@runuai/host 0.9.13 → 0.9.42

package/lib/managed-update-scheduler.ts

@@ -0,0 +1,125 @@
+export const MANAGED_UPDATE_INITIAL_DELAY_MS = 2 * 60_000;
+export const MANAGED_UPDATE_DAILY_DELAY_MS = 24 * 60 * 60_000;
+export const MANAGED_UPDATE_BUSY_RETRY_MS = 10 * 60_000;
+export const MANAGED_UPDATE_FAILURE_RETRY_MS = 15 * 60_000;
+export const MANAGED_UPDATE_MAX_FAILURE_RETRY_MS = 6 * 60 * 60_000;
+export const MANAGED_UPDATE_JITTER_FRACTION = 0.2;
+
+export type ManagedScheduledCheckResult =
+  | "current"
+  | "updated"
+  | "busy"
+  | "not-managed";
+
+export interface ManagedUpdateSchedulerOptions {
+  readonly isIdle: () => boolean;
+  readonly check: () => Promise<ManagedScheduledCheckResult>;
+  readonly onUpdated: () => void;
+  readonly onError?: (error: unknown) => void;
+  readonly random?: () => number;
+  readonly setTimer?: (callback: () => void, delayMs: number) => NodeJS.Timeout;
+  readonly clearTimer?: (timer: NodeJS.Timeout) => void;
+}
+
+/**
+ * Availability-first automatic update loop. It never blocks boot, never even
+ * fetches while a task is active, rechecks idle at activation through the
+ * caller's `check`, and jitters every fleet-wide edge.
+ */
+export class ManagedUpdateScheduler {
+  private timer: NodeJS.Timeout | null = null;
+  private running = false;
+  private stopped = false;
+  private pendingRestart = false;
+  private failureCount = 0;
+  private readonly random: () => number;
+  private readonly setTimer: NonNullable<ManagedUpdateSchedulerOptions["setTimer"]>;
+  private readonly clearTimer: NonNullable<ManagedUpdateSchedulerOptions["clearTimer"]>;
+
+  constructor(private readonly options: ManagedUpdateSchedulerOptions) {
+    this.random = options.random ?? Math.random;
+    this.setTimer = options.setTimer ?? ((callback, delayMs) => setTimeout(callback, delayMs));
+    this.clearTimer = options.clearTimer ?? clearTimeout;
+  }
+
+  start(): void {
+    if (this.stopped || this.timer || this.running) return;
+    this.schedule(MANAGED_UPDATE_INITIAL_DELAY_MS);
+  }
+
+  stop(): void {
+    this.stopped = true;
+    if (this.timer) this.clearTimer(this.timer);
+    this.timer = null;
+  }
+
+  private schedule(baseDelayMs: number): void {
+    if (this.stopped) return;
+    const delay = jitterDelay(baseDelayMs, this.random());
+    this.timer = this.setTimer(() => {
+      this.timer = null;
+      void this.run();
+    }, delay);
+    this.timer.unref?.();
+  }
+
+  private async run(): Promise<void> {
+    if (this.stopped || this.running) return;
+    this.running = true;
+    try {
+      if (!this.options.isIdle()) {
+        this.schedule(MANAGED_UPDATE_BUSY_RETRY_MS);
+        return;
+      }
+      if (this.pendingRestart) {
+        this.stop();
+        this.options.onUpdated();
+        return;
+      }
+      const result = await this.options.check();
+      if (this.stopped) return;
+      if (result === "updated") {
+        this.pendingRestart = true;
+        // Work may have appeared while the network/extraction pass awaited.
+        // This second synchronous check is immediately adjacent to the
+        // synchronous shutdown request, leaving no event-loop race between.
+        if (this.options.isIdle()) {
+          this.stop();
+          this.options.onUpdated();
+        } else {
+          this.schedule(MANAGED_UPDATE_BUSY_RETRY_MS);
+        }
+        return;
+      }
+      if (result === "not-managed") {
+        this.stop();
+        return;
+      }
+      this.failureCount = 0;
+      this.schedule(
+        result === "busy"
+          ? MANAGED_UPDATE_BUSY_RETRY_MS
+          : MANAGED_UPDATE_DAILY_DELAY_MS,
+      );
+    } catch (error) {
+      this.options.onError?.(error);
+      const backoff = Math.min(
+        MANAGED_UPDATE_FAILURE_RETRY_MS * 2 ** this.failureCount,
+        MANAGED_UPDATE_MAX_FAILURE_RETRY_MS,
+      );
+      this.failureCount += 1;
+      this.schedule(backoff);
+    } finally {
+      this.running = false;
+    }
+  }
+}
+
+export function jitterDelay(baseDelayMs: number, random: number): number {
+  if (!Number.isFinite(random) || random < 0 || random > 1) {
+    throw new Error("managed update jitter source must be between 0 and 1");
+  }
+  const factor = 1 - MANAGED_UPDATE_JITTER_FRACTION +
+    2 * MANAGED_UPDATE_JITTER_FRACTION * random;
+  return Math.round(baseDelayMs * factor);
+}

