@runuai/host 0.9.14 → 0.9.42

package/lib/browser-testing.ts

@@ -43,8 +43,18 @@
  */
 import { createHash } from "node:crypto";
 
-import { dockerCli } from "./docker-exec";
+import {
+  taskAppContainerName,
+  taskContainerBackend,
+  taskContainerCli,
+} from "./task-container-cli";
 import { MCP_CONFIG_LOCK_PATH } from "./mcp-config-lock";
+import {
+  RUNTIME_AUTHORITY_ENV,
+  runtimeAuthorityDockerExecArgs,
+} from "./runtime-authority";
+import { STANDARD_DEFAULT_NODE_VERSION } from "./standard-image";
+import type { TaskEnvironmentHandle } from "./task-environment/types";
 
 const SERVER_DISPLAY = ":99";
 /**
@@ -935,17 +945,23 @@ const VIEWER_STEPS: string[] = [
   // Xvfb — one-shot; the X lockfile is the truth (also set when an agent
   // started the display itself). If it dies the lock clears and the next
   // session ensure relaunches it.
-  `command -v Xvfb >/dev/null 2>&1 || exit 0; [ -e ${X_LOCK} ] || nohup ${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &`,
+  `[ -x /usr/bin/Xvfb ] || exit 0; [ -e ${X_LOCK} ] || /usr/bin/nohup /usr/bin/${XVFB_CMD} >>/tmp/uai-xvfb.log 2>&1 &`,
   // x11vnc under a restart loop (it exits whenever the X server isn't up
   // yet). Pidfile-guarded.
-  `command -v x11vnc >/dev/null 2>&1 || exit 0; [ -f /tmp/uai-x11vnc.pid ] && kill -0 "$(cat /tmp/uai-x11vnc.pid)" 2>/dev/null && exit 0; nohup sh -c 'echo $$ > /tmp/uai-x11vnc.pid; while true; do x11vnc -display ${SERVER_DISPLAY} -forever -shared -nopw -quiet >>/tmp/uai-x11vnc.log 2>&1; sleep 2; done' >/dev/null 2>&1 &`,
+  `[ -x /usr/bin/x11vnc ] || exit 0; [ -f /tmp/uai-x11vnc.pid ] && /usr/bin/kill -0 "$(/usr/bin/cat /tmp/uai-x11vnc.pid)" 2>/dev/null && exit 0; /usr/bin/nohup /bin/sh -c 'echo $$ > /tmp/uai-x11vnc.pid; while true; do /usr/bin/x11vnc -display ${SERVER_DISPLAY} -forever -shared -nopw -quiet >>/tmp/uai-x11vnc.log 2>&1; /bin/sleep 2; done' >/dev/null 2>&1 &`,
   // websockify/noVNC under the same pattern.
-  `command -v websockify >/dev/null 2>&1 || exit 0; [ -f /tmp/uai-novnc.pid ] && kill -0 "$(cat /tmp/uai-novnc.pid)" 2>/dev/null && exit 0; nohup sh -c 'echo $$ > /tmp/uai-novnc.pid; while true; do websockify --web=/usr/share/novnc 0.0.0.0:6080 localhost:5900 >>/tmp/uai-websockify.log 2>&1; sleep 2; done' >/dev/null 2>&1 &`,
+  `[ -x /usr/bin/websockify ] || exit 0; [ -f /tmp/uai-novnc.pid ] && /usr/bin/kill -0 "$(/usr/bin/cat /tmp/uai-novnc.pid)" 2>/dev/null && exit 0; /usr/bin/nohup /bin/sh -c 'echo $$ > /tmp/uai-novnc.pid; while true; do /usr/bin/websockify --web=/usr/share/novnc 0.0.0.0:6080 localhost:5900 >>/tmp/uai-websockify.log 2>&1; /bin/sleep 2; done' >/dev/null 2>&1 &`,
 ];
 
