@runuai/host 0.9.55 → 0.9.57

package/lib/engine-login.ts

@@ -125,7 +125,7 @@ export interface EngineLoginSeams {
   removeTempDir(path: string): Promise<void>;
   startContainer(
     request: EngineLoginContainerRequest,
-    onOutput: (chunk: string) => void,
+    onOutput: (chunk: string, stream?: "stdout" | "stderr") => void,
   ): Promise<EngineLoginProcess>;
   replayCodexCallback(
     containerName: string,
@@ -186,6 +186,8 @@ interface LoginOperation {
   settlementPromise: Promise<void> | null;
   suppressTerminalEvent: boolean;
   outputTail: string;
+  /** stdout-only tail — the credential boundary (stderr never joins it). */
+  stdoutTail: string;
   inputUsed: boolean;
   callbackUsed: boolean;
   pendingInput: string | null;
@@ -393,6 +395,7 @@ export class EngineLoginManager {
       settlementPromise: null,
       suppressTerminalEvent: false,
       outputTail: "",
+      stdoutTail: "",
       inputUsed: false,
       callbackUsed: false,
       pendingInput: null,
@@ -462,6 +465,7 @@ export class EngineLoginManager {
     );
     operation.inputUsed = true;
     operation.outputTail = "";
+    operation.stdoutTail = "";
     if (!operation.process) {
       console.log(
         `[engine-login] input buffered for ${opId} (login process still starting)`,
@@ -650,7 +654,7 @@ export class EngineLoginManager {
       const containerName = `uai-login-${operation.engine}-${this.seams.randomHex(8)}`;
       processHandle = await this.seams.startContainer(
         { engine: operation.engine, containerName, tempDir },
-        (chunk) => this.onOutput(operation, chunk),
+        (chunk, stream) => this.onOutput(operation, chunk, stream ?? "stdout"),
       );
       if (!this.isCurrent(operation)) {
         await this.stopDetachedProcess(processHandle);
@@ -688,13 +692,28 @@ export class EngineLoginManager {
     }
   }
 
-  private onOutput(operation: LoginOperation, chunk: string): void {
+  private onOutput(
+    operation: LoginOperation,
+    chunk: string,
+    stream: "stdout" | "stderr" = "stdout",
+  ): void {
     if (!this.isCurrent(operation) || operation.finishing) return;
     operation.outputTail = appendUtf8Tail(
       operation.outputTail,
       chunk,
       MAX_OUTPUT_TAIL_BYTES,
     );
+    if (stream === "stdout") {
+      // The CREDENTIAL boundary reads stdout only: stderr chunks (the Apple
+      // runtime's XPC chatter) interleaving into a merged tail once produced
+      // a corrupted token-shaped capture (live 2026-08-21). The merged tail
+      // above stays for URL detection and human-facing evidence.
+      operation.stdoutTail = appendUtf8Tail(
+        operation.stdoutTail,
+        chunk,
+        MAX_OUTPUT_TAIL_BYTES,
+      );
+    }
 