package/lib/mcp-gateway.ts

@@ -3,7 +3,8 @@
  * connections in front of task containers WITHOUT the credentials ever
  * entering them.
  *
- * Containers call `http://host.docker.internal:<port>/t/<token>/<slug>`; the
+ * Containers call `http://<gateway-host>:<port>/t/<token>/<slug>` (Docker:
+ * host.docker.internal; Apple: the vmnet gateway IP); the
  * gateway resolves the per-task token to an ACL file written at session
  * ensure (which connections this task may use), attaches the connection's
  * Authorization header host-side (refreshing OAuth tokens as needed), and
@@ -16,19 +17,117 @@
  * per-task token stays the auth).
  */
 
-import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+import {
+  appendFileSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import {
+  createServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { Readable, pipeline } from "node:stream";
 import { resolve } from "node:path";
 
 import { env } from "./env";
-import { dockerCli } from "./docker-exec";
+import {
+  appleContainerRuntimeBinding,
+  pinnedContainerRuntimeProvider,
+} from "./container-runtime";
+import {
+  taskAppContainerName,
+  taskContainerBackend,
+  taskContainerCli,
+} from "./task-container-cli";
 import { MCP_CONFIG_LOCK_PATH } from "./mcp-config-lock";
+import {
+  RUNTIME_AUTHORITY_ENV,
+  runtimeAuthorityDockerExecArgs,
+} from "./runtime-authority";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
 import { authHeaderFor, getConnection } from "./mcp-connections";
+import { agentClisReady } from "./standard-image";
+import { isSafeHostTaskId, assertSafeHostTaskId } from "./task-identity";
+import type { McpGatewayCapability } from "../src/protocol";
 
