@runuai/host 0.9.69 → 0.9.71

package/lib/task-environment/types.ts

@@ -186,6 +186,16 @@ export type TaskEnvironmentRecoveryResult =
 export interface TaskEnvironmentHandle<TTeardownResult = void>
   extends TaskEnvironmentAgentSessionSurface {
   readonly descriptor: TaskEnvironmentDescriptor;
+  /** ADR-121 strangler ops: task-scoped file IO through the provider, so
+   * call sites stop knowing where the workspace physically lives. Paths are
+   * ENVIRONMENT-absolute and must sit inside the descriptor's workspace
+   * (assertWorkspaceScopedPath). Providers whose workspace is host-side
+   * (docker, apple) implement these as direct filesystem access — zero
+   * behavior change; machine providers reach over their transport. Read
+   * resolves null for a missing file and rejects for any other failure —
+   * absence and error are different facts. */
+  readWorkspaceFile(path: string): Promise<Uint8Array | null>;
+  writeWorkspaceFile(path: string, bytes: Uint8Array): Promise<void>;
   exec(request: TaskEnvironmentExecRequest): Promise<TaskEnvironmentExecResult>;
   spawn(request: TaskEnvironmentSpawnRequest): Promise<TaskEnvironmentProcess>;
   copy(request: TaskEnvironmentCopyRequest): Promise<void>;
@@ -245,6 +255,28 @@ export interface TaskEnvironmentProvider<
   ): Promise<TaskEnvironmentHandle<TTeardownResult>>;
 }
 
+/** Workspace-scope guard for the strangler file ops: the path must be an
+ * absolute, NUL-free, dot-segment-free environment path inside the
+ * descriptor's workspace. Escaping the workspace through the file ops would
+ * hand callers the environment's whole filesystem. */
+export function assertWorkspaceScopedPath(
+  descriptor: TaskEnvironmentDescriptor,
+  path: string,
+): void {
+  if (!path.startsWith("/") || path.includes("\0")) {
+    throw new Error("workspace file path must be an absolute NUL-free path");
+  }
+  if (path.split("/").some((part) => part === "." || part === "..")) {
+    throw new Error("workspace file path must not contain dot segments");
+  }
+  const root = descriptor.workspacePath.endsWith("/")
+    ? descriptor.workspacePath
+    : `${descriptor.workspacePath}/`;
+  if (path !== descriptor.workspacePath && !path.startsWith(root)) {
+    throw new Error("workspace file path escapes the task workspace");
+  }
+}
+
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 /** Shared admission guard for provider implementations and fake providers. */

package/lib/task-environment/workspace-files.ts

@@ -0,0 +1,51 @@
+/**
+ * ADR-121 strangler ops: the host-filesystem implementation of the
+ * workspace file operations, shared by every provider whose workspace
+ * physically lives on the host (docker, apple-container). Behavior is
+ * byte-identical to the direct fs access call sites used to perform — the
+ * point of the strangler's first phase is that call sites stop KNOWING the
+ * workspace is host-side, not that anything moves yet.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import {
+  assertWorkspaceScopedPath,
+  type TaskEnvironmentDescriptor,
+} from "./types";
+
+/** Map an environment-absolute workspace path to its host location. */
+function hostPathFor(
+  descriptor: TaskEnvironmentDescriptor,
+  hostWorkspaceRoot: string,
+  path: string,
+): string {
+  assertWorkspaceScopedPath(descriptor, path);
+  const relative = path.slice(descriptor.workspacePath.length);
+  return join(hostWorkspaceRoot, ...relative.split("/").filter(Boolean));
+}
+
+export function hostWorkspaceRead(
+  descriptor: TaskEnvironmentDescriptor,
+  hostWorkspaceRoot: string,
+  path: string,
+): Uint8Array | null {
+  try {
+    return readFileSync(hostPathFor(descriptor, hostWorkspaceRoot, path));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+export function hostWorkspaceWrite(
+  descriptor: TaskEnvironmentDescriptor,
+  hostWorkspaceRoot: string,
+  path: string,
+  bytes: Uint8Array,
+): void {
+  const target = hostPathFor(descriptor, hostWorkspaceRoot, path);
+  mkdirSync(dirname(target), { recursive: true });
+  writeFileSync(target, bytes);
+}

package/lib/transcript.ts

@@ -14,6 +14,7 @@ import { resolve } from "node:path";
 
 import { taskWorkspaceDir } from "./env";
 import { rewriteAttachmentRefs } from "./orchestrator";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
 import type { TranscriptTarget } from "../src/protocol";
 
 /** Container path agents are pointed at. */
@@ -26,20 +27,97 @@ const TARGET_FILENAME: Record<TranscriptTarget, string> = {
   "chat-front": "chat-front.md",
 };
 
