@runuai/host 0.9.13 → 0.9.42

package/lib/db.ts

@@ -65,4 +65,5 @@ export function getDb(): ReturnType<typeof drizzle> {
 }
 
 export type Db = ReturnType<typeof getDb>;
+export type { HostTask } from "../db/schema";
 export { schema };

package/lib/docker-exec.ts

@@ -23,34 +23,84 @@ export interface DockerResult {
   status: number | null;
   stdout: string;
   stderr: string;
+  /** True when tailOutputBytes discarded earlier diagnostic output. */
+  outputTruncated?: boolean;
 }
 
 export function dockerCli(
   args: string[],
-  opts: { input?: string; timeoutMs?: number } = {},
+  opts: {
+    input?: string;
+    timeoutMs?: number;
+    /** Optional aggregate stdout+stderr cap for cardinality-sensitive probes.
+     * Exceeding it kills the child and resolves with status:null. */
+    maxOutputBytes?: number;
+    /** Keep draining the child but retain only this many trailing bytes from
+     * each output stream. Use for legitimately verbose bounded operations
+     * whose complete compiler/install log must not accumulate in host RAM. */
+    tailOutputBytes?: number;
+    /** Selection probes can intentionally ignore this process's pinned host. */
+    env?: NodeJS.ProcessEnv;
+  } = {},
 ): Promise<DockerResult> {
   return new Promise<DockerResult>((resolve) => {
     let stdout = "";
     let stderr = "";
+    let stdoutTruncated = false;
+    let stderrTruncated = false;
     let settled = false;
-    const child = spawn("docker", args, { stdio: ["pipe", "pipe", "pipe"] });
+    const child = spawn("docker", args, {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: opts.env,
+    });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
+      // A SIGKILLed client normally closes at once, but an unreapable child
+      // (D-state, wedged pipe) must not hold this promise open forever: the
+      // caller's own deadline already expired, so settle as failed after a
+      // short grace even if `close` never fires.
+      const settle = setTimeout(() => {
+        stderr += `docker did not settle after its ${opts.timeoutMs ?? DEFAULT_TIMEOUT_MS}ms deadline`;
+        finish(null);
+      }, 5_000);
+      settle.unref?.();
     }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
     timer.unref?.();
     const finish = (status: number | null) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve({ status, stdout, stderr });
+      resolve({
+        status,
+        stdout,
+        stderr,
+        outputTruncated: stdoutTruncated || stderrTruncated || undefined,
+      });
     };
     child.stdout?.setEncoding("utf8");
     child.stderr?.setEncoding("utf8");
     child.stdout?.on("data", (c: string) => {
-      stdout += c;
+      if (settled) return;
+      if (outputWouldExceedLimit(stdout, stderr, c, opts.maxOutputBytes)) {
+        stderr += "docker output exceeded configured limit";
+        child.kill("SIGKILL");
+        finish(null);
+        return;
+      }
+      const tailed = appendOutputTail(stdout, c, opts.tailOutputBytes);
+      stdout = tailed.output;
+      stdoutTruncated ||= tailed.truncated;
     });
     child.stderr?.on("data", (c: string) => {
-      stderr += c;
+      if (settled) return;
+      if (outputWouldExceedLimit(stdout, stderr, c, opts.maxOutputBytes)) {
+        child.kill("SIGKILL");
+        finish(null);
+        return;
+      }
+      const tailed = appendOutputTail(stderr, c, opts.tailOutputBytes);
+      stderr = tailed.output;
+      stderrTruncated ||= tailed.truncated;
     });
     child.on("error", (err: Error) => {
       stderr += err.message;
@@ -70,3 +120,35 @@ export function dockerCli(
     child.stdin?.end();
   });
 }
+
+function appendOutputTail(
+  current: string,
+  chunk: string,
+  limit: number | undefined,
+): { output: string; truncated: boolean } {
+  if (limit === undefined) return { output: current + chunk, truncated: false };
+  const bounded = Math.max(0, Math.floor(limit));
+  const combined = Buffer.from(current + chunk);
+  if (combined.byteLength <= bounded) {
+    return { output: combined.toString("utf8"), truncated: false };
+  }
+  return {
+    output: combined.subarray(combined.byteLength - bounded).toString("utf8"),
+    truncated: true,
+  };
+}
+
+function outputWouldExceedLimit(
+  stdout: string,
+  stderr: string,
+  chunk: string,
+  limit: number | undefined,
+): boolean {
+  return (
+    limit !== undefined &&
+    Buffer.byteLength(stdout) +
+      Buffer.byteLength(stderr) +
+      Buffer.byteLength(chunk) >
+      limit
+  );
+}

