@runuai/host 0.9.69 → 0.9.71

package/lib/task-environment/index.ts

@@ -22,6 +22,12 @@ import {
   type DockerTaskEnvironmentRecoveryDriver,
   type DockerMachineIdentity,
 } from "./docker";
+import { createAwsMachineProvider } from "../machine-provider-aws";
+import { createLocalMachineProvider } from "../machine-provider-local";
+import { ensureMachineKeyPair } from "../machine-keys";
+import { requestAccessToken } from "../github-tokens";
+import { createMachineTaskEnvironmentProvider } from "./machine";
+import { createMachineHostTaskEnvironmentProvider } from "./machine-task-up";
 import { TaskEnvironmentRegistry } from "./registry";
 import {
   parseTaskEnvironmentLocator,
@@ -113,6 +119,53 @@ const appleProvider = createAppleContainerTaskEnvironmentProvider<
 
 registry.register(appleProvider);
 
+// ---------------------------------------------------------------------------
+// ADR-121: machine-backed tasks (ephemeral VM per task). Opt-in via
+// UAI_MACHINE_TASKS=1 — the guinea-pig flag; selection stays coarse (whole
+// host) until machine-backing becomes a per-task property.
+// ---------------------------------------------------------------------------
+
+function machineTasksEnabled(): boolean {
+  return process.env.UAI_MACHINE_TASKS === "1";
+}
+
+function machineBackend() {
+  if (process.env.UAI_MACHINE_PROVIDER === "aws") {
+    const region = process.env.UAI_AWS_REGION;
+    if (!region) {
+      throw new Error("UAI_MACHINE_PROVIDER=aws requires UAI_AWS_REGION");
+    }
+    return createAwsMachineProvider({
+      region,
+      subnetId: process.env.UAI_AWS_SUBNET_ID,
+      securityGroupId: process.env.UAI_AWS_SECURITY_GROUP_ID,
+      iamInstanceProfileArn: process.env.UAI_AWS_INSTANCE_PROFILE_ARN,
+    });
+  }
+  return createLocalMachineProvider();
+}
+
+const machineEnvironmentProvider = createMachineTaskEnvironmentProvider({
+  machines: machineBackend(),
+  taskControlDir: (taskId) => taskDir(taskId),
+  mintKeyPair: ensureMachineKeyPair,
+});
+
+const machineProvider = createMachineHostTaskEnvironmentProvider({
+  environment: machineEnvironmentProvider,
+  taskControlDir: (taskId) => taskDir(taskId),
+  machineImage: () => process.env.UAI_MACHINE_IMAGE ?? "uai-machine:dev",
+  machineCpus: () => Number(process.env.UAI_MACHINE_CPUS ?? "2"),
+  machineMemoryMiB: () => Number(process.env.UAI_MACHINE_MEMORY_MIB ?? "4096"),
+  // Local machines on macOS need loopback-published ssh (bridge IPs are not
+  // host-routable there); cloud machines and Linux dial the address directly.
+  publishSsh: () =>
+    process.env.UAI_MACHINE_PROVIDER !== "aws" && process.platform === "darwin",
+  githubToken: (userId) => requestAccessToken(userId),
+});
+
+registry.register(machineProvider);
+
 /**
  * Bind the Docker provider's private recovery implementation. Kept as a
  * replaceable module seam so HMR can reload the orchestrator without leaving
@@ -129,8 +182,9 @@ export function provisionTaskEnvironment(
   credentials: TaskUpCredentials = {},
   onPrepared?: (locator: TaskEnvironmentLocator) => Promise<void>,
 ): Promise<TaskEnvironmentProvisioned<TaskUpResult, TaskDownResult>> {
-  const provider =
-    requireMachineIdentity().backend === "apple-container"
+  const provider = machineTasksEnabled()
+    ? machineProvider
+    : requireMachineIdentity().backend === "apple-container"
       ? appleProvider
       : dockerProvider;
   return provider.provision({

package/lib/task-environment/machine-task-up.ts

@@ -0,0 +1,333 @@
+/**
+ * ADR-121: the machine-backed task-up adapter.