-const APT_DEPS_CMD = "npx -y playwright@latest install-deps chromium";
+const DEFAULT_NODE_BIN =
+  `/opt/asdf-data/installs/nodejs/${STANDARD_DEFAULT_NODE_VERSION}/bin`;
+const ROOT_RUNTIME_PATH =
+  `${DEFAULT_NODE_BIN}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`;
+const APT_DEPS_CMD =
+  `PATH=${ROOT_RUNTIME_PATH} ${DEFAULT_NODE_BIN}/npx ` +
+  "-y playwright@latest install-deps chromium";
 const APT_VIEWER_CMD =
-  "apt-get install -y --no-install-recommends xvfb x11vnc novnc websockify";
+  "/usr/bin/apt-get install -y --no-install-recommends xvfb x11vnc novnc websockify";
 
 function aptGuardPaths(): { done: string; lock: string } {
   const digest = createHash("sha256")
@@ -978,10 +994,19 @@ export async function setupBrowserTesting(
   containerName: string,
   hasCodex: boolean,
   codexHomes: readonly string[] = hasCodex ? [DEFAULT_CODEX_HOME] : [],
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "launchDetachedSession">,
 ): Promise<BrowserSetup> {
   let ready = false;
   let configured = false;
   let changed = false;
+  // The no-handle fallbacks below exec by container name. The passed name is
+  // the Docker Compose replica shape; on the Apple backend the container has
+  // the provider's fixed name and the `docker` binary does not exist (live
+  // 2026-08-18: every fallback died with spawn docker ENOENT, which is why
+  // sessions never saw their browser MCP tools). Normalize both here.
+  const container = taskContainerBackend().apple
+    ? taskAppContainerName(taskId)
+    : containerName;
   try {
     const selectedCodexHomes = hasCodex
       ? [...new Set(codexHomes.length > 0 ? codexHomes : [DEFAULT_CODEX_HOME])]
@@ -1001,9 +1026,27 @@ export async function setupBrowserTesting(
     // ONE exec per daemon: the single-line nohup shape is the only one that
     // reliably survives `docker exec -d`.
     for (const step of VIEWER_STEPS) {
-      await dockerCli(["exec", "-d", containerName, "sh", "-c", step], {
-        timeoutMs: 10_000,
-      });
+      if (environment) {
+        await environment.launchDetachedSession({
+          argv: ["sh", "-c", step],
+          env: RUNTIME_AUTHORITY_ENV,
+          maxOutputBytes: 64 * 1024,
+          launchTimeoutMs: 10_000,
+        });
+      } else {
+        await taskContainerCli(
+          [
+            "exec",
+            "-d",
+            ...runtimeAuthorityDockerExecArgs(),
+            container,
+            "sh",
+            "-c",
+            step,
+          ],
+          { timeoutMs: 10_000 },
+        );
+      }
     }
 