package/lib/engine-accounts.ts

@@ -29,7 +29,12 @@ import { join } from "node:path";
 import { eq } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
-import { dockerCli } from "./docker-exec";
+import {
+  taskContainerBackend,
+  taskContainerCli,
+} from "./task-container-cli";
+import { RUNTIME_AUTHORITY_ENV, runtimeAuthorityDockerExecArgs } from "./runtime-authority";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
 import { openAesGcm, sealAesGcm } from "./secrets";
 import { newId } from "./ulid";
 
@@ -354,9 +359,46 @@ async function copyDirInto(
   hostDir: string,
   containerDir: string,
   container: string,
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "copy">,
 ): Promise<void> {
+  if (environment) {
+    const run = async (argv: [string, ...string[]], step: string) => {
+      const result = await environment.exec({
+        argv,
+        user: "root",
+        env: RUNTIME_AUTHORITY_ENV,
+        timeoutMs: EXEC_TIMEOUT_MS,
+        maxOutputBytes: 64 * 1024,
+      });
+      if (result.exitCode !== 0) {
+        const detail = Buffer.from(result.stderr).toString("utf8").trim().slice(0, 200);
+        throw new Error(
+          `${step} failed (${result.exitCode === null ? "environment timeout" : `exit ${result.exitCode}`})` +
+            (detail ? `: ${detail}` : ""),
+        );
+      }
+    };
+    await run(["/bin/mkdir", "-p", containerDir], `mkdir ${containerDir}`);
+    await environment.copy({
+      direction: "into",
+      source: hostDir,
+      destination: containerDir,
+    });
+    await run(
+      ["/bin/chown", "-R", "node:node", containerDir],
+      `chown -R node:node ${containerDir}`,
+    );
+    return;
+  }
+  // Backend-aware fallback (2026-08-18 sweep + review round 4): the apple
+  // path normally arrives with an environment handle above; when it does
+  // not, the bundled CLI speaks these exec/cp verbs — but the CALLER's name
+  // is the Docker replica shape, which does not exist on apple.
+  const target = taskContainerBackend().apple
+    ? container.replace(/-app-1$/, "-app")
+    : container;
   const must = async (args: string[], step: string): Promise<void> => {
-    const res = await dockerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
+    const res = await taskContainerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
     if (res.status !== 0) {
       const detail = res.stderr.trim().slice(0, 200);
       throw new Error(
@@ -366,13 +408,32 @@ async function copyDirInto(
     }
   };
   await must(
-    ["exec", "-u", "root", container, "mkdir", "-p", containerDir],
+    [
+      "exec",
+      "-u",
+      "root",
+      ...runtimeAuthorityDockerExecArgs(),
+      target,
+      "/bin/mkdir",
+      "-p",
+      containerDir,
+    ],
     `mkdir ${containerDir}`,
   );
   // Copy the dir CONTENTS (trailing /.) into the target dir.
-  await must(["cp", `${hostDir}/.`, `${container}:${containerDir}`], "docker cp account dir");
+  await must(["cp", `${hostDir}/.`, `${target}:${containerDir}`], "docker cp account dir");
   await must(
-    ["exec", "-u", "root", container, "chown", "-R", "node:node", containerDir],
+    [
+      "exec",
+      "-u",
+      "root",
+      ...runtimeAuthorityDockerExecArgs(),
+      target,
+      "/bin/chown",
+      "-R",
+      "node:node",
+      containerDir,
+    ],
     `chown -R node:node ${containerDir}`,
   );
 }
@@ -393,6 +454,7 @@ export async function provisionEngineAccounts(
   container: string,
   kinds: Iterable<string>,
   seams: Partial<AccountSeams> = {},
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "copy">,
 ): Promise<ProvisionEngineAccountsResult> {
   const s = withDefaults(seams);
   const seen = new Set<string>();
@@ -413,6 +475,7 @@ export async function provisionEngineAccounts(
           account.configDir.hostDir,
           account.configDir.containerDir,
           container,
+          environment,
         );
         copied += 1;
       } catch (err) {