@runuai/host 0.8.43 → 0.8.45

package/lib/browser-testing.ts

@@ -47,7 +47,18 @@ import { dockerCli } from "./docker-exec";
 import { MCP_CONFIG_LOCK_PATH } from "./mcp-config-lock";
 
 const SERVER_DISPLAY = ":99";
-const XVFB_CMD = `Xvfb ${SERVER_DISPLAY} -screen 0 1440x900x24 -nolisten tcp`;
+/**
+ * The virtual screen, and the ONLY place its size is written.
+ *
+ * Chromium's window has to be told the same numbers (see CHROMIUM_ARGS). There
+ * is no window manager on this display — nothing to maximise a window or
+ * service a resize — so the window is whatever size it was created at, forever.
+ * Two independent copies of "1440x900" would drift, and the failure is quiet:
+ * the page renders at the size you asked for while the window shows part of it.
+ */
+const SCREEN_W = 1440;
+const SCREEN_H = 900;
+const XVFB_CMD = `Xvfb ${SERVER_DISPLAY} -screen 0 ${SCREEN_W}x${SCREEN_H}x24 -nolisten tcp`;
 
 /**
  * The MCP server package — PINNED, deliberately, and the single source of
@@ -127,6 +138,42 @@ const INSTALL_BROWSER =
   `PLAYWRIGHT_SKIP_BROWSER_GC=1 timeout --kill-after=10 ${INSTALL_TIMEOUT_S} ` +
   `npx -y ${MCP_PKG} install-browser ${BROWSER}`;
 const INSTALL_LOG = "/tmp/uai-pw-browser.log";
+
+/**
+ * Chromium flags the MCP has no CLI passthrough for, so they ride a config file
+ * (`--config`, `browser.launchOptions.args`).
+ *
+ * `--window-size`/`--window-position` because there is NO WINDOW MANAGER on the
+ * virtual display. Chromium opens at its own default — 1050x880 inside a
+ * 1440x900 screen — and with nothing to service resize requests, stays there. A
+ * later `browser_resize` then only APPEARS to work: Playwright falls back to a
+ * CDP device-metrics override, so the page renders at the requested width while
+ * the window still shows the leftmost 1050px. Everything past that edge is
+ * painted where nobody can see it and nothing reports an error. Window creation
+ * is the only moment the size can be set.
+ *
+ * `--test-type` suppresses "You are using an unsupported command-line flag:
+ * --no-sandbox", which we cannot avoid triggering — no user namespaces in the
+ * container, so the sandbox has to go. Measured on this exact launch path
+ * (persistent context): the infobar costs 56px of viewport, permanently, in a
+ * window a human is watching.
+ */
+const CHROMIUM_ARGS = [
+  "--test-type",
+  "--window-position=0,0",
+  `--window-size=${SCREEN_W},${SCREEN_H}`,
+];
+const MCP_LAUNCH_CONFIG = "/tmp/uai-playwright-mcp.json";
+/**
+ * Base64, not raw JSON. This command is embedded three ways — a JSON value in
+ * `.mcp.json`, a TOML LITERAL in Codex's config, and an `sh -lc` argument — and
+ * a literal TOML string cannot contain a single quote at all (`tomlString`
+ * throws rather than emit one). Base64's alphabet has no quotes, so the same
+ * bytes survive every layer with no escaping rules to get wrong.
+ */
+const MCP_LAUNCH_CONFIG_B64 = Buffer.from(
+  JSON.stringify({ browser: { launchOptions: { args: CHROMIUM_ARGS } } }),
+).toString("base64");
 /** Host-side backstop, deliberately looser than the in-container `timeout`. */
 const INSTALL_TIMEOUT_MS = 300_000;
 const MCP_CONFIG_PATH = "/workspace/.mcp.json";
@@ -162,12 +209,16 @@ const X_LOCK = `/tmp/.X${SERVER_DISPLAY.slice(1)}-lock`;
 // slow. Ensuring the display is fine: Xvfb is local and instant.
 const SERVER_LAUNCHER =
   `cd /workspace; ` +
+  // Writing a local file is not a download — it stays off the handshake budget.
+  `echo ${MCP_LAUNCH_CONFIG_B64} | base64 -d > ${MCP_LAUNCH_CONFIG}; ` +
   `if command -v Xvfb >/dev/null 2>&1; then ` +
   `[ -e ${X_LOCK} ] || (nohup ${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &); ` +
   `sleep 1; export DISPLAY=${SERVER_DISPLAY}; ` +
-  `exec npx -y ${MCP_PKG} --browser ${BROWSER} --no-sandbox; ` +
+  `exec npx -y ${MCP_PKG} --config ${MCP_LAUNCH_CONFIG} ` +
+  `--browser ${BROWSER} --no-sandbox; ` +
   `else ` +
-  `exec npx -y ${MCP_PKG} --browser ${BROWSER} --no-sandbox --headless; ` +
+  `exec npx -y ${MCP_PKG} --config ${MCP_LAUNCH_CONFIG} ` +
+  `--browser ${BROWSER} --no-sandbox --headless; ` +
   `fi`;
 