+ *
+ * Bridges the host's task contract (TaskLaunchInput → TaskUpResult) onto the
+ * pure machine environment provider (MachineTaskInput → descriptor). This is
+ * where task semantics live for machines: project clones happen IN the
+ * machine's world with a one-shot credential over stdin, the task branch is
+ * created off the clone's default HEAD, and repo problems degrade into an
+ * initWarning system note instead of failing the task (a machine with an
+ * empty workspace and a clear message beats a respawn loop).
+ *
+ * Compose-era result fields are satisfied honestly rather than faked:
+ * `composeProject` carries the machine id (the one durable runtime name this
+ * task owns) and `worktreePath` carries the host-side task control dir (the
+ * directory that really does hold this task's host-side state — its machine
+ * key). Consumers that need the workspace go through the environment handle.
+ */
+import type {
+  TaskDownResult,
+  TaskLaunchInput,
+  TaskUpCredentials,
+  TaskUpResult,
+} from "../agent";
+import {
+  MACHINE_TASK_ENVIRONMENT_PROVIDER,
+  parseMachineTaskEnvironmentLocator,
+  type MachineTaskInput,
+} from "./machine";
+import type {
+  TaskEnvironmentDescriptor,
+  TaskEnvironmentHandle,
+  TaskEnvironmentProvider,
+  TaskEnvironmentProvisionRequest,
+  TaskEnvironmentProvisioned,
+} from "./types";
+
+/** In-machine clone budget per project. */
+const CLONE_TIMEOUT_MS = 10 * 60_000;
+const GIT_STEP_TIMEOUT_MS = 60_000;
+const STEP_OUTPUT_BYTES = 256 * 1024;
+
+export interface MachineHostTaskUpDeps {
+  /** The pure machine environment provider (createMachineTaskEnvironmentProvider). */
+  environment: TaskEnvironmentProvider<
+    MachineTaskInput,
+    void,
+    TaskEnvironmentDescriptor
+  >;
+  /** Host-side control dir for the task (holds the machine key). */
+  taskControlDir(taskId: string): string;
+  machineImage(): string;
+  machineCpus(): number;
+  machineMemoryMiB(): number;
+  /** macOS-local machines need loopback-published ssh; cloud machines don't. */
+  publishSsh(): boolean;
+  /** The task owner's GitHub access token, or null when GitHub is not
+   * connected (public/anonymous clone fallback). */
+  githubToken(userId: string): Promise<{ accessToken: string } | null>;
+}
+
+/** Mirrors src/index.ts isGithubRepo — host-side predicate only. */
+export function isGithubRepoUrl(input: string): boolean {
+  const value = input.trim();
+  if (/^(?:[^@/]+@)?(?:www\.)?github\.com:/i.test(value)) return true;
+  if (/^[\w.-]+\/[\w.-]+(?:\.git)?\/?$/i.test(value)) return true;
+  try {
+    const url = new URL(value);
+    return /^(?:www\.)?github\.com$/i.test(url.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/** Canonical HTTPS form for GitHub repos (shorthand and ssh forms included);
+ * non-GitHub URLs pass through untouched. */
+export function machineCloneUrl(repoUrl: string): string {
+  const value = repoUrl.trim();
+  const ssh = /^(?:[^@/]+@)?(?:www\.)?github\.com:(.+)$/i.exec(value);
+  if (ssh?.[1]) {
+    return `https://github.com/${ssh[1].replace(/\.git$/i, "")}.git`;
+  }
+  if (/^[\w.-]+\/[\w.-]+(?:\.git)?\/?$/i.test(value)) {
+    return `https://github.com/${value.replace(/\/+$/, "").replace(/\.git$/i, "")}.git`;
+  }
+  return value;
+}
+
+/** Workspace-safe project directory name. The slug is cloud-normalized, but
+ * the machine path re-checks: a path-capable slug must never reach argv. */
+function projectDirectoryName(slug: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(slug) || slug.includes("..")) {
+    throw new Error(`unsafe project slug for machine clone: ${slug}`);
+  }
+  return slug;
+}
+
+interface StepResult {
+  exitCode: number | null;
+  stderr: string;
+}
+
+/** One-shot exec with stdin: spawn, deliver the secret, drain, await exit.
