@runuai/host 0.9.88 → 0.9.90

package/lib/codex-auth.ts

@@ -3,13 +3,32 @@
  * in {@link ./github-tokens} (ADR-027/033 → host 0.8.1).
  *
  * The host owner's `~/.codex` is docker-cp'd into each task container ONCE, at
- * task-up (`scripts/agent/task-up.sh`). When the owner re-logs into Codex —
- * the refresh token gets revoked (a login elsewhere) and `codex login` rewrites
- * `~/.codex/auth.json` — already-running containers keep their stale copy, so a
- * re-login otherwise only helps NEW tasks. The live sweep refreshes the
- * credential-bearing copy while deliberately preserving the container's
- * `config.toml`: browser/MCP setup owns that live file and serializes its
- * updates with agent spawning.
+ * task-up (`scripts/agent/task-up.sh`). When the owner re-logs into Codex,
+ * `codex login` revokes and rewrites `~/.codex/auth.json` on the HOST —
+ * already-running containers keep their stale copy, so a re-login otherwise
+ * only helps NEW tasks. The live sweep refreshes the credential-bearing copy
+ * while deliberately preserving the container's `config.toml`: browser/MCP
+ * setup owns that live file and serializes its updates with agent spawning.
+ *
+ * That revoke-then-rewrite is CLIENT-SIDE and scoped to the LOCAL codex_home —
+ * not a server-side "one session per account" policy. `codex login` calls
+ * `clear_existing_auth_before_login` (openai/codex `cli/src/login.rs`), which
+ * revokes only whatever token `revocable_token()` (`login/src/auth/revoke.rs`)
+ * finds in THIS SAME codex_home's `auth.json` via `logout_with_revoke`
+ * (`login/src/auth/manager.rs`) — it never looks at, let alone reaches, another
+ * login's session. Separate logins are independent authorization_code+PKCE
+ * grants with independent refresh lineages (source analysis corroborated by a
+ * community-verified workaround, not an empirical run — full writeup:
+ * `docs/pricing-economics.md` R8/R10).
+ *
+ * What DOES matter for concurrency: refresh rotation is single-use, and a
+ * reused refresh token comes back `refresh_token_reused` — a TERMINAL
+ * `Exhausted` failure the client never retries. This file's docker-cp pattern
+ * already gives every task container its own independent filesystem copy of
+ * ONE lineage with nothing to reconcile them, so the instant any one
+ * container's own `codex` process refreshes, every sibling copy is a stale
+ * member of a now-rotated family and its next refresh is terminal, not
+ * self-healing — containers must never refresh this credential themselves.
  *
  * Three triggers, covering every path:
  *   - {@link watchCodexAuth} — fs.watch on `~/.codex`, for `codex login` run

package/lib/machine-provider-aws.ts

@@ -403,10 +403,51 @@ export function createAwsMachineProvider(
       try {
         const existing = JSON.parse(found.stdout);
         if (typeof existing === "string" && existing.startsWith("sg-")) {
+          // The group admits only host addresses — and it may predate THIS
+          // host (a second managed host in the fleet account, or this host
+          // rebooting onto a new public IP). Ensure our egress /32 is
+          // present; a duplicate rule is AWS's problem to dedupe, not ours
+          // to pre-check. Without this, every machine of a newer host sat
+          // unreachable behind the first host's rule ("machine never became
+          // reachable over ssh", live 2026-08-31).
+          const ensureEgress = await hostEgressIp();
+          const ensured = await runner([
+            "ec2",
+            "authorize-security-group-ingress",
+            "--group-id",
+            existing,
+            "--ip-permissions",
+            JSON.stringify([
+              {
+                IpProtocol: "tcp",
+                FromPort: 0,
+                ToPort: 65535,
+                IpRanges: [
+                  {
+                    CidrIp: `${ensureEgress}/32`,
+                    Description: "uai orchestrating host",
+                  },
+                ],
+              },
+            ]),
+          ]);
+          if (
+            ensured.status !== 0 &&
+            !/InvalidPermission\.Duplicate/.test(ensured.stderr)
+          ) {
+            throw new Error(
+              `could not admit this host into ${MANAGED_SECURITY_GROUP}: ${
+                ensured.stderr.trim() || `exit ${ensured.status ?? "killed"}`
+              }`,
+            );
+          }
           resolvedSecurityGroup = existing;
           return existing;
         }
-      } catch {
+      } catch (err) {
+        if (err instanceof Error && /could not admit this host/.test(err.message)) {
+          throw err;
+        }
         // fall through to creation
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.88",
+  "version": "0.9.90",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -2614,7 +2614,11 @@ function parseCloudFrame(data: RawData): CloudToHost | null {
   ) {
     return { kind: "mcp.op", opId: frame.opId, op: frame.op };
   }
-  console.warn("[host-agent] dropping unknown frame");
+  // Names only — never payloads (frames can carry tokens).
+  console.warn(
+    `[host-agent] dropping unknown frame kind=${String(frame.kind)}` +
+      (frame.kind === "command" ? ` command=${String(frame.command)}` : ""),
+  );
   return null;
 }
 
@@ -2861,28 +2865,35 @@ function rawDataToBuffer(data: RawData): Buffer {
   return Buffer.from(data);
 }
 
+// Exhaustive BY TYPE: `satisfies Record<keyof HostCommands, true>` makes a
+// command missing from this map a compile error. The previous hand-written
+// array silently dropped any frame it lagged behind on — hostUpdate and
+// hostRestart shipped in 0.9.62 and every remote Update/Restart click since
+// died here as "dropping unknown frame" / a cloud-side command timeout.
+const HOST_COMMAND_NAMES = {
+  hostUpdate: true,
+  hostRestart: true,
+  taskUp: true,
+  taskDown: true,
+  taskStatus: true,
+  taskStop: true,
+  channelEnsure: true,
+  channelTeardown: true,
+  channelDeliver: true,
+  channelResolvePermission: true,
+  cloneRepo: true,
+  taskDiff: true,
+  attachmentWrite: true,
+  attachmentRead: true,
+  filesOp: true,
+  channelInterrupt: true,
+  appendTranscript: true,
+  previewEnsure: true,
+  engineAccountRemove: true,
+} satisfies Record<keyof HostCommands, true>;
+
 function isHostCommand(command: string): command is keyof HostCommands {
-  // ⚠️ Keep in sync with the HostCommands interface + dispatchCommand. This is a
-  // manual allow-list (TS can't derive it from the type), so a missing entry
-  // silently drops the frame and hangs the cloud command.
-  return [
-    "taskUp",
-    "taskDown",
-    "taskStatus",
-    "channelEnsure",
-    "channelTeardown",
-    "channelDeliver",
-    "channelResolvePermission",
-    "cloneRepo",
-    "taskDiff",
-    "attachmentWrite",
-    "attachmentRead",
-    "filesOp",
-    "channelInterrupt",
-    "appendTranscript",
-    "previewEnsure",
-    "engineAccountRemove",
-  ].includes(command);
+  return Object.hasOwn(HOST_COMMAND_NAMES, command);
 }
 
 function expectString(args: unknown[], index: number): string {