@runuai/host 0.9.70 → 0.9.72

package/lib/agents/transport.ts

@@ -23,6 +23,7 @@
 
 import {
   copyFileSync,
+  readFileSync,
   mkdirSync,
   renameSync,
   rmSync,
@@ -39,6 +40,14 @@ import { taskWorkspaceDir } from "../env";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
 import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
 import { DurableProcess, runnerScriptPath } from "./durable-proc";
+import {
+  MachineDurableProcess,
+  deployRunner,
+  machineSessionDir,
+  publishMachineCurrentSession,
+  stopMachinePredecessor,
+  type MachineSessionEnvironment,
+} from "./machine-durable";
 import {
   AGENT_SESSION_OUTPUT_BUFFER_BYTES,
   EnvironmentLineProcess,
@@ -93,9 +102,13 @@ const ATTACH_HEARTBEAT_FRESH_MS = 20_000;
  * the feed, multiplicity growing by one per errored turn. Enforcing the
  * invariant here covers every replacement path, including future ones.
  */
-const liveTails = new Map<string, DurableProcess>();
+interface DetachableTail extends LineTransport {
+  detach(): void;
+}
 
-function claimTail(key: string, proc: DurableProcess): DurableProcess {
+const liveTails = new Map<string, DetachableTail>();
+
+function claimTail<T extends DetachableTail>(key: string, proc: T): T {
   liveTails.get(key)?.detach();
   liveTails.set(key, proc);
   return proc;
@@ -106,6 +119,17 @@ function durableEnabled(): boolean {
 }
 
 export function createAgentTransport(opts: AgentTransportOptions): LineTransport {
+  // ADR-121: machine-backed sessions ride the environment's own transport —
+  // the container-runtime preflight is a docker/apple concern a machine task
+  // must not trip over, and the host-FS durable flow below polls files a
+  // machine does not share. Machine durability uses the ssh-tail backend.
+  if (opts.environment.descriptor.locator.provider === "machine") {
+    if (!durableEnabled()) {
+      clearCurrentSession(opts.taskId, opts.agentId);
+      return directEnvironmentTransport(opts);
+    }
+    return machineDurableTransport(opts);
+  }
   // Session creation can happen after channel/task lifecycle queues drain, well
   // after the command-level runtime preflight. Recheck at the actual attach or
   // spawn boundary so a cached ready verdict cannot launch container work.
@@ -277,6 +301,166 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
   return claimTail(tailKey, proc);
 }
 
