@runuai/host 0.9.64 → 0.9.66

package/lib/container-runtime.ts

@@ -883,14 +883,21 @@ export async function detectContainerRuntime(
         appleUnavailable(preference, selectedAppleRuntime(deps) === null, deps)
       );
     }
-    // ADR-106: prefer the bundled runtime wherever it can run — ambient
-    // Docker existing is not a reason to skip it. A failed activation falls
-    // through to Docker rather than degrading a machine that has one.
+    // ADR-119 (inverting ADR-106): a present, healthy ambient Docker/OrbStack
+    // daemon wins — it is the battle-tested path, and `auto` must never
+    // migrate a machine off a working daemon it already trusts. The bundled
+    // runtime is the zero-dependency fallback for machines with no daemon:
+    // an absent/remote/unanswering Docker on a machine that never chose
+    // Docker is not an error to surface. One probe serves both outcomes —
+    // its rendered state is reused if the bundled runtime also fails.
+    const ambient = await detectAmbientDockerCore(preference, deps);
+    if (ambient.usable) return ambient.state;
     const selected = await probeAndSelectApple(preference, deps);
     if (selected !== null) return selected;
+    return ambient.state;
   }
 
-  return detectAmbientDocker(preference, deps);
+  return (await detectAmbientDockerCore(preference, deps)).state;
 }
 
 function appleUnavailable(
@@ -915,10 +922,19 @@ function appleUnavailable(
   };
 }
 
-async function detectAmbientDocker(
+/**
+ * Ambient-Docker detection. `usable: false` marks the ADR-119 fall-through
+ * verdicts — an absent daemon, a remote endpoint, an unresolvable context —
+ * so `auto` can try the bundled runtime instead of surfacing Docker's
+ * errors on a machine that never chose Docker, while still carrying the
+ * rendered state for callers that need it (explicit `docker`, and auto once
+ * the bundled runtime also failed). A ready selection and a pin conflict
+ * are both `usable: true`: neither may fall through.
+ */
+async function detectAmbientDockerCore(
   preference: "auto" | "docker",
   deps: RuntimeDetectionDeps,
-): Promise<ContainerRuntimeState> {
+): Promise<{ usable: boolean; state: ContainerRuntimeState }> {
   // A successful ambient `docker info` is not a durable selection: collapse a
   // named context to its exact local endpoint before publishing DOCKER_HOST.
   const selection =
@@ -929,24 +945,30 @@ async function detectAmbientDocker(
         : null;
   if (selection && !isLocalDockerEndpoint(selection.host)) {
     return {
-      status: "no-runtime",
-      preference,
-      message:
-        "The selected Docker endpoint is remote. " +
-        "Uai Host requires a local Unix-socket daemon for workspace mounts and loopback tunnels. " +
-        `Select a local Docker context, then run \`${RUNTIME_RESTART_COMMAND}\`.`,
-      action: RUNTIME_RESTART_COMMAND,
+      usable: false,
+      state: {
+        status: "no-runtime",
+        preference,
+        message:
+          "The selected Docker endpoint is remote. " +
+          "Uai Host requires a local Unix-socket daemon for workspace mounts and loopback tunnels. " +
+          `Select a local Docker context, then run \`${RUNTIME_RESTART_COMMAND}\`.`,
+        action: RUNTIME_RESTART_COMMAND,
+      },
     };
   }
 
   if (deps.dockerInfo === undefined && selection === null) {
     return {
-      status: "no-runtime",
-      preference,
-      message:
-        "Uai Host could not resolve the selected Docker context to a local endpoint. " +
-        `Select a local Docker context and run \`${RUNTIME_RECHECK_COMMAND}\`.`,
-      action: RUNTIME_RECHECK_COMMAND,
+      usable: false,
+      state: {
+        status: "no-runtime",
+        preference,
+        message:
+          "Uai Host could not resolve the selected Docker context to a local endpoint. " +
+          `Select a local Docker context and run \`${RUNTIME_RECHECK_COMMAND}\`.`,
+        action: RUNTIME_RECHECK_COMMAND,
+      },
     };
   }
 
