@runuai/host 0.9.69 → 0.9.70

package/lib/task-environment/types.ts

@@ -186,6 +186,16 @@ export type TaskEnvironmentRecoveryResult =
 export interface TaskEnvironmentHandle<TTeardownResult = void>
   extends TaskEnvironmentAgentSessionSurface {
   readonly descriptor: TaskEnvironmentDescriptor;
+  /** ADR-121 strangler ops: task-scoped file IO through the provider, so
+   * call sites stop knowing where the workspace physically lives. Paths are
+   * ENVIRONMENT-absolute and must sit inside the descriptor's workspace
+   * (assertWorkspaceScopedPath). Providers whose workspace is host-side
+   * (docker, apple) implement these as direct filesystem access — zero
+   * behavior change; machine providers reach over their transport. Read
+   * resolves null for a missing file and rejects for any other failure —
+   * absence and error are different facts. */
+  readWorkspaceFile(path: string): Promise<Uint8Array | null>;
+  writeWorkspaceFile(path: string, bytes: Uint8Array): Promise<void>;
   exec(request: TaskEnvironmentExecRequest): Promise<TaskEnvironmentExecResult>;
   spawn(request: TaskEnvironmentSpawnRequest): Promise<TaskEnvironmentProcess>;
   copy(request: TaskEnvironmentCopyRequest): Promise<void>;
@@ -245,6 +255,28 @@ export interface TaskEnvironmentProvider<
   ): Promise<TaskEnvironmentHandle<TTeardownResult>>;
 }
 
+/** Workspace-scope guard for the strangler file ops: the path must be an
+ * absolute, NUL-free, dot-segment-free environment path inside the
+ * descriptor's workspace. Escaping the workspace through the file ops would
+ * hand callers the environment's whole filesystem. */
+export function assertWorkspaceScopedPath(
+  descriptor: TaskEnvironmentDescriptor,
+  path: string,
+): void {
+  if (!path.startsWith("/") || path.includes("\0")) {
+    throw new Error("workspace file path must be an absolute NUL-free path");
+  }
+  if (path.split("/").some((part) => part === "." || part === "..")) {
+    throw new Error("workspace file path must not contain dot segments");
+  }
+  const root = descriptor.workspacePath.endsWith("/")
+    ? descriptor.workspacePath
+    : `${descriptor.workspacePath}/`;
+  if (path !== descriptor.workspacePath && !path.startsWith(root)) {
+    throw new Error("workspace file path escapes the task workspace");
+  }
+}
+
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 /** Shared admission guard for provider implementations and fake providers. */

