@runuai/host 0.9.13 → 0.9.42

package/lib/agents/grok.ts

@@ -1,15 +1,15 @@
 /**
  * GrokSession — a real AgentSession backed by xAI's **Grok** CLI, run inside
- * the task container:
+ * the task environment:
  *
- *   docker exec -i task-<id>-app-1 ~/.grok/bin/grok -p "<prompt>" \
+ *   ~/.grok/bin/grok -p "<prompt>" \
  *     --output-format streaming-json --permission-mode bypassPermissions \
  *     -m grok-4.5 --system-prompt-override "<briefing>" [-r <sessionId>]
  *
  * Like Kimi (and unlike Claude's persistent stdin / Codex's app-server), Grok
  * headless mode is **one-shot per turn**: `-p` runs one prompt to completion,
  * streams newline-delimited JSON, and exits. Each `send()` spawns a fresh
- * `docker exec`; sends are **serialized** so a second message can't race a
+ * provider process; sends are **serialized** so a second message can't race a
  * running turn. Continuity is `-r <sessionId>` — captured from the turn-end
  * event (per-agent isolation, since each session tracks its own id).
  *
@@ -28,11 +28,20 @@
  * it in-container. Cloud never sees it (ADR-015). `--system-prompt-override`
  * carries the channel briefing (no fold-into-turn-1 needed).
  */
-import { spawn, type ChildProcess } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { requireContainerRuntimeOperational } from "../runtime-guard";
+import type {
+  TaskEnvironmentAgentSessionSurface,
+  TaskEnvironmentSessionRequest,
+} from "../task-environment/types";
+import {
+  AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+  spawnEnvironmentProcess,
+  type AgentEnvironmentProcess,
+} from "./proc";
 import { register } from "./registry";
 import type {
   AgentEvent,
@@ -94,15 +103,15 @@ export function mapGrokLine(line: string): MappedGrokLine {
 // Session
 // ---------------------------------------------------------------------------
 
-export type Spawner = (args: string[]) => ChildProcess;
-const defaultSpawn: Spawner = (args) =>
-  spawn("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+export type Spawner = (
+  request: TaskEnvironmentSessionRequest,
+) => AgentEnvironmentProcess;
 
 export class GrokSession implements AgentSession {
   readonly agentId: string;
   readonly kind: AgentKind = "grok";
 
-  private readonly containerName: string;
+  private readonly environment: TaskEnvironmentAgentSessionSurface;
   private readonly model?: string;
   private readonly systemPreamble: string;
   private readonly agentEnv: Record<string, string>;
@@ -110,24 +119,25 @@ export class GrokSession implements AgentSession {
 
   private readonly handlers = new Set<AgentEventHandler>();
   private sessionId: string | null = null;
-  private current: ChildProcess | null = null;
+  private current: AgentEnvironmentProcess | null = null;
   private queue: Promise<void> = Promise.resolve();
   private closed = false;
 
   constructor(args: {
     taskId: string;
     agent: RosterAgent;
-    containerName: string;
+    environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
     spawner?: Spawner;
   }) {
     this.agentId = args.agent.id;
-    this.containerName = args.containerName;
+    this.environment = args.environment;
     this.model = args.agent.model;
     this.systemPreamble = args.systemPreamble;
     this.agentEnv = args.agentEnv ?? {};
-    this.spawner = args.spawner ?? defaultSpawn;
+    this.spawner =
+      args.spawner ?? ((request) => spawnEnvironmentProcess(this.environment, request));
   }
 
   onEvent(handler: AgentEventHandler): () => void {
@@ -142,22 +152,18 @@ export class GrokSession implements AgentSession {
 
   async send(text: string): Promise<void> {
     if (this.closed) return;
-    this.queue = this.queue.then(() => this.runTurn(text));
-    return this.queue;
+    const turn = this.queue.catch(() => {}).then(() => this.runTurn(text));
+    this.queue = turn;
+    return turn;
   }
 
