@runuai/host 0.8.24 → 0.8.26

package/lib/agent.ts

@@ -178,9 +178,13 @@ async function runAgent<T extends z.ZodTypeAny>(
     if (parsed) {
       const failure = FailureEnvelope.safeParse(parsed);
       if (failure.success) {
+        // Prefer the actual tool output over the bash envelope's generic
+        // "agent step failed" — the docker/git/apt error is what the operator
+        // needs, and it must reach the cloud, not just the host log.
+        const detail = toolStderrDetail(stderrBuf);
         throw new AgentError(
           failure.data.error.code,
-          failure.data.error.message,
+          detail || failure.data.error.message,
           {
             step: failure.data.error.step,
             exitCode: failure.data.error.exit_code ?? exitCode,
@@ -236,6 +240,28 @@ function tryParseLastJsonLine(buf: string): unknown {
   return null;
 }
 
+/**
+ * The FAILING TOOL's output from a script's stderr — the docker/git/apt lines
+ * that actually say WHY a step failed, dropping our own `[uai-agent] step:`
+ * breadcrumbs and the `{"ok":false,…}` envelope. The bash envelope's message
+ * is generic ("agent step failed"); this is what makes it specific so the
+ * reason reaches the cloud UI instead of only the host log — useless when the
+ * host is a remote user's machine (live 2026-07-22, "compose_up_failed" with
+ * no why). Bounded to the last few lines so a build log doesn't flood the UI.
+ */
+export function toolStderrDetail(stderr: string): string {
+  const lines = stderr
+    .split(/\r?\n/)
+    .map((l) => l.replace(/\s+$/, ""))
+    .filter((l) => l.trim().length > 0)
+    .filter((l) => !l.startsWith("[uai-agent"))
+    .filter((l) => !l.trimStart().startsWith('{"ok"'));
+  return lines
+    .slice(-6)
+    .map((l) => (l.length > 300 ? `${l.slice(0, 300)}…` : l))
+    .join("\n");
+}
+
 // ---------------------------------------------------------------------------
 // Public API. One function per agent command.
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.24",
+  "version": "0.8.26",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/scripts/agent/task-up.sh

@@ -322,6 +322,11 @@ fi
     printf '    image: %s\n' "$DERIVED_IMAGE"
   else
     printf '    image: %s\n' "$STANDARD_IMAGE"
+    # Never pull: the standard image is built LOCALLY by the host, not hosted
+    # on any registry. Without this, an absent image makes compose attempt a
+    # doomed registry pull ("pull access denied for uai-standard") instead of
+    # failing clearly (live 2026-07-22, a fresh host mid standard-image build).
+    printf '    pull_policy: never\n'
   fi
   printf '    init: true\n'
   printf '    working_dir: /workspace\n'
@@ -441,6 +446,18 @@ fi
 docker volume create "$ASDF_VOLUME" >/dev/null 2>&1 || true
 docker volume create "$PW_VOLUME" >/dev/null 2>&1 || true
 
+# The standard base image is built by the host (ensureStandardImage), never
+# pulled from a registry — and derived tasks FROM it too. If it's absent (the
+# host started before Docker was ready, or the build failed) compose would try
+# a doomed registry pull; fail with an actionable message instead (the host
+# also (re)builds it on demand before task-up — this is the belt-and-suspenders
+# check for a still-in-progress or failed build). Live 2026-07-22.
+if ! docker image inspect "$STANDARD_IMAGE" >/dev/null 2>&1; then
+  emit_err "STANDARD_IMAGE_MISSING" \
+    "the host base image $STANDARD_IMAGE is not built yet — the host builds it at startup (a few minutes on first run, and after Docker Desktop finishes starting). Wait for the host log line 'built standard image', or restart the host, then retry. If it keeps failing the host log shows the build error (often Docker Desktop low on memory/disk)." \
+    "check standard image"
+fi
+
 step "COMPOSE_UP_FAILED" "docker compose up -d"
 if [ "$has_derived" = "1" ]; then
   docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" up -d --build >/dev/null

package/src/index.ts

@@ -1,4 +1,5 @@
 import { agent, AgentError } from "../lib/agent";
+import { ensureStandardImage } from "../lib/standard-image";
 import { cloneRepo } from "../lib/repo-clone";
 import { handleFilesOp } from "../lib/shared-files";
 import { getOrchestrator } from "../lib/orchestrator";
@@ -119,6 +120,15 @@ export const hostCommands: HostCommands = {
       storeTaskCliSecret(input.task.id, input.task.cliSecret);
     }
     recordHostEvent(input.task.id, "task.created");
+    // Self-heal the standard base image before task-up needs it. The boot-time
+    // build is best-effort + one-shot: if the host started before Docker was
+    // ready (common on Docker Desktop), uai-standard:dev was never built and
+    // every task-up died on a doomed registry pull (live 2026-07-22). This is
+    // idempotent — a fast image-inspect when present, a real build only when
+    // missing/stale (Docker is definitely up now, a task just arrived). Never
+    // throws; a build failure surfaces as a clear STANDARD_IMAGE_MISSING from
+    // task-up.sh's guard.
+    await ensureStandardImage();
     const result = await wrapAgent(ctx, "taskUp", () => agent.taskUp(input));
     if (result.ok) {
       recordTaskUpResult(input.task.id, result.value);