-export const MCP_GATEWAY_PORT = Number(process.env.UAI_MCP_GATEWAY_PORT ?? 5877);
-const BIND = process.env.UAI_MCP_GATEWAY_BIND ?? "127.0.0.1";
+export type { McpGatewayCapability } from "../src/protocol";
+
+const DEFAULT_MCP_GATEWAY_PORT = 5877;
+
+function gatewayPort(value: string | undefined): number {
+  if (value === undefined || !/^\d+$/.test(value)) {
+    return DEFAULT_MCP_GATEWAY_PORT;
+  }
+  const port = Number(value);
+  return Number.isSafeInteger(port) && port >= 1 && port <= 65_535
+    ? port
+    : DEFAULT_MCP_GATEWAY_PORT;
+}
+
+export const MCP_GATEWAY_PORT = gatewayPort(
+  process.env.UAI_MCP_GATEWAY_PORT,
+);
+/** Loopback for Docker (Desktop/OrbStack forward host.docker.internal to it).
+ * Apple vmnet guests cannot reach host loopback at all, so the apple backend
+ * defaults to all interfaces — the unguessable per-task path token remains
+ * the auth (same posture the operator override has always allowed). Resolved
+ * per call: the runtime pin lands before the production listener starts, and
+ * a pin never changes within a process. */
+function gatewayBindAddress(): string {
+  const configured = process.env.UAI_MCP_GATEWAY_BIND;
+  if (configured) return configured;
+  // The pin, not the ready-gated identity: the production listener starts
+  // during boot while activation still reports `checking`, and a loopback
+  // bind chosen then would strand every vmnet guest.
+  return pinnedContainerRuntimeProvider() === "apple-container"
+    ? "0.0.0.0"
+    : "127.0.0.1";
+}
+
+/** Host address a task container dials to reach this gateway. Docker guests
+ * resolve host.docker.internal; Apple vmnet guests dial the vmnet gateway IP,
+ * read once per process from the bundled CLI's network inspection (the
+ * builtin `default` network the app containers join). A resolution failure
+ * throws so the config write fails visibly and is retried on the next session
+ * ensure, rather than baking a dead URL into the task. */
+let cachedAppleGatewayHost: string | null = null;
+async function taskGatewayHost(): Promise<string> {
+  if (pinnedContainerRuntimeProvider() !== "apple-container") {
+    return "host.docker.internal";
+  }
+  if (cachedAppleGatewayHost !== null) return cachedAppleGatewayHost;
+  const binding = appleContainerRuntimeBinding();
+  if (binding === null) {
+    throw new Error("apple-container selected without a bundled CLI binding");
+  }
+  const { execFile } = await import("node:child_process");
+  const stdout = await new Promise<string>((resolveExec, rejectExec) => {
+    execFile(
+      binding.containerCliPath,
+      ["network", "inspect", "default"],
+      { timeout: 15_000, maxBuffer: 256 * 1024 },
+      (error, out) => (error ? rejectExec(error) : resolveExec(out)),
+    );
+  });
+  const parsed = JSON.parse(stdout) as Array<{
+    status?: { ipv4Gateway?: unknown };
+  }>;
+  const gateway = parsed[0]?.status?.ipv4Gateway;
+  if (
+    typeof gateway !== "string" ||
+    !/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(gateway)
+  ) {
+    throw new Error("could not resolve the vmnet gateway address");
+  }
+  cachedAppleGatewayHost = gateway;
+  return gateway;
+}
 /** MCP request bodies are small JSON-RPC frames; cap so audit parsing (and a
  *  hostile container) can't balloon host memory. Responses stream freely. */
 const MAX_BODY_BYTES = 4 * 1024 * 1024;
@@ -37,6 +136,10 @@ const MAX_BODY_BYTES = 4 * 1024 * 1024;
  *  streams open indefinitely, and an abort mid-pipe once took the whole host
  *  process down as an unhandled Readable 'error' (2026-07-13). */
 const UPSTREAM_CONNECT_TIMEOUT_MS = 60_000;
+const GATEWAY_RETRY_INITIAL_DELAY_MS = 1_000;
+const GATEWAY_RETRY_MAX_DELAY_MS = 15_000;
+const GATEWAY_RETRY_MIN_JITTER = 0.8;
+const GATEWAY_RETRY_JITTER_SPAN = 0.4;
 
 export interface TaskMcpConnection {
   id: string;
@@ -84,6 +187,11 @@ export function ensureTaskGatewayAcl(
 }
 
 export function clearTaskGatewayAcl(taskId: string): void {
+  // Defense in depth: the id becomes a filesystem path component, and some
+  // callers derive it from container-influenced data (labels). A traversal
+  // like `../container-runtime-provider` must never resolve outside the ACL
+  // directory, so an unsafe id is a no-op here rather than a deletion.
+  if (!isSafeHostTaskId(taskId)) return;
   try {
     rmSync(aclPath(taskId));
   } catch {
@@ -91,6 +199,20 @@ export function clearTaskGatewayAcl(taskId: string): void {
   }
 }
 
+/** Strict variant used only when acknowledging orphan-GC completion. */
+export function clearTaskGatewayAclStrict(taskId: string): void {
+  assertSafeHostTaskId(taskId);
+  const path = aclPath(taskId);
+  rmSync(path, { force: true });
+  try {
+    lstatSync(path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+  throw new Error("task gateway ACL remains after removal");
+}
+
 function audit(entry: Record<string, unknown>): void {
   try {
     const dir = resolve(env.dataDir, "logs");
@@ -256,17 +378,291 @@ async function handle(req: IncomingMessage, res: ServerResponse): Promise<void>
   }
 }
 