-  private buildArgs(prompt: string): string[] {
-    const args = ["exec", "-i", "-u", "node"];
+  private buildRequest(prompt: string): TaskEnvironmentSessionRequest {
     // Host-resident API key (pasted in the engines panel, ADR-015): forward
     // name-only — docker takes the value from the client env, keeping the
     // secret out of argv. Subscription logins need nothing here (task-up
     // copies ~/.grok into the container instead).
-    if (process.env.XAI_API_KEY) args.push("-e", "XAI_API_KEY");
-    for (const [k, v] of Object.entries(this.agentEnv)) {
-      args.push("-e", `${k}=${v}`);
-    }
-    args.push(
-      this.containerName,
+    const inheritEnv = process.env.XAI_API_KEY ? ["XAI_API_KEY"] : [];
+    const argv = [
       GROK_BIN,
       "-p",
       prompt,
@@ -166,19 +172,26 @@ export class GrokSession implements AgentSession {
       // The container is the isolation boundary — auto-run tools.
       "--permission-mode",
       "bypassPermissions",
-    );
-    if (this.model) args.push("-m", this.model);
+    ];
+    if (this.model) argv.push("-m", this.model);
     if (this.systemPreamble.trim().length > 0) {
-      args.push("--system-prompt-override", this.systemPreamble);
+      argv.push("--system-prompt-override", this.systemPreamble);
     }
     // Resume the same conversation across turns (captured from the last end).
-    if (this.sessionId) args.push("-r", this.sessionId);
-    return args;
+    if (this.sessionId) argv.push("-r", this.sessionId);
+    return {
+      argv: argv as [string, ...string[]],
+      user: "node",
+      inheritEnv,
+      env: this.agentEnv,
+      maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+    };
   }
 
   private async runTurn(text: string): Promise<void> {
     if (this.closed) return;
-    const child = this.spawner(this.buildArgs(text));
+    requireContainerRuntimeOperational();
+    const child = this.spawner(this.buildRequest(text));
     this.current = child;
 
     let acc = "";
@@ -256,6 +269,6 @@ register({
   supportedEfforts: () => [...GROK_EFFORTS],
   available: () =>
     existsSync(grokAuthPath()) || Boolean(process.env.XAI_API_KEY),
-  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
-    new GrokSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+  create: async ({ taskId, agent, environment, systemPreamble, agentEnv }) =>
+    new GrokSession({ taskId, agent, environment, systemPreamble, agentEnv }),
 });

package/lib/agents/kimi.ts

@@ -1,15 +1,15 @@
 /**
  * KimiSession — a real AgentSession backed by Moonshot's **Kimi Code** CLI,
- * run inside the task container:
+ * run inside the task environment:
  *
- *   docker exec -i task-<id>-app-1 ~/.kimi-code/bin/kimi \
+ *   ~/.kimi-code/bin/kimi \
  *     -p "<prompt>" -m kimi-code/k3 --output-format stream-json [-r <sessionId>]
  *
  * Unlike Claude (persistent stdin session) and Codex (`app-server` JSON-RPC),
  * Kimi Code is **one-shot per turn**: `-p` runs a single prompt to completion,
  * streams newline-delimited JSON to stdout, and exits. Multi-turn continuity is
  * `-r <sessionId>` (the session lives in Kimi's cloud + the container's
- * ~/.kimi-code). So each `send()` spawns a fresh `docker exec`; sends are
+ * ~/.kimi-code). So each `send()` spawns a fresh provider process; sends are
  * serialized so a second message can't race a running turn.
  *
  * Stream-json vocabulary (reverse-engineered — OpenAI-chat-style role lines):
@@ -24,12 +24,21 @@
  * `-p` runs non-interactively and auto-runs tools (the container is the
  * isolation boundary), so there are no permission prompts to resolve.
  */
-import { spawn, type ChildProcess } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { requireContainerRuntimeOperational } from "../runtime-guard";
+import type {
+  TaskEnvironmentAgentSessionSurface,
+  TaskEnvironmentSessionRequest,
+} from "../task-environment/types";
 import { newId } from "../ulid";
+import {
+  AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+  spawnEnvironmentProcess,
+  type AgentEnvironmentProcess,
+} from "./proc";
 import { register } from "./registry";
 import type {
   AgentEvent,
@@ -40,7 +49,7 @@ import type {
 } from "./types";
 