@@ -954,20 +976,26 @@ async function detectAmbientDocker(
   if (proof !== null) {
     if (selection) {
       if (!pinRuntime("docker", selection.host, proof.engineId)) {
-        return pinnedRuntimeUnavailable(preference);
+        return { usable: true, state: pinnedRuntimeUnavailable(preference) };
       }
     }
-    return { status: "ready", preference, provider: "docker" };
+    return {
+      usable: true,
+      state: { status: "ready", preference, provider: "docker" },
+    };
   }
   return {
-    status: "no-runtime",
-    preference,
-    message:
-      preference === "docker"
-        ? "No working Docker runtime was found. Install or start Docker, then run " +
-          `\`${RUNTIME_RECHECK_COMMAND}\`.`
-        : NO_RUNTIME_MESSAGE,
-    action: RUNTIME_RECHECK_COMMAND,
+    usable: false,
+    state: {
+      status: "no-runtime",
+      preference,
+      message:
+        preference === "docker"
+          ? "No working Docker runtime was found. Install or start Docker, then run " +
+            `\`${RUNTIME_RECHECK_COMMAND}\`.`
+          : NO_RUNTIME_MESSAGE,
+      action: RUNTIME_RECHECK_COMMAND,
+    },
   };
 }
 

package/lib/github-tokens.ts

@@ -1502,6 +1502,12 @@ function isBadCredentialError(reason: string): boolean {
  */
 export function isTransientGithubError(reason: string): boolean {
   if (isBadCredentialError(reason)) return false;
+  // A blank reason proves nothing about the credential. Seen live 2026-08-25:
+  // `gh auth login` raced its own task's teardown (the container died under
+  // the exec), exited nonzero with EMPTY stderr, and the fall-through verdict
+  // told the user their auth expired and to reconnect — it hadn't. Unknown
+  // must route to the retrying/soft path, never to a reconnect demand.
+  if (reason.trim() === "") return true;
   return (
     /HTTP 5\d\d|Service Unavailable|Bad Gateway|Gateway Time-?out|server error|rate limit|too many requests|secondary rate|unavailable|unreachable/i.test(
       reason,
@@ -1739,11 +1745,15 @@ export async function setupTaskGithub(
     if (err instanceof ContainerRuntimeUnavailableError) throw err;
     const reason = err instanceof Error ? err.message : String(err);
     console.warn(`[github] task ${taskId}: gh setup failed: ${reason}`);
+    // A task already torn down must not receive notes: its thread is
+    // read-only, and a gh failure RACING that teardown (exec into a dying
+    // container, live 2026-08-25) says nothing a reader can act on.
+    const taskStillActive = (deps.taskIsActive ?? taskIsActive)(taskId);
     // A revoked refresh token can't recover by retrying — drop it so the user
     // gets a clean re-grant, and tell the chat once.
     if (isRevokedTokenError(reason)) {
       (deps.deleteToken ?? deleteToken)(userId);
-      authExpiredHandler?.(taskId, userId, reason);
+      if (taskStillActive) authExpiredHandler?.(taskId, userId, reason);
       return false;
     }
     // A retry chain already armed for this task means a sibling entry point
@@ -1756,7 +1766,9 @@ export async function setupTaskGithub(
     // "gh auth" notes for one outage is noise. Exhaustion posts its own note
     // (in scheduleGithubRetry). The handler classifies the reason (transient
     // 5xx blip vs. genuine expiry) and words the note accordingly.
-    if (attempt === 0) authExpiredHandler?.(taskId, userId, reason);
+    if (attempt === 0 && taskStillActive) {
+      authExpiredHandler?.(taskId, userId, reason);
+    }
     scheduleGithubRetry(
       taskId,
       userId,

