@runuai/host 0.9.90 → 0.9.92

package/lib/agents/factory.ts

@@ -21,6 +21,7 @@ import "./kimi";
 import "./grok";
 import "./cursor";
 import "./opencode";
+import "./uai";
 
 import { agentClisReady } from "../standard-image";
 import { factoryFor, supportsExecutionProfile } from "./registry";

package/lib/agents/types.ts

@@ -54,6 +54,9 @@ export const RosterAgent = z.object({
   initialPrompt: z.string().optional(), // first-turn instructions, this task only
   skills: z.array(RosterSkill).optional(), // ADR-046 reference material
   permissions: z.array(z.string()).optional(), // ADR-048 `uai` CLI capabilities
+  // ADR-128: which upstream protocol a Uai-engine model speaks — resolved
+  // cloud-side from the model catalog; selects the delegated adapter.
+  uaiProvider: z.enum(["anthropic", "openai"]).optional(),
 });
 export type RosterAgent = z.infer<typeof RosterAgent>;
 

package/lib/agents/uai.ts

@@ -0,0 +1,87 @@
+/**
+ * The Uai Managed Engine (ADR-128) — not a harness, a delegation.
+ *
+ * The customer picks "Uai Managed Engine" and one of Uai's models; under
+ * the hood this adapter spawns the EXISTING claude or codex adapter
+ * (chosen by the model's provider, resolved cloud-side into
+ * `agent.uaiProvider`) with the environment pointed at the inference
+ * gateway: base URL swapped, the agent's own task token as the API
+ * credential, and the host's real provider credentials explicitly
+ * BLANKED so a BYO host's Claude subscription can never be billed for a
+ * Uai-engine turn. The gateway meters usage server-side and the cloud
+ * debits credits — this file never sees money.
+ *
+ * The model slug passes through verbatim: the underlying CLI sends it as
+ * the request's `model`, and the gateway maps slug → upstream id.
+ */
+
+import { factoryFor, register } from "./registry";
+import type { AgentSession, AgentSessionFactory } from "./types";
+
+const DEFAULT_GATEWAY_URL = "https://inference.runuai.com";
+
+export function gatewayUrl(): string {
+  return process.env.UAI_INFERENCE_GATEWAY_URL || DEFAULT_GATEWAY_URL;
+}
+
+/** The env override set for a delegated session. Exported for tests. */
+export function uaiGatewayEnv(
+  provider: "anthropic" | "openai",
+  url: string,
+  taskToken: string,
+): Record<string, string> {
+  if (provider === "openai") {
+    return {
+      OPENAI_BASE_URL: url,
+      OPENAI_API_KEY: taskToken,
+    };
+  }
+  return {
+    ANTHROPIC_BASE_URL: url,
+    ANTHROPIC_AUTH_TOKEN: taskToken,
+    // Explicit blanks WIN over the claude adapter's passEnv inheritance
+    // (same mechanism its communicator profile uses to scrub) — the host's
+    // real credential must never ride a gateway-billed session.
+    ANTHROPIC_API_KEY: "",
+    CLAUDE_CODE_OAUTH_TOKEN: "",
+  };
+}
+
+const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession> => {
+  const provider = args.agent.uaiProvider === "openai" ? "openai" : "anthropic";
+  const delegateKind = provider === "openai" ? "codex" : "claude";
+  const delegate = factoryFor(delegateKind);
+  if (!delegate) {
+    throw new Error(`uai engine: no ${delegateKind} adapter registered to delegate to`);
+  }
+  const taskToken = args.agentEnv?.UAI_TASK_TOKEN;
+  if (!taskToken) {
+    // agentCliEnv mints no token for a permissionless non-secretary agent;
+    // the gateway authenticates with exactly that token, so the engine
+    // needs it. The default crew grants permissions, so this is rare.
+    throw new Error(
+      "uai engine: this agent has no task token (no CLI permissions) — grant it at least one permission or use a direct engine",
+    );
+  }
+  return delegate.create({
+    ...args,
+    agentEnv: {
+      ...(args.agentEnv ?? {}),
+      ...uaiGatewayEnv(provider, gatewayUrl(), taskToken),
+    },
+  });
+};
+
+register({
+  kind: "uai",
+  label: "Uai Managed Engine",
+  // The model catalog is cloud data (ADR-128); the composer sources it from
+  // /api/org/inference/models, never from host capabilities. Advertising an
+  // empty list here simply marks the kind spawnable on this host.
+  supportedModels: () => [],
+  supportedEfforts: () => [],
+  // Always available: the engine needs no host-side credential — auth is
+  // the per-agent task token, billing is the org's credits.
+  available: () => true,
+  create,
+});