 /** Installed by the image's install.sh (code.kimi.com); absolute so a
- *  non-login `docker exec` doesn't depend on PATH. */
+ *  non-login provider process doesn't depend on PATH. */
 const KIMI_BIN = "/home/node/.kimi-code/bin/kimi";
 
 // Model ids from `~/.kimi-code/config.toml` (`kimi -m <id>`). k3 is the
@@ -143,15 +152,15 @@ export function mapKimiLine(line: string): MappedLine {
 // ---------------------------------------------------------------------------
 
 /** Injectable spawn seam (tests provide a fake). */
-export type Spawner = (args: string[]) => ChildProcess;
-const defaultSpawn: Spawner = (args) =>
-  spawn("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+export type Spawner = (
+  request: TaskEnvironmentSessionRequest,
+) => AgentEnvironmentProcess;
 
 export class KimiSession implements AgentSession {
   readonly agentId: string;
   readonly kind: AgentKind = "kimi";
 
-  private readonly containerName: string;
+  private readonly environment: TaskEnvironmentAgentSessionSurface;
   private readonly model?: string;
   private readonly systemPreamble: string;
   private readonly agentEnv: Record<string, string>;
@@ -159,7 +168,7 @@ export class KimiSession implements AgentSession {
 
   private readonly handlers = new Set<AgentEventHandler>();
   private sessionId: string | null = null;
-  private current: ChildProcess | null = null;
+  private current: AgentEnvironmentProcess | null = null;
   private queue: Promise<void> = Promise.resolve();
   private sentPreamble = false;
   private closed = false;
@@ -167,17 +176,18 @@ export class KimiSession implements AgentSession {
   constructor(args: {
     taskId: string;
     agent: RosterAgent;
-    containerName: string;
+    environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
     spawner?: Spawner;
   }) {
     this.agentId = args.agent.id;
-    this.containerName = args.containerName;
+    this.environment = args.environment;
     this.model = args.agent.model;
     this.systemPreamble = args.systemPreamble;
     this.agentEnv = args.agentEnv ?? {};
-    this.spawner = args.spawner ?? defaultSpawn;
+    this.spawner =
+      args.spawner ?? ((request) => spawnEnvironmentProcess(this.environment, request));
   }
 
   onEvent(handler: AgentEventHandler): () => void {
@@ -194,32 +204,37 @@ export class KimiSession implements AgentSession {
    *  running one instead of spawning a racing `kimi -p`. */
   async send(text: string): Promise<void> {
     if (this.closed) return;
-    this.queue = this.queue.then(() => this.runTurn(text));
-    return this.queue;
+    const turn = this.queue.catch(() => {}).then(() => this.runTurn(text));
+    this.queue = turn;
+    return turn;
   }
 
-  private buildArgs(prompt: string): string[] {
-    const args = ["exec", "-i", "-u", "node"];
-    for (const [k, v] of Object.entries(this.agentEnv)) {
-      args.push("-e", `${k}=${v}`);
-    }
-    args.push(
-      this.containerName,
+  private buildRequest(prompt: string): TaskEnvironmentSessionRequest {
+    const argv = [
       KIMI_BIN,
       "-p",
       prompt,
       "--output-format",
       "stream-json",
-    );
-    if (this.model) args.push("-m", this.model);
+    ];
+    if (this.model) argv.push("-m", this.model);
     // Continue the same Kimi session across turns (captured from the first
     // turn's resume_hint). First turn has none → a fresh session.
-    if (this.sessionId) args.push("-r", this.sessionId);
-    return args;
+    if (this.sessionId) argv.push("-r", this.sessionId);
+    return {
+      argv: argv as [string, ...string[]],
+      user: "node",
+      env: this.agentEnv,
+      maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+    };
   }
 
   private async runTurn(text: string): Promise<void> {
     if (this.closed) return;
+    // A turn may have spent minutes queued behind its predecessor. Admission
+    // at send() time is stale; this synchronous check immediately precedes the
+    // provider process launch and leaves the first-turn preamble unconsumed on fail.
+    requireContainerRuntimeOperational();
     // Kimi's `-p` has no system-prompt flag, so fold the channel briefing into
     // the FIRST turn's prompt (later turns carry it via the resumed session).
     const prompt =
@@ -228,7 +243,7 @@ export class KimiSession implements AgentSession {
         : text;
     this.sentPreamble = true;
 