     // Browser readiness — AWAITED, and deliberately OUTSIDE the marker guard.
@@ -1019,23 +1062,68 @@ export async function setupBrowserTesting(
     // from outside: the volume is host-wide, so another container's Playwright
     // can evict our build mid-task. Re-running it is how that heals — and it
     // costs ~0.5s once the build is present.
-    await dockerCli(
-      ["exec", "-u", "root", containerName, "chown", "node:node", "/opt/pw-browsers"],
-      { timeoutMs: 5_000 },
-    );
-    const installed = await dockerCli(
-      ["exec", "-w", "/workspace", containerName, "sh", "-lc", PREWARM_CMD],
-      { timeoutMs: INSTALL_TIMEOUT_MS },
-    );
-    ready = installed.status === 0;
+    const installed = environment
+      ? await (async () => {
+          await environment.exec({
+            argv: ["/usr/bin/chown", "node:node", "/opt/pw-browsers"],
+            user: "root",
+            env: RUNTIME_AUTHORITY_ENV,
+            timeoutMs: 5_000,
+            maxOutputBytes: 64 * 1024,
+          });
+          return environment.exec({
+            argv: ["sh", "-lc", PREWARM_CMD],
+            cwd: "/workspace",
+            env: RUNTIME_AUTHORITY_ENV,
+            timeoutMs: INSTALL_TIMEOUT_MS,
+            maxOutputBytes: 256 * 1024,
+          });
+        })()
+      : await taskContainerCli(
+          [
+            "exec",
+            "-u",
+            "root",
+            ...runtimeAuthorityDockerExecArgs(),
+            container,
+            "/usr/bin/chown",
+            "node:node",
+            "/opt/pw-browsers",
+          ],
+          { timeoutMs: 5_000 },
+        ).then(async (chown) => {
+          if (chown.status !== 0) return chown;
+          return taskContainerCli(
+            [
+              "exec",
+              "-w",
+              "/workspace",
+              ...runtimeAuthorityDockerExecArgs(),
+              container,
+              "sh",
+              "-lc",
+              PREWARM_CMD,
+            ],
+            { timeoutMs: INSTALL_TIMEOUT_MS },
+          );
+        });
+    const installedStatus =
+      "exitCode" in installed ? installed.exitCode : installed.status;
+    const installedStderr =
+      "stderr" in installed && installed.stderr instanceof Uint8Array
+        ? Buffer.from(installed.stderr).toString("utf8")
+        : typeof installed.stderr === "string"
+          ? installed.stderr
+          : "";
+    ready = installedStatus === 0;
     if (!ready) {
       // Agents still spawn — a task without a browser beats no task — but the
       // caller retries on this, and it is logged loudly, because the symptom
       // downstream (a browser that won't launch) reads as anything but an
       // install that quietly failed up here.
       console.warn(
-        `[browser] task ${taskId}: browser install failed (status ${installed.status}); ` +
-          `see ${INSTALL_LOG} in the container. ${installed.stderr.slice(0, 200)}`,
+        `[browser] task ${taskId}: browser install failed (status ${installedStatus}); ` +
+          `see ${INSTALL_LOG} in the container. ${installedStderr.slice(0, 200)}`,
       );
     }
 
