@runuai/host 0.9.98 → 0.9.100

package/db/migrations/0017_engine_account_scope.sql

@@ -0,0 +1,7 @@
+-- ADR-131 Decision 3: engine accounts carry a scope — 'host' (the owner's,
+-- today's rows) or 'org:<orgId>' (a workspace's account on a shared host).
+-- Tasks resolve accounts by their scope; org scopes never see the default
+-- slot or the host's rows.
+ALTER TABLE `host_engine_accounts` ADD `scope` text NOT NULL DEFAULT 'host';--> statement-breakpoint
+CREATE INDEX `host_engine_accounts_scope_kind_idx` ON `host_engine_accounts` (`scope`,`kind`);--> statement-breakpoint
+ALTER TABLE `uai_host_tasks` ADD `engine_account_scope` text;

package/db/migrations/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1786406402000,
       "tag": "0016_task_environment",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1788820000000,
+      "tag": "0017_engine_account_scope",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -37,6 +37,10 @@ export const hostTasks = sqliteTable(
     ownerEmail: text("owner_email"),
     ownerName: text("owner_name"),
     projectSlugs: text("project_slugs").notNull().default("[]"),
+    // ADR-131 D3: which engine-account scope this task resolves credentials
+    // from ("org:<orgId>" on a shared host; null = "host"). Persisted so a
+    // host restart re-provisions the same scope before the cloud re-sends it.
+    engineAccountScope: text("engine_account_scope"),
     lockedAt: integer("locked_at", { mode: "number" }),
     startedAt: integer("started_at", { mode: "number" }),
     endedAt: integer("ended_at", { mode: "number" }),
@@ -271,6 +275,9 @@ export const engineAccounts = sqliteTable("host_engine_accounts", {
   authKind: text("auth_kind").notNull(), // "env" | "config-dir"
   secretEnc: text("secret_enc"), // sealed JSON (env kind); null for config-dir
   configDir: text("config_dir"), // host dir (config-dir kind); null for env
+  // ADR-131 D3: "host" (owner-level, default) or "org:<orgId>" (a workspace's
+  // account on a shared host). Resolution is by exact scope.
+  scope: text("scope").notNull().default("host"),
   createdAt: integer("created_at", { mode: "number" }).notNull(),
 });
 

package/lib/engine-accounts.ts

@@ -22,6 +22,10 @@
  * caps reset over time).
  */
 
+import {
+  HOST_ACCOUNT_SCOPE,
+  isEngineAccountScope,
+} from "../src/protocol";
 import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -85,6 +89,8 @@ export interface EngineAccountInfo {
   label: string;
   authKind: AccountAuthKind;
   isDefault: boolean;
+  /** ADR-131 D3: "host" or "org:<orgId>". */
+  scope: string;
 }
 
 /** A fully-resolved account, ready to inject / provision (host-trusted; the
@@ -94,6 +100,8 @@ export interface ResolvedEngineAccount {
   kind: string;
   label: string;
   isDefault: boolean;
+  /** ADR-131 D3: "host" or "org:<orgId>". */
+  scope: string;
   authKind: AccountAuthKind;
   /** Env merged into the agent's docker exec. Empty for the default env
    *  account (the ambient `.env.local` credential is account #1). */
@@ -141,6 +149,27 @@ function unpackSecret(enc: string): string {
   return openAesGcm(ct, nonce);
 }
 
+// ---------------------------------------------------------------------------
+// Scopes (ADR-131 Decision 3).
+// ---------------------------------------------------------------------------
+
+/**
+ * Every account has a scope. `host` is the owner's: the default slot plus
+ * every extra account connected before scopes existed (and every one an
+ * owner connects on a BYO/dedicated host). `org:<orgId>` is a workspace's
+ * account on a shared host: resolved ONLY for that workspace's tasks, and
+ * never joined by the default slot — a tenant sees exactly what it connected.
+ */
+export { HOST_ACCOUNT_SCOPE, isEngineAccountScope };
+
+/** A row's scope (legacy rows read as `host`) matches the requested one. */
+export function accountInScope(
+  rowScope: string | null | undefined,
+  scope: string,
+): boolean {
+  return (rowScope ?? HOST_ACCOUNT_SCOPE) === scope;
+}
+
 // ---------------------------------------------------------------------------
 // Resolution.
 // ---------------------------------------------------------------------------
@@ -177,6 +206,7 @@ function synthesizeDefault(
       label: "Default",
       isDefault: true,
       authKind: "env",
+      scope: HOST_ACCOUNT_SCOPE,
       execEnv: {},
     };
   }
@@ -187,6 +217,7 @@ function synthesizeDefault(
     label: "Default",
     isDefault: true,
     authKind: "config-dir",
+    scope: HOST_ACCOUNT_SCOPE,
     execEnv: d.selectVar ? { [d.selectVar]: containerDir } : {},
     configDir: {
       hostDir: (d.defaultHostDir as (o: string) => string)(s.ownerHome()),
@@ -196,14 +227,22 @@ function synthesizeDefault(
 }
 