     if (operation.engine === "claude") {
       if (operation.inputUsed && !operation.postInputOutputSeen) {
@@ -723,14 +742,18 @@ export class EngineLoginManager {
       // Before the one-time input is consumed, token-shaped output could only
       // be an authorization URL/detail or hostile terminal content. This also
       // prevents an input echo from becoming the credential boundary.
+      // The scan reads the RECONSTRUCTED screen, not the raw stream: the
+      // TUI's diff renderer skips already-correct cells, so the raw bytes
+      // never carry the contiguous token (see renderTerminalScreenText).
       const token = operation.inputUsed
-        ? extractClaudeOAuthToken(operation.outputTail)
+        ? extractClaudeOAuthToken(renderTerminalScreenText(operation.stdoutTail))
         : null;
       if (token) {
         console.log(
           `[engine-login] token detected in CLI output for ${operation.opId}; persisting`,
         );
         operation.outputTail = "";
+        operation.stdoutTail = "";
         this.beginClaudeFinish(operation, token);
         return;
       }
@@ -990,6 +1013,7 @@ export class EngineLoginManager {
   private detach(operation: LoginOperation): void {
     operation.active = false;
     operation.outputTail = "";
+    operation.stdoutTail = "";
     operation.pendingInput = null;
     operation.callbackTarget = null;
     this.clearOperationTimer(operation);
@@ -1128,8 +1152,10 @@ export function detectClaudeCliError(tail: string): string | null {
  * secret-checked so it can ride a terminal event message (ADR-116). Anything
  * token-shaped disqualifies the whole line rather than risking a partial. */
 function lastSignificantOutputLine(tail: string): string | null {
-  const lines = tail
-    .replace(/\u001b\[[0-9;?]*[ -\/]*[@-~]/g, "")
+  // stripTerminalControl handles the shapes the old inline regex missed —
+  // private-parameter CSI (kitty's ESC[<u, ESC[>4m) and charset selects
+  // (ESC(B) — whose husks once surfaced verbatim as "(B[>4m[<u" evidence.
+  const lines = stripTerminalControl(tail)
     .replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, "")
     .split("\n")
     .map((line) => line.trim())
@@ -1211,6 +1237,146 @@ function stripTerminalControl(value: string): string {
     .replace(/\r/g, "\n");
 }
 
