@runuai/host 0.9.70 → 0.9.72

package/src/index.ts

@@ -19,7 +19,9 @@ import {
 } from "../lib/agent-cli";
 import {
   clearRefresh,
+  injectIntoContainer,
   reconcileTaskGitAuth,
+  requestAccessToken,
 } from "../lib/github-tokens";
 import {
   prepareTaskGithubGitCredential,
@@ -35,7 +37,10 @@ import {
   missingRequiredKeys,
   parseEnvSchema,
 } from "../lib/env-schema";
-import { appendTranscript as writeTranscript } from "../lib/transcript";
+import {
+  appendTranscript as writeTranscript,
+  appendTranscriptViaEnvironment,
+} from "../lib/transcript";
 import { buildTaskDiff } from "../lib/task-diff";
 import {
   deleteHostTask,
@@ -448,6 +453,37 @@ export const hostCommands: HostCommands = {
             runtimeQuarantinedForRecreate = true;
           }
         }
+      } else if (
+        existingTask?.statusMirror === "running" &&
+        existingTask.environmentProvider === "machine"
+      ) {
+        // ADR-121: a machine-backed task revalidates through its own
+        // provider — the compose fast path below speaks docker and would
+        // misread a machine row. Running machine → persisted success;
+        // anything else falls through to provisionTaskEnvironment, whose
+        // machine provider owns recovery semantics.
+        try {
+          const environment = await reconstructPersistedTaskEnvironment(
+            existingTask,
+          );
+          if (environment) {
+            const machineStatus = await environment.status();
+            if (machineStatus.state === "running") {
+              orchestrator.allowChannel(input.task.id);
+              return {
+                ok: true,
+                value: {
+                  composeProject: existingTask.composeProject ?? "",
+                  worktreePath: existingTask.worktreePath ?? "",
+                },
+              };
+            }
+          }
+        } catch (error) {
+          console.warn(
+            `[machine] task ${input.task.id}: running-row revalidation failed, continuing to provision: ${error instanceof Error ? error.message : String(error)}`,
+          );
+        }
       } else if (existingTask?.statusMirror === "running") {
         if (!existingTask.composeProject || !existingTask.worktreePath) {
           return {
@@ -813,16 +849,33 @@ export const hostCommands: HostCommands = {
         // and mark a running task as errored. The reconciler injects + schedules
         // (or emits a system note on failure) on its own; the agents come up
         // regardless and the token lands well before the first `gh` call.
-        void reconcileTaskGitAuth(
-          input.task.id,
-          input.task.ownerUserId,
-        ).catch((err) =>
-          console.warn(
-            `[github] task ${input.task.id}: post-start reconciliation failed: ${
-              err instanceof Error ? err.message : String(err)
-            }`,
-          ),
-        );
+        // ADR-121: machine-backed tasks take a direct environment injection —
+        // the compose reconciler would probe for an app container, find none,
+        // and silently skip. Reconnect re-injection for machines is a
+        // follow-up alongside the machine recovery pass.
+        if (getHostTask(input.task.id)?.environmentProvider === "machine") {
+          void machineTaskGithubAuth(
+            input.task.id,
+            input.task.ownerUserId,
+          ).catch((err) =>
+            console.warn(
+              `[github] machine task ${input.task.id}: auth injection failed: ${
+                err instanceof Error ? err.message : String(err)
+              }`,
+            ),
+          );
+        } else {
+          void reconcileTaskGitAuth(
+            input.task.id,
+            input.task.ownerUserId,
+          ).catch((err) =>
+            console.warn(
+              `[github] task ${input.task.id}: post-start reconciliation failed: ${
+                err instanceof Error ? err.message : String(err)
+              }`,
+            ),
+          );
+        }
       } else if (result.code === HostErrorCode.HostUnavailable) {
         // A daemon outage is retryable infrastructure state, not proof that
         // the task itself failed. Undo the optimistic local `starting` mirror
@@ -904,6 +957,17 @@ export const hostCommands: HostCommands = {
       }
       const result = await wrapAgent(ctx, "taskDown", async () => {
         if (environment === null) return agent.taskDown(input);
+        // ADR-121: an ordinary stop of a machine task must keep the machine's
+        // disk — the workspace lives THERE, not on a host worktree the way
+        // compose teardown preserves it. Stop is the resumable gesture
+        // (provision restarts a stopped machine); only orphan GC terminates.
+        if (
+          !orphanGc &&
+          environment.descriptor.locator.provider === "machine"
+        ) {
+          await environment.stop();
+          return taskDownResultForInput(input, { status: "stopped" });
+        }
         return taskDownResultForInput(input, await environment.teardown());
       });
       if (result.ok) {
@@ -1265,6 +1329,24 @@ export const hostCommands: HostCommands = {
   async appendTranscript(_ctx, taskId, author, text, targets) {
     // Per-message + high-frequency, so no logCommand (avoid log spam).
     try {
+      // ADR-121: a machine-backed workspace lives in the machine's world —
+      // the append must travel over the environment transport. Container
+      // tasks keep the direct host-FS write (their workspace is a bind
+      // mount and the sync path is cheaper than a docker exec per message).
+      const task = getHostTask(taskId);
+      if (task?.environmentProvider === "machine") {
+        const environment = await reconstructHostTaskEnvironment(taskId);
+        if (environment) {
+          await appendTranscriptViaEnvironment(
+            taskId,
+            environment,
+            author,
+            text,
+            targets,
+          );
+          return ok(undefined);
+        }
+      }
       writeTranscript(taskId, author, text, targets);
       return ok(undefined);
     } catch (err) {
@@ -1277,6 +1359,30 @@ function normalizeChannelSpec(input: ChannelEnsureInput): ChannelEnsureInput {
   return { ...input, workspacePath: "/workspace" };
 }
 
+/**
+ * ADR-121: gh auth for a machine-backed task, injected over the environment
+ * transport (token via exec stdin — same `gh auth login --with-token` +
+ * `setup-git` gesture as containers, no compose probing). Best-effort like
+ * the compose reconciler: absence of a GitHub connection is a quiet no-op.
+ */
+async function machineTaskGithubAuth(
+  taskId: string,
+  userId: string,
+): Promise<void> {
+  const environment = await reconstructHostTaskEnvironment(taskId);
+  if (!environment) return;
+  const token = await requestAccessToken(userId);
+  if (!token) return;
+  // Machine work is not container work: no docker/apple runtime admission.
+  await injectIntoContainer(
+    taskId,
+    token.accessToken,
+    undefined,
+    () => {},
+    environment,
+  );
+}
+
 async function reconstructHostTaskEnvironment(
   taskId: string,
 ): Promise<TaskEnvironmentHandle<TaskDownResult> | null> {