@runuai/host 0.9.87 → 0.9.89

package/lib/orchestrator.ts

@@ -1549,6 +1549,7 @@ export class Orchestrator {
     // can consume/reorder prompt state while the earlier error still owns it.
     let eventTail: Promise<void> = Promise.resolve();
     session.onEvent((event) => {
+      this.markChannelActivity(channel.taskId);
       // Recycle/teardown deletes the old session before calling close().
       // Adapters deliberately emit a final exit event; without this identity
       // guard it can delete a replacement or consume its respawn budget.
@@ -3001,6 +3002,20 @@ export class Orchestrator {
    * reconciles it to `stopped` (worktree present) and it can be resumed. Since
    * `stopped` is not an ACTIVE status, host recovery won't restart it.
    */
+  /** Last observed sign of life per channel: any session event (agent
+   * output, turn boundaries) or an inbound delivery. The idle-stop veto
+   * (ADR-125) reads this — the cloud decides idleness from what it can see,
+   * but only the host can see a turn that is mid-flight RIGHT NOW. */
+  readonly #channelActivity = new Map<string, number>();
+
+  markChannelActivity(taskId: string): void {
+    this.#channelActivity.set(taskId, Date.now());
+  }
+
+  lastChannelActivity(taskId: string): number | null {
+    return this.#channelActivity.get(taskId) ?? null;
+  }
+
   async stopTask(taskId: string): Promise<{ ok: boolean; error?: string }> {
     return this.runTaskLifecycle(taskId, () =>
       this.stopTaskWithinLifecycle(taskId),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.87",
+  "version": "0.9.89",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/index.ts

@@ -1029,6 +1029,28 @@ export const hostCommands: HostCommands = {
     });
   },
 
+  async taskStop(ctx, taskId, input) {
+    logCommand(ctx, "taskStop", taskId, input.reason);
+    // ADR-125: idle stops are the cloud's judgment from what it can see;
+    // only the host can see a turn that is mid-flight RIGHT NOW. Manual
+    // pause carries no veto — a human's explicit gesture wins.
+    if (input.reason === "idle") {
+      const activeAt = getOrchestrator().lastChannelActivity(taskId);
+      if (activeAt !== null && Date.now() - activeAt < IDLE_STOP_VETO_MS) {
+        return { ok: true, value: { vetoed: "active" as const } };
+      }
+    }
+    const result = await getOrchestrator().stopTask(taskId);
+    if (!result.ok) {
+      return {
+        ok: false,
+        code: HostErrorCode.Internal,
+        message: result.error ?? "stop failed",
+        retryable: true,
+      };
+    }
+    return { ok: true, value: {} };
+  },
   async taskStatus(ctx, taskId) {
     logCommand(ctx, "taskStatus", taskId);
     const runtimeFailure = runtimeUnavailable();
@@ -1112,6 +1134,9 @@ export const hostCommands: HostCommands = {
     const runtimeFailure = runtimeUnavailable();
     if (runtimeFailure) return runtimeFailure;
     try {
+      // An inbound turn is activity: the idle veto must cover the gap between
+      // this delivery landing and the agent's first output event.
+      getOrchestrator().markChannelActivity(taskId);
       const result = await getOrchestrator().deliver(taskId, agentId, text);
       if (!result.ok) {
         return {
@@ -1532,6 +1557,10 @@ function teardownRuntimeUnavailable(): HostCommandResult<never> | null {
   };
 }
 
+/** ADR-125: an idle stop is vetoed when the channel showed any activity
+ * this recently — a delivery landing or any session event. */
+const IDLE_STOP_VETO_MS = 120_000;
+
 const RUNTIME_TASK_ADMISSION_WAIT_MS = 3_000;
 
 /**

package/src/main.ts

@@ -173,6 +173,7 @@ import {
   HOST_MAINTENANCE_READINESS_PROTOCOL_FEATURE,
   HOST_CONFIG_PROTOCOL_FEATURE,
   HOST_REMOTE_LIFECYCLE_PROTOCOL_FEATURE,
+  HOST_TASK_STOP_PROTOCOL_FEATURE,
   HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
   HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
   HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
@@ -584,6 +585,7 @@ function buildCapabilities(): HostCapabilities {
       HOST_ENGINE_LOGIN_PROTOCOL_FEATURE,
       HOST_CONFIG_PROTOCOL_FEATURE,
       HOST_REMOTE_LIFECYCLE_PROTOCOL_FEATURE,
+      HOST_TASK_STOP_PROTOCOL_FEATURE,
       HOST_ENGINE_ACCOUNTS_PROTOCOL_FEATURE,
       HOST_ENGINE_CONNECT_PROTOCOL_FEATURE,
       // The echo adapter cannot execute the in-task CLI. Advertising typed
@@ -2279,6 +2281,12 @@ async function dispatchCommand(
       const downInput = expectTaskDownInput(args, 0);
       return hostCommands.taskDown(ctx, downInput);
     }
+    case "taskStop":
+      return hostCommands.taskStop(
+        ctx,
+        typeof args[0] === "string" ? args[0] : "",
+        (args[1] ?? { reason: "manual" }) as { reason: "idle" | "manual" },
+      );
     case "taskStatus":
       return hostCommands.taskStatus(ctx, expectString(args, 0));
     case "channelEnsure":
@@ -2606,7 +2614,11 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
   ) {
     return { kind: "mcp.op", opId: frame.opId, op: frame.op };
   }
-  console.warn("[host-agent] dropping unknown frame");
+  // Names only — never payloads (frames can carry tokens).
+  console.warn(
+    `[host-agent] dropping unknown frame kind=${String(frame.kind)}` +
+      (frame.kind === "command" ? ` command=${String(frame.command)}` : ""),
+  );
   return null;
 }
 