@@ -1048,55 +1136,80 @@ export async function setupBrowserTesting(
     // survives those copies, so a gated setup could skip the rewrite and
     // report ready while Codex had no browser at all. The migration is cheap
     // and byte-idempotent, so the honest fix is to re-assert.
-    const wrote = await dockerCli(
-      [
-        "exec",
-        // asdf resolves node only where a .tool-versions applies.
-        "-w",
-        "/workspace",
-        "-e",
-        `UAI_BROWSER_DEF=${JSON.stringify(SERVER_DEF)}`,
-        "-e",
-        `UAI_MCP_PATH=${MCP_CONFIG_PATH}`,
-        "-e",
-        `UAI_CLAUDE_SETTINGS_PATH=${CLAUDE_SETTINGS_PATH}`,
-        "-e",
-        `UAI_CLAUDE_SETTINGS_DEF=${CLAUDE_SETTINGS_JSON}`,
-        ...(selectedCodexHomes.length > 0
-          ? ["-e", `UAI_CODEX_HOMES=${JSON.stringify(selectedCodexHomes)}`]
-          : []),
-        containerName,
-        "flock",
-        "-w",
-        "10",
-        MCP_CONFIG_LOCK_PATH,
-        "timeout",
-        "--kill-after=5",
-        String(
-          Math.max(45, 15 + selectedCodexHomes.length * 12),
-        ),
-        "node",
-        "-e",
-        MIGRATE_JS,
-      ],
-      {
-        // Lock wait + the per-home-scaled in-container bound + SIGKILL grace,
-        // with ten seconds left for Docker/process overhead. The host must
-        // never win this race: killing docker exec does not kill its child.
-        timeoutMs:
-          (10 +
-            Math.max(45, 15 + selectedCodexHomes.length * 12) +
-            5 +
-            10) *
-          1_000,
-      },
-    );
-    if (wrote.status !== 0) {
+    const writeTimeoutMs =
+      (10 + Math.max(45, 15 + selectedCodexHomes.length * 12) + 5 + 10) *
+      1_000;
+    const writeEnv = {
+      ...RUNTIME_AUTHORITY_ENV,
+      UAI_BROWSER_DEF: JSON.stringify(SERVER_DEF),
+      UAI_MCP_PATH: MCP_CONFIG_PATH,
+      UAI_CLAUDE_SETTINGS_PATH: CLAUDE_SETTINGS_PATH,
+      UAI_CLAUDE_SETTINGS_DEF: CLAUDE_SETTINGS_JSON,
+      ...(selectedCodexHomes.length > 0
+        ? { UAI_CODEX_HOMES: JSON.stringify(selectedCodexHomes) }
+        : {}),
+    };
+    const writeArgv = [
+      "flock",
+      "-w",
+      "10",
+      MCP_CONFIG_LOCK_PATH,
+      "timeout",
+      "--kill-after=5",
+      String(Math.max(45, 15 + selectedCodexHomes.length * 12)),
+      "node",
+      "-e",
+      MIGRATE_JS,
+    ] as [string, ...string[]];
+    const wrote = environment
+      ? await environment.exec({
+          argv: writeArgv,
+          cwd: "/workspace",
+          env: writeEnv,
+          timeoutMs: writeTimeoutMs,
+          maxOutputBytes: 256 * 1024,
+        })
+      : await taskContainerCli(
+          [
+            "exec",
+            "-w",
+            "/workspace",
+            "-e",
+            `UAI_BROWSER_DEF=${JSON.stringify(SERVER_DEF)}`,
+            "-e",
+            `UAI_MCP_PATH=${MCP_CONFIG_PATH}`,
+            "-e",
+            `UAI_CLAUDE_SETTINGS_PATH=${CLAUDE_SETTINGS_PATH}`,
+            "-e",
+            `UAI_CLAUDE_SETTINGS_DEF=${CLAUDE_SETTINGS_JSON}`,
+            ...(selectedCodexHomes.length > 0
+              ? ["-e", `UAI_CODEX_HOMES=${JSON.stringify(selectedCodexHomes)}`]
+              : []),
+            ...runtimeAuthorityDockerExecArgs(),
+            container,
+            ...writeArgv,
+          ],
+          { timeoutMs: writeTimeoutMs },
+        );
+    const wroteStatus = "exitCode" in wrote ? wrote.exitCode : wrote.status;
+    const wroteStdout =
+      "stdout" in wrote && wrote.stdout instanceof Uint8Array
+        ? Buffer.from(wrote.stdout).toString("utf8")
+        : typeof wrote.stdout === "string"
+          ? wrote.stdout
+          : "";
+    const wroteStderr =
+      "stderr" in wrote && wrote.stderr instanceof Uint8Array
+        ? Buffer.from(wrote.stderr).toString("utf8")
+        : typeof wrote.stderr === "string"
+          ? wrote.stderr
+          : "";
+    if (wroteStatus !== 0) {
       console.warn(
-        `[browser] task ${taskId}: MCP config write failed: ${wrote.stderr.slice(0, 300)}`,
+        `[browser] task ${taskId}: MCP config write failed: ${wroteStderr.slice(0, 300)}`,
       );
     } else {
-      const resultLine = wrote.stdout
+      const resultLine = wroteStdout
         .split(/\r?\n/)
         .find((line) => line.startsWith(CONFIG_RESULT_TOKEN));
       if (!resultLine) {
@@ -1147,43 +1260,70 @@ export async function setupBrowserTesting(
       APT_VIEWER_CMD,
       // Close lock fd 9 before starting long-lived viewer grandchildren, or
       // they inherit it and keep the apt lock forever after this worker exits.
-      `su -s /bin/sh node -c ${shellQuote(viewerSetup)} 9>&-`,
-      "chown -R node:node /home/node/.npm 2>/dev/null || true",
-      `touch ${aptGuard.done}`,
+      `/usr/bin/su -s /bin/sh node -c ${shellQuote(viewerSetup)} 9>&-`,
+      "/usr/bin/chown -R node:node /home/node/.npm 2>/dev/null || true",
+      `/usr/bin/touch ${aptGuard.done}`,
     ].join("; ");
     const guardedAptStart = [
       `[ -f ${aptGuard.done} ] && exit 0`,
       `exec 9>${aptGuard.lock}`,
-      "flock -n 9 || exit 0",
+      "/usr/bin/flock -n 9 || exit 0",
       // A different worker may have completed between the first check and
       // this lock acquisition.
       `[ -f ${aptGuard.done} ] && exit 0`,
-      `nohup sh -lc ${shellQuote(aptWorker)} 9>&9 </dev/null ` +
+      `/usr/bin/nohup /bin/sh -c ${shellQuote(aptWorker)} 9>&9 </dev/null ` +
         ">/tmp/uai-pw-deps.log 2>&1 &",
     ].join("; ");
 