package/lib/machine-provider-aws.ts

@@ -136,6 +136,21 @@ export function awsUserData(authorizedPublicKey: string): string {
     '  chmod 700 "$home/.ssh"',
     '  chmod 600 "$home/.ssh/authorized_keys"',
     "done",
+    // Swap BEFORE any workload: an Opus agent + a bundler + Chromium on a
+    // swapless machine hits the memory wall as a thrash (load 14, RAM 100%,
+    // sshd/code-server accept loops starved — live 2026-08-31 on the first
+    // real machine task; the HOSTS got their swapfile in 0.9.85, the
+    // machines never did). Best-effort: a machine without fallocate still
+    // boots.
+    "(fallocate -l 4G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile && echo '/swapfile none swap sw 0 0' >> /etc/fstab) || true",
+    // The task OWNS its machine (ADR-121 — per-customer kernel isolation is
+    // the whole point); denying sudo just breaks project setups that
+    // container tasks handle fine (live 2026-08-31: a Hightop machine task
+    // could not install the Infisical CLI its repo's config expects).
+    "echo 'node ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/node && chmod 440 /etc/sudoers.d/node",
+    // Infisical CLI: baseline parity with the standard container image —
+    // pnpm-secrets-style project setups expect it on PATH. Best-effort.
+    "(V=0.43.110; case \$(uname -m) in aarch64|arm64) T=arm64;; *) T=amd64;; esac; curl -fsSL -o /tmp/inf.tgz https://github.com/Infisical/cli/releases/download/v\${V}/cli_\${V}_linux_\${T}.tar.gz && tar -xzf /tmp/inf.tgz -C /tmp infisical && install -m 0755 /tmp/infisical /usr/local/bin/infisical) || true",
     "",
   ].join("\n");
   // RAW script, not base64: AWS CLI v2 base64-encodes --user-data ITSELF.

package/lib/vnode-pressure.ts

@@ -30,12 +30,25 @@ const exec = promisify(execFile);
 const ADMISSION_THRESHOLD = 0.9;
 /** Warn-log above this fraction. */
 const WARN_THRESHOLD = 0.8;
+/**
+ * The vnode counter ALONE cannot refuse: `kern.num_vnodes` includes the
+ * reclaimable vnode cache, and a healthy long-uptime Mac converges to
+ * num_vnodes == maxvnodes forever (live false-positive, 2026-08-31: the
+ * Studio refused every task at "100%" with ZERO VMs running and the file
+ * table at 1.2%). Real virtiofs pinning holds OPEN FILES — the Aug-24
+ * incident read 96% of `kern.num_files/kern.maxfiles`. So refusal
+ * requires the vnode ratio AND genuine file-table pressure together.
+ */
+const FILE_TABLE_CORROBORATION_THRESHOLD = 0.5;
 const CACHE_MS = 15_000;
 
 export interface VnodePressure {
   current: number;
   max: number;
   ratio: number;
+  filesCurrent: number;
+  filesMax: number;
+  filesRatio: number;
 }
 