 const SERVER_COMMAND = "sh";
@@ -250,6 +301,24 @@ const HISTORICAL_SERVER_DEFS: Array<Record<string, unknown>> = [
         `else exec npx -y @playwright/mcp@0.0.78 --browser chromium --no-sandbox --headless; fi`,
     ],
   },
+  {
+    // The pinned launcher BEFORE `--config`: no window geometry and no
+    // `--test-type`, so its Chromium opened at 1050x880 on a 1440x900 screen,
+    // clipping anything wider, under an infobar. Listed so a container still
+    // running it is rewritten rather than left as it is.
+    command: "sh",
+    args: [
+      "-lc",
+      `cd /workspace; ` +
+        `if command -v Xvfb >/dev/null 2>&1; then ` +
+        `[ -e ${X_LOCK} ] || (nohup ${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &); ` +
+        `sleep 1; export DISPLAY=${SERVER_DISPLAY}; ` +
+        `exec npx -y ${MCP_PKG} --browser ${BROWSER} --no-sandbox; ` +
+        `else ` +
+        `exec npx -y ${MCP_PKG} --browser ${BROWSER} --no-sandbox --headless; ` +
+        `fi`,
+    ],
+  },
   SERVER_DEF,
 ];
 

package/lib/tunnel-registry.ts

@@ -0,0 +1,104 @@
+/**
+ * Tunnel upstreams, plus the frames that arrive before an upstream exists.
+ *
+ * `tunnel.open` is handled ASYNCHRONOUSLY on the host: resolving a target can
+ * await the task lifecycle lock and, for an ad-hoc preview, `docker run` of a
+ * sidecar (ADR-043). The frames that follow it — `tunnel.data`,
+ * `tunnel.requestEnd`, `tunnel.close` — are handled synchronously off the same
+ * WebSocket, and the cloud emits `requestEnd` for a bodyless GET on the tick
+ * after `open`. So they routinely land while the open is still resolving.
+ *
+ * Looking the tunnel up with `tunnels.get(id)?.` silently dropped them, and a
+ * dropped `requestEnd` is unrecoverable rather than merely late. The HTTP open
+ * deliberately leaves its `ClientRequest` unended so request bodies can stream,
+ * and node writes no header until `write`/`end` — so the upstream socket
+ * CONNECTS and then receives nothing at all. On the wire that reads as an
+ * established TCP connection carrying zero bytes, an upstream that never saw a
+ * request, and a flat 30s `504 host did not respond in time` from the cloud's
+ * ack deadline: four symptoms that each point somewhere different, none of them
+ * at the open that never finished.
+ *
+ * So ops for an opening tunnel are QUEUED and replayed on `register`. The
+ * queue is bounded by the request itself — the cloud stops sending once its
+ * ack deadline fires — and is dropped by `abandon` when an open fails, so a
+ * tunnel that never opens leaves nothing behind.
+ */
+
+export interface TunnelUpstream {
+  write(chunk: Buffer): boolean;
+  end(): void;
+  destroy(): void;
+}
+
+type TunnelOp = (upstream: TunnelUpstream) => void;
+
+export class TunnelRegistry {
+  private readonly open = new Map<string, TunnelUpstream>();
+  /** tunnelId -> ops that arrived while its `tunnel.open` was still resolving. */
+  private readonly opening = new Map<string, TunnelOp[]>();
+
+  /**
+   * Mark a tunnel as opening. MUST be called synchronously when `tunnel.open`
+   * is received — before the first `await` of target resolution — or the frames
+   * that follow have nothing to queue against and are dropped, which is the
+   * whole bug this class exists for.
+   */
+  markOpening(tunnelId: string): void {
+    this.opening.set(tunnelId, []);
+  }
+
+  /** Target resolved: publish the upstream and replay what arrived meanwhile. */
+  register(tunnelId: string, upstream: TunnelUpstream): void {
+    this.open.set(tunnelId, upstream);
+    const queued = this.opening.get(tunnelId);
+    this.opening.delete(tunnelId);
+    if (!queued) return;
+    for (const op of queued) op(upstream);
+  }
+
+  /** Open failed (no target, or it errored) — nothing will ever service these. */
+  abandon(tunnelId: string): void {
+    this.opening.delete(tunnelId);
+  }
+
+  get(tunnelId: string): TunnelUpstream | undefined {
+    return this.open.get(tunnelId);
+  }
+
+  delete(tunnelId: string): void {
+    this.open.delete(tunnelId);
+  }
+
+  /**
+   * Run `op` against the upstream now, or queue it if the tunnel is still
+   * opening. A tunnel this registry has never heard of is dropped, exactly as
+   * the old `?.` did — that is a frame for a tunnel already torn down, not a
+   * race.
+   */
+  apply(tunnelId: string, op: TunnelOp): void {
+    const upstream = this.open.get(tunnelId);
+    if (upstream) {
+      op(upstream);
+      return;
+    }
+    this.opening.get(tunnelId)?.push(op);
+  }
+
+  /**
+   * Tear the tunnel down now, or as soon as it opens. Queued ops are discarded
+   * rather than replayed first: they exist to be written to an upstream that is
+   * about to be destroyed, and a `write` after `destroy` is at best wasted and
+   * at worst an unhandled error on a socket nobody is listening to any more.
+   */
+  abort(tunnelId: string): void {
+    const upstream = this.open.get(tunnelId);
+    this.open.delete(tunnelId);
+    if (upstream) {
+      upstream.destroy();
+      return;
+    }
+    if (this.opening.has(tunnelId)) {
+      this.opening.set(tunnelId, [(u) => u.destroy()]);
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.43",
+  "version": "0.8.45",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/src/main.ts

