if (outcome.status === "not-managed") {
+        return {
+          ok: false,
+          code: HostErrorCode.Internal,
+          message:
+            "this host is not a managed install — update it where it runs",
+          retryable: false,
+        };
+      }
+      if (outcome.status === "deferred") {
+        // A rollback hold is an operator verdict that the newer release is
+        // unsafe on this host; a remote click must not override it.
+        return {
+          ok: true,
+          value: { version: outcome.version, staged: false, deferred: true },
+        };
+      }
+      if (outcome.status === "current") {
+        return { ok: true, value: { version: outcome.version, staged: false } };
+      }
+      managedHostRestartHook?.();
+      return { ok: true, value: { version: outcome.version, staged: true } };
+    } catch (error) {
+      return {
+        ok: false,
+        code: HostErrorCode.Internal,
+        message: `update failed: ${
+          error instanceof Error ? error.message : "unknown error"
+        }`,
+        retryable: true,
+      };
+    }
+  },
+  async hostRestart(ctx) {
+    logCommand(ctx, "hostRestart");
+    if (!managedHostRestartHook) {
+      return {
+        ok: false,
+        code: HostErrorCode.Internal,
+        message: "restart is unavailable in this process",
+        retryable: false,
+      };
+    }
+    // The result frame flushes before exit: shutdown drains in-flight
+    // commands (this one included) before the process terminates.
+    managedHostRestartHook();
+    return { ok: true, value: undefined };
+  },
   async taskUp(ctx, input) {
     logCommand(ctx, "taskUp", input.task.id);
     const admissionFailure = managedMaintenanceUnavailable();

package/src/main.ts

@@ -161,7 +161,7 @@ import {
   onAgentClisReady,
   standardRuntimes,
 } from "../lib/standard-image";
-import { hostCommands, hostEvents } from "./index";
+import { hostCommands, hostEvents, setManagedHostRestartHook } from "./index";
 import { EventOutbox, transmitEventOutbox } from "./event-outbox";
 import {
   HostErrorCode,
@@ -171,6 +171,7 @@ import {
   GITHUB_REPOSITORY_ACCESS_PROTOCOL_FEATURE,
   HOST_MAINTENANCE_READINESS_PROTOCOL_FEATURE,
   HOST_CONFIG_PROTOCOL_FEATURE,
+  HOST_REMOTE_LIFECYCLE_PROTOCOL_FEATURE,
   HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
   HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
@@ -567,6 +568,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_LOGS_PROTOCOL_FEATURE,
       HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
       HOST_CONFIG_PROTOCOL_FEATURE,
+      HOST_REMOTE_LIFECYCLE_PROTOCOL_FEATURE,
       HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
       HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
@@ -2284,6 +2286,10 @@ async function dispatchCommand(
         expectString(args, 1),
         expectNumberArg(args, 2),
       );
+    case "hostUpdate":
+      return hostCommands.hostUpdate(ctx);
+    case "hostRestart":
+      return hostCommands.hostRestart(ctx);
     case "engineAccountRemove": {
       // ADR-116: mirror the local API's post-mutation behavior — the cloud's
       // account list self-heals through the capability re-advertisement.
@@ -3263,6 +3269,8 @@ export function requestManagedHostRestart(): void {
   shutdownExitCode = MANAGED_UPDATE_RESTART_EXIT_CODE;
   requestShutdown("SIGTERM");
 }
+// Remote hostUpdate/hostRestart commands reuse the exact activation restart.
+setManagedHostRestartHook(requestManagedHostRestart);
 
 /** Automatic host updates wait only for in-flight work to drain. Running
  * tasks are deliberately not counted: durable sessions survive the service

package/src/protocol.ts

@@ -86,6 +86,9 @@ export const MCP_GATEWAY_HEALTH_PROTOCOL_FEATURE = "mcp-gateway-health-v1";
 export const HOST_LOGS_PROTOCOL_FEATURE = "host-logs-v1";
 export const HOST_ENGINE_LOGIN_PROTOCOL_FEATURE = "host-engine-login-v1";
 export const HOST_CONFIG_PROTOCOL_FEATURE = "host-config-v1";
+/** Remote update/restart over the bridge (owner-gated cloud routes). */
+export const HOST_REMOTE_LIFECYCLE_PROTOCOL_FEATURE =
+  "host-remote-lifecycle-v1";
 /** ADR-116: labeled engine accounts on the cloud host page — account list in
  * capabilities, account-targeted login (`label` on engine.login.start), and
  * the engineAccountRemove command. */
@@ -345,6 +348,9 @@ export type EngineLoginEventFrame =
         | "starting"
         | "awaiting_input"
         | "awaiting_callback"
+        // Device-code flow (codex `--device-auth`): the operator confirms a
+        // short one-time code on the provider's page; nothing is pasted back.
+        | "awaiting_confirmation"
         | "succeeded"
         | "cancelled";
       url?: never;
@@ -787,6 +793,7 @@ export function isEngineLoginEventFrame(
     (frame.phase === "starting" ||
       frame.phase === "awaiting_input" ||
       frame.phase === "awaiting_callback" ||
+      frame.phase === "awaiting_confirmation" ||
       frame.phase === "succeeded" ||
       frame.phase === "cancelled") &&
     !Object.hasOwn(frame, "errorCode")
@@ -1246,7 +1253,26 @@ export type FilesOpValue =
   | { dataBase64: string; size: number; eof: boolean } // read
   | Record<string, never>; // write / mkdir / delete
 
+export interface HostUpdateOutcome {
+  version: string;
+  /** True when a newer signed release was staged and the host is about to
+   * drain-restart into it; false when it was already current. */
+  staged: boolean;
+  /** Set when a rollback hold deferred the update (operator ran a rollback;
+   * remote updates respect that verdict). */
+  deferred?: boolean;
+}
+
 export interface HostCommands {
+  /**
+   * Stage a signed update from the release feed and drain-restart into it.
+   * Managed installs only; the host verifies the signature itself, so the
+   * remote trigger adds no trust surface. The reconnect on the new version
+   * is the real confirmation.
+   */
+  hostUpdate(ctx: CommandContext): Promise<HostCommandResult<HostUpdateOutcome>>;
+  /** Drain in-flight work, then let the service supervisor respawn the host. */
+  hostRestart(ctx: CommandContext): Promise<HostCommandResult<void>>;
   taskUp(
     ctx: CommandContext,
     input: TaskLaunchInput,