 /** DB extras for a kind, resolved into injectable form. */
-function resolveExtras(kind: string, s: AccountSeams): ResolvedEngineAccount[] {
+function resolveExtras(
+  kind: string,
+  s: AccountSeams,
+  scope: string,
+): ResolvedEngineAccount[] {
   const d = KINDS[kind];
   if (!d) return [];
   const rows = getDb()
     .select()
     .from(schema.engineAccounts)
     .all()
-    .filter((r) => r.kind === kind);
+    .filter(
+      (r) =>
+        r.kind === kind &&
+        accountInScope((r as { scope?: string | null }).scope, scope),
+    );
   const out: ResolvedEngineAccount[] = [];
   for (const row of rows) {
     if (row.authKind === "env") {
@@ -226,6 +265,7 @@ function resolveExtras(kind: string, s: AccountSeams): ResolvedEngineAccount[] {
         label: row.label,
         isDefault: false,
         authKind: "env",
+        scope,
         execEnv,
       });
     } else if (row.authKind === "config-dir" && row.configDir && d.selectVar) {
@@ -236,6 +276,7 @@ function resolveExtras(kind: string, s: AccountSeams): ResolvedEngineAccount[] {
         label: row.label,
         isDefault: false,
         authKind: "config-dir",
+        scope,
         execEnv: { [d.selectVar]: containerDir },
         configDir: { hostDir: row.configDir, containerDir },
       });
@@ -248,12 +289,16 @@ function resolveExtras(kind: string, s: AccountSeams): ResolvedEngineAccount[] {
 export function resolveEngineAccounts(
   kind: string,
   seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
 ): ResolvedEngineAccount[] {
   const s = withDefaults(seams);
   const accounts: ResolvedEngineAccount[] = [];
-  const def = synthesizeDefault(kind, s);
-  if (def) accounts.push(def);
-  accounts.push(...resolveExtras(kind, s));
+  // The default slot is the OWNER's credential: it joins the host scope only.
+  if (scope === HOST_ACCOUNT_SCOPE) {
+    const def = synthesizeDefault(kind, s);
+    if (def) accounts.push(def);
+  }
+  accounts.push(...resolveExtras(kind, s, scope));
   return accounts;
 }
 
@@ -261,22 +306,47 @@ export function resolveEngineAccounts(
 export function listEngineAccounts(
   kind: string,
   seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
 ): EngineAccountInfo[] {
-  return resolveEngineAccounts(kind, seams).map((a) => ({
+  return resolveEngineAccounts(kind, seams, scope).map((a) => ({
     id: a.id,
     kind: a.kind,
     label: a.label,
     authKind: a.authKind,
     isDefault: a.isDefault,
+    scope: a.scope,
   }));
 }
 
+/** Every scope holding at least one stored account for the kind, plus
+ *  `host` (which may consist of the default slot alone). */
+export function engineAccountScopes(kind: string): string[] {
+  const scopes = new Set<string>([HOST_ACCOUNT_SCOPE]);
+  for (const row of getDb().select().from(schema.engineAccounts).all()) {
+    if (row.kind !== kind) continue;
+    scopes.add((row as { scope?: string | null }).scope ?? HOST_ACCOUNT_SCOPE);
+  }
+  return [...scopes];
+}
+
+/** Account list across ALL scopes — the capabilities advertisement. The
+ *  cloud filters per caller; labels only, never credentials. */
+export function listEngineAccountsAllScopes(
+  kind: string,
+  seams: Partial<AccountSeams> = {},
+): EngineAccountInfo[] {
+  return engineAccountScopes(kind).flatMap((scope) =>
+    listEngineAccounts(kind, seams, scope),
+  );
+}
+
 /** How many accounts a kind has right now (default + extras). */
 export function engineAccountCount(
   kind: string,
   seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
 ): number {
-  return resolveEngineAccounts(kind, seams).length;
+  return resolveEngineAccounts(kind, seams, scope).length;
 }
 