package/lib/orchestrator.ts

@@ -73,6 +73,7 @@ import {
 import {
   appleCliRunner,
   appleTaskContainerName,
+  appleTaskStoreVolumeName,
   parseAppleTaskEnvironmentLocator,
 } from "./task-environment/apple-container";
 import { parseDockerTaskEnvironmentLocator } from "./task-environment/docker";
@@ -5660,9 +5661,15 @@ interface RecoveryTaskConsumers {
  * proof (the jq filter behind "verify task runtime isolation"): each required
  * canonical entry appears exactly once, every owned-npm-config spelling
  * (case-folded, underscores treated as hyphens) must be one of the canonical
- * eight, and PATH plus the asdf/corepack controls hold their exact values
- * exactly once. */
-export function appleTaskEnvironmentAuthorityHolds(value: unknown): boolean {
+ * entries, and PATH plus the asdf/corepack controls hold their exact values
+ * exactly once. ADR-118: `storeDir` mirrors task-up's apple-only store
+ * authority — a string requires both canonical store-dir entries (and owns
+ * the key), while null FORBIDS every store-dir spelling, so a container's
+ * environment and its store mount can never disagree silently. */
+export function appleTaskEnvironmentAuthorityHolds(
+  value: unknown,
+  storeDir: string | null = null,
+): boolean {
   if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) {
     return false;
   }
@@ -5681,8 +5688,30 @@ export function appleTaskEnvironmentAuthorityHolds(value: unknown): boolean {
     `npm_config_logs_dir=${npmCache}/_logs`,
     "NPM_CONFIG_UMASK=0002",
     "npm_config_umask=0002",
+    ...(storeDir !== null
+      ? [
+          `NPM_CONFIG_STORE_DIR=${storeDir}`,
+          `npm_config_store_dir=${storeDir}`,
+        ]
+      : []),
+  ];
+  const owned = [
+    "prefix",
+    "cache",
+    "logs-dir",
+    "umask",
+    ...(storeDir !== null ? ["store-dir"] : []),
   ];
-  const owned = ["prefix", "cache", "logs-dir", "umask"];
+  if (storeDir === null) {
+    const carriesStoreKey = environment.some((entry) => {
+      const folded = entry.split("=")[0]!.toLowerCase();
+      return (
+        folded.startsWith("npm_config_") &&
+        folded.slice("npm_config_".length).replace(/_/g, "-") === "store-dir"
+      );
+    });
+    if (carriesStoreKey) return false;
+  }
   const countOf = (exact: string): number =>
     environment.filter((entry) => entry === exact).length;
   const isOwnedNpmConfig = (key: string): boolean => {
@@ -5829,6 +5858,30 @@ export async function proveAppleTaskRuntimeContract(options: {
         workspaceAuthorityHolds = false;
       }
     }
+    // ADR-118: the store volume and the store environment must agree. A
+    // pre-ADR-118 container carries neither (grandfathered until natural
+    // teardown — an old container is a live fd cost, not a deadlock); a
+    // current container carries exactly one writable attachment of ITS OWN
+    // store volume at the store path plus the matching env authority. A
+    // container claiming the env without the mount would silently drop its
+    // store into the container layer; a foreign volume at the store path is
+    // an integrity hole. Both are violations.
+    const storeVolumeName = appleTaskStoreVolumeName(options.taskId);
+    const storeMounts = mounts.filter(
+      (mount) => mount?.destination === "/opt/uai/store",
+    );
+    const storeVolumeMounts = mounts.filter(
+      (mount) => mount?.type?.volume?.name === storeVolumeName,
+    );
+    const storeContractHolds =
+      storeMounts.length === 0
+        ? storeVolumeMounts.length === 0
+        : storeMounts.length === 1 &&
+          storeVolumeMounts.length === 1 &&
+          storeVolumeMounts[0] === storeMounts[0] &&
+          Array.isArray(storeMounts[0]?.options) &&
+          !(storeMounts[0]!.options as unknown[]).includes("ro");
+    const storeDir = storeMounts.length === 0 ? null : "/opt/uai/store/pnpm";
     const rawEnvironment = record?.configuration?.initProcess?.environment;
     const holds =
       record?.status?.state === "running" &&
@@ -5843,7 +5896,8 @@ export async function proveAppleTaskRuntimeContract(options: {
       // contradictory and proves nothing.
       !(runtimeMounts[0]!.options as unknown[]).includes("rw") &&
       workspaceAuthorityHolds &&
-      appleTaskEnvironmentAuthorityHolds(rawEnvironment);
+      storeContractHolds &&
+      appleTaskEnvironmentAuthorityHolds(rawEnvironment, storeDir);
     return holds ? { kind: "holds" } : { kind: "violated" };
   } catch {
     return { kind: "violated" };
@@ -6039,7 +6093,21 @@ export async function recoverAppleTaskEnvironment(
         '[ ! -L /var/lib/uai/asdf-upper ] || { echo "upper is a symlink" >&2; exit 1; }; ' +
         '[ -d /var/lib/uai/asdf-upper ] || { echo "upper is not a directory" >&2; exit 1; }; ' +
         '[ "$(/usr/bin/stat -c %U /var/lib/uai/asdf-upper)" = "node" ] || { echo "upper is not node-owned" >&2; exit 1; }; ' +
-        "/usr/bin/test -d /opt/asdf-data/plugins",
+        "/usr/bin/test -d /opt/asdf-data/plugins; " +
+        // ADR-118: when the store volume is attached (pre-ADR-118 containers
+        // have none — grandfathered), re-assert the same writable-mount +
+        // node-owned-store proof as task-up §6a. The chown persisted on the
+        // volume's ext4, but a resized/replaced attachment must not slip
+        // through recovery unproven.
+        'if /bin/grep -q " /opt/uai/store " /proc/mounts; then ' +
+        'store_lines=$(/bin/grep -c " /opt/uai/store " /proc/mounts || true); ' +
+        '[ "$store_lines" = "1" ] || { echo "expected exactly one /opt/uai/store mount, found $store_lines" >&2; exit 1; }; ' +
+        'sopts=$(/bin/grep " /opt/uai/store " /proc/mounts | /usr/bin/cut -d" " -f4); ' +
+        'case ",$sopts," in *",ro,"*) echo "store volume is unexpectedly read-only" >&2; exit 1 ;; esac; ' +
+        "/bin/mkdir -p /opt/uai/store/pnpm; " +
+        "/bin/chown node:node /opt/uai/store /opt/uai/store/pnpm; " +
+        '[ "$(/usr/bin/stat -c %U /opt/uai/store/pnpm)" = "node" ] || { echo "store dir is not node-owned" >&2; exit 1; }; ' +
+        "fi",
     ],
     user: "root",
     env: {},

package/lib/task-environment/apple-container.ts

@@ -138,6 +138,13 @@ export function appleTaskContainerName(taskId: string): string {
   return `task-${taskId}-app`;
 }
 
