@runuai/host 0.9.89 → 0.9.91

package/lib/agents/factory.ts

@@ -21,6 +21,7 @@ import "./kimi";
 import "./grok";
 import "./cursor";
 import "./opencode";
+import "./uai";
 
 import { agentClisReady } from "../standard-image";
 import { factoryFor, supportsExecutionProfile } from "./registry";

package/lib/agents/types.ts

@@ -54,6 +54,9 @@ export const RosterAgent = z.object({
   initialPrompt: z.string().optional(), // first-turn instructions, this task only
   skills: z.array(RosterSkill).optional(), // ADR-046 reference material
   permissions: z.array(z.string()).optional(), // ADR-048 `uai` CLI capabilities
+  // ADR-128: which upstream protocol a Uai-engine model speaks — resolved
+  // cloud-side from the model catalog; selects the delegated adapter.
+  uaiProvider: z.enum(["anthropic", "openai"]).optional(),
 });
 export type RosterAgent = z.infer<typeof RosterAgent>;
 

package/lib/agents/uai.ts

@@ -0,0 +1,87 @@
+/**
+ * The Uai Managed Engine (ADR-128) — not a harness, a delegation.
+ *
+ * The customer picks "Uai Managed Engine" and one of Uai's models; under
+ * the hood this adapter spawns the EXISTING claude or codex adapter
+ * (chosen by the model's provider, resolved cloud-side into
+ * `agent.uaiProvider`) with the environment pointed at the inference
+ * gateway: base URL swapped, the agent's own task token as the API
+ * credential, and the host's real provider credentials explicitly
+ * BLANKED so a BYO host's Claude subscription can never be billed for a
+ * Uai-engine turn. The gateway meters usage server-side and the cloud
+ * debits credits — this file never sees money.
+ *
+ * The model slug passes through verbatim: the underlying CLI sends it as
+ * the request's `model`, and the gateway maps slug → upstream id.
+ */
+
+import { factoryFor, register } from "./registry";
+import type { AgentSession, AgentSessionFactory } from "./types";
+
+const DEFAULT_GATEWAY_URL = "https://inference.runuai.com";
+
+export function gatewayUrl(): string {
+  return process.env.UAI_INFERENCE_GATEWAY_URL || DEFAULT_GATEWAY_URL;
+}
+
+/** The env override set for a delegated session. Exported for tests. */
+export function uaiGatewayEnv(
+  provider: "anthropic" | "openai",
+  url: string,
+  taskToken: string,
+): Record<string, string> {
+  if (provider === "openai") {
+    return {
+      OPENAI_BASE_URL: url,
+      OPENAI_API_KEY: taskToken,
+    };
+  }
+  return {
+    ANTHROPIC_BASE_URL: url,
+    ANTHROPIC_AUTH_TOKEN: taskToken,
+    // Explicit blanks WIN over the claude adapter's passEnv inheritance
+    // (same mechanism its communicator profile uses to scrub) — the host's
+    // real credential must never ride a gateway-billed session.
+    ANTHROPIC_API_KEY: "",
+    CLAUDE_CODE_OAUTH_TOKEN: "",
+  };
+}
+
+const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession> => {
+  const provider = args.agent.uaiProvider === "openai" ? "openai" : "anthropic";
+  const delegateKind = provider === "openai" ? "codex" : "claude";
+  const delegate = factoryFor(delegateKind);
+  if (!delegate) {
+    throw new Error(`uai engine: no ${delegateKind} adapter registered to delegate to`);
+  }
+  const taskToken = args.agentEnv?.UAI_TASK_TOKEN;
+  if (!taskToken) {
+    // agentCliEnv mints no token for a permissionless non-secretary agent;
+    // the gateway authenticates with exactly that token, so the engine
+    // needs it. The default crew grants permissions, so this is rare.
+    throw new Error(
+      "uai engine: this agent has no task token (no CLI permissions) — grant it at least one permission or use a direct engine",
+    );
+  }
+  return delegate.create({
+    ...args,
+    agentEnv: {
+      ...(args.agentEnv ?? {}),
+      ...uaiGatewayEnv(provider, gatewayUrl(), taskToken),
+    },
+  });
+};
+
+register({
+  kind: "uai",
+  label: "Uai Managed Engine",
+  // The model catalog is cloud data (ADR-128); the composer sources it from
+  // /api/org/inference/models, never from host capabilities. Advertising an
+  // empty list here simply marks the kind spawnable on this host.
+  supportedModels: () => [],
+  supportedEfforts: () => [],
+  // Always available: the engine needs no host-side credential — auth is
+  // the per-agent task token, billing is the org's credits.
+  available: () => true,
+  create,
+});