 // ---------------------------------------------------------------------------
@@ -339,9 +409,19 @@ export function selectAccount(
 /** Pick an account for a kind (default + extras), applying rotation state. */
 export function pickEngineAccount(
   kind: string,
-  opts: { exclude?: Set<string>; seams?: Partial<AccountSeams>; now?: number } = {},
+  opts: {
+    exclude?: Set<string>;
+    seams?: Partial<AccountSeams>;
+    now?: number;
+    /** ADR-131 D3: the task's scope; default = the host's own accounts. */
+    scope?: string;
+  } = {},
 ): ResolvedEngineAccount | null {
-  const accounts = resolveEngineAccounts(kind, opts.seams ?? {});
+  const accounts = resolveEngineAccounts(
+    kind,
+    opts.seams ?? {},
+    opts.scope ?? HOST_ACCOUNT_SCOPE,
+  );
   return selectAccount(accounts, { exclude: opts.exclude, now: opts.now });
 }
 
@@ -495,6 +575,7 @@ export async function provisionEngineAccounts(
   kinds: Iterable<string>,
   seams: Partial<AccountSeams> = {},
   environment?: Pick<TaskEnvironmentHandle, "exec" | "copy">,
+  scope: string = HOST_ACCOUNT_SCOPE,
 ): Promise<ProvisionEngineAccountsResult> {
   const s = withDefaults(seams);
   const seen = new Set<string>();
@@ -504,7 +585,7 @@ export async function provisionEngineAccounts(
   for (const kind of kinds) {
     if (seen.has(kind)) continue;
     seen.add(kind);
-    for (const account of resolveEngineAccounts(kind, s)) {
+    for (const account of resolveEngineAccounts(kind, s, scope)) {
       if (account.isDefault || !account.configDir) continue;
       if (!s.fileExists(account.configDir.hostDir)) {
         failed += 1;
@@ -554,8 +635,12 @@ export function addEngineAccount(
   label: string,
   creds: { apiKey?: string; token?: string },
   seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
 ): AddAccountResult {
   const s = withDefaults(seams);
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
   const trimmedLabel = label.trim();
   if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
   const secret = (creds.token ?? creds.apiKey ?? "").trim();
@@ -581,6 +666,7 @@ export function addEngineAccount(
         secretEnc: packSecret(JSON.stringify({ [envVar]: secret })),
         configDir: null,
         createdAt: now,
+        scope,
       })
       .run();
     return { ok: true, message: `Added Claude account "${trimmedLabel}".`, id };
@@ -621,6 +707,7 @@ export function addEngineAccount(
         secretEnc: null,
         configDir: hostDir,
         createdAt: now,
+        scope,
       })
       .run();
     return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
@@ -642,7 +729,11 @@ export function addCodexAccountFromAuthJson(
   label: string,
   authJson: string,
   seams: Partial<AccountSeams> = {},
+  scope: string = HOST_ACCOUNT_SCOPE,
 ): AddAccountResult {
+  if (!isEngineAccountScope(scope)) {
+    return { ok: false, message: "The account scope is invalid." };
+  }
   const s = withDefaults(seams);
   const trimmedLabel = label.trim();
   if (!trimmedLabel) return { ok: false, message: "Give the account a label." };
@@ -690,6 +781,7 @@ export function addCodexAccountFromAuthJson(
       secretEnc: null,
       configDir: hostDir,
       createdAt: Date.now(),
+      scope,
     })
     .run();
   return { ok: true, message: `Added Codex account "${trimmedLabel}".`, id };
@@ -698,7 +790,19 @@ export function addCodexAccountFromAuthJson(
 /** Remove an EXTRA account (idempotent). The synthesized default can't be
  *  removed here (use the engine disconnect flow for the legacy slot). The
  *  isolated host config dir of a config-dir account is deleted too. */
-export function removeEngineAccount(id: string): { ok: boolean; message: string } {
+/** Whether a caller acting in `scope` may remove `row`. `undefined` is the
+ *  host's own local UI, which may remove anything. */
+export function accountRemovableInScope(
+  row: { scope?: string | null },
+  scope: string | undefined,
+): boolean {
+  return scope === undefined || accountInScope(row.scope, scope);
+}
+
+export function removeEngineAccount(
+  id: string,
+  scope?: string,
+): { ok: boolean; message: string } {
   if (id.startsWith("default:")) {
     return {
       ok: false,
@@ -711,6 +815,11 @@ export function removeEngineAccount(id: string): { ok: boolean; message: string
     .where(eq(schema.engineAccounts.id, id))
     .get();
   if (!row) return { ok: true, message: "Account already removed." };
+  // ADR-131 D3: a workspace removes only its own accounts — never the host's
+  // and never another workspace's, whatever id it names.
+  if (!accountRemovableInScope(row, scope)) {
+    return { ok: false, message: "That account belongs to a different scope." };
+  }
   getDb().delete(schema.engineAccounts).where(eq(schema.engineAccounts.id, id)).run();
   if (row.authKind === "config-dir" && row.configDir) {
     try {