+/** ADR-118: the task-private block volume carrying the pnpm store. Must
+ * match apple_store_volume_for_task in scripts/agent/_common.sh. */
+export function appleTaskStoreVolumeName(taskId: string): string {
+  assertSafeHostTaskId(taskId);
+  return `uai-store-${taskId}`;
+}
+
 export function createAppleContainerTaskEnvironmentProvider<
   TInput = never,
   TCredentials = never,

package/lib/task-inventory.ts

@@ -31,7 +31,10 @@ import {
   taskContainerBackend,
   taskContainerCli,
 } from "./task-container-cli";
-import { appleTaskContainerName } from "./task-environment/apple-container";
+import {
+  appleTaskContainerName,
+  appleTaskStoreVolumeName,
+} from "./task-environment/apple-container";
 
 export {
   assertSafeHostTaskId,
@@ -231,6 +234,49 @@ function parseAppleInventoryRows(stdout: string): AppleInventoryRow[] | null {
   return rows;
 }
 
+type AppleVolumeInventoryRow = { name: string; taskLabel: string | null };
+
+/** ADR-118: strict volume-inventory shape, same discipline as containers —
+ * `volume ls --format json` rows carry configuration.name (volumes have no
+ * configuration.id) and optional labels; any malformed row invalidates the
+ * WHOLE inventory, because a partially-readable answer could be hiding
+ * exactly the labeled volume the orphan proof exists to find. */
+function parseAppleVolumeInventoryRows(
+  stdout: string,
+): AppleVolumeInventoryRow[] | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  const rows: AppleVolumeInventoryRow[] = [];
+  for (const row of parsed) {
+    if (typeof row !== "object" || row === null) return null;
+    const configuration = (row as { configuration?: unknown }).configuration;
+    if (typeof configuration !== "object" || configuration === null) {
+      return null;
+    }
+    const name = (configuration as { name?: unknown }).name;
+    if (typeof name !== "string" || name === "") return null;
+    const labels = (configuration as { labels?: unknown }).labels;
+    if (labels === undefined || labels === null) {
+      rows.push({ name, taskLabel: null });
+      continue;
+    }
+    if (typeof labels !== "object" || Array.isArray(labels)) return null;
+    const label = (labels as Record<string, unknown>)["com.uai.task"];
+    if (label === undefined) {
+      rows.push({ name, taskLabel: null });
+      continue;
+    }
+    if (typeof label !== "string") return null;
+    rows.push({ name, taskLabel: label });
+  }
+  return rows;
+}
+
 function composeTaskId(project: string): string | null {
   if (!project.startsWith("task-")) return null;
   const taskId = project.slice("task-".length);
@@ -439,9 +485,10 @@ export async function proveOrphanTaskResourcesAbsent(
 ): Promise<void> {
   assertSafeHostTaskId(taskId);
   if (appleDeps.appleBackend()) {
-    // Apple task resources: the fixed-name container and the derived image.
-    // No compose networks/volumes exist there. Absence is proven only by the
-    // exact not-found grammars (a failed query is never absence).
+    // Apple task resources: the fixed-name container, the derived image, and
+    // the ADR-118 store volume. No compose networks or anonymous volumes
+    // exist there. Absence is proven only by the exact not-found grammars (a
+    // failed query is never absence).
     // Derive the apple name from the branch's own backend decision, not the
     // global pin — this proof runs exactly when appleBackend() says apple.
     const containerName = appleTaskContainerName(taskId);
@@ -485,6 +532,31 @@ export async function proveOrphanTaskResourcesAbsent(
           : `orphan proof: derived image ${imageRef} could not be proven absent (exit ${inspected.status ?? "killed"})`,
       );
     }
+    // ADR-118: the store volume must be gone too — GC purging local state
+    // while the volume survives would leak it forever (nothing else ever
+    // deletes by this name; task-down is the remediation the caller retries).
+    const storeVolume = appleTaskStoreVolumeName(taskId);
+    const inspectedVolume = await appleDeps.appleCli([
+      "volume",
+      "inspect",
+      storeVolume,
+    ]);
+    const volumeAbsent =
+      typeof inspectedVolume.status === "number" &&
+      inspectedVolume.status !== 0 &&
+      inspectedVolume.stdout.trim() === "" &&
+      inspectedVolume.stderr
+        .split("\n")
+        .some(
+          (line) => line.trim() === `Error: volume not found: ${storeVolume}`,
+        );
+    if (!volumeAbsent) {
+      throw new Error(
+        inspectedVolume.status === 0
+          ? `orphan proof: store volume ${storeVolume} still exists`
+          : `orphan proof: store volume ${storeVolume} could not be proven absent (exit ${inspectedVolume.status ?? "killed"})`,
+      );
+    }
     // The same ownership set the enumeration uses (round 5): a RENAMED
     // container still carrying this task's label is this task's resource,
     // and the exact-name check above cannot see it. An unreadable inventory
@@ -509,6 +581,31 @@ export async function proveOrphanTaskResourcesAbsent(
         );
       }
     }
+    // ADR-118, same ownership rule for volumes: a RENAMED volume still
+    // carrying this task's label is this task's store, and the exact-name
+    // probe above cannot see it. An unreadable inventory proves nothing.
+    const volumesListed = await appleDeps.appleCli([
+      "volume",
+      "ls",
+      "--format",
+      "json",
+    ]);
+    if (volumesListed.status !== 0) {
+      throw new Error(
+        `orphan proof: volume inventory failed (exit ${volumesListed.status ?? "killed"})`,
+      );
+    }
+    const volumeRows = parseAppleVolumeInventoryRows(volumesListed.stdout);
+    if (volumeRows === null) {
+      throw new Error("orphan proof: volume inventory was unparseable");
+    }
+    for (const row of volumeRows) {
+      if (row.taskLabel === taskId) {
+        throw new Error(
+          `orphan proof: volume ${row.name} still carries this task's ownership label`,
+        );
+      }
+    }
     // Workspace absence, exactly like the Docker proof below.
     const appleTaskDir = resolve(env.workspaceRoot, "tasks", taskId);
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.64",
+  "version": "0.9.66",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/_common.sh

