@runuai/host 0.9.76 → 0.9.77

package/lib/agents/transport.ts

@@ -37,6 +37,7 @@ import { and, eq } from "drizzle-orm";
 
 import { getDb, schema } from "../db";
 import { taskWorkspaceDir } from "../env";
+import { machineSessionAuthorityEnv } from "../runtime-authority";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
 import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
 import { DurableProcess, runnerScriptPath } from "./durable-proc";
@@ -124,11 +125,19 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
   // must not trip over, and the host-FS durable flow below polls files a
   // machine does not share. Machine durability uses the ssh-tail backend.
   if (opts.environment.descriptor.locator.provider === "machine") {
+    // The session env was assembled with the CONTAINER runtime authority
+    // (asdf/corepack pins to shared read-only volumes) — on a machine those
+    // paths do not exist and the pins actively break package managers.
+    // Swap in the machine authority; credentials and task env pass through.
+    const machineOpts: AgentTransportOptions = {
+      ...opts,
+      explicitEnv: machineSessionAuthorityEnv(opts.explicitEnv),
+    };
     if (!durableEnabled()) {
-      clearCurrentSession(opts.taskId, opts.agentId);
-      return directEnvironmentTransport(opts);
+      clearCurrentSession(machineOpts.taskId, machineOpts.agentId);
+      return directEnvironmentTransport(machineOpts);
     }
-    return machineDurableTransport(opts);
+    return machineDurableTransport(machineOpts);
   }
   // Session creation can happen after channel/task lifecycle queues drain, well
   // after the command-level runtime preflight. Recheck at the actual attach or

package/lib/codex-auth.ts

@@ -201,6 +201,61 @@ export async function injectCodexIntoContainer(
   }
 }
 
+/**
+ * ADR-121: deliver the DEFAULT Codex slot into a MACHINE task over the
+ * environment transport. The legacy paths (task-up docker cp, recovery
+ * inject, the reinject sweep) all speak docker grammar, so a machine task's
+ * codex agent ran without auth.json and looped 'Reconnecting' (live
+ * 2026-08-27, first EC2 task). Files land as the ssh user (node), so no
+ * chown pass is needed. Returns true when there was nothing to inject.
+ */
+export async function injectCodexIntoMachine(
+  environment: {
+    exec(request: {
+      argv: readonly [string, ...string[]];
+      timeoutMs: number;
+      maxOutputBytes: number;
+    }): Promise<{ exitCode: number | null; stderr: Uint8Array }>;
+    copy(request: {
+      direction: "into";
+      source: string;
+      destination: string;
+    }): Promise<void>;
+  },
+  deps: CodexDeps = {},
+): Promise<boolean> {
+  const exists = deps.fileExists ?? existsSync;
+  const dir = ownerCodexDir();
+  if (!exists(join(dir, "auth.json"))) return true; // nothing to inject
+  try {
+    const made = await environment.exec({
+      argv: ["/bin/mkdir", "-p", "/home/node/.codex"],
+      timeoutMs: EXEC_TIMEOUT_MS,
+      maxOutputBytes: 64 * 1024,
+    });
+    if (made.exitCode !== 0) {
+      throw new Error(
+        `mkdir /home/node/.codex exited ${made.exitCode}: ${Buffer.from(made.stderr).toString("utf8").trim()}`,
+      );
+    }
+    for (const item of CODEX_ITEMS) {
+      const source = join(dir, item);
+      if (!exists(source)) continue;
+      await environment.copy({
+        direction: "into",
+        source,
+        destination: `/home/node/.codex/${item}`,
+      });
+    }
+    return true;
+  } catch (err) {
+    console.error(
+      `[codex] machine inject: ${err instanceof Error ? err.message : err} — Codex in this task will fail until the next ensure retries`,
+    );
+    return false;
+  }
+}
+
 /**
  * Refresh the freshly (re)logged-in Codex files in every task container that
  * is both DB-active AND confirmed running by docker. `config.toml` is excluded:

package/lib/runtime-authority.ts

@@ -67,6 +67,49 @@ export const RUNTIME_AUTHORITY_ENV: Readonly<Record<string, string>> =
     ENV: "",
   });
 