-/** Start the gateway listener. Idempotent-ish: call once from main. */
-export function startMcpGateway(): void {
-  const server = createServer((req, res) => {
-    void handle(req, res).catch(() => deny(res, 500, "gateway error"));
-  });
-  server.on("error", (err) => {
-    console.warn(`[mcp-gateway] listener error: ${err.message}`);
-  });
-  server.listen(MCP_GATEWAY_PORT, BIND, () => {
-    console.log(`[mcp-gateway] listening on ${BIND}:${MCP_GATEWAY_PORT}`);
+export interface McpGatewayController {
+  /** Current bounded capability snapshot. Never contains a raw listener error. */
+  state(): McpGatewayCapability;
+  /** Subscribe to semantic state changes. The current snapshot is read via state(). */
+  subscribe(
+    listener: (state: McpGatewayCapability) => void,
+  ): () => void;
+  /** Permanently stop this controller and release its listener/timer. */
+  stop(): Promise<void>;
+}
+
+export interface McpGatewayListener extends McpGatewayController {
+  /** Start once; repeated calls before stop are idempotent. */
+  start(): McpGatewayController;
+}
+
+export interface McpGatewayListenerOptions {
+  port?: number;
+  bind?: string;
+  retryInitialDelayMs?: number;
+  retryMaxDelayMs?: number;
+  serverFactory?: (
+    requestListener: (req: IncomingMessage, res: ServerResponse) => void,
+  ) => Server;
+  setRetryTimeout?: (
+    callback: () => void,
+    delayMs: number,
+  ) => NodeJS.Timeout;
+  clearRetryTimeout?: (timer: NodeJS.Timeout) => void;
+  random?: () => number;
+  logger?: Pick<Console, "log" | "warn">;
+}
+
+function listenerFailureReason(
+  error: unknown,
+): "port_in_use" | "bind_failed" {
+  return (error as NodeJS.ErrnoException | null)?.code === "EADDRINUSE"
+    ? "port_in_use"
+    : "bind_failed";
+}
+
+function positiveInteger(value: number | undefined, fallback: number): number {
+  return typeof value === "number" && Number.isFinite(value) && value >= 1
+    ? Math.floor(value)
+    : fallback;
+}
+
+function sameGatewayState(
+  left: McpGatewayCapability,
+  right: McpGatewayCapability,
+): boolean {
+  return (
+    left.status === right.status &&
+    left.port === right.port &&
+    (left.status !== "down" ||
+      (right.status === "down" && left.reason === right.reason))
+  );
+}
+
+/**
+ * Construct one restart-safe MCP gateway listener. Exported so listener
+ * lifecycle tests can use deterministic fake servers without opening a real
+ * host port; production uses the singleton wrapper below.
+ */
+export function createMcpGatewayListener(
+  options: McpGatewayListenerOptions = {},
+): McpGatewayListener {
+  const port =
+    Number.isSafeInteger(options.port) &&
+    (options.port ?? 0) >= 1 &&
+    (options.port ?? 0) <= 65_535
+      ? (options.port as number)
+      : MCP_GATEWAY_PORT;
+  const bind = options.bind ?? gatewayBindAddress();
+  const retryInitialDelayMs = positiveInteger(
+    options.retryInitialDelayMs,
+    GATEWAY_RETRY_INITIAL_DELAY_MS,
+  );
+  const retryMaxDelayMs = Math.max(
+    retryInitialDelayMs,
+    positiveInteger(
+      options.retryMaxDelayMs,
+      GATEWAY_RETRY_MAX_DELAY_MS,
+    ),
+  );
+  const serverFactory = options.serverFactory ?? createServer;
+  const setRetryTimeout =
+    options.setRetryTimeout ??
+    ((callback: () => void, delayMs: number) =>
+      setTimeout(callback, delayMs));
+  const clearRetryTimeout = options.clearRetryTimeout ?? clearTimeout;
+  const random = options.random ?? Math.random;
+  const logger = options.logger ?? console;
+  const subscribers = new Set<
+    (state: McpGatewayCapability) => void
+  >();
+
+  let capability: McpGatewayCapability = Object.freeze({
+    status: "starting",
+    port,
   });
+  let server: Server | null = null;
+  let retryTimer: NodeJS.Timeout | null = null;
+  let consecutiveFailures = 0;
+  let started = false;
+  let stopped = false;
+  let stopPromise: Promise<void> | null = null;
+
+  const setState = (next: McpGatewayCapability): void => {
+    const frozen = Object.freeze(next);
+    if (sameGatewayState(capability, frozen)) return;
+    capability = frozen;
+    for (const subscriber of subscribers) {
+      try {
+        subscriber(capability);
+      } catch {
+        // Capability observers must never take down the host listener.
+      }
+    }
+  };
+
+  const closeServer = (target: Server): void => {
+    try {
+      target.close(() => undefined);
+      target.closeAllConnections?.();
+    } catch {
+      // A listener that failed before binding has nothing left to close.
+    }
+  };
+
+  const retryDelay = (): number => {
+    const exponent = Math.min(Math.max(consecutiveFailures - 1, 0), 30);
+    const baseDelayMs = Math.min(
+      retryMaxDelayMs,
+      retryInitialDelayMs * 2 ** exponent,
+    );
+    const sample = random();
+    const boundedSample = Number.isFinite(sample)
+      ? Math.min(1, Math.max(0, sample))
+      : 0.5;
+    return Math.min(
+      retryMaxDelayMs,
+      Math.max(
+        1,
+        Math.round(
+          baseDelayMs *
+            (GATEWAY_RETRY_MIN_JITTER +
+              GATEWAY_RETRY_JITTER_SPAN * boundedSample),
+        ),
+      ),
+    );
+  };
+
+  let beginAttempt: () => void;
+
+  const scheduleRetry = (
+    reason: "port_in_use" | "bind_failed",
+  ): void => {
+    if (stopped || retryTimer !== null) return;
+    consecutiveFailures += 1;
+    setState({ status: "down", port, reason });
+    const delayMs = retryDelay();
+    logger.warn(
+      `[mcp-gateway] listener down (${reason}); retrying in ${delayMs}ms`,
+    );
+    retryTimer = setRetryTimeout(() => {
+      retryTimer = null;
+      beginAttempt();
+    }, delayMs);
+    retryTimer.unref();
+  };
+
+  const listenerFailed = (target: Server, error: unknown): void => {
+    if (stopped || server !== target) return;
+    server = null;
+    closeServer(target);
+    scheduleRetry(listenerFailureReason(error));
+  };
+
+  beginAttempt = (): void => {
+    if (stopped || server !== null || retryTimer !== null) return;
+
+    let nextServer: Server;
+    try {
+      nextServer = serverFactory((req, res) => {
+        void handle(req, res).catch(() => deny(res, 500, "gateway error"));
+      });
+    } catch {
+      scheduleRetry("bind_failed");
+      return;
+    }
+    server = nextServer;
+
+    nextServer.on("error", (error) => {
+      listenerFailed(nextServer, error);
+    });
+    nextServer.on("listening", () => {
+      if (stopped || server !== nextServer) {
+        closeServer(nextServer);
+        return;
+      }
+      consecutiveFailures = 0;
+      setState({ status: "ready", port });
+      logger.log(`[mcp-gateway] listening on ${bind}:${port}`);
+    });
+    nextServer.on("close", () => {
+      if (stopped || server !== nextServer) return;
+      server = null;
+      scheduleRetry("bind_failed");
+    });
+
+    try {
+      nextServer.listen(port, bind);
+    } catch (error) {
+      listenerFailed(nextServer, error);
+    }
+  };
+
+  const controller: McpGatewayListener = {
+    state: () => capability,
+    subscribe: (listener) => {
+      subscribers.add(listener);
+      return () => subscribers.delete(listener);
+    },
+    start: () => {
+      if (stopped) {
+        throw new Error("MCP gateway listener cannot restart after stop");
+      }
+      if (!started) {
+        started = true;
+        beginAttempt();
+      }
+      return controller;
+    },
+    stop: () => {
+      if (stopPromise) return stopPromise;
+      stopped = true;
+      if (retryTimer !== null) {
+        clearRetryTimeout(retryTimer);
+        retryTimer = null;
+      }
+      const activeServer = server;
+      server = null;
+      stopPromise = new Promise<void>((resolveStop) => {
+        if (activeServer === null) {
+          resolveStop();
+          return;
+        }
+        let resolved = false;
+        const finish = (): void => {
+          if (resolved) return;
+          resolved = true;
+          resolveStop();
+        };
+        activeServer.once("close", finish);
+        try {
+          activeServer.close(finish);
+          activeServer.closeAllConnections?.();
+          if (!activeServer.listening) queueMicrotask(finish);
+        } catch {
+          finish();
+        }
+      }).finally(() => {
+        subscribers.clear();
+      });
+      return stopPromise;
+    },
+  };
+  return controller;
+}
+
+let gatewayController: McpGatewayListener | null = null;
+
+/** Start (or return) the process-wide gateway listener. */
+export function startMcpGateway(): McpGatewayController {
+  gatewayController ??= createMcpGatewayListener();
+  return gatewayController.start();
+}
+
+/** Stop and reset the process-wide listener (also the deterministic test seam). */
+export async function stopMcpGateway(): Promise<void> {
+  const active = gatewayController;
+  if (active === null) return;
+  await active.stop();
+  if (gatewayController === active) gatewayController = null;
 }
 