@@ -383,6 +383,9 @@ app_container_for_task()      { printf 'task-%s-app-1' "$(_uai_lower "$1")"; }
 # replica suffix. Must match appleTaskContainerName in
 # lib/task-environment/apple-container.ts.
 apple_app_container_for_task() { printf 'task-%s-app' "$(_uai_lower "$1")"; }
+# ADR-118: per-task block volume carrying the pnpm store. Must match
+# appleTaskStoreVolumeName in lib/task-environment/apple-container.ts.
+apple_store_volume_for_task() { printf 'uai-store-%s' "$(_uai_lower "$1")"; }
 
 # -----------------------------------------------------------------------------
 # ADR-106 container runtime selection. The host publishes the selected backend
@@ -456,6 +459,26 @@ apple_container_proven_absent() {
   [ "$apple_absent_proven" -eq 1 ]
 }
 
+# ADR-118: same single-response absence discipline for a named volume. Only
+# the exact whole-line not-found grammar naming this volume proves absence;
+# any other failure (broken apiserver, timeout) proves nothing.
+apple_volume_proven_absent() {
+  apple_vabsent_name="$1"
+  apple_vabsent_dir=$(mktemp -d "${TMPDIR:-/tmp}/uai-vabsent.XXXXXX") \
+    || return 1
+  apple_vabsent_rc=0
+  "$CONTAINER_CLI" volume inspect "$apple_vabsent_name" \
+    >"$apple_vabsent_dir/out" 2>"$apple_vabsent_dir/err" \
+    || apple_vabsent_rc=$?
+  apple_vabsent_proven=1
+  [ "$apple_vabsent_rc" -ne 0 ] || apple_vabsent_proven=0
+  [ ! -s "$apple_vabsent_dir/out" ] || apple_vabsent_proven=0
+  grep -Fqx "Error: volume not found: $apple_vabsent_name" \
+    "$apple_vabsent_dir/err" 2>/dev/null || apple_vabsent_proven=0
+  rm -rf "$apple_vabsent_dir"
+  [ "$apple_vabsent_proven" -eq 1 ]
+}
+
 # Canonicalise every GitHub URL shape to credential-free HTTPS. task-up selects
 # the credential per task: the creator's connected GitHub token is primary;
 # SSH is a fallback only when that user has no GitHub connection on this host.