+/**
+ * ADR-121: durable machine sessions. Same DB row + attach/replace semantics
+ * as the container flow; the session files live in the MACHINE's workspace
+ * and are reached over the environment transport (MachineDurableProcess).
+ * Degrades to direct pipes when the handle lacks the wider ops or the runner
+ * asset is missing — sessions work, they just don't survive host restarts.
+ */
+function machineDurableTransport(opts: AgentTransportOptions): LineTransport {
+  const surface = opts.environment;
+  const capable =
+    "exec" in surface && "spawnSession" in surface && "writeWorkspaceFile" in surface;
+  let runnerSource: Buffer | null = null;
+  if (capable) {
+    try {
+      runnerSource = readFileSync(runnerScriptPath());
+    } catch (err) {
+      console.warn(
+        `[transport] runner unavailable (${err instanceof Error ? err.message : err}) — falling back to direct pipes for ${opts.agentId}`,
+      );
+    }
+  }
+  if (!capable || runnerSource === null) {
+    clearCurrentSession(opts.taskId, opts.agentId);
+    return directEnvironmentTransport(opts);
+  }
+  const environment = surface as unknown as MachineSessionEnvironment &
+    TaskEnvironmentAgentSessionSurface;
+
+  const db = getDb();
+  const row = db
+    .select()
+    .from(schema.hostAgentSessions)
+    .where(
+      and(
+        eq(schema.hostAgentSessions.taskId, opts.taskId),
+        eq(schema.hostAgentSessions.agentId, opts.agentId),
+      ),
+    )
+    .get();
+  const persistOffset = (offset: number): void => {
+    db.update(schema.hostAgentSessions)
+      .set({ outboxOffset: offset, updatedAt: Date.now() })
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, opts.taskId),
+          eq(schema.hostAgentSessions.agentId, opts.agentId),
+        ),
+      )
+      .run();
+  };
+  const markClosed = (): void => {
+    db.update(schema.hostAgentSessions)
+      .set({ status: "closed", updatedAt: Date.now() })
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, opts.taskId),
+          eq(schema.hostAgentSessions.agentId, opts.agentId),
+        ),
+      )
+      .run();
+  };
+  const tailKey = `${opts.taskId}:${opts.agentId}`;
+
+  // ---- Attach: a previous host process left this machine's runner alive. --
+  // Freshness cannot be a sync stat over ssh; MachineDurableProcess probes
+  // the heartbeat immediately on attach and finishes fast when it is stale.
+  if (
+    opts.allowAttach &&
+    row &&
+    row.status === "running" &&
+    row.containerName === environment.durableIdentity &&
+    (row.attachCompatibilityKey ?? null) ===
+      (opts.attachCompatibilityKey ?? null)
+  ) {
+    const proc = new MachineDurableProcess({
+      environment,
+      sessionDir: row.sessionDir,
+      initialOutboxOffset: row.outboxOffset,
+      onOffsetAdvance: persistOffset,
+      onCloseRequested: markClosed,
+      debugLabel: opts.debugLabel,
+    });
+    proc.onExit(markClosed);
+    return claimTail(tailKey, proc);
+  }
+
+  // ---- Spawn a fresh runner, asking any predecessor to stop. --------------
+  const staleMachineSession =
+    row && row.containerName === environment.durableIdentity
+      ? row.sessionDir
+      : null;
+  const sessionDir = machineSessionDir(
+    environment.descriptor.workspacePath,
+    opts.agentId,
+  );
+  const proc = new MachineDurableProcess({
+    environment,
+    sessionDir,
+    onOffsetAdvance: persistOffset,
+    onCloseRequested: markClosed,
+    debugLabel: opts.debugLabel,
+    launch: async () => {
+      // Unconditional stop of a same-machine predecessor (see the container
+      // flow): a runner falsely marked closed may still be alive, and a stop
+      // appended to a dead session's inbox is harmless.
+      if (staleMachineSession) {
+        await stopMachinePredecessor(environment, staleMachineSession);
+      }
+      const runnerPath = await deployRunner(environment, sessionDir);
+      await publishMachineCurrentSession(environment, sessionDir);
+      const result = await environment.launchDetachedSession({
+        argv: [
+          "node",
+          runnerPath,
+          sessionDir,
+          "--",
+          opts.cli,
+          ...opts.cliArgs,
+        ],
+        inheritEnv: opts.passEnv ?? [],
+        env: opts.explicitEnv ?? {},
+        launchTimeoutMs: 30_000,
+        maxOutputBytes: 256 * 1024,
+      });
+      return { exitCode: result.exitCode, stderr: result.stderr };
+    },
+  });
+
+  const now = Date.now();
+  db.insert(schema.hostAgentSessions)
+    .values({
+      taskId: opts.taskId,
+      agentId: opts.agentId,
+      sessionDir,
+      containerName: environment.durableIdentity,
+      kind: opts.kind,
+      attachCompatibilityKey: opts.attachCompatibilityKey ?? null,
+      outboxOffset: 0,
+      status: "running",
+      createdAt: now,
+      updatedAt: now,
+    })
+    .onConflictDoUpdate({
+      target: [schema.hostAgentSessions.taskId, schema.hostAgentSessions.agentId],
+      set: {
+        sessionDir,
+        containerName: environment.durableIdentity,
+        kind: opts.kind,
+        attachCompatibilityKey: opts.attachCompatibilityKey ?? null,
+        outboxOffset: 0,
+        status: "running",
+        updatedAt: now,
+      },
+    })
+    .run();
+
+  proc.onExit(markClosed);
+  return claimTail(tailKey, proc);
+}
+
 function directEnvironmentTransport(opts: AgentTransportOptions): LineTransport {
   return new EnvironmentLineProcess({
     environment: opts.environment,

package/lib/orchestrator.ts

@@ -96,6 +96,7 @@ import {
   apiUrlFromCloudUrl,
   loadTaskCliSecret,
   writeAgentCli,
+  writeAgentCliViaEnvironment,
 } from "./agent-cli";
 import {
   DEFAULT_CODEX_HOME,
@@ -1370,6 +1371,13 @@ export class Orchestrator {
 
       for (const agent of missing) channel.spawning.add(agent.id);
       try {
+        // ADR-121: machine workspaces are only reachable through the
+        // environment handle — the docker-exec cold-start default would
+        // dial a container that does not exist. Settle the handle first.
+        if (task.environmentProvider === "machine") {
+          await this.agentEnvironment(channel).catch(() => {});
+          if (!this.isActiveChannel(channel)) return;
+        }
         // Same per-agent materialisation the initial start does. Browser setup
         // is awaited before EVERY missing-session spawn: that reasserts configs
         // clobbered by resume/auth injection and covers roster generation.
@@ -1402,8 +1410,8 @@ export class Orchestrator {
 