+function transcriptEntry(author: string, text: string): string | null {
+  // Rewrite cloud attachment URLs to the in-container path so an agent reading
+  // the transcript can open referenced files directly.
+  const body = rewriteAttachmentRefs(text).trim();
+  if (!body) return null;
+  return `## ${author}\n\n${body}\n\n`;
+}
+
 export function appendTranscript(
   taskId: string,
   author: string,
   text: string,
   targets: TranscriptTarget[],
 ): void {
-  // Rewrite cloud attachment URLs to the in-container path so an agent reading
-  // the transcript can open referenced files directly.
-  const body = rewriteAttachmentRefs(text).trim();
-  if (!body) return;
+  const entry = transcriptEntry(author, text);
+  if (entry === null) return;
   const dir = resolve(taskWorkspaceDir(taskId), ".uai");
   mkdirSync(dir, { recursive: true });
-  const entry = `## ${author}\n\n${body}\n\n`;
   for (const target of new Set(targets)) {
     appendFileSync(resolve(dir, TARGET_FILENAME[target]), entry);
   }
 }
+
+// ---------------------------------------------------------------------------
+// ADR-121: environment-side transcript for machine-backed tasks. The
+// workspace lives in the machine's world, so the append travels over the
+// environment transport (entry via stdin). A per-task promise chain
+// preserves message order the way the sync host-FS path did implicitly.
+// ---------------------------------------------------------------------------
+
+const environmentAppendChains = new Map<string, Promise<void>>();
+
+async function appendOneViaEnvironment(
+  environment: TaskEnvironmentHandle<unknown>,
+  target: TranscriptTarget,
+  entry: string,
+): Promise<void> {
+  const path = `${environment.descriptor.workspacePath}/.uai/${TARGET_FILENAME[target]}`;
+  const proc = await environment.spawn({
+    argv: [
+      "/bin/sh",
+      "-c",
+      'mkdir -p "$(dirname "$1")" && cat >> "$1"',
+      "append",
+      path,
+    ],
+    inheritEnv: [],
+    env: {},
+    timeoutMs: 30_000,
+    maxOutputBytes: 8 * 1024,
+  });
+  const drains = [
+    (async () => {
+      for await (const chunk of proc.stdout) void chunk;
+    })(),
+    (async () => {
+      for await (const chunk of proc.stderr) void chunk;
+    })(),
+  ];
+  await proc.write(Buffer.from(entry));
+  await proc.closeInput();
+  const exit = await proc.completion;
+  await Promise.allSettled(drains);
+  if (exit.exitCode !== 0) {
+    throw new Error(`environment transcript append exited ${exit.exitCode}`);
+  }
+}
+
+export function appendTranscriptViaEnvironment(
+  taskId: string,
+  environment: TaskEnvironmentHandle<unknown>,
+  author: string,
+  text: string,
+  targets: TranscriptTarget[],
+): Promise<void> {
+  const entry = transcriptEntry(author, text);
+  if (entry === null) return Promise.resolve();
+  const previous = environmentAppendChains.get(taskId) ?? Promise.resolve();
+  const next = previous
+    .catch(() => {})
+    .then(async () => {
+      for (const target of new Set(targets)) {
+        await appendOneViaEnvironment(environment, target, entry);
+      }
+    });
+  environmentAppendChains.set(taskId, next);
+  // Bound the map: forget the chain once it settles as the latest entry.
+  void next.finally(() => {
+    if (environmentAppendChains.get(taskId) === next) {
+      environmentAppendChains.delete(taskId);
+    }
+  });
+  return next;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.69",
+  "version": "0.9.71",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -19,14 +19,28 @@ import {
 } from "../lib/agent-cli";
 import {
   clearRefresh,
+  injectIntoContainer,
   reconcileTaskGitAuth,
+  requestAccessToken,
 } from "../lib/github-tokens";
 import {
   prepareTaskGithubGitCredential,
   type TaskGithubGitCredential,
 } from "../lib/github-git-auth";
 import { readAttachment, writeAttachment } from "../lib/attachments";
-import { appendTranscript as writeTranscript } from "../lib/transcript";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { taskProjectWorktree } from "../lib/env";
+import { getDecryptedForProject } from "../lib/host-env";
+import {
+  envSchemaNote,
+  missingRequiredKeys,
+  parseEnvSchema,
+} from "../lib/env-schema";
+import {
+  appendTranscript as writeTranscript,
+  appendTranscriptViaEnvironment,
+} from "../lib/transcript";
 import { buildTaskDiff } from "../lib/task-diff";
 import {
   deleteHostTask,
@@ -439,6 +453,37 @@ export const hostCommands: HostCommands = {
             runtimeQuarantinedForRecreate = true;
           }
         }
+      } else if (
+        existingTask?.statusMirror === "running" &&
+        existingTask.environmentProvider === "machine"
+      ) {
+        // ADR-121: a machine-backed task revalidates through its own
+        // provider — the compose fast path below speaks docker and would
+        // misread a machine row. Running machine → persisted success;
+        // anything else falls through to provisionTaskEnvironment, whose
+        // machine provider owns recovery semantics.
+        try {
+          const environment = await reconstructPersistedTaskEnvironment(
+            existingTask,
+          );
+          if (environment) {
+            const machineStatus = await environment.status();
+            if (machineStatus.state === "running") {
+              orchestrator.allowChannel(input.task.id);
+              return {
+                ok: true,
+                value: {
+                  composeProject: existingTask.composeProject ?? "",
+                  worktreePath: existingTask.worktreePath ?? "",
+                },
+              };
+            }
+          }
+        } catch (error) {
+          console.warn(
+            `[machine] task ${input.task.id}: running-row revalidation failed, continuing to provision: ${error instanceof Error ? error.message : String(error)}`,
+          );
+        }
       } else if (existingTask?.statusMirror === "running") {
         if (!existingTask.composeProject || !existingTask.worktreePath) {
           return {