+const SCREEN_MAX_ROWS = 200;
+const SCREEN_MAX_COLS = 600;
+
+/**
+ * Rebuild the visible terminal screen from raw TUI output. The login CLI's
+ * renderer diffs frames: a repainted line SKIPS cells that already show the
+ * right character and jumps the cursor over them. The minted token paints
+ * over the "Paste code here if prompted >" prompt, whose `code` leaves an
+ * 'o' exactly where `sk-ant-oat01-`'s 'o' lands — so the byte stream carries
+ * `sk-ant-` ESC[10G `at01-…` and NEVER the contiguous token (live
+ * 2026-08-21, first Linux host; the Air's earlier "corrupted" capture was
+ * the same hole, not stderr interleave). Only a spatial reconstruction sees
+ * what the operator sees, so the credential scan reads this rendering, never
+ * the raw stream. Cells no frame painted stay spaces — a hole can only be
+ * filled by content some frame actually painted there, never closed up.
+ */
+export function renderTerminalScreenText(value: string): string {
+  const rows: (string[] | undefined)[] = [];
+  let row = 0;
+  let col = 0;
+  let savedRow = 0;
+  let savedCol = 0;
+  const clamp = () => {
+    row = Math.min(Math.max(row, 0), SCREEN_MAX_ROWS - 1);
+    col = Math.min(Math.max(col, 0), SCREEN_MAX_COLS);
+  };
+  const line = (): string[] => (rows[row] ??= []);
+  const pattern =
+    // OSC | CSI(params, final) | charset | bare ESC final | CR | LF | text
+    /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b\[([0-9;:?<=>]*)[!-/]*([@-~])|\x1b[()][0-9A-B]|\x1b([78=>DEHM])|(\r)|(\n)|([^\x1b\r\n\x00-\x1f\x7f]+)|[\s\S]/g;
+  for (const part of value.matchAll(pattern)) {
+    const [, csiParams, csiFinal, escFinal, cr, lf, text] = part;
+    if (text !== undefined) {
+      const cells = line();
+      for (const ch of text) {
+        if (col < SCREEN_MAX_COLS) cells[col] = ch;
+        col += 1;
+      }
+      clamp();
+      continue;
+    }
+    if (cr !== undefined) {
+      col = 0;
+      continue;
+    }
+    if (lf !== undefined) {
+      row += 1;
+      clamp();
+      continue;
+    }
+    if (escFinal !== undefined) {
+      if (escFinal === "7") [savedRow, savedCol] = [row, col];
+      else if (escFinal === "8") [row, col] = [savedRow, savedCol];
+      else if (escFinal === "D" || escFinal === "E") row += 1;
+      else if (escFinal === "M") row -= 1;
+      if (escFinal === "E") col = 0;
+      clamp();
+      continue;
+    }
+    if (csiFinal === undefined) continue;
+    const params = csiParams ?? "";
+    // Private-parameter sequences (kitty keyboard pops, DEC modes) are not
+    // cursor movement — never let e.g. `ESC[<u` restore a stale cursor.
+    if (/[?<=>]/.test(params)) continue;
+    const numbers = params.split(";").map((entry) => Number.parseInt(entry, 10));
+    const n = (index: number, fallback: number): number => {
+      const parsed = numbers[index];
+      return Number.isFinite(parsed) && parsed! > 0 ? parsed! : fallback;
+    };
+    switch (csiFinal) {
+      case "G":
+        col = n(0, 1) - 1;
+        break;
+      case "A":
+        row -= n(0, 1);
+        break;
+      case "B":
+        row += n(0, 1);
+        break;
+      case "C":
+        col += n(0, 1);
+        break;
+      case "D":
+        col -= n(0, 1);
+        break;
+      case "E":
+        row += n(0, 1);
+        col = 0;
+        break;
+      case "F":
+        row -= n(0, 1);
+        col = 0;
+        break;
+      case "d":
+        row = n(0, 1) - 1;
+        break;
+      case "H":
+      case "f":
+        row = n(0, 1) - 1;
+        col = n(1, 1) - 1;
+        break;
+      case "s":
+        [savedRow, savedCol] = [row, col];
+        break;
+      case "u":
+        [row, col] = [savedRow, savedCol];
+        break;
+      case "K": {
+        const cells = line();
+        const mode = Number.isFinite(numbers[0]) ? numbers[0]! : 0;
+        if (mode === 0) cells.length = Math.min(cells.length, col);
+        else if (mode === 1) {
+          for (let i = 0; i <= col && i < cells.length; i += 1) cells[i] = " ";
+        } else if (mode === 2) cells.length = 0;
+        break;
+      }
+      case "J": {
+        const mode = Number.isFinite(numbers[0]) ? numbers[0]! : 0;
+        if (mode === 0) {
+          line().length = Math.min(line().length, col);
+          rows.length = Math.min(rows.length, row + 1);
+        } else if (mode === 1) {
+          for (let i = 0; i < row; i += 1) rows[i] = undefined;
+          const cells = line();
+          for (let i = 0; i <= col && i < cells.length; i += 1) cells[i] = " ";
+        } else {
+          rows.length = 0;
+        }
+        break;
+      }
+      default:
+        break;
+    }
+    clamp();
+  }
+  return rows
+    .map((cells) => Array.from(cells ?? [], (cell) => cell ?? " ").join(""))
+    .join("\n");
+}
+
 function candidateHttpsUrls(value: string): string[] {
   const plain = stripTerminalControl(value);
   return [...plain.matchAll(/https:\/\/[^\s<>"'\x00-\x1f]+/g)]
@@ -1247,9 +1413,18 @@ export function findSafeHttpsUrl(value: string): string | null {
 
 export function extractClaudeOAuthToken(value: string): string | null {
   const plain = stripTerminalControl(value);
-  const match = /(?:^|[^A-Za-z0-9_-])(sk-ant-[A-Za-z0-9_-]{16,4096})(?![A-Za-z0-9_-])/.exec(
-    plain,
-  );
+  // The FULL `sk-ant-oat01-` prefix and a realistic minimum length are both
+  // load-bearing: the TUI's diff renderer skips screen cells that already
+  // hold the right character, so naive control-stripping glues the runs into
+  // `sk-ant-at01-…` — one character short, token-shaped, wrong — which a
+  // permissive scan once persisted as a "successful" login whose agents then
+  // 401'd forever (live 2026-08-21). The strict prefix makes any mangled
+  // capture a non-match; the actual token match happens against the
+  // reconstructed screen (renderTerminalScreenText), where it is contiguous.
+  const match =
+    /(?:^|[^A-Za-z0-9_-])(sk-ant-oat01-[A-Za-z0-9_-]{64,4096})(?![A-Za-z0-9_-])/.exec(
+      plain,
+    );
   return match?.[1] ?? null;
 }
 
