@runuai/host 0.9.82 → 0.9.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.82",
+  "version": "0.9.84",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cli.ts

@@ -20,7 +20,11 @@
 // runs far too late.)
 import "./load-env";
 
-import { spawn, spawnSync } from "node:child_process";
+import {
+  spawn,
+  spawnSync,
+  type SpawnSyncReturns,
+} from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
@@ -139,6 +143,11 @@ async function main(): Promise<void> {
       return cmdRuntime(rest);
     case "tune":
       return cmdTune();
+    case "aws":
+      if (rest[0] === "setup") return cmdAwsSetup(rest.slice(1));
+      console.error(red("usage: uai-host aws setup [--region <region>] [--rotate]"));
+      process.exitCode = 1;
+      return;
     case "update":
       return cmdUpdate(rest);
     case "rollback":
@@ -500,6 +509,234 @@ async function boundedResponseJson(
 
 // --- runtime ---------------------------------------------------------------
 
+// --- aws setup (ADR-125 BYO-AWS: mint the host's scoped AWS identity) --------
+
+/** Mirrors scripts/machine-ami/byo-aws-quickcreate.yaml — keep in sync. */
+const AWS_MACHINE_POLICY = {
+  Version: "2012-10-17",
+  Statement: [
+    {
+      Sid: "UaiMachines",
+      Effect: "Allow",
+      Action: [
+        "ec2:RunInstances",
+        "ec2:StartInstances",
+        "ec2:StopInstances",
+        "ec2:TerminateInstances",
+        "ec2:CreateTags",
+        "ec2:DescribeInstances",
+        "ec2:DescribeImages",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeVpcs",
+        "ec2:DescribeSecurityGroups",
+        "ec2:CreateSecurityGroup",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateSnapshot",
+        "ec2:DeleteSnapshot",
+        "ec2:CreateVolume",
+        "ec2:DescribeSnapshots",
+        "ec2:DescribeVolumes",
+      ],
+      Resource: "*",
+    },
+  ],
+};
+const AWS_SETUP_USER = "uai-host";
+
+/** Run the aws CLI with the operator's AMBIENT (admin) credentials: any
+ * AWS_* that load-env pulled from .env.local is a previously-minted SCOPED
+ * key that cannot administer IAM, and letting it shadow the shell's admin
+ * credentials makes every failure read as a permissions mystery. */
+function awsAdmin(
+  args: string[],
+  region: string | null,
+): SpawnSyncReturns<string> {
+  const env = { ...process.env };
+  const fromFile = (() => {
+    try {
+      return parseDotenv(readFileSync(envLocalPath(), "utf8"));
+    } catch {
+      return {} as Record<string, string>;
+    }
+  })();
+  if (
+    env.AWS_ACCESS_KEY_ID &&
+    env.AWS_ACCESS_KEY_ID === fromFile.AWS_ACCESS_KEY_ID
+  ) {
+    delete env.AWS_ACCESS_KEY_ID;
+    delete env.AWS_SECRET_ACCESS_KEY;
+    delete env.AWS_SESSION_TOKEN;
+  }
+  return spawnSync(
+    "aws",
+    [...(region ? ["--region", region] : []), "--output", "json", ...args],
+    { encoding: "utf8", env },
+  );
+}
+
+async function cmdAwsSetup(rest: string[]): Promise<void> {
+  const rotate = rest.includes("--rotate");
+  const regionFlagAt = rest.indexOf("--region");
+  let region = regionFlagAt >= 0 ? (rest[regionFlagAt + 1] ?? "") : "";
+
+  const version = spawnSync("aws", ["--version"], { encoding: "utf8" });
+  if (version.status !== 0) {
+    console.error(red("the aws CLI is not installed (or not on PATH)"));
+    console.error("install it: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html");
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!region) {
+    const configured = spawnSync("aws", ["configure", "get", "region"], {
+      encoding: "utf8",
+    });
+    region = (configured.stdout ?? "").trim();
+  }
+  if (!region) {
+    console.error(red("no AWS region — pass --region <region> (e.g. --region us-west-2)"));
+    process.exitCode = 1;
+    return;
+  }
+
+  const identity = awsAdmin(["sts", "get-caller-identity"], region);
+  if (identity.status !== 0) {
+    console.error(red("no working AWS admin credentials in this shell"));
+    console.error(
+      "sign in first (aws configure, aws sso login, or exported AWS_* vars), then re-run",
+    );
+    console.error(dim((identity.stderr ?? "").trim().slice(0, 200)));
+    process.exitCode = 1;