+ * The secret rides the ssh stream only — never argv, never the persisted
+ * env, never machine disk. */
+async function execWithStdin(
+  handle: TaskEnvironmentHandle<unknown>,
+  argv: readonly [string, ...string[]],
+  stdin: string,
+  timeoutMs: number,
+): Promise<StepResult> {
+  const proc = await handle.spawn({
+    argv,
+    inheritEnv: [],
+    env: { GIT_TERMINAL_PROMPT: "0" },
+    timeoutMs,
+    maxOutputBytes: STEP_OUTPUT_BYTES,
+  });
+  let stderr = "";
+  const drainOut = (async () => {
+    for await (const chunk of proc.stdout) {
+      void chunk; // drained; clone progress is not retained
+    }
+  })();
+  const drainErr = (async () => {
+    for await (const chunk of proc.stderr) {
+      stderr = (stderr + Buffer.from(chunk).toString("utf8")).slice(-8192);
+    }
+  })();
+  await proc.write(Buffer.from(stdin));
+  await proc.closeInput();
+  const exit = await proc.completion;
+  await Promise.allSettled([drainOut, drainErr]);
+  return { exitCode: exit.exitCode, stderr: stderr.trim() };
+}
+
+async function execStep(
+  handle: TaskEnvironmentHandle<unknown>,
+  argv: readonly [string, ...string[]],
+  timeoutMs: number,
+): Promise<StepResult> {
+  const result = await handle.exec({
+    argv,
+    env: { GIT_TERMINAL_PROMPT: "0" },
+    timeoutMs,
+    maxOutputBytes: STEP_OUTPUT_BYTES,
+  });
+  return {
+    exitCode: result.exitCode,
+    stderr: Buffer.from(result.stderr).toString("utf8").trim().slice(-8192),
+  };
+}
+
+/** The remote clone script for the credentialed path. The token is read from
+ * stdin into the clone process env; /usr/local/bin/uai-git-askpass (baked in
+ * the machine image) answers git's prompts from it. */
+const CREDENTIALED_CLONE_SCRIPT =
+  'IFS= read -r UAI_GIT_TOKEN && export UAI_GIT_TOKEN GIT_ASKPASS=/usr/local/bin/uai-git-askpass GIT_TERMINAL_PROMPT=0 && exec git clone -- "$1" "$2"';
+
+async function cloneProject(
+  handle: TaskEnvironmentHandle<unknown>,
+  workspacePath: string,
+  project: { slug: string; repoUrl: string },
+  taskBranch: string,
+  owner: { name?: string; email?: string },
+  token: string | null,
+): Promise<string | null> {
+  const destination = `${workspacePath}/${projectDirectoryName(project.slug)}`;
+  const url = machineCloneUrl(project.repoUrl);
+  const useToken = token !== null && isGithubRepoUrl(project.repoUrl);
+
+  // Resume/retry idempotency: a repository that already exists is the task's
+  // live work — never re-clone over it, and leave its branch state alone.
+  const already = await execStep(
+    handle,
+    ["/bin/sh", "-c", 'test -e "$1/.git"', "check", destination],
+    GIT_STEP_TIMEOUT_MS,
+  );
+  if (already.exitCode === 0) return null;
+
+  const clone = useToken
+    ? await execWithStdin(
+        handle,
+        ["/bin/sh", "-c", CREDENTIALED_CLONE_SCRIPT, "clone", url, destination],
+        `${token}\n`,
+        CLONE_TIMEOUT_MS,
+      )
+    : await execStep(
+        handle,
+        ["git", "clone", "--", url, destination],
+        CLONE_TIMEOUT_MS,
+      );
+  if (clone.exitCode !== 0) {
+    return `could not clone ${project.repoUrl} for ${project.slug}: ${clone.stderr || "clone failed"}`;
+  }
+
+  // Task branch off the clone's default HEAD (matches the compose path's
+  // `-b <branch> origin/<default>`). -B keeps an empty-repo clone (unborn
+  // HEAD) and a re-run both working; failure degrades, never fails the task.
+  const branch = await execStep(
+    handle,
+    ["git", "-C", destination, "checkout", "-B", taskBranch],
+    GIT_STEP_TIMEOUT_MS,
+  );
+  if (branch.exitCode !== 0) {
+    return `cloned ${project.slug} but could not create branch ${taskBranch}: ${branch.stderr}`;
+  }
+
+  // Repo-local commit identity so agent commits work out of the box.