package/lib/codex-auth.ts

@@ -3,13 +3,32 @@
  * in {@link ./github-tokens} (ADR-027/033 → host 0.8.1).
  *
  * The host owner's `~/.codex` is docker-cp'd into each task container ONCE, at
- * task-up (`scripts/agent/task-up.sh`). When the owner re-logs into Codex —
- * the refresh token gets revoked (a login elsewhere) and `codex login` rewrites
- * `~/.codex/auth.json` — already-running containers keep their stale copy, so a
- * re-login otherwise only helps NEW tasks. The live sweep refreshes the
- * credential-bearing copy while deliberately preserving the container's
- * `config.toml`: browser/MCP setup owns that live file and serializes its
- * updates with agent spawning.
+ * task-up (`scripts/agent/task-up.sh`). When the owner re-logs into Codex,
+ * `codex login` revokes and rewrites `~/.codex/auth.json` on the HOST —
+ * already-running containers keep their stale copy, so a re-login otherwise
+ * only helps NEW tasks. The live sweep refreshes the credential-bearing copy
+ * while deliberately preserving the container's `config.toml`: browser/MCP
+ * setup owns that live file and serializes its updates with agent spawning.
+ *
+ * That revoke-then-rewrite is CLIENT-SIDE and scoped to the LOCAL codex_home —
+ * not a server-side "one session per account" policy. `codex login` calls
+ * `clear_existing_auth_before_login` (openai/codex `cli/src/login.rs`), which
+ * revokes only whatever token `revocable_token()` (`login/src/auth/revoke.rs`)
+ * finds in THIS SAME codex_home's `auth.json` via `logout_with_revoke`
+ * (`login/src/auth/manager.rs`) — it never looks at, let alone reaches, another
+ * login's session. Separate logins are independent authorization_code+PKCE
+ * grants with independent refresh lineages (source analysis corroborated by a
+ * community-verified workaround, not an empirical run — full writeup:
+ * `docs/pricing-economics.md` R8/R10).
+ *
+ * What DOES matter for concurrency: refresh rotation is single-use, and a
+ * reused refresh token comes back `refresh_token_reused` — a TERMINAL
+ * `Exhausted` failure the client never retries. This file's docker-cp pattern
+ * already gives every task container its own independent filesystem copy of
+ * ONE lineage with nothing to reconcile them, so the instant any one
+ * container's own `codex` process refreshes, every sibling copy is a stale
+ * member of a now-rotated family and its next refresh is terminal, not
+ * self-healing — containers must never refresh this credential themselves.
  *
  * Three triggers, covering every path:
  *   - {@link watchCodexAuth} — fs.watch on `~/.codex`, for `codex login` run

package/lib/machine-provider-aws.ts

@@ -403,10 +403,51 @@ export function createAwsMachineProvider(
       try {
         const existing = JSON.parse(found.stdout);
         if (typeof existing === "string" && existing.startsWith("sg-")) {
+          // The group admits only host addresses — and it may predate THIS
+          // host (a second managed host in the fleet account, or this host
+          // rebooting onto a new public IP). Ensure our egress /32 is
+          // present; a duplicate rule is AWS's problem to dedupe, not ours
+          // to pre-check. Without this, every machine of a newer host sat
+          // unreachable behind the first host's rule ("machine never became
+          // reachable over ssh", live 2026-08-31).
+          const ensureEgress = await hostEgressIp();
+          const ensured = await runner([
+            "ec2",
+            "authorize-security-group-ingress",
+            "--group-id",
+            existing,
+            "--ip-permissions",
+            JSON.stringify([
+              {
+                IpProtocol: "tcp",
+                FromPort: 0,
+                ToPort: 65535,
+                IpRanges: [
+                  {
+                    CidrIp: `${ensureEgress}/32`,
+                    Description: "uai orchestrating host",
+                  },
+                ],
+              },
+            ]),
+          ]);
+          if (
+            ensured.status !== 0 &&
+            !/InvalidPermission\.Duplicate/.test(ensured.stderr)
+          ) {
+            throw new Error(
+              `could not admit this host into ${MANAGED_SECURITY_GROUP}: ${
+                ensured.stderr.trim() || `exit ${ensured.status ?? "killed"}`
+              }`,
+            );
+          }
           resolvedSecurityGroup = existing;
           return existing;
         }
-      } catch {
+      } catch (err) {
+        if (err instanceof Error && /could not admit this host/.test(err.message)) {
+          throw err;
+        }
         // fall through to creation
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.89",
+  "version": "0.9.91",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -2919,6 +2919,9 @@ function expectTaskAgents(value: unknown): TaskAgent[] {
     // effort was previously dropped here even though the protocol + adapters
     // carry it — fixed alongside skills (ADR-046).
     if (typeof row.effort === "string") out.effort = row.effort;
+    if (row.uaiProvider === "anthropic" || row.uaiProvider === "openai") {
+      out.uaiProvider = row.uaiProvider;
+    }
     if (typeof row.defaultPrompt === "string") {
       out.defaultPrompt = row.defaultPrompt;
     }

package/src/protocol.ts

@@ -173,6 +173,8 @@ export type PermissionDecision = { kind: "accept" } | { kind: "decline" };
  * `effort` (when set) is the CLI reasoning level, passed through like `model`.
  */
 export interface TaskAgent {
+  /** ADR-128: upstream protocol of a Uai-engine model (kind "uai"). */
+  uaiProvider?: "anthropic" | "openai";
   id: string;
   label: string;
   kind: string;