@@ -59,6 +59,7 @@ import {
   ensurePreviewSidecar,
   invalidatePreviewSidecar,
 } from "../lib/preview-sidecar";
+import { TunnelRegistry } from "../lib/tunnel-registry";
 import { newId } from "../lib/ulid";
 import {
   capabilities as agentKindCapabilities,
@@ -126,13 +127,7 @@ let reconnectAttempt = 0;
 let inFlight = 0;
 let shutdownRequested = false;
 let pendingBinaryTunnelId: string | null = null;
-const tunnels = new Map<string, TunnelUpstream>();
-
-interface TunnelUpstream {
-  write(chunk: Buffer): boolean;
-  end(): void;
-  destroy(): void;
-}
+const tunnels = new TunnelRegistry();
 
 interface PausableSource {
   pause(): unknown;
@@ -301,7 +296,8 @@ function connect(): void {
       const tunnelId = pendingBinaryTunnelId;
       pendingBinaryTunnelId = null;
       if (!tunnelId) return;
-      tunnels.get(tunnelId)?.write(rawDataToBuffer(data));
+      const chunk = rawDataToBuffer(data);
+      tunnels.apply(tunnelId, (upstream) => upstream.write(chunk));
       return;
     }
 
@@ -315,6 +311,10 @@ function connect(): void {
         void handleCommand(socket, frame);
         break;
       case "tunnel.open":
+        // Synchronously, BEFORE handleTunnelOpen's first await: the frames that
+        // follow this one (a bodyless GET's `requestEnd` arrives on the next
+        // tick) need somewhere to queue while the target resolves.
+        tunnels.markOpening(frame.tunnelId);
         void handleTunnelOpen(socket, frame);
         break;
       case "tunnel.data":
@@ -322,7 +322,10 @@ function connect(): void {
         break;
       case "tunnel.requestEnd":
         // Request body complete → finish the upstream request so it can reply.
-        tunnels.get(frame.tunnelId)?.end();
+        // Queued if the open is still resolving: node flushes no request header
+        // until `end`, so losing this strands the upstream on a connected
+        // socket that never receives a byte.
+        tunnels.apply(frame.tunnelId, (upstream) => upstream.end());
         break;
       case "tunnel.close":
         closeTunnel(socket, frame.tunnelId, frame.reason);
@@ -497,6 +500,8 @@ async function handleTunnelOpen(
 ): Promise<void> {
   const target = await resolveTunnelTarget(frame);
   if (!target) {
+    // Nothing will ever service what queued behind this open.
+    tunnels.abandon(frame.tunnelId);
     send(wsSocket, {
       kind: "tunnel.ack",
       tunnelId: frame.tunnelId,
@@ -555,7 +560,9 @@ function handleHttpTunnelOpen(
     },
   );
 
-  tunnels.set(frame.tunnelId, upstream);
+  // Registering replays anything that arrived while the target resolved — for a
+  // bodyless GET that is the `requestEnd` this request cannot reply without.
+  tunnels.register(frame.tunnelId, upstream);
 
   upstream.on("error", (err) => {
     tunnels.delete(frame.tunnelId);
@@ -595,7 +602,6 @@ function handleRawTunnelOpen(
   target: UpstreamAddr,
 ): void {
   const upstream = new Socket();
-  tunnels.set(frame.tunnelId, upstream);
 
   let acked = false;
   let responseBuffer = Buffer.alloc(0);
@@ -660,6 +666,11 @@ function handleRawTunnelOpen(
   });
 
   upstream.connect(target.port, target.host);
+  // AFTER `connect`, not before: replaying a queued write onto a socket that
+  // has not started connecting errors, while node buffers writes made once it
+  // is connecting. An upgrade's own request goes out from the `connect`
+  // handler, so only client frames that overtook the open replay here.
+  tunnels.register(frame.tunnelId, upstream);
 }
 
 function closeTunnel(
@@ -667,9 +678,9 @@ function closeTunnel(
   tunnelId: string,
   reason: string | undefined,
 ): void {
-  const upstream = tunnels.get(tunnelId);
-  tunnels.delete(tunnelId);
-  upstream?.destroy();
+  // `abort`, not get+delete: a client that gives up while the target is still
+  // resolving would otherwise leave the tunnel to open onto nobody.
+  tunnels.abort(tunnelId);
   send(wsSocket, { kind: "tunnel.close", tunnelId, reason });
 }