package/scripts/agent/task-down.sh

@@ -79,7 +79,9 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
   # writable Git data below is deleted or success is reported. A CLI failure
   # that does not name this container as not-found proves nothing — the
   # workspace and its Git data must survive until absence is confirmed. The
-  # Apple runtime has no per-task networks, sidecars, or anonymous volumes.
+  # Apple runtime has no per-task networks or sidecars; its one per-task
+  # volume (the ADR-118 store) is removed under the same ownership proof
+  # below.
   if crt inspect "$app_container" >/dev/null 2>&1; then
     emit_err "COMPOSE_DOWN_FAILED" \
       "task runtime resources remain after teardown" \
@@ -90,6 +92,35 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
       "could not verify task container removal; refusing to delete the task workspace" \
       "container verification after cleanup"
   fi
+  # ADR-118: the task's store volume. Deleting only after the container is
+  # proven absent releases the attachment; the same exact-identity +
+  # ownership-label discipline gates destruction, and absence must be proven
+  # before success is reported — a leaked volume defeats the orphan GC that
+  # keys on this exact name. A pre-ADR-118 task simply has no such volume
+  # and passes straight through the absence proof.
+  step "COMPOSE_DOWN_FAILED" "remove task store volume"
+  store_volume=$(apple_store_volume_for_task "$task_id")
+  if store_volume_json=$(crt volume inspect "$store_volume" 2>/dev/null); then
+    store_volume_ok=$(printf '%s' "$store_volume_json" \
+      | jq -r --arg name "$store_volume" --arg tid "$task_id" '
+          if (type == "array" and length == 1
+              and (.[0] | type == "object")
+              and .[0].id == $name
+              and ((.[0].configuration.labels["com.uai.task"] // "") == $tid))
+          then "ok" else "mismatch" end' 2>/dev/null) \
+      || store_volume_ok="mismatch"
+    if [ "$store_volume_ok" != "ok" ]; then
+      emit_err "COMPOSE_DOWN_FAILED" \
+        "A volume named $store_volume exists but could not be proven as this task's own (exact identity + ownership label); Uai will not delete a volume it cannot prove it owns. Remove or rename it, then retry." \
+        "remove task store volume"
+    fi
+    crt volume delete "$store_volume" >/dev/null 2>&1 || true
+  fi
+  if ! apple_volume_proven_absent "$store_volume"; then
+    emit_err "COMPOSE_DOWN_FAILED" \
+      "could not verify task store volume removal; refusing to delete the task workspace" \
+      "store volume verification after cleanup"
+  fi
 else
   uai_require_compose_plugin
   step "COMPOSE_DOWN_FAILED" "docker compose down -v --rmi local"

package/scripts/agent/task-up.sh

@@ -52,6 +52,15 @@ PW_VOLUME="uai-playwright"
 # directory shares carry no exclusivity, like /workspace itself.
 PW_BROWSERS_DIR="$UAI_WORKSPACE_ROOT/pw-browsers"
 DERIVED_IMAGE="uai-task-${task_id}"
+# ADR-118 (apple only): the pnpm store rides a task-private block volume. On
+# virtiofs every store file pins a host fd for the VM's lifetime — one
+# monorepo install held ~130k host descriptors and two tasks exhausted the
+# system file table (live 2026-08-25). A block volume costs one fd total.
+# One volume per task, never shared: block volumes allow exactly ONE
+# writable attachment, and the store was per-task on the old path anyway.
+TASK_STORE_VOLUME=$(apple_store_volume_for_task "$task_id")
+TASK_STORE_MOUNT="/opt/uai/store"
+TASK_STORE_DIR="$TASK_STORE_MOUNT/pnpm"
 
