@runuai/host 0.9.55 → 0.9.56

package/lib/engine-login.ts

@@ -125,7 +125,7 @@ export interface EngineLoginSeams {
   removeTempDir(path: string): Promise<void>;
   startContainer(
     request: EngineLoginContainerRequest,
-    onOutput: (chunk: string) => void,
+    onOutput: (chunk: string, stream?: "stdout" | "stderr") => void,
   ): Promise<EngineLoginProcess>;
   replayCodexCallback(
     containerName: string,
@@ -186,6 +186,8 @@ interface LoginOperation {
   settlementPromise: Promise<void> | null;
   suppressTerminalEvent: boolean;
   outputTail: string;
+  /** stdout-only tail — the credential boundary (stderr never joins it). */
+  stdoutTail: string;
   inputUsed: boolean;
   callbackUsed: boolean;
   pendingInput: string | null;
@@ -393,6 +395,7 @@ export class EngineLoginManager {
       settlementPromise: null,
       suppressTerminalEvent: false,
       outputTail: "",
+      stdoutTail: "",
       inputUsed: false,
       callbackUsed: false,
       pendingInput: null,
@@ -462,6 +465,7 @@ export class EngineLoginManager {
     );
     operation.inputUsed = true;
     operation.outputTail = "";
+    operation.stdoutTail = "";
     if (!operation.process) {
       console.log(
         `[engine-login] input buffered for ${opId} (login process still starting)`,
@@ -650,7 +654,7 @@ export class EngineLoginManager {
       const containerName = `uai-login-${operation.engine}-${this.seams.randomHex(8)}`;
       processHandle = await this.seams.startContainer(
         { engine: operation.engine, containerName, tempDir },
-        (chunk) => this.onOutput(operation, chunk),
+        (chunk, stream) => this.onOutput(operation, chunk, stream ?? "stdout"),
       );
       if (!this.isCurrent(operation)) {
         await this.stopDetachedProcess(processHandle);
@@ -688,13 +692,28 @@ export class EngineLoginManager {
     }
   }
 
-  private onOutput(operation: LoginOperation, chunk: string): void {
+  private onOutput(
+    operation: LoginOperation,
+    chunk: string,
+    stream: "stdout" | "stderr" = "stdout",
+  ): void {
     if (!this.isCurrent(operation) || operation.finishing) return;
     operation.outputTail = appendUtf8Tail(
       operation.outputTail,
       chunk,
       MAX_OUTPUT_TAIL_BYTES,
     );
+    if (stream === "stdout") {
+      // The CREDENTIAL boundary reads stdout only: stderr chunks (the Apple
+      // runtime's XPC chatter) interleaving into a merged tail once produced
+      // a corrupted token-shaped capture (live 2026-08-21). The merged tail
+      // above stays for URL detection and human-facing evidence.
+      operation.stdoutTail = appendUtf8Tail(
+        operation.stdoutTail,
+        chunk,
+        MAX_OUTPUT_TAIL_BYTES,
+      );
+    }
 
     if (operation.engine === "claude") {
       if (operation.inputUsed && !operation.postInputOutputSeen) {
@@ -724,13 +743,14 @@ export class EngineLoginManager {
       // be an authorization URL/detail or hostile terminal content. This also
       // prevents an input echo from becoming the credential boundary.
       const token = operation.inputUsed
-        ? extractClaudeOAuthToken(operation.outputTail)
+        ? extractClaudeOAuthToken(operation.stdoutTail)
         : null;
       if (token) {
         console.log(
           `[engine-login] token detected in CLI output for ${operation.opId}; persisting`,
         );
         operation.outputTail = "";
+        operation.stdoutTail = "";
         this.beginClaudeFinish(operation, token);
         return;
       }
@@ -990,6 +1010,7 @@ export class EngineLoginManager {
   private detach(operation: LoginOperation): void {
     operation.active = false;
     operation.outputTail = "";
+    operation.stdoutTail = "";
     operation.pendingInput = null;
     operation.callbackTarget = null;
     this.clearOperationTimer(operation);
@@ -1247,9 +1268,18 @@ export function findSafeHttpsUrl(value: string): string | null {
 