package/lib/engine-connect.ts

@@ -10,7 +10,9 @@
  */
 
 import {
+  HOST_ACCOUNT_SCOPE,
   isEngineAccountLabel,
+  isEngineAccountScope,
   isHostOpId,
   MAX_ENGINE_CONNECT_LINE_CHARS,
   MAX_ENGINE_CONNECT_SECRET_CHARS,
@@ -57,8 +59,10 @@ export class EngineConnectManager {
     secret: string | undefined,
     label: string | undefined,
     emit: EmitEngineConnectEvent,
+    scope: string | undefined = undefined,
   ): boolean {
     if (!isHostOpId(opId) || this.operations.has(opId)) return false;
+    if (scope !== undefined && !isEngineAccountScope(scope)) return false;
     if (
       secret !== undefined &&
       (secret.length < 1 || secret.length > MAX_ENGINE_CONNECT_SECRET_CHARS)
@@ -93,7 +97,7 @@ export class EngineConnectManager {
       this.finish(operation, false, "Engine connect timed out.");
     }, CONNECT_TIMEOUT_MS);
     operation.timer.unref?.();
-    void this.run(operation, secret, label).catch((error: unknown) => {
+    void this.run(operation, secret, label, scope).catch((error: unknown) => {
       this.finish(
         operation,
         false,
@@ -118,6 +122,7 @@ export class EngineConnectManager {
     operation: ConnectOperation,
     secret: string | undefined,
     label: string | undefined,
+    scope: string | undefined,
   ): Promise<void> {
     const { engine } = operation;
     const emitLine = (line: string): void => {
@@ -153,11 +158,28 @@ export class EngineConnectManager {
 
     // ADR-116 labeled extra account — the sink validates kind support.
     if (label !== undefined && secret !== undefined) {
-      const added = addEngineAccount(engine, label, { token: secret });
+      const added = addEngineAccount(
+        engine,
+        label,
+        { token: secret },
+        {},
+        scope ?? HOST_ACCOUNT_SCOPE,
+      );
       if (added.ok) this.afterMutation(engine, false);
       this.finish(operation, added.ok, added.message);
       return;
     }
+    // ADR-131 D3: everything below writes the host's DEFAULT slot or re-detects
+    // a host-side login — the owner's credential, never a workspace's. A
+    // tenant scope must not reach it.
+    if (scope !== undefined && scope !== HOST_ACCOUNT_SCOPE) {
+      this.finish(
+        operation,
+        false,
+        "Workspace accounts need a label and a pasted secret; the host's own sign-in is not available to workspaces.",
+      );
+      return;
+    }
 