+  if (owner.name) {
+    await execStep(
+      handle,
+      ["git", "-C", destination, "config", "user.name", owner.name],
+      GIT_STEP_TIMEOUT_MS,
+    );
+  }
+  if (owner.email) {
+    await execStep(
+      handle,
+      ["git", "-C", destination, "config", "user.email", owner.email],
+      GIT_STEP_TIMEOUT_MS,
+    );
+  }
+  return null;
+}
+
+/** Wrap the void-teardown machine handle so registry consumers get the
+ * TaskDownResult contract the compose providers speak. */
+function withTaskDownResult(
+  handle: TaskEnvironmentHandle<unknown>,
+): TaskEnvironmentHandle<TaskDownResult> {
+  // Explicit delegation, never Object.create: the machine handle is a class
+  // with private fields, and a prototype-borrowed method invoked on a foreign
+  // receiver throws on its first #member access.
+  return {
+    descriptor: handle.descriptor,
+    durableIdentity: handle.durableIdentity,
+    readWorkspaceFile: (path) => handle.readWorkspaceFile(path),
+    writeWorkspaceFile: (path, bytes) => handle.writeWorkspaceFile(path, bytes),
+    exec: (request) => handle.exec(request),
+    spawn: (request) => handle.spawn(request),
+    spawnSession: (request) => handle.spawnSession(request),
+    launchDetachedSession: (request) => handle.launchDetachedSession(request),
+    copy: (request) => handle.copy(request),
+    ports: () => handle.ports(),
+    status: () => handle.status(),
+    recover: (context) => handle.recover(context),
+    stop: () => handle.stop(),
+    teardown: async (): Promise<TaskDownResult> => {
+      await handle.teardown();
+      return { status: "terminated" };
+    },
+  };
+}
+
+export function createMachineHostTaskEnvironmentProvider(
+  deps: MachineHostTaskUpDeps,
+): TaskEnvironmentProvider<
+  TaskLaunchInput,
+  TaskUpCredentials,
+  TaskUpResult,
+  TaskDownResult
+> {
+  return {
+    kind: MACHINE_TASK_ENVIRONMENT_PROVIDER,
+
+    async provision(
+      request: TaskEnvironmentProvisionRequest<TaskLaunchInput, TaskUpCredentials>,
+    ): Promise<TaskEnvironmentProvisioned<TaskUpResult, TaskDownResult>> {
+      const { input } = request;
+      const provisioned = await deps.environment.provision({
+        taskId: request.taskId,
+        input: {
+          image: deps.machineImage(),
+          cpus: deps.machineCpus(),
+          memoryMiB: deps.machineMemoryMiB(),
+          ...(deps.publishSsh() ? { publishSsh: true } : {}),
+        },
+        credentials: undefined,
+        onPrepared: request.onPrepared,
+      });
+      const handle = provisioned.handle;
+      const workspacePath = handle.descriptor.workspacePath;
+      const warnings: string[] = [];
+
+      try {
+        const projects = [...input.projects].sort(
+          (a, b) => a.position - b.position,
+        );
+        const wantsGithub = projects.some((project) =>
+          isGithubRepoUrl(project.repoUrl),
+        );
+        const token = wantsGithub
+          ? await deps.githubToken(input.task.ownerUserId)
+          : null;
+        for (const project of projects) {
+          const warning = await cloneProject(
+            handle,
+            workspacePath,
+            project,
+            input.task.branch,
+            { name: input.ownerName, email: input.ownerEmail },
+            token?.accessToken ?? null,
+          );
+          if (warning) warnings.push(warning);
+        }
+      } catch (error) {
+        // Provisioning-infrastructure failures (ssh died, unsafe slug) tear
+        // the machine down rather than stranding an orphan; per-repo problems
+        // were already converted to warnings above and do not land here.
+        await handle.teardown().catch(() => {});
+        throw error;
+      }
+
+      const machineId = parseMachineTaskEnvironmentLocator(
+        handle.descriptor.locator,
+      ).machineId;
+      return {
+        handle: withTaskDownResult(handle),
+        result: {
+          composeProject: machineId,
+          worktreePath: deps.taskControlDir(request.taskId),
+          ...(warnings.length > 0
+            ? { initWarning: warnings.join("\n") }
+            : {}),
+        },
+      };
+    },
+
+    async reconstruct(locator) {
+      return withTaskDownResult(await deps.environment.reconstruct(locator));
+    },
+  };
+}