+/**
+ * ADR-121: the MACHINE flavor of the authority env. A machine is a
+ * single-task trust domain — the container constants above defend SHARED
+ * host resources (the read-only asdf/corepack volume, uai-npm prefixes)
+ * that do not exist on a machine, and carrying them anyway pinned corepack
+ * to an unwritable /opt path with the network off, so `pnpm install`
+ * failed out of the box (live 2026-08-27, first EC2 task — the agent had
+ * to hand-repair its own environment). Keep the hygiene (loader/env
+ * clearing, prompt-free corepack), drop the container-topology pins.
+ */
+export const MACHINE_RUNTIME_AUTHORITY_ENV: Readonly<Record<string, string>> =
+  Object.freeze({
+    PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/node/.local/bin",
+    HOME: "/home/node",
+    XDG_CONFIG_HOME: "/home/node/.config",
+    XDG_DATA_HOME: "/home/node/.local/share",
+    XDG_CACHE_HOME: "/home/node/.cache",
+    COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
+    LD_PRELOAD: "",
+    LD_AUDIT: "",
+    LD_LIBRARY_PATH: "",
+    NODE_OPTIONS: "",
+    NODE_PATH: "",
+    PS4: "",
+    BASH_ENV: "",
+    ENV: "",
+  });
+
+/** Rewrite a session env assembled for a CONTAINER into its machine form:
+ * every container-authority key is dropped, then the machine authority is
+ * overlaid. Non-authority keys (engine credentials, task tokens, preview
+ * env) pass through untouched. */
+export function machineSessionAuthorityEnv(
+  env: Readonly<Record<string, string>> | undefined,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(env ?? {})) {
+    if (key in RUNTIME_AUTHORITY_ENV) continue;
+    out[key] = value;
+  }
+  return { ...out, ...MACHINE_RUNTIME_AUTHORITY_ENV };
+}
+
 /** Docker `exec` options for the fixed authority environment. Callers append
  * this after every less-trusted `-e` option and immediately before the
  * container name. Container admission additionally rejects noncanonical

package/lib/task-environment/machine-task-up.ts

@@ -27,6 +27,7 @@ import type {
   TaskUpCredentials,
   TaskUpResult,
 } from "../agent";
+import { injectCodexIntoMachine } from "../codex-auth";
 import { sharedRoot } from "../shared-files";
 import {
   MACHINE_TASK_ENVIRONMENT_PROVIDER,
@@ -524,6 +525,19 @@ export function createMachineHostTaskEnvironmentProvider(
       });
       if (sharedWarning) warnings.push(sharedWarning);
 
+      // Codex default-slot credentials: the legacy delivery paths are all
+      // docker grammar; machines get theirs over the transport. Best-effort
+      // — a failed inject degrades codex agents, never the task.
+      if (input.task.agents.some((agent) => agent.kind === "codex")) {
+        await injectCodexIntoMachine(handle).catch((error: unknown) => {
+          console.warn(
+            `[machine] task ${request.taskId}: codex inject failed: ${
+              error instanceof Error ? error.message : String(error)
+            }`,
+          );
+        });
+      }
+
       // Editor pane: code-server on the machine (same flags as uai-init's
       // container launch), idempotent across provision re-runs and resume.
       // Best-effort — a missing binary degrades the Editor tab, never the task.

package/lib/task-environment/machine.ts

@@ -14,8 +14,9 @@
  * is complete now so nothing about the shape is provisional.
  */
 
-import { spawn as nodeSpawn } from "node:child_process";
-import { readFileSync, writeFileSync } from "node:fs";
+import { execFile, spawn as nodeSpawn } from "node:child_process";
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { promisify } from "node:util";
 
 import type {
   MachineInfo,
@@ -386,6 +387,46 @@ class MachineTaskEnvironmentHandle implements TaskEnvironmentHandle {
     }
     const target = await this.#target();
     if (request.direction === "into") {
+      // Directory sources tar-stream over the transport (engine-account
+      // homes — live 2026-08-27: codex's auth.json never reached the
+      // machine because readFileSync(dir) threw EISDIR and the account
+      // materialization died). Single files keep the direct cat path.
+      if (statSync(request.source).isDirectory()) {
+        const tarball = await promisify(execFile)(
+          "tar",
+          ["-C", request.source, "-cf", "-", "."],
+          { encoding: "buffer", maxBuffer: 256 * 1024 * 1024 },
+        );
+        const extract = await capturedCliExec(
+          this.#deps.spawn,
+          "ssh",
+          machineEnvironmentSshArgs(
+            target,
+            {
+              argv: [
+                "/bin/sh",
+                "-c",
+                'mkdir -p "$1" && tar -C "$1" -xf -',
+                "copy",
+                request.destination,
+              ],
+            },
+            "interactive",
+          ),
+          {
+            argv: ["/bin/sh"],
+            stdin: tarball.stdout,
+            timeoutMs: 300_000,
+            maxOutputBytes: 1024 * 1024,
+          },
+        );
+        if (extract.exitCode !== 0) {
+          throw new Error(
+            `machine directory copy failed: ${Buffer.from(extract.stderr).toString("utf8").trim()}`,
+          );
+        }
+        return;
+      }
       const bytes = readFileSync(request.source);
       const result = await capturedCliExec(
         this.#deps.spawn,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.76",
+  "version": "0.9.77",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",