-    await dockerCli(
-      [
-        "exec",
-        "-u",
-        "root",
-        // HOME=/home/node is for asdf version resolution ONLY — without the
-        // cache redirect below, root's npx writes ROOT-OWNED entries into
-        // node's ~/.npm and breaks the node user's own npx (which launches
-        // the MCP server). Found live 2026-07-08.
-        "-e",
-        "HOME=/home/node",
-        "-e",
-        "npm_config_cache=/tmp/uai-root-npm-cache",
-        "-w",
-        "/workspace",
-        containerName,
-        "sh",
-        "-lc",
-        guardedAptStart,
-      ],
-      { timeoutMs: 10_000 },
-    );
+    const rootWorkerEnv = {
+      ...RUNTIME_AUTHORITY_ENV,
+      NPM_CONFIG_CACHE: "/tmp/uai-root-npm-cache",
+      npm_config_cache: "/tmp/uai-root-npm-cache",
+      NPM_CONFIG_LOGS_DIR: "/tmp/uai-root-npm-cache/_logs",
+      npm_config_logs_dir: "/tmp/uai-root-npm-cache/_logs",
+    };
+    if (environment) {
+      await environment.exec({
+        argv: ["/bin/sh", "-c", guardedAptStart],
+        user: "root",
+        cwd: "/workspace",
+        env: rootWorkerEnv,
+        timeoutMs: 10_000,
+        maxOutputBytes: 64 * 1024,
+      });
+    } else {
+      await taskContainerCli(
+        [
+          "exec",
+          "-u",
+          "root",
+          // HOME=/home/node is for asdf version resolution ONLY — without the
+          // cache redirect below, root's npx writes ROOT-OWNED entries into
+          // node's ~/.npm and breaks the node user's own npx (which launches
+          // the MCP server). Found live 2026-07-08.
+          "-w",
+          "/workspace",
+          ...runtimeAuthorityDockerExecArgs(),
+          // These root-worker exceptions must follow the common authority args:
+          // Docker/npm use the final value when a spelling is repeated. Keep
+          // both cases aligned so npm's case-insensitive config lookup cannot
+          // fall back to node's private cache or logs directory.
+          "-e",
+          "NPM_CONFIG_CACHE=/tmp/uai-root-npm-cache",
+          "-e",
+          "npm_config_cache=/tmp/uai-root-npm-cache",
+          "-e",
+          "NPM_CONFIG_LOGS_DIR=/tmp/uai-root-npm-cache/_logs",
+          "-e",
+          "npm_config_logs_dir=/tmp/uai-root-npm-cache/_logs",
+          container,
+          "/bin/sh",
+          "-c",
+          guardedAptStart,
+        ],
+        { timeoutMs: 10_000 },
+      );
+    }
     console.log(
       `[browser] task ${taskId}: Playwright MCP wired (browser ${ready ? "ready" : "NOT ready"}; apt deps backgrounded)`,
     );

package/lib/codex-auth.ts

@@ -42,6 +42,12 @@ import { isNull } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
 import { dockerCli } from "./docker-exec";
+import {
+  listRunningTaskAppContainerNames,
+  taskAppContainerName,
+  taskContainerCli,
+} from "./task-container-cli";
+import { runtimeAuthorityDockerExecArgs } from "./runtime-authority";
 
 /** The exact set task-up.sh copies into `/home/node/.codex`. */
 const CODEX_ITEMS = [
@@ -72,7 +78,7 @@ function ownerCodexDir(): string {
 }
 
 const defaultExec: NonNullable<CodexDeps["exec"]> = async (args) => {
-  const res = await dockerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
+  const res = await taskContainerCli(args, { timeoutMs: EXEC_TIMEOUT_MS });
   return { status: res.status, stdout: res.stdout, stderr: res.stderr };
 };
 