@@ -786,6 +831,17 @@ export const hostCommands: HostCommands = {
             result.value.initWarning,
           );
         }
+        // ADR-122 phase 1: a project that declares @required env keys with
+        // no value on this host gets ONE visible note now — not a blank 500
+        // hours later (live 2026-08-25). Best-effort by design: a schema
+        // read hiccup must never fail a completed task-up.
+        void noteMissingRequiredEnvKeys(input).catch((err) =>
+          console.warn(
+            `[env-schema] task ${input.task.id}: validation note failed: ${
+              err instanceof Error ? err.message : String(err)
+            }`,
+          ),
+        );
         // GitHub auth for the container is best-effort (ADR-027) and runs in the
         // background — it must never block or fail task-up. Awaiting it here would
         // couple the command result to a network token-exchange: a slow/hung
@@ -793,16 +849,33 @@ export const hostCommands: HostCommands = {
         // and mark a running task as errored. The reconciler injects + schedules
         // (or emits a system note on failure) on its own; the agents come up
         // regardless and the token lands well before the first `gh` call.
-        void reconcileTaskGitAuth(
-          input.task.id,
-          input.task.ownerUserId,
-        ).catch((err) =>
-          console.warn(
-            `[github] task ${input.task.id}: post-start reconciliation failed: ${
-              err instanceof Error ? err.message : String(err)
-            }`,
-          ),
-        );
+        // ADR-121: machine-backed tasks take a direct environment injection —
+        // the compose reconciler would probe for an app container, find none,
+        // and silently skip. Reconnect re-injection for machines is a
+        // follow-up alongside the machine recovery pass.
+        if (getHostTask(input.task.id)?.environmentProvider === "machine") {
+          void machineTaskGithubAuth(
+            input.task.id,
+            input.task.ownerUserId,
+          ).catch((err) =>
+            console.warn(
+              `[github] machine task ${input.task.id}: auth injection failed: ${
+                err instanceof Error ? err.message : String(err)
+              }`,
+            ),
+          );
+        } else {
+          void reconcileTaskGitAuth(
+            input.task.id,
+            input.task.ownerUserId,
+          ).catch((err) =>
+            console.warn(
+              `[github] task ${input.task.id}: post-start reconciliation failed: ${
+                err instanceof Error ? err.message : String(err)
+              }`,
+            ),
+          );
+        }
       } else if (result.code === HostErrorCode.HostUnavailable) {
         // A daemon outage is retryable infrastructure state, not proof that
         // the task itself failed. Undo the optimistic local `starting` mirror
@@ -1169,6 +1242,20 @@ export const hostCommands: HostCommands = {
   async attachmentWrite(ctx, input) {
     logCommand(ctx, "attachmentWrite", input.taskId, input.filename);
     try {
+      // ADR-121 strangler: attachments go through the environment's file
+      // ops, so this call site no longer knows where the workspace lives —
+      // host-side providers implement them as the exact direct fs access
+      // this used to be; machine providers reach over their transport. A
+      // row without a reconstructible environment (legacy) keeps the
+      // host-FS path unchanged.
+      const environment = await reconstructHostTaskEnvironment(input.taskId);
+      if (environment) {
+        await environment.writeWorkspaceFile(
+          attachmentEnvironmentPath(environment, input.filename),
+          Buffer.from(input.dataBase64, "base64"),
+        );
+        return ok(undefined);
+      }
       writeAttachment(
         input.taskId,
         input.filename,
@@ -1183,7 +1270,12 @@ export const hostCommands: HostCommands = {
   async attachmentRead(ctx, input) {
     logCommand(ctx, "attachmentRead", input.taskId, input.filename);
     try {
-      const bytes = readAttachment(input.taskId, input.filename);
+      const environment = await reconstructHostTaskEnvironment(input.taskId);
+      const bytes = environment
+        ? await environment.readWorkspaceFile(
+            attachmentEnvironmentPath(environment, input.filename),
+          )
+        : readAttachment(input.taskId, input.filename);
       if (!bytes) {
         return {
           ok: false,
@@ -1191,7 +1283,7 @@ export const hostCommands: HostCommands = {
           message: `no such attachment: ${input.filename}`,
         };
       }
-      return ok({ dataBase64: bytes.toString("base64") });
+      return ok({ dataBase64: Buffer.from(bytes).toString("base64") });
     } catch (err) {
       return failFromUnknown(err);
     }
@@ -1226,6 +1318,24 @@ export const hostCommands: HostCommands = {
   async appendTranscript(_ctx, taskId, author, text, targets) {
     // Per-message + high-frequency, so no logCommand (avoid log spam).
     try {
+      // ADR-121: a machine-backed workspace lives in the machine's world —
+      // the append must travel over the environment transport. Container
+      // tasks keep the direct host-FS write (their workspace is a bind
+      // mount and the sync path is cheaper than a docker exec per message).
+      const task = getHostTask(taskId);
+      if (task?.environmentProvider === "machine") {
+        const environment = await reconstructHostTaskEnvironment(taskId);
+        if (environment) {
+          await appendTranscriptViaEnvironment(
+            taskId,
+            environment,
+            author,
+            text,
+            targets,
+          );
+          return ok(undefined);
+        }
+      }
       writeTranscript(taskId, author, text, targets);
       return ok(undefined);
     } catch (err) {
@@ -1238,6 +1348,30 @@ function normalizeChannelSpec(input: ChannelEnsureInput): ChannelEnsureInput {
   return { ...input, workspacePath: "/workspace" };
 }
 