 # ADR-106: runtime selection is shared with task-down/task-status via
 # _common.sh; `docker` keeps the historical Compose path byte-for-byte, while
@@ -1711,6 +1720,35 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
       "Uai could not create the shared $ASDF_VOLUME volume on the Apple container runtime. Retry after the runtime is healthy." \
       "create shared volumes"
   fi
+  # ADR-118: create or adopt this task's private store volume. Adoption
+  # requires the same exact-identity + ownership-label proof as container
+  # destruction: exactly one record, whose id is the requested name,
+  # carrying com.uai.task=<this task>. A volume merely OCCUPYING the
+  # reserved name is not this task's store and must never be mounted into
+  # it — foreign bytes at the package store are an integrity boundary.
+  step "CONTAINER_INIT_FAILED" "create task store volume"
+  if store_volume_json=$(crt volume inspect "$TASK_STORE_VOLUME" 2>/dev/null); then
+    store_volume_ok=$(printf '%s' "$store_volume_json" \
+      | jq -r --arg name "$TASK_STORE_VOLUME" --arg tid "$task_id" '
+          if (type == "array" and length == 1
+              and (.[0] | type == "object")
+              and .[0].id == $name
+              and ((.[0].configuration.labels["com.uai.task"] // "") == $tid))
+          then "ok" else "mismatch" end' 2>/dev/null) \
+      || store_volume_ok="mismatch"
+    if [ "$store_volume_ok" != "ok" ]; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "A volume named $TASK_STORE_VOLUME exists but could not be proven as this task's own (exact identity + ownership label); Uai will not attach a store volume it cannot prove it owns. Remove or rename it, then retry." \
+        "create task store volume"
+    fi
+  else
+    if ! crt volume create --label "com.uai.task=$task_id" \
+      "$TASK_STORE_VOLUME" >/dev/null 2>&1; then
+      emit_err "CONTAINER_INIT_FAILED" \
+        "Uai could not create this task's store volume $TASK_STORE_VOLUME on the Apple container runtime. Retry after the runtime is healthy." \
+        "create task store volume"
+    fi
+  fi
 else
   crt volume create "$PW_VOLUME" >/dev/null 2>&1 || true
 fi
@@ -2059,6 +2097,13 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     printf 'npm_config_logs_dir=%s/_logs\n' "$TASK_NPM_CACHE"
     printf 'NPM_CONFIG_UMASK=0002\n'
     printf 'npm_config_umask=0002\n'
+    # ADR-118: pnpm's store must live on the task's block volume, never on
+    # the virtiofs workspace (pnpm's same-filesystem fallback would drop it
+    # at the workspace root). Env beats a project .npmrc, so repos need no
+    # config. Cross-filesystem hard links are impossible; pnpm's
+    # package-import-method=auto falls back to copying, which is correct.
+    printf 'NPM_CONFIG_STORE_DIR=%s\n' "$TASK_STORE_DIR"
+    printf 'npm_config_store_dir=%s\n' "$TASK_STORE_DIR"
     printf 'UAI_WORKSPACE=/workspace\n'
     printf 'UAI_RUNTIME_PROJECTS=/run/uai/runtime-projects\n'
     printf 'LD_PRELOAD=\n'
@@ -2124,6 +2169,9 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     -v "$RUNTIME_MATERIALIZER_SOURCE:/usr/local/bin/uai-materialize-runtimes:ro"
     -v "$COREPACK_VERSION_SOURCE:/usr/local/share/uai/corepack-version:ro"
     -v "$PW_BROWSERS_DIR:/opt/pw-browsers"
+    # ADR-118: task-private store volume, writable — created and
+    # ownership-proven above; single-attach by runtime construction.
+    -v "$TASK_STORE_VOLUME:$TASK_STORE_MOUNT"
   )
   if [ "$shared_files_mode" != "off" ]; then
     shared_suffix=""
@@ -2267,16 +2315,27 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
   mounts_proof_filter='
     [ .[] | select(.destination == "/run/uai/asdf-lower") ] as $runtime
     | [ .[] | select((.type.volume.name? // "") == "uai-asdf-data") ] as $shared
+    | [ .[] | select(.destination == $store_mount) ] as $store
+    | [ .[] | select((.type.volume.name? // "") == $store_volume) ] as $store_vol
     | ($runtime | length) == 1
       and ($shared | length) == 1
       and (($runtime[0].type.volume.name? // "") == "uai-asdf-data")
       and ((($runtime[0].options // []) | index("ro")) != null)
       and ((($runtime[0].options // []) | index("rw")) == null)
       and (([ .[] | select(.destination == "/opt/asdf-data") ] | length) == 0)
+      # ADR-118: the task-private store volume attaches WRITABLE at exactly
+      # its one mount point, and no other volume occupies that path.
+      and ($store | length) == 1
+      and ($store_vol | length) == 1
+      and (($store[0].type.volume.name? // "") == $store_volume)
+      and ((($store[0].options // []) | index("ro")) == null)
   '
 fi
 if ! printf '%s\n' "$app_mounts_json" \
-  | jq -e "$mounts_proof_filter" >/dev/null 2>&1; then
+  | jq -e \
+    --arg store_mount "$TASK_STORE_MOUNT" \
+    --arg store_volume "$TASK_STORE_VOLUME" \
+    "$mounts_proof_filter" >/dev/null 2>&1; then
   if ! quarantine_untrusted_app_container; then
     emit_err "CONTAINER_INIT_FAILED" \
       "Uai found an unsafe shared runtime mount and could not prove the task container stopped. Stop it manually before retrying." \
@@ -2286,16 +2345,23 @@ if ! printf '%s\n' "$app_mounts_json" \
     "Uai stopped this task because its shared runtime cache was not the exact read-only uai-asdf-data volume. Retry to recreate the container safely." \
     "verify task runtime isolation"
 fi
+# ADR-118: the store authority exists only on the apple path (Docker tasks
+# keep pnpm's default resolution); an empty $store keeps the historical
+# docker proof byte-for-byte.
+env_proof_store_dir=""
+[ "$TASK_RUNTIME_MODE" != "apple-container" ] \
+  || env_proof_store_dir="$TASK_STORE_DIR"
 if ! printf '%s\n' "$app_config_env_json" | jq -e \
   --arg path "$TASK_RUNTIME_PATH" \
   --arg prefix "$TASK_NPM_PREFIX" \
-  --arg cache "$TASK_NPM_CACHE" '
+  --arg cache "$TASK_NPM_CACHE" \
+  --arg store "$env_proof_store_dir" '
   def is_owned_npm_config($owned):
     ascii_downcase as $folded
     | ($folded | startswith("npm_config_"))
       and (($owned | index($folded[11:] | gsub("_"; "-"))) != null);
   (. // []) as $env
-  | [
+  | ([
       "NPM_CONFIG_PREFIX=\($prefix)",
       "npm_config_prefix=\($prefix)",
       "NPM_CONFIG_CACHE=\($cache)",
@@ -2304,10 +2370,15 @@ if ! printf '%s\n' "$app_config_env_json" | jq -e \
       "npm_config_logs_dir=\($cache)/_logs",
       "NPM_CONFIG_UMASK=0002",
       "npm_config_umask=0002"
-    ] as $required
-  | [
+    ]
+    + (if $store != "" then [
+        "NPM_CONFIG_STORE_DIR=\($store)",
+        "npm_config_store_dir=\($store)"
+      ] else [] end)) as $required
+  | ([
       "prefix", "cache", "logs-dir", "umask"
-    ] as $owned
+    ]
+    + (if $store != "" then ["store-dir"] else [] end)) as $owned
   | ($env | type == "array")
     and all($env[]; type == "string")
     and all($required[];
@@ -2381,6 +2452,16 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
     [ -d /var/lib/uai/asdf-upper ] || { echo "upper is not a directory" >&2; exit 1; }
     [ "$(/usr/bin/stat -c %U /var/lib/uai/asdf-upper)" = "node" ] || { echo "upper is not node-owned" >&2; exit 1; }
     /usr/bin/test -d /opt/asdf-data/plugins
+    # ADR-118: the store volume is a fresh ext4 with a root-owned root; hand
+    # the pnpm store dir to node and prove the attachment from the guest
+    # mount table — exactly one writable mount at the store path.
+    store_lines=$(/bin/grep -c " /opt/uai/store " /proc/mounts || true)
+    [ "$store_lines" = "1" ] || { echo "expected exactly one /opt/uai/store mount, found $store_lines" >&2; exit 1; }
+    sopts=$(/bin/grep " /opt/uai/store " /proc/mounts | /usr/bin/cut -d" " -f4)
+    case ",$sopts," in *",ro,"*) echo "store volume is unexpectedly read-only" >&2; exit 1 ;; esac
+    /bin/mkdir -p /opt/uai/store/pnpm
+    /bin/chown node:node /opt/uai/store /opt/uai/store/pnpm
+    [ "$(/usr/bin/stat -c %U /opt/uai/store/pnpm)" = "node" ] || { echo "store dir is not node-owned" >&2; exit 1; }
   ' >/dev/null || overlay_rc=$?
   if [ "$overlay_rc" -ne 0 ]; then
     require_docker_after_failed_step "establish task runtime overlay"
@@ -2550,6 +2631,15 @@ task_runtime_exec_env=(
   -e "BASH_ENV="
   -e "ENV="
 )
+# ADR-118 (apple only): every runtime-bearing exec — uai-init's installs
+# above all — must aim pnpm at the task's block volume, exactly like the
+# container env-file. Docker execs keep the historical environment.
+if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
+  task_runtime_exec_env+=(
+    -e "NPM_CONFIG_STORE_DIR=$TASK_STORE_DIR"
+    -e "npm_config_store_dir=$TASK_STORE_DIR"
+  )
+fi
 