+    return;
+  }
+  const account = (() => {
+    try {
+      return (JSON.parse(identity.stdout) as { Account?: string }).Account ?? "?";
+    } catch {
+      return "?";
+    }
+  })();
+
+  const existingEnv = (() => {
+    try {
+      return parseDotenv(readFileSync(envLocalPath(), "utf8"));
+    } catch {
+      return {} as Record<string, string>;
+    }
+  })();
+  if (existingEnv.AWS_ACCESS_KEY_ID && !rotate) {
+    console.log(
+      `already configured (key ${existingEnv.AWS_ACCESS_KEY_ID.slice(0, 8)}…, region ${existingEnv.UAI_AWS_REGION ?? "?"})`,
+    );
+    console.log(`re-run with ${bold("--rotate")} to mint a fresh key`);
+    return;
+  }
+
+  console.log(`account ${account}, region ${region} — creating the ${AWS_SETUP_USER} identity`);
+
+  const created = awsAdmin(
+    ["iam", "create-user", "--user-name", AWS_SETUP_USER],
+    region,
+  );
+  if (
+    created.status !== 0 &&
+    !(created.stderr ?? "").includes("EntityAlreadyExists")
+  ) {
+    console.error(red(`could not create the ${AWS_SETUP_USER} IAM user: ${(created.stderr ?? "").trim().slice(0, 300)}`));
+    process.exitCode = 1;
+    return;
+  }
+
+  // put-user-policy overwrites: re-running upgrades the policy in place.
+  const policy = awsAdmin(
+    [
+      "iam",
+      "put-user-policy",
+      "--user-name",
+      AWS_SETUP_USER,
+      "--policy-name",
+      "uai-machines",
+      "--policy-document",
+      JSON.stringify(AWS_MACHINE_POLICY),
+    ],
+    region,
+  );
+  if (policy.status !== 0) {
+    console.error(red(`could not attach the machine policy: ${(policy.stderr ?? "").trim().slice(0, 300)}`));
+    process.exitCode = 1;
+    return;
+  }
+
+  const keyResult = awsAdmin(
+    ["iam", "create-access-key", "--user-name", AWS_SETUP_USER],
+    region,
+  );
+  if (keyResult.status !== 0) {
+    console.error(red(`could not create an access key: ${(keyResult.stderr ?? "").trim().slice(0, 300)}`));
+    if ((keyResult.stderr ?? "").includes("LimitExceeded")) {
+      console.error(
+        `the user already has two keys — list them with: aws iam list-access-keys --user-name ${AWS_SETUP_USER}\n` +
+          `and delete one with: aws iam delete-access-key --user-name ${AWS_SETUP_USER} --access-key-id <id>`,
+      );
+    }
+    process.exitCode = 1;
+    return;
+  }
+  let keyId = "";
+  let secret = "";
+  try {
+    const parsed = JSON.parse(keyResult.stdout) as {
+      AccessKey?: { AccessKeyId?: string; SecretAccessKey?: string };
+    };
+    keyId = parsed.AccessKey?.AccessKeyId ?? "";
+    secret = parsed.AccessKey?.SecretAccessKey ?? "";
+  } catch {
+    // handled below
+  }
+  if (!keyId || !secret) {
+    console.error(red("create-access-key returned no key material"));
+    process.exitCode = 1;
+    return;
+  }
+
+  writeEnvValuesAtomic(envLocalPath(), {
+    UAI_MACHINE_TASKS: "1",
+    UAI_MACHINE_PROVIDER: "aws",
+    UAI_AWS_REGION: region,
+    AWS_ACCESS_KEY_ID: keyId,
+    AWS_SECRET_ACCESS_KEY: secret,
+  });
+
+  // Rotation hygiene: the key the env file carried before this run belongs
+  // to the scoped user; a minted replacement leaves it orphaned AND holding
+  // the 2-key limit. Best-effort delete, loudly skippable.
+  const previousKey = existingEnv.AWS_ACCESS_KEY_ID;
+  if (rotate && previousKey && previousKey !== keyId) {
+    const deleted = awsAdmin(
+      [
+        "iam",
+        "delete-access-key",
+        "--user-name",
+        AWS_SETUP_USER,
+        "--access-key-id",
+        previousKey,
+      ],
+      region,
+    );
+    if (deleted.status === 0) {
+      console.log(`rotated: deleted the previous key ${previousKey.slice(0, 8)}…`);
+    } else {
+      console.log(
+        yellow(`minted a new key but could not delete ${previousKey.slice(0, 8)}… — remove it manually if unused`),
+      );
+    }
+  }
+
+  console.log(`${bold("done")} — scoped credentials written to ${envLocalPath()}`);
+  console.log(`  UAI_MACHINE_PROVIDER=aws  UAI_AWS_REGION=${region}  (machine tasks enabled)`);
+  console.log(`restart the host to activate: ${cyan("uai-host restart")}`);
+}
+
 // --- tune (ADR-118 follow-up: vnode/file-table ceilings) ---------------------
 