-    const child = this.spawner(this.buildArgs(prompt));
+    const child = this.spawner(this.buildRequest(prompt));
     this.current = child;
 
     let buf = "";
@@ -308,6 +323,6 @@ register({
   // Gated on the operator's Kimi Code subscription credential (copied into
   // containers at task-up). No login → the engine isn't advertised.
   available: () => existsSync(kimiCredPath()),
-  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
-    new KimiSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+  create: async ({ taskId, agent, environment, systemPreamble, agentEnv }) =>
+    new KimiSession({ taskId, agent, environment, systemPreamble, agentEnv }),
 });

package/lib/agents/opencode.ts

@@ -1,8 +1,8 @@
 /**
  * OpencodeSession — a real AgentSession backed by the OpenCode CLI's
- * non-interactive `run` mode, executed inside the task container (ADR-077):
+ * non-interactive `run` mode, executed inside the task environment (ADR-077):
  *
- *   docker exec -i task-<id>-app-1 ~/.opencode/bin/opencode run \
+ *   ~/.opencode/bin/opencode run \
  *     --format json --auto --model <provider/model> [--variant <effort>] \
  *     [--session <id>] "<prompt>"
  *
@@ -10,7 +10,7 @@
  * `run` executes a single prompt to completion, streams newline-delimited JSON
  * events to stdout, and exits. Multi-turn continuity is `--session <id>` (the
  * id is captured from the first turn's event stream). Each `send()` spawns a
- * fresh `docker exec`; sends are serialized so a second message can't race a
+ * fresh provider process; sends are serialized so a second message can't race a
  * running turn.
  *
  * `--format json` vocabulary (one object per line, `type` field):
@@ -29,12 +29,21 @@
  * there are no permission prompts to resolve. ADR-076: `OPENCODE_DATA_DIR` in
  * agentEnv selects which account's data dir (auth) this exec uses.
  */
-import { spawn, type ChildProcess } from "node:child_process";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { requireContainerRuntimeOperational } from "../runtime-guard";
+import type {
+  TaskEnvironmentAgentSessionSurface,
+  TaskEnvironmentSessionRequest,
+} from "../task-environment/types";
 import { newId } from "../ulid";
+import {
+  AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+  spawnEnvironmentProcess,
+  type AgentEnvironmentProcess,
+} from "./proc";
 import { isRateLimitMessage } from "./rate-limit";
 import { register } from "./registry";
 import type {
@@ -47,7 +56,7 @@ import type {
 } from "./types";
 
 /** Installed by the image's opencode installer (opencode.ai/install); absolute
- *  so a non-login `docker exec` doesn't depend on PATH. */
+ *  so a non-login provider process doesn't depend on PATH. */
 const OPENCODE_BIN = "/home/node/.opencode/bin/opencode";
 
 // OpenCode is multi-provider: models are `provider/model` strings. This is a
@@ -257,9 +266,9 @@ export function mapOpencodeLine(line: string): MappedOpencodeLine {
 // ---------------------------------------------------------------------------
 
 /** Injectable spawn seam (tests provide a fake). */
-export type Spawner = (args: string[]) => ChildProcess;
-const defaultSpawn: Spawner = (args) =>
-  spawn("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+export type Spawner = (
+  request: TaskEnvironmentSessionRequest,
+) => AgentEnvironmentProcess;
 
 /** Sum this turn's step usage into a running total. */
 function addUsage(acc: AgentUsage, u: AgentUsage): AgentUsage {
@@ -278,7 +287,7 @@ export class OpencodeSession implements AgentSession {
   readonly agentId: string;
   readonly kind: AgentKind = "opencode";
 