 // --- task container wiring (ADR-057 task-up writers) -------------------------
@@ -663,11 +1059,16 @@ export async function setupMcpTaskConfig(
   connections: TaskMcpConnection[],
   engineKinds: string[],
   codexHomes: readonly string[] = ["/home/node/.codex"],
+  environment?: Pick<TaskEnvironmentHandle, "exec">,
 ): Promise<boolean> {
   // No early return on empty: the claude adapter passes
   // `--mcp-config /workspace/.mcp.json` unconditionally (ADR-057), so the
   // file must exist — an empty mcpServers map — even with no connections.
   try {
+    // Boot-time standard-image maintenance can briefly replace the shared CLI
+    // shims used by these in-container writers. The ACL is itself observable
+    // state, so hold the same barrier before it or any Docker side effect.
+    await agentClisReady;
     const has = (kind: string): boolean => engineKinds.includes(kind);
     if (
       has("codex") &&
@@ -679,8 +1080,9 @@ export async function setupMcpTaskConfig(
       throw new Error("invalid Codex MCP connection slug");
     }
     const acl = ensureTaskGatewayAcl(taskId, connections);
+    const gatewayHost = await taskGatewayHost();
     const urlFor = (slug: string): string =>
-      `http://host.docker.internal:${MCP_GATEWAY_PORT}/t/${acl.token}/${slug}`;
+      `http://${gatewayHost}:${MCP_GATEWAY_PORT}/t/${acl.token}/${slug}`;
 