@@ -2853,28 +2865,35 @@ function rawDataToBuffer(data: RawData): Buffer {
   return Buffer.from(data);
 }
 
+// Exhaustive BY TYPE: `satisfies Record<keyof HostCommands, true>` makes a
+// command missing from this map a compile error. The previous hand-written
+// array silently dropped any frame it lagged behind on — hostUpdate and
+// hostRestart shipped in 0.9.62 and every remote Update/Restart click since
+// died here as "dropping unknown frame" / a cloud-side command timeout.
+const HOST_COMMAND_NAMES = {
+  hostUpdate: true,
+  hostRestart: true,
+  taskUp: true,
+  taskDown: true,
+  taskStatus: true,
+  taskStop: true,
+  channelEnsure: true,
+  channelTeardown: true,
+  channelDeliver: true,
+  channelResolvePermission: true,
+  cloneRepo: true,
+  taskDiff: true,
+  attachmentWrite: true,
+  attachmentRead: true,
+  filesOp: true,
+  channelInterrupt: true,
+  appendTranscript: true,
+  previewEnsure: true,
+  engineAccountRemove: true,
+} satisfies Record<keyof HostCommands, true>;
+
 function isHostCommand(command: string): command is keyof HostCommands {
-  // ⚠️ Keep in sync with the HostCommands interface + dispatchCommand. This is a
-  // manual allow-list (TS can't derive it from the type), so a missing entry
-  // silently drops the frame and hangs the cloud command.
-  return [
-    "taskUp",
-    "taskDown",
-    "taskStatus",
-    "channelEnsure",
-    "channelTeardown",
-    "channelDeliver",
-    "channelResolvePermission",
-    "cloneRepo",
-    "taskDiff",
-    "attachmentWrite",
-    "attachmentRead",
-    "filesOp",
-    "channelInterrupt",
-    "appendTranscript",
-    "previewEnsure",
-    "engineAccountRemove",
-  ].includes(command);
+  return Object.hasOwn(HOST_COMMAND_NAMES, command);
 }
 
 function expectString(args: unknown[], index: number): string {

package/src/protocol.ts

@@ -89,6 +89,10 @@ export const HOST_CONFIG_PROTOCOL_FEATURE = "host-config-v1";
 /** Remote update/restart over the bridge (owner-gated cloud routes). */
 export const HOST_REMOTE_LIFECYCLE_PROTOCOL_FEATURE =
   "host-remote-lifecycle-v1";
+/** ADR-125: cloud-initiated resumable task stop (idle auto-stop + manual
+ * pause). Idle stops carry reason "idle" and the host may VETO them when a
+ * turn is active right now — the veto is an ok result, not an error. */
+export const HOST_TASK_STOP_PROTOCOL_FEATURE = "host-task-stop-v1";
 /** ADR-116: labeled engine accounts on the cloud host page — account list in
  * capabilities, account-targeted login (`label` on engine.login.start), and
  * the engineAccountRemove command. */
@@ -1111,6 +1115,19 @@ export interface TaskLaunchInput {
   ownerName?: string;
 }
 
+/** ADR-125 resumable stop. "idle" = the cloud's sweep decided nobody is
+ * using the task; the host may veto if a turn is live. "manual" = a human
+ * pressed pause; no veto. */
+export interface TaskStopInput {
+  reason: "idle" | "manual";
+}
+
+export interface TaskStopResult {
+  /** Present when the host declined an idle stop because the channel showed
+   * activity within its veto window. The cloud retries on a later sweep. */
+  vetoed?: "active";
+}
+
 export interface TaskDownInput {
   taskId: string;
   task: TaskCommandTask;
@@ -1296,6 +1313,11 @@ export interface HostCommands {
     ctx: CommandContext,
     taskId: string,
   ): Promise<HostCommandResult<TaskStatusResult>>;
+  taskStop(
+    ctx: CommandContext,
+    taskId: string,
+    input: TaskStopInput,
+  ): Promise<HostCommandResult<TaskStopResult>>;
   channelEnsure(
     ctx: CommandContext,
     input: ChannelEnsureInput,