-  private readonly containerName: string;
+  private readonly environment: TaskEnvironmentAgentSessionSurface;
   private readonly model?: string;
   private readonly effort?: string;
   private readonly systemPreamble: string;
@@ -287,7 +296,7 @@ export class OpencodeSession implements AgentSession {
 
   private readonly handlers = new Set<AgentEventHandler>();
   private sessionId: string | null = null;
-  private current: ChildProcess | null = null;
+  private current: AgentEnvironmentProcess | null = null;
   private queue: Promise<void> = Promise.resolve();
   private sentPreamble = false;
   private closed = false;
@@ -295,18 +304,19 @@ export class OpencodeSession implements AgentSession {
   constructor(args: {
     taskId: string;
     agent: RosterAgent;
-    containerName: string;
+    environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
     spawner?: Spawner;
   }) {
     this.agentId = args.agent.id;
-    this.containerName = args.containerName;
+    this.environment = args.environment;
     this.model = args.agent.model;
     this.effort = args.agent.effort;
     this.systemPreamble = args.systemPreamble;
     this.agentEnv = args.agentEnv ?? {};
-    this.spawner = args.spawner ?? defaultSpawn;
+    this.spawner =
+      args.spawner ?? ((request) => spawnEnvironmentProcess(this.environment, request));
   }
 
   onEvent(handler: AgentEventHandler): () => void {
@@ -323,17 +333,13 @@ export class OpencodeSession implements AgentSession {
    *  running one instead of spawning a racing `opencode run`. */
   async send(text: string): Promise<void> {
     if (this.closed) return;
-    this.queue = this.queue.then(() => this.runTurn(text));
-    return this.queue;
+    const turn = this.queue.catch(() => {}).then(() => this.runTurn(text));
+    this.queue = turn;
+    return turn;
   }
 
-  private buildArgs(prompt: string): string[] {
-    const args = ["exec", "-i", "-u", "node"];
-    for (const [k, v] of Object.entries(this.agentEnv)) {
-      args.push("-e", `${k}=${v}`);
-    }
-    args.push(
-      this.containerName,
+  private buildRequest(prompt: string): TaskEnvironmentSessionRequest {
+    const argv = [
       OPENCODE_BIN,
       "run",
       "--format",
@@ -341,19 +347,25 @@ export class OpencodeSession implements AgentSession {
       // Auto-approve permissions not explicitly denied — the container is the
       // sandbox, and headless has no interactive approver.
       "--auto",
-    );
-    if (this.model) args.push("--model", this.model);
-    if (this.effort) args.push("--variant", this.effort);
+    ];
+    if (this.model) argv.push("--model", this.model);
+    if (this.effort) argv.push("--variant", this.effort);
     // Continue the same OpenCode session across turns (captured from the first
     // turn's stream). First turn has none → a fresh session.
-    if (this.sessionId) args.push("--session", this.sessionId);
+    if (this.sessionId) argv.push("--session", this.sessionId);
     // The prompt is positional; put it LAST so it's never mistaken for a flag.
-    args.push(prompt);
-    return args;
+    argv.push(prompt);
+    return {
+      argv: argv as [string, ...string[]],
+      user: "node",
+      env: this.agentEnv,
+      maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+    };
   }
 
   private async runTurn(text: string): Promise<void> {
     if (this.closed) return;
+    requireContainerRuntimeOperational();
     // `run` has no system-prompt flag, so fold the channel briefing into the
     // FIRST turn's prompt (later turns carry it via the resumed session).
     const prompt =
@@ -362,7 +374,7 @@ export class OpencodeSession implements AgentSession {
         : text;
     this.sentPreamble = true;
 
-    const child = this.spawner(this.buildArgs(prompt));
+    const child = this.spawner(this.buildRequest(prompt));
     this.current = child;
 
     let turnUsage: AgentUsage = {};
@@ -467,6 +479,6 @@ register({
   // Gated on the operator's OpenCode auth (copied into containers at task-up).
   // No auth → the engine isn't advertised.
   available: () => existsSync(opencodeAuthPath()),
-  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
-    new OpencodeSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+  create: async ({ taskId, agent, environment, systemPreamble, agentEnv }) =>
+    new OpencodeSession({ taskId, agent, environment, systemPreamble, agentEnv }),
 });