     const claudeEntries: Record<string, unknown> = {};
     const codexEntries: Record<string, string> = {};
@@ -755,13 +1157,38 @@ export async function setupMcpTaskConfig(
     const steps =
       `timeout --kill-after=${MCP_CONFIG_WRITE_KILL_AFTER_S} ` +
       `${MCP_CONFIG_WRITE_TIMEOUT_S} sh -lc ${shellQuote(writes)}`;
-    const result = await dockerCli(
-      ["exec", containerName, "sh", "-lc", steps],
-      { timeoutMs: MCP_CONFIG_HOST_TIMEOUT_MS },
-    );
-    if (result.status !== 0) {
+    const result = environment
+      ? await environment.exec({
+          argv: ["sh", "-lc", steps],
+          env: RUNTIME_AUTHORITY_ENV,
+          timeoutMs: MCP_CONFIG_HOST_TIMEOUT_MS,
+          maxOutputBytes: 256 * 1024,
+        })
+      : await taskContainerCli(
+          [
+            "exec",
+            ...runtimeAuthorityDockerExecArgs(),
+            // Backend-aware fallback: the passed name is the Docker replica
+            // shape and `docker` does not exist on an apple host (live
+            // 2026-08-18: spawn docker ENOENT killed every no-handle config
+            // write, so sessions never saw their MCP tools).
+            taskContainerBackend().apple
+              ? taskAppContainerName(taskId)
+              : containerName,
+            "sh",
+            "-lc",
+            steps,
+          ],
+          { timeoutMs: MCP_CONFIG_HOST_TIMEOUT_MS },
+        );
+    const status = "exitCode" in result ? result.exitCode : result.status;
+    const stderr =
+      "stderr" in result && result.stderr instanceof Uint8Array
+        ? Buffer.from(result.stderr).toString("utf8")
+        : result.stderr;
+    if (status !== 0) {
       console.warn(
-        `[mcp-gateway] task ${taskId}: config write failed: ${result.stderr.slice(0, 300)}`,
+        `[mcp-gateway] task ${taskId}: config write failed: ${stderr.slice(0, 300)}`,
       );
       return false;
     }