+/**
+ * ADR-121: gh auth for a machine-backed task, injected over the environment
+ * transport (token via exec stdin — same `gh auth login --with-token` +
+ * `setup-git` gesture as containers, no compose probing). Best-effort like
+ * the compose reconciler: absence of a GitHub connection is a quiet no-op.
+ */
+async function machineTaskGithubAuth(
+  taskId: string,
+  userId: string,
+): Promise<void> {
+  const environment = await reconstructHostTaskEnvironment(taskId);
+  if (!environment) return;
+  const token = await requestAccessToken(userId);
+  if (!token) return;
+  // Machine work is not container work: no docker/apple runtime admission.
+  await injectIntoContainer(
+    taskId,
+    token.accessToken,
+    undefined,
+    () => {},
+    environment,
+  );
+}
+
 async function reconstructHostTaskEnvironment(
   taskId: string,
 ): Promise<TaskEnvironmentHandle<TaskDownResult> | null> {
@@ -1267,6 +1401,53 @@ function taskDownResultForInput(
   };
 }
 
+/** Attachment location inside the environment — same shape every provider
+ * serves (`<workspace>/.uai/attachments/<name>`), basename-hardened exactly
+ * like the legacy host-side safePath. */
+function attachmentEnvironmentPath(
+  environment: { descriptor: { workspacePath: string } },
+  filename: string,
+): string {
+  const name = filename.split("/").pop() ?? "";
+  if (name === "" || name === "." || name === ".." || name.includes("\0")) {
+    throw new Error("invalid attachment filename");
+  }
+  return `${environment.descriptor.workspacePath}/.uai/attachments/${name}`;
+}
+
+/** ADR-122 phase 1: read each project's committed .env.schema from the
+ * fresh workspace, compare @required keys against the union of values this
+ * host actually injected (env is merged across projects, so any project's
+ * value covers the key), and post one note naming what's missing. */
+async function noteMissingRequiredEnvKeys(
+  input: TaskLaunchInput,
+): Promise<void> {
+  const provided = new Set<string>();
+  for (const project of input.projects) {
+    for (const key of Object.keys(getDecryptedForProject(project.id))) {
+      provided.add(key);
+    }
+  }
+  const perProject: Array<{ slug: string; missing: string[] }> = [];
+  for (const project of input.projects) {
+    let content: string;
+    try {
+      content = readFileSync(
+        resolve(taskProjectWorktree(input.task.id, project.slug), ".env.schema"),
+        "utf8",
+      );
+    } catch {
+      continue; // No schema, no opinion — today's behavior, unchanged.
+    }
+    perProject.push({
+      slug: project.slug,
+      missing: missingRequiredKeys(parseEnvSchema(content), provided),
+    });
+  }
+  const note = envSchemaNote(perProject);
+  if (note) getOrchestrator().emitSystemNote(input.task.id, note);
+}
+
 function logCommand(
   ctx: CommandContext,
   command: keyof HostCommands,