 # OpenCode and code-server share ~/.local/share. OpenCode credentials are
 # copied as root below, so creating only its leaf with `mkdir -p` can leave the

package/src/main.ts

@@ -461,11 +461,14 @@ if (initialRuntime.status === "ready") {
 // would be wrong and alarming. Only a genuine expiry/revocation asks for a
 // reconnect. Both cases keep retrying in the background regardless.
 setAuthExpiredHandler((taskId, _userId, reason) => {
+  // A blank reason (gh died with no stderr — e.g. racing its own task's
+  // teardown) classifies as transient; don't interpolate an empty clause.
+  const detail = reason.trim();
   const note = isTransientGithubError(reason)
-    ? `GitHub is temporarily unavailable — ${reason}. Uai is retrying ` +
-      `automatically; no action needed unless this persists (then run ` +
-      `/retry-gh).`
-    : `gh authentication expired (reason: ${reason}). Reconnect GitHub on ` +
+    ? `GitHub setup hit a temporary failure${detail ? ` — ${detail}` : ""}. ` +
+      `Uai is retrying automatically; no action needed unless this ` +
+      `persists (then run /retry-gh).`
+    : `gh authentication expired (reason: ${detail}). Reconnect GitHub on ` +
       `Account, then run /retry-gh in this task to restore.`;
   getOrchestrator().emitSystemNote(taskId, note);
 });