package/lib/task-environment/workspace-files.ts

@@ -0,0 +1,51 @@
+/**
+ * ADR-121 strangler ops: the host-filesystem implementation of the
+ * workspace file operations, shared by every provider whose workspace
+ * physically lives on the host (docker, apple-container). Behavior is
+ * byte-identical to the direct fs access call sites used to perform — the
+ * point of the strangler's first phase is that call sites stop KNOWING the
+ * workspace is host-side, not that anything moves yet.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import {
+  assertWorkspaceScopedPath,
+  type TaskEnvironmentDescriptor,
+} from "./types";
+
+/** Map an environment-absolute workspace path to its host location. */
+function hostPathFor(
+  descriptor: TaskEnvironmentDescriptor,
+  hostWorkspaceRoot: string,
+  path: string,
+): string {
+  assertWorkspaceScopedPath(descriptor, path);
+  const relative = path.slice(descriptor.workspacePath.length);
+  return join(hostWorkspaceRoot, ...relative.split("/").filter(Boolean));
+}
+
+export function hostWorkspaceRead(
+  descriptor: TaskEnvironmentDescriptor,
+  hostWorkspaceRoot: string,
+  path: string,
+): Uint8Array | null {
+  try {
+    return readFileSync(hostPathFor(descriptor, hostWorkspaceRoot, path));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+export function hostWorkspaceWrite(
+  descriptor: TaskEnvironmentDescriptor,
+  hostWorkspaceRoot: string,
+  path: string,
+  bytes: Uint8Array,
+): void {
+  const target = hostPathFor(descriptor, hostWorkspaceRoot, path);
+  mkdirSync(dirname(target), { recursive: true });
+  writeFileSync(target, bytes);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.69",
+  "version": "0.9.70",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -26,6 +26,15 @@ import {
   type TaskGithubGitCredential,
 } from "../lib/github-git-auth";
 import { readAttachment, writeAttachment } from "../lib/attachments";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { taskProjectWorktree } from "../lib/env";
+import { getDecryptedForProject } from "../lib/host-env";
+import {
+  envSchemaNote,
+  missingRequiredKeys,
+  parseEnvSchema,
+} from "../lib/env-schema";
 import { appendTranscript as writeTranscript } from "../lib/transcript";
 import { buildTaskDiff } from "../lib/task-diff";
 import {
@@ -786,6 +795,17 @@ export const hostCommands: HostCommands = {
             result.value.initWarning,
           );
         }
+        // ADR-122 phase 1: a project that declares @required env keys with
+        // no value on this host gets ONE visible note now — not a blank 500
+        // hours later (live 2026-08-25). Best-effort by design: a schema
+        // read hiccup must never fail a completed task-up.
+        void noteMissingRequiredEnvKeys(input).catch((err) =>
+          console.warn(
+            `[env-schema] task ${input.task.id}: validation note failed: ${
+              err instanceof Error ? err.message : String(err)
+            }`,
+          ),
+        );
         // GitHub auth for the container is best-effort (ADR-027) and runs in the
         // background — it must never block or fail task-up. Awaiting it here would
         // couple the command result to a network token-exchange: a slow/hung
@@ -1169,6 +1189,20 @@ export const hostCommands: HostCommands = {
   async attachmentWrite(ctx, input) {
     logCommand(ctx, "attachmentWrite", input.taskId, input.filename);
     try {
+      // ADR-121 strangler: attachments go through the environment's file
+      // ops, so this call site no longer knows where the workspace lives —
+      // host-side providers implement them as the exact direct fs access
+      // this used to be; machine providers reach over their transport. A
+      // row without a reconstructible environment (legacy) keeps the
+      // host-FS path unchanged.
+      const environment = await reconstructHostTaskEnvironment(input.taskId);
+      if (environment) {
+        await environment.writeWorkspaceFile(
+          attachmentEnvironmentPath(environment, input.filename),
+          Buffer.from(input.dataBase64, "base64"),
+        );
+        return ok(undefined);
+      }
       writeAttachment(
         input.taskId,
         input.filename,
@@ -1183,7 +1217,12 @@ export const hostCommands: HostCommands = {
   async attachmentRead(ctx, input) {
     logCommand(ctx, "attachmentRead", input.taskId, input.filename);
     try {
-      const bytes = readAttachment(input.taskId, input.filename);
+      const environment = await reconstructHostTaskEnvironment(input.taskId);
+      const bytes = environment
+        ? await environment.readWorkspaceFile(
+            attachmentEnvironmentPath(environment, input.filename),
+          )
+        : readAttachment(input.taskId, input.filename);
       if (!bytes) {
         return {
           ok: false,
@@ -1191,7 +1230,7 @@ export const hostCommands: HostCommands = {
           message: `no such attachment: ${input.filename}`,
         };
       }
-      return ok({ dataBase64: bytes.toString("base64") });
+      return ok({ dataBase64: Buffer.from(bytes).toString("base64") });
     } catch (err) {
       return failFromUnknown(err);
     }
@@ -1267,6 +1306,53 @@ function taskDownResultForInput(
   };
 }
 
+/** Attachment location inside the environment — same shape every provider
+ * serves (`<workspace>/.uai/attachments/<name>`), basename-hardened exactly
+ * like the legacy host-side safePath. */
+function attachmentEnvironmentPath(
+  environment: { descriptor: { workspacePath: string } },
+  filename: string,
+): string {
+  const name = filename.split("/").pop() ?? "";
+  if (name === "" || name === "." || name === ".." || name.includes("\0")) {
+    throw new Error("invalid attachment filename");
+  }
+  return `${environment.descriptor.workspacePath}/.uai/attachments/${name}`;
+}
+
+/** ADR-122 phase 1: read each project's committed .env.schema from the
+ * fresh workspace, compare @required keys against the union of values this
+ * host actually injected (env is merged across projects, so any project's
+ * value covers the key), and post one note naming what's missing. */
+async function noteMissingRequiredEnvKeys(
+  input: TaskLaunchInput,
+): Promise<void> {
+  const provided = new Set<string>();
+  for (const project of input.projects) {
+    for (const key of Object.keys(getDecryptedForProject(project.id))) {
+      provided.add(key);
+    }
+  }
+  const perProject: Array<{ slug: string; missing: string[] }> = [];
+  for (const project of input.projects) {
+    let content: string;
+    try {
+      content = readFileSync(
+        resolve(taskProjectWorktree(input.task.id, project.slug), ".env.schema"),
+        "utf8",
+      );
+    } catch {
+      continue; // No schema, no opinion — today's behavior, unchanged.
+    }
+    perProject.push({
+      slug: project.slug,
+      missing: missingRequiredKeys(parseEnvSchema(content), provided),
+    });
+  }
+  const note = envSchemaNote(perProject);
+  if (note) getOrchestrator().emitSystemNote(input.task.id, note);
+}
+
 function logCommand(
   ctx: CommandContext,
   command: keyof HostCommands,