     const result = await connectEngine(
       engine as EngineKind,

package/lib/engine-login.ts

@@ -27,7 +27,9 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 
 import {
+  HOST_ACCOUNT_SCOPE,
   isEngineAccountLabel,
+  isEngineAccountScope,
   isHostOpId,
   MAX_ENGINE_LOGIN_QUERY_CHARS,
   MAX_ENGINE_LOGIN_TEXT_CHARS,
@@ -145,8 +147,16 @@ export interface EngineLoginSeams {
   persistClaudeToken(token: string): Promise<void>;
   persistCodexAuth(sourceFile: string): Promise<void>;
   /** ADR-116: labeled extra-account captures (never the default slots). */
-  addClaudeAccount(label: string, token: string): { ok: boolean; message: string };
-  addCodexAccount(label: string, authJson: string): { ok: boolean; message: string };
+  addClaudeAccount(
+    label: string,
+    token: string,
+    scope: string,
+  ): { ok: boolean; message: string };
+  addCodexAccount(
+    label: string,
+    authJson: string,
+    scope: string,
+  ): { ok: boolean; message: string };
   refreshEngineAccountAgents(engine: "claude"): Promise<void>;
   reinjectCodexRunningTasks(): Promise<void>;
   ownerHome(): string;
@@ -209,6 +219,8 @@ interface LoginOperation {
   /** ADR-116: when set, the captured credential lands in a labeled extra
    * account instead of the default slot. */
   accountLabel: string | null;
+  /** ADR-131 D3: the scope a labeled capture is stored under. */
+  accountScope: string;
   /** Diagnosis breadcrumb: has ANY output arrived after the one-time code
    * was written? Distinguishes "stdin never delivered" from "CLI answered
    * and we ignored it" without reading the PTY transcript. */
@@ -299,10 +311,10 @@ function defaultSeams(options: EngineLoginManagerOptions): EngineLoginSeams {
     },
     persistClaudeToken: (token) => persistClaudeTokenAtomic(token),
     persistCodexAuth: (sourceFile) => persistCodexAuthAtomic(sourceFile),
-    addClaudeAccount: (label, token) =>
-      addEngineAccount("claude", label, { token }),
-    addCodexAccount: (label, authJson) =>
-      addCodexAccountFromAuthJson(label, authJson),
+    addClaudeAccount: (label, token, scope) =>
+      addEngineAccount("claude", label, { token }, {}, scope),
+    addCodexAccount: (label, authJson, scope) =>
+      addCodexAccountFromAuthJson(label, authJson, {}, scope),
     refreshEngineAccountAgents: options.refreshEngineAccountAgents,
     reinjectCodexRunningTasks: () => reinjectCodexRunningTasks(),
     ownerHome,
@@ -370,8 +382,25 @@ export class EngineLoginManager {
     engine: EngineLoginKind,
     emit: EmitEngineLoginEvent,
     label?: string,
+    scope?: string,
   ): boolean {
     if (!isHostOpId(opId)) return false;
+    if (scope !== undefined && !isEngineAccountScope(scope)) {
+      safeEmit(
+        emit,
+        failedEvent(opId, engine, "start_failed", "The account scope is invalid."),
+      );
+      return false;
+    }
+    // A workspace's sign-in is always a labeled account: the default slot is
+    // the host owner's and must never be written on a tenant's behalf.
+    if (scope !== undefined && scope !== HOST_ACCOUNT_SCOPE && label === undefined) {
+      safeEmit(
+        emit,
+        failedEvent(opId, engine, "start_failed", "A workspace account needs a label."),
+      );
+      return false;
+    }
     if (label !== undefined && !isEngineAccountLabel(label)) {
       safeEmit(
         emit,
@@ -426,6 +455,7 @@ export class EngineLoginManager {
       pendingInput: null,
       callbackTarget: null,
       accountLabel: label ?? null,
+      accountScope: scope ?? HOST_ACCOUNT_SCOPE,
       postInputOutputSeen: false,
     };
     this.operations.set(opId, operation);
@@ -941,7 +971,11 @@ export class EngineLoginManager {
       // ADR-116: labeled capture — an extra account, not the default slot.
       // Extras are picked up at the next agent spawn / rotation, so no
       // running-agent refresh is needed (mirrors the local accounts API).
-      const added = this.seams.addClaudeAccount(operation.accountLabel, token);
+      const added = this.seams.addClaudeAccount(
+        operation.accountLabel,
+        token,
+        operation.accountScope,
+      );
       terminal = added.ok
         ? {
             kind: "engine.login.event",
@@ -1011,7 +1045,11 @@ export class EngineLoginManager {
           join(tempDir, "codex", "auth.json"),
           "utf8",
         );
-        added = this.seams.addCodexAccount(operation.accountLabel, contents);
+        added = this.seams.addCodexAccount(
+          operation.accountLabel,
+          contents,
+          operation.accountScope,
+        );
       } catch {
         added = {
           ok: false,