@@ -82,7 +88,7 @@ function defaultActiveTaskContainers(): string[] {
     .from(schema.hostTasks)
     .where(isNull(schema.hostTasks.endedAt))
     .all()
-    .map((r) => `task-${r.taskId}-app-1`);
+    .map((r) => taskAppContainerName(r.taskId));
 }
 
 /**
@@ -93,6 +99,13 @@ function defaultActiveTaskContainers(): string[] {
 async function dockerRunningNames(
   exec: NonNullable<CodexDeps["exec"]>,
 ): Promise<Set<string> | null> {
+  // The list verb differs per backend (docker ps vs apple container list);
+  // the shared helper owns that translation. The injected exec seam is kept
+  // for tests, which script docker-shaped ps answers.
+  if (exec === defaultExec) {
+    const names = await listRunningTaskAppContainerNames();
+    return names === null ? null : new Set(names);
+  }
   const res = await exec(["ps", "--filter", "status=running", "--format", "{{.Names}}"]);
   if (res.status !== 0) return null;
   return new Set(
@@ -129,7 +142,16 @@ async function copyCodexInto(
     }
   };
   await must(
-    ["exec", "-u", "root", container, "mkdir", "-p", "/home/node/.codex"],
+    [
+      "exec",
+      "-u",
+      "root",
+      ...runtimeAuthorityDockerExecArgs(),
+      container,
+      "/bin/mkdir",
+      "-p",
+      "/home/node/.codex",
+    ],
     "mkdir /home/node/.codex",
   );
   for (const item of items) {
@@ -138,7 +160,17 @@ async function copyCodexInto(
     await must(["cp", src, `${container}:/home/node/.codex/`], `docker cp ${item}`);
   }
   await must(
-    ["exec", "-u", "root", container, "chown", "-R", "node:node", "/home/node/.codex"],
+    [
+      "exec",
+      "-u",
+      "root",
+      ...runtimeAuthorityDockerExecArgs(),
+      container,
+      "/bin/chown",
+      "-R",
+      "node:node",
+      "/home/node/.codex",
+    ],
     "chown -R node:node /home/node/.codex",
   );
 }
@@ -220,7 +252,7 @@ let debounceTimer: ReturnType<typeof setTimeout> | null = null;
  * missing `~/.codex` dir is a no-op — the host-start reinject already handles
  * a first login that flips Codex available. UAI_CODEX_REINJECT=0 disables it.
  */
-export function watchCodexAuth(): void {
+export function watchCodexAuth(canReinject: () => boolean = () => true): void {
   if (watcher || process.env.UAI_CODEX_REINJECT === "0") return;
   const dir = ownerCodexDir();
   if (!existsSync(dir)) return;
@@ -229,7 +261,9 @@ export function watchCodexAuth(): void {
       // filename is null on some platforms — then we can't tell, so proceed.
       if (filename && filename !== "auth.json") return;
       if (debounceTimer) clearTimeout(debounceTimer);
-      debounceTimer = setTimeout(() => void reinjectCodexRunningTasks(), 2_000);
+      debounceTimer = setTimeout(() => {
+        if (canReinject()) void reinjectCodexRunningTasks();
+      }, 2_000);
       debounceTimer.unref?.();
     });
   } catch (err) {

package/lib/command-db.ts

@@ -37,6 +37,26 @@ export function createTaskDownCommandDb(
   return dbPath;
 }
 
+/**
+ * Environment-provider teardown reconstructs from a durable task locator, not
+ * from the cloud command payload that originally provisioned it. The teardown
+ * script needs only the exact task identity/runtime row; it deliberately
+ * derives every destructive Docker/filesystem target from that identity.
+ */
+export function createTaskEnvironmentDownCommandDb(
+  taskId: string,
+  runtime: HostTask | null,
+): string {
+  const dbPath = newCommandDbPath(taskId);
+  const db = openCommandDb(dbPath);
+  try {
+    insertTask(db, runtimeTask(taskId, runtime));
+  } finally {
+    db.close();
+  }
+  return dbPath;
+}
+
 export function createTaskStatusCommandDb(
   taskId: string,
   runtime: HostTask | null,