 export function extractClaudeOAuthToken(value: string): string | null {
   const plain = stripTerminalControl(value);
-  const match = /(?:^|[^A-Za-z0-9_-])(sk-ant-[A-Za-z0-9_-]{16,4096})(?![A-Za-z0-9_-])/.exec(
-    plain,
-  );
+  // The FULL `sk-ant-oat01-` prefix and a realistic minimum length are both
+  // load-bearing: the login CLI's stderr (the Apple runtime's XPC chatter is
+  // full of the word "token") interleaves with stdout in the captured tail,
+  // and a permissive scan once matched a corrupted hybrid — `sk-ant-at01-…`,
+  // one character short, token-shaped, wrong — which persisted as a
+  // "successful" login whose agents then 401'd forever (live 2026-08-21).
+  // A strict prefix makes a mangled interleave a non-match, and the CLI
+  // prints the token again on its plain summary line, which then matches.
+  const match =
+    /(?:^|[^A-Za-z0-9_-])(sk-ant-oat01-[A-Za-z0-9_-]{64,4096})(?![A-Za-z0-9_-])/.exec(
+      plain,
+    );
   return match?.[1] ?? null;
 }
 
@@ -1388,7 +1418,7 @@ function callbackReplayUrl(
 
 async function startLoginContainer(
   request: EngineLoginContainerRequest,
-  onOutput: (chunk: string) => void,
+  onOutput: (chunk: string, stream?: "stdout" | "stderr") => void,
 ): Promise<EngineLoginProcess> {
   const args = engineLoginContainerArgs(request);
   const child = spawn(engineLoginBackend().command, args, {
@@ -1397,8 +1427,8 @@ async function startLoginContainer(
   });
   child.stdout.setEncoding("utf8");
   child.stderr.setEncoding("utf8");
-  child.stdout.on("data", (chunk: string) => onOutput(chunk));
-  child.stderr.on("data", (chunk: string) => onOutput(chunk));
+  child.stdout.on("data", (chunk: string) => onOutput(chunk, "stdout"));
+  child.stderr.on("data", (chunk: string) => onOutput(chunk, "stderr"));
   child.stdin.on("error", () => {});
 
   let stopped = false;

package/lib/orchestrator.ts

@@ -2299,6 +2299,11 @@ export class Orchestrator {
           // Token revoked/expired: the env-injected credential only changes on
           // a fresh runner. Re-spawn on the re-resolved account (picks up a
           // reconnected token); bounded so a still-bad token can't loop.
+          // Log the matched evidence — the 2026-08-21 corrupted-token loop was
+          // diagnosed blind because the trigger text never appeared anywhere.
+          console.warn(
+            `[orchestrator] ${channel.taskId}/${agentId}: claude auth-revoked pattern matched: ${event.message.slice(0, 300)}`,
+          );
           await this.refreshAgentToken(channel, agent);
           break;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.55",
+  "version": "0.9.56",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/install/linux.ts

@@ -545,7 +545,7 @@ export async function prepareLinuxDefinitionInstallRollback(
   }
 }
 
-function assertSystemdDisabledForRollback(
+export function assertSystemdDisabledForRollback(
   execute: StepExecutor,
   allowMissing: boolean,
 ): void {
@@ -553,11 +553,25 @@ function assertSystemdDisabledForRollback(
   const disabled = execute(false, "systemctl", disableArgs);
   if (disabled.status === 0) return;
   if (allowMissing) {
+    // Disabling a unit whose FILE is already gone answers with stderr-only
+    // "does not exist" on AL2023 (live 2026-08-21: a poisoned rollback from
+    // an earlier failed install could never complete, wedging every later
+    // install at "could not begin"). Gone is as disabled as it gets.
+    if (/does not exist|no such file or directory/i.test(disabled.stderr)) {
+      return;
+    }
     const probeArgs = ["--user", "is-enabled", UNIT];
     const probe = execute(false, "systemctl", probeArgs);
+    const probeState = probe.stdout.trim();
+    const neverInstalled =
+      probe.status !== 0 &&
+      probeState === "" &&
+      /no such file or directory|failed to get unit file state/i.test(
+        probe.stderr,
+      );
     if (
       probe.status !== 0 &&
-      DISABLED_SYSTEMD_STATES.has(probe.stdout.trim())
+      (DISABLED_SYSTEMD_STATES.has(probeState) || neverInstalled)
     ) {
       return;
     }