         const apiUrl = apiUrlFromCloudUrl(env.UAI_CLOUD_URL);
         const cliSecret = loadTaskCliSecret(channel.taskId);
-        const cliWritten = writeAgentCli(
-          channel.taskId,
+        const cliWritten = await materializeAgentCli(
+          task,
           roster,
           apiUrl,
           channel.mode === "secretary",
@@ -1698,6 +1706,14 @@ export class Orchestrator {
     // browser/MCP configuration, or runner creation can execute in Docker.
     await agentClisReady;
     if (!this.isActiveChannel(channel)) return false;
+    // ADR-121: machine workspaces are only reachable through the environment
+    // handle. Settle it before any materialization step below, so identity,
+    // skills, browser, and MCP writes all ride the provider surface instead
+    // of dialing a compose container that does not exist.
+    if (task.environmentProvider === "machine") {
+      await this.agentEnvironment(channel).catch(() => {});
+      if (!this.isActiveChannel(channel)) return false;
+    }
     // Freeze the generation before any slow docker work. A roster add while
     // setup awaits must reconcile under its own engine-aware browser pass,
     // not slip into this factory loop under the old generation's config.
@@ -1777,8 +1793,8 @@ export class Orchestrator {
     // are actually enforced. Best-effort, host-side.
     const apiUrl = apiUrlFromCloudUrl(env.UAI_CLOUD_URL);
     const cliSecret = loadTaskCliSecret(channel.taskId);
-    const cliWritten = writeAgentCli(
-      channel.taskId,
+    const cliWritten = await materializeAgentCli(
+      task,
       channel.roster,
       apiUrl,
       channel.mode === "secretary",
@@ -5619,6 +5635,35 @@ async function quarantineWritableAppleRuntimeContainers(options: {
 
 /** Dispatch one durable row through its provider. Generic boot orchestration
  * owns DB/lifecycle sequencing but never derives a Compose/container identity. */
+/**
+ * ADR-121: materialize the in-task uai CLI through whichever surface owns the
+ * workspace — host FS for container tasks, the environment transport for
+ * machine tasks (their workspace is not host-reachable). Best-effort like the
+ * host-side writer.
+ */
+async function materializeAgentCli(
+  task: typeof schema.hostTasks.$inferSelect,
+  roster: RosterAgent[],
+  apiUrl: string | null,
+  allowPermissionless: boolean,
+): Promise<boolean> {
+  if (task.environmentProvider === "machine") {
+    try {
+      const environment = await reconstructPersistedTaskEnvironment(task);
+      if (environment === null) return false;
+      return await writeAgentCliViaEnvironment(
+        environment,
+        roster,
+        apiUrl,
+        allowPermissionless,
+      );
+    } catch {
+      return false;
+    }
+  }
+  return writeAgentCli(task.taskId, roster, apiUrl, allowPermissionless);
+}
+
 async function recoverPersistedTaskEnvironment(
   task: typeof schema.hostTasks.$inferSelect,
   maintenanceReady: Promise<void>,

package/lib/runtime-state.ts

@@ -31,6 +31,11 @@ export function getHostTask(taskId: string): HostTask | null {
 
 /** Remove a provisional first-seen row when admission loses a lifecycle gate. */
 export function deleteHostTask(taskId: string): void {
+  // Row deletions are rare and load-bearing; a silent one cost a live
+  // machine-task forensic session (2026-08-27). Name the caller.
+  console.warn(
+    `[runtime-state] deleting host task row ${taskId}\n${(new Error().stack ?? "").split("\n").slice(2, 5).join("\n")}`,
+  );
   getDb()
     .delete(schema.hostTasks)
     .where(eq(schema.hostTasks.taskId, taskId))
@@ -41,6 +46,7 @@ export function deleteHostTask(taskId: string): void {
  * happen before this transaction; a SQLite failure leaves every task-owned
  * row intact rather than acknowledging a partial metadata deletion. */
 export function purgeHostTaskState(taskId: string): void {
+  console.warn(`[runtime-state] purging all host state for task ${taskId}`);
   getDb().transaction((tx) => {
     tx.delete(schema.hostAgentSessions)
       .where(eq(schema.hostAgentSessions.taskId, taskId))

package/lib/task-environment/index.ts

@@ -22,6 +22,15 @@ import {
   type DockerTaskEnvironmentRecoveryDriver,
   type DockerMachineIdentity,
 } from "./docker";
+import { createAwsMachineProvider } from "../machine-provider-aws";
+import { createLocalMachineProvider } from "../machine-provider-local";
+import { ensureMachineKeyPair } from "../machine-keys";
+import { requestAccessToken } from "../github-tokens";
+import {
+  createMachineTaskEnvironmentProvider,
+  MACHINE_TASK_ENVIRONMENT_PROVIDER,
+} from "./machine";
+import { createMachineHostTaskEnvironmentProvider } from "./machine-task-up";
 import { TaskEnvironmentRegistry } from "./registry";
 import {
   parseTaskEnvironmentLocator,
@@ -113,6 +122,53 @@ const appleProvider = createAppleContainerTaskEnvironmentProvider<
 
 registry.register(appleProvider);
 