 let cached: { at: number; value: VnodePressure | null } | null = null;
@@ -47,14 +60,30 @@ export async function readVnodePressure(): Promise<VnodePressure | null> {
   try {
     const { stdout } = await exec(
       "/usr/sbin/sysctl",
-      ["-n", "kern.num_vnodes", "kern.maxvnodes"],
+      ["-n", "kern.num_vnodes", "kern.maxvnodes", "kern.num_files", "kern.maxfiles"],
       { timeout: 5_000 },
     );
     const parts = stdout.trim().split(/\s+/).map(Number);
     const current = parts[0] ?? Number.NaN;
     const max = parts[1] ?? Number.NaN;
-    if (Number.isFinite(current) && Number.isFinite(max) && max > 0) {
-      value = { current, max, ratio: current / max };
+    const filesCurrent = parts[2] ?? Number.NaN;
+    const filesMax = parts[3] ?? Number.NaN;
+    if (
+      Number.isFinite(current) &&
+      Number.isFinite(max) &&
+      max > 0 &&
+      Number.isFinite(filesCurrent) &&
+      Number.isFinite(filesMax) &&
+      filesMax > 0
+    ) {
+      value = {
+        current,
+        max,
+        ratio: current / max,
+        filesCurrent,
+        filesMax,
+        filesRatio: filesCurrent / filesMax,
+      };
     }
   } catch {
     // Sensor failure is never a task failure; admission simply has no data.
@@ -67,11 +96,15 @@ export async function readVnodePressure(): Promise<VnodePressure | null> {
 export async function vnodeAdmissionProblem(): Promise<string | null> {
   const pressure = await readVnodePressure();
   if (!pressure || pressure.ratio < ADMISSION_THRESHOLD) return null;
+  // A full vnode table with an idle file table is a warm cache, not danger.
+  if (pressure.filesRatio < FILE_TABLE_CORROBORATION_THRESHOLD) return null;
   return (
     `the macOS vnode table is at ${Math.round(pressure.ratio * 100)}% ` +
-    `(${pressure.current}/${pressure.max}); starting another task VM risks ` +
-    "system-wide file-table exhaustion. Close a running task, or raise the " +
-    "ceiling once with: sudo uai-host tune"
+    `(${pressure.current}/${pressure.max}) with the file table at ` +
+    `${Math.round(pressure.filesRatio * 100)}% ` +
+    `(${pressure.filesCurrent}/${pressure.filesMax}); starting another task ` +
+    "VM risks system-wide file-table exhaustion. Close a running task, or " +
+    "raise the ceiling once with: sudo uai-host tune"
   );
 }
 
@@ -82,15 +115,19 @@ let lastLoggedBand: "ok" | "warn" | "critical" = "ok";
 export async function logVnodePressure(): Promise<void> {
   const pressure = await readVnodePressure();
   if (!pressure) return;
-  const band =
-    pressure.ratio >= ADMISSION_THRESHOLD
-      ? "critical"
-      : pressure.ratio >= WARN_THRESHOLD
-        ? "warn"
-        : "ok";
+  const refusing =
+    pressure.ratio >= ADMISSION_THRESHOLD &&
+    pressure.filesRatio >= FILE_TABLE_CORROBORATION_THRESHOLD;
+  const band = refusing
+    ? "critical"
+    : pressure.filesRatio >= WARN_THRESHOLD || pressure.ratio >= WARN_THRESHOLD
+      ? "warn"
+      : "ok";
   if (band === lastLoggedBand) return;
   lastLoggedBand = band;
-  const detail = `${pressure.current}/${pressure.max} (${Math.round(pressure.ratio * 100)}%)`;
+  const detail =
+    `vnodes ${pressure.current}/${pressure.max} (${Math.round(pressure.ratio * 100)}%), ` +
+    `files ${pressure.filesCurrent}/${pressure.filesMax} (${Math.round(pressure.filesRatio * 100)}%)`;
   if (band === "critical") {
     console.warn(
       `[vnode] table at ${detail} — new apple task VMs will be refused; run: sudo uai-host tune`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.90",
+  "version": "0.9.92",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/main.ts

@@ -2919,6 +2919,9 @@ function expectTaskAgents(value: unknown): TaskAgent[] {
     // effort was previously dropped here even though the protocol + adapters
     // carry it — fixed alongside skills (ADR-046).
     if (typeof row.effort === "string") out.effort = row.effort;
+    if (row.uaiProvider === "anthropic" || row.uaiProvider === "openai") {
+      out.uaiProvider = row.uaiProvider;
+    }
     if (typeof row.defaultPrompt === "string") {
       out.defaultPrompt = row.defaultPrompt;
     }

package/src/protocol.ts

@@ -173,6 +173,8 @@ export type PermissionDecision = { kind: "accept" } | { kind: "decline" };
  * `effort` (when set) is the CLI reasoning level, passed through like `model`.
  */
 export interface TaskAgent {
+  /** ADR-128: upstream protocol of a Uai-engine model (kind "uai"). */
+  uaiProvider?: "anthropic" | "openai";
   id: string;
   label: string;
   kind: string;