 const TUNE_DAEMON_LABEL = "com.runuai.tune";
@@ -2019,6 +2256,10 @@ function printHelp(): void {
   runtime recheck      probe Docker again and refresh cloud capabilities
   tune                 (macOS, sudo) raise kernel vnode/file-table ceilings for
                        apple-container task VMs and persist them across boots
+  aws setup [--region <r>] [--rotate]
+                       enable machine-backed tasks in YOUR AWS account: uses
+                       the admin credentials already in this shell to mint a
+                       scoped uai-host IAM key and writes the host config
   setup --cloud <wss-url> --enroll <token>
                        claim this machine via an enrollment token from the web
                        app (mints + writes the host credential); on an

package/src/main.ts

@@ -598,6 +598,18 @@ function buildCapabilities(): HostCapabilities {
     // advertise them as usable while the machine cannot run a container.
     runtimes: runtime.status === "ready" ? standardRuntimes() : [],
     containerRuntime: runtime,
+    // ADR-125: surface machine backing so the host page can say "AWS"
+    // instead of implying containers are the whole story.
+    ...(process.env.UAI_MACHINE_TASKS === "1"
+      ? {
+          machineTasks: {
+            provider: process.env.UAI_MACHINE_PROVIDER ?? "local",
+            ...(process.env.UAI_AWS_REGION
+              ? { region: process.env.UAI_AWS_REGION }
+              : {}),
+          },
+        }
+      : {}),
     maintenanceReady: areAgentClisReady(),
     mcpGateway: mcpGateway.state(),
     engineLogins: engineLoginManager.capabilities(),

package/src/protocol.ts

@@ -943,6 +943,14 @@ export interface HostCapabilities {
   /** ADR-101: the machine-level container backend. Optional for rolling
    *  compatibility with hosts predating runtime detection. */
   containerRuntime?: ContainerRuntimeCapability;
+  /** ADR-125: machine-backed tasks (each task on its own ephemeral machine).
+   * Present when the host is configured for them; the cloud shows the
+   * provider/region on the host page and, eventually, per-task backing
+   * choice keys off it. */
+  machineTasks?: {
+    provider: string;
+    region?: string;
+  };
   /** ADR-100: one-way boot latch. It becomes true after the initial shared
    * image/CLI maintenance pass settles, including a best-effort failure. */
   maintenanceReady?: boolean;