@@ -1388,7 +1563,7 @@ function callbackReplayUrl(
 
 async function startLoginContainer(
   request: EngineLoginContainerRequest,
-  onOutput: (chunk: string) => void,
+  onOutput: (chunk: string, stream?: "stdout" | "stderr") => void,
 ): Promise<EngineLoginProcess> {
   const args = engineLoginContainerArgs(request);
   const child = spawn(engineLoginBackend().command, args, {
@@ -1397,8 +1572,8 @@ async function startLoginContainer(
   });
   child.stdout.setEncoding("utf8");
   child.stderr.setEncoding("utf8");
-  child.stdout.on("data", (chunk: string) => onOutput(chunk));
-  child.stderr.on("data", (chunk: string) => onOutput(chunk));
+  child.stdout.on("data", (chunk: string) => onOutput(chunk, "stdout"));
+  child.stderr.on("data", (chunk: string) => onOutput(chunk, "stderr"));
   child.stdin.on("error", () => {});
 
   let stopped = false;
@@ -1926,6 +2101,11 @@ export async function createEngineLoginTempDir(
     await marker.sync();
     await marker.close();
     marker = null;
+    // The container is told HOME and CODEX_HOME live under the leaf, and
+    // codex refuses to start when CODEX_HOME does not exist (claude
+    // self-creates its HOME). Create both up front.
+    await mkdir(join(path, "home"), { mode: 0o700 });
+    await mkdir(join(path, "codex"), { mode: 0o700 });
     await syncDirectory(path);
     return path;
   } catch (error) {

package/lib/orchestrator.ts

@@ -2299,6 +2299,11 @@ export class Orchestrator {
           // Token revoked/expired: the env-injected credential only changes on
           // a fresh runner. Re-spawn on the re-resolved account (picks up a
           // reconnected token); bounded so a still-bad token can't loop.
+          // Log the matched evidence — the 2026-08-21 corrupted-token loop was
+          // diagnosed blind because the trigger text never appeared anywhere.
+          console.warn(
+            `[orchestrator] ${channel.taskId}/${agentId}: claude auth-revoked pattern matched: ${event.message.slice(0, 300)}`,
+          );
           await this.refreshAgentToken(channel, agent);
           break;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.55",
+  "version": "0.9.57",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/install/linux.ts

@@ -545,7 +545,7 @@ export async function prepareLinuxDefinitionInstallRollback(
   }
 }
 
-function assertSystemdDisabledForRollback(
+export function assertSystemdDisabledForRollback(
   execute: StepExecutor,
   allowMissing: boolean,
 ): void {
@@ -553,11 +553,25 @@ function assertSystemdDisabledForRollback(
   const disabled = execute(false, "systemctl", disableArgs);
   if (disabled.status === 0) return;
   if (allowMissing) {
+    // Disabling a unit whose FILE is already gone answers with stderr-only
+    // "does not exist" on AL2023 (live 2026-08-21: a poisoned rollback from
+    // an earlier failed install could never complete, wedging every later
+    // install at "could not begin"). Gone is as disabled as it gets.
+    if (/does not exist|no such file or directory/i.test(disabled.stderr)) {
+      return;
+    }
     const probeArgs = ["--user", "is-enabled", UNIT];
     const probe = execute(false, "systemctl", probeArgs);
+    const probeState = probe.stdout.trim();
+    const neverInstalled =
+      probe.status !== 0 &&
+      probeState === "" &&
+      /no such file or directory|failed to get unit file state/i.test(
+        probe.stderr,
+      );
     if (
       probe.status !== 0 &&
-      DISABLED_SYSTEMD_STATES.has(probe.stdout.trim())
+      (DISABLED_SYSTEMD_STATES.has(probeState) || neverInstalled)
     ) {
       return;
     }