+// ---------------------------------------------------------------------------
+// ADR-121: machine-backed tasks (ephemeral VM per task). Opt-in via
+// UAI_MACHINE_TASKS=1 — the guinea-pig flag; selection stays coarse (whole
+// host) until machine-backing becomes a per-task property.
+// ---------------------------------------------------------------------------
+
+function machineTasksEnabled(): boolean {
+  return process.env.UAI_MACHINE_TASKS === "1";
+}
+
+function machineBackend() {
+  if (process.env.UAI_MACHINE_PROVIDER === "aws") {
+    const region = process.env.UAI_AWS_REGION;
+    if (!region) {
+      throw new Error("UAI_MACHINE_PROVIDER=aws requires UAI_AWS_REGION");
+    }
+    return createAwsMachineProvider({
+      region,
+      subnetId: process.env.UAI_AWS_SUBNET_ID,
+      securityGroupId: process.env.UAI_AWS_SECURITY_GROUP_ID,
+      iamInstanceProfileArn: process.env.UAI_AWS_INSTANCE_PROFILE_ARN,
+    });
+  }
+  return createLocalMachineProvider();
+}
+
+const machineEnvironmentProvider = createMachineTaskEnvironmentProvider({
+  machines: machineBackend(),
+  taskControlDir: (taskId) => taskDir(taskId),
+  mintKeyPair: ensureMachineKeyPair,
+});
+
+const machineProvider = createMachineHostTaskEnvironmentProvider({
+  environment: machineEnvironmentProvider,
+  taskControlDir: (taskId) => taskDir(taskId),
+  machineImage: () => process.env.UAI_MACHINE_IMAGE ?? "uai-machine:dev",
+  machineCpus: () => Number(process.env.UAI_MACHINE_CPUS ?? "2"),
+  machineMemoryMiB: () => Number(process.env.UAI_MACHINE_MEMORY_MIB ?? "4096"),
+  // Local machines on macOS need loopback-published ssh (bridge IPs are not
+  // host-routable there); cloud machines and Linux dial the address directly.
+  publishSsh: () =>
+    process.env.UAI_MACHINE_PROVIDER !== "aws" && process.platform === "darwin",
+  githubToken: (userId) => requestAccessToken(userId),
+});
+
+registry.register(machineProvider);
+
 /**
  * Bind the Docker provider's private recovery implementation. Kept as a
  * replaceable module seam so HMR can reload the orchestrator without leaving
@@ -129,8 +185,9 @@ export function provisionTaskEnvironment(
   credentials: TaskUpCredentials = {},
   onPrepared?: (locator: TaskEnvironmentLocator) => Promise<void>,
 ): Promise<TaskEnvironmentProvisioned<TaskUpResult, TaskDownResult>> {
-  const provider =
-    requireMachineIdentity().backend === "apple-container"
+  const provider = machineTasksEnabled()
+    ? machineProvider
+    : requireMachineIdentity().backend === "apple-container"
       ? appleProvider
       : dockerProvider;
   return provider.provision({
@@ -253,6 +310,9 @@ export function persistedTaskEnvironmentsMatchMachine(
       };
     }
     if (locator === null) continue;
+    // ADR-121: machine locators name an ephemeral VM, not a container
+    // daemon — no container-runtime identity claim to verify.
+    if (locator.provider === MACHINE_TASK_ENVIRONMENT_PROVIDER) continue;
     try {
       const persisted = locatorMachineIdentity(locator);
       if (
@@ -321,6 +381,8 @@ export function hostTaskEnvironmentsAllowMachineSelection(
       if (locator.provider !== task.environmentProvider) {
         throw new Error("task environment provider does not match its locator");
       }
+      // ADR-121: machine rows make no container-runtime claim.
+      if (locator.provider === MACHINE_TASK_ENVIRONMENT_PROVIDER) continue;
       const persisted = locatorMachineIdentity(locator);
       if (
         persisted.backend !== machine.backend ||

package/lib/task-environment/legacy-adoption.ts

@@ -166,6 +166,12 @@ function legacyCandidate(
     // 2026-08-15): a crash-preserved prepared apple locator made adoption —
     // and with it runtime selection — fail closed, so the task could not
     // even be settled.
+    // ADR-121: machine-backed rows are not container-runtime residents at
+    // all — their locator names an ephemeral VM, not a docker/apple daemon.
+    // They must never wedge container-runtime selection (live 2026-08-27:
+    // the first machine task quarantined the whole VM runtime on reconnect,
+    // collapsing every host command into a retry storm).
+    if (locator.provider === "machine") return null;
     let persistedMachine: HostMachineIdentity;
     if (locator.provider === "docker-compose") {
       persistedMachine = parseDockerTaskEnvironmentLocator(locator).machine;