@runuai/host 0.9.56 → 0.9.58

package/lib/engine-login.ts

@@ -66,6 +66,8 @@ const LOGIN_MOUNT = "/run/uai-engine-login";
 const LOGIN_HOME = `${LOGIN_MOUNT}/home`;
 const CODEX_HOME = `${LOGIN_MOUNT}/codex`;
 const MAX_OUTPUT_TAIL_BYTES = 64 * 1_024;
+/** script(1) transcripts of a login run a few KB; 1MB is a hostile-file cap. */
+const MAX_TRANSCRIPT_BYTES = 1_024 * 1_024;
 const MAX_CODEX_AUTH_BYTES = 1024 * 1024;
 const DOCKER_CONTROL_TIMEOUT_MS = 15_000;
 const DOCKER_CLEANUP_TIMEOUT_MS = 5_000;
@@ -132,6 +134,14 @@ export interface EngineLoginSeams {
     callbackUrl: string,
   ): Promise<void>;
   reconcileStaleContainers(): Promise<void>;
+  /**
+   * Read the script(1) PTY transcript from the login leaf (null when absent
+   * or unreadable). The transcript is written INSIDE the container, so it is
+   * the pure PTY byte stream — structurally free of the container runtime's
+   * own stdio chatter, which on the Apple CLI painted XPC noise over the
+   * very cells the TUI's diff renderer skipped (live 2026-08-21).
+   */
+  readTranscript(tempDir: string): Promise<string | null>;
   persistClaudeToken(token: string): Promise<void>;
   persistCodexAuth(sourceFile: string): Promise<void>;
   /** ADR-116: labeled extra-account captures (never the default slots). */
@@ -272,6 +282,17 @@ function defaultSeams(options: EngineLoginManagerOptions): EngineLoginSeams {
     replayCodexCallback,
     reconcileStaleContainers: () =>
       reconcileStaleEngineLoginResources({ tempRoot }),
+    readTranscript: async (tempDir) => {
+      try {
+        const body = await readBoundedRegularFile(
+          join(tempDir, "typescript"),
+          MAX_TRANSCRIPT_BYTES,
+        );
+        return body.toString("utf8");
+      } catch {
+        return null;
+      }
+    },
     persistClaudeToken: (token) => persistClaudeTokenAtomic(token),
     persistCodexAuth: (sourceFile) => persistCodexAuthAtomic(sourceFile),
     addClaudeAccount: (label, token) =>
@@ -742,8 +763,11 @@ export class EngineLoginManager {
       // Before the one-time input is consumed, token-shaped output could only
       // be an authorization URL/detail or hostile terminal content. This also
       // prevents an input echo from becoming the credential boundary.
+      // The scan reads the RECONSTRUCTED screen, not the raw stream: the
+      // TUI's diff renderer skips already-correct cells, so the raw bytes
+      // never carry the contiguous token (see renderTerminalScreenText).
       const token = operation.inputUsed
-        ? extractClaudeOAuthToken(operation.stdoutTail)
+        ? extractClaudeOAuthToken(renderTerminalScreenText(operation.stdoutTail))
         : null;
       if (token) {
         console.log(
@@ -804,6 +828,37 @@ export class EngineLoginManager {
       if (operation.finishPromise) await operation.finishPromise;
       return;
     }
+    if (
+      operation.engine === "claude" &&
+      result.code === 0 &&
+      operation.inputUsed &&
+      operation.tempDir
+    ) {
+      // A clean exit after the code went in means the CLI almost certainly
+      // minted and printed the token — a stream capture that saw nothing is
+      // the capture's failure, not the login's. The relayed stream can be
+      // polluted by the container runtime's own chatter (the Apple CLI's XPC
+      // noise painted characters over the cells the TUI's diff renderer
+      // skipped, corrupting the reconstructed screen — live 2026-08-21 on
+      // the Air, straight after the Linux fix). The PTY transcript is
+      // written inside the container and cannot contain that noise, so it
+      // gets the authoritative re-read before this operation is failed.
+      const transcript = await this.seams.readTranscript(operation.tempDir);
+      if (!this.isCurrent(operation) || operation.finishing) return;
+      const token = transcript
+        ? extractClaudeOAuthToken(renderTerminalScreenText(transcript))
+        : null;
+      if (token) {
+        console.log(
+          `[engine-login] token recovered from the PTY transcript for ${operation.opId}; persisting`,
+        );
+        operation.outputTail = "";
+        operation.stdoutTail = "";
+        this.beginClaudeFinish(operation, token);
+        if (operation.finishPromise) await operation.finishPromise;
+        return;
+      }
+    }
     const evidence = lastSignificantOutputLine(operation.outputTail);
     console.warn(
       `[engine-login] login process for ${operation.opId} ended (exit ${result.code ?? "spawn-failed"}) before completion` +
@@ -1149,8 +1204,10 @@ export function detectClaudeCliError(tail: string): string | null {
  * secret-checked so it can ride a terminal event message (ADR-116). Anything
  * token-shaped disqualifies the whole line rather than risking a partial. */
 function lastSignificantOutputLine(tail: string): string | null {
-  const lines = tail
-    .replace(/\u001b\[[0-9;?]*[ -\/]*[@-~]/g, "")
+  // stripTerminalControl handles the shapes the old inline regex missed —
+  // private-parameter CSI (kitty's ESC[<u, ESC[>4m) and charset selects
+  // (ESC(B) — whose husks once surfaced verbatim as "(B[>4m[<u" evidence.
+  const lines = stripTerminalControl(tail)
     .replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, "")
     .split("\n")
     .map((line) => line.trim())
@@ -1232,6 +1289,146 @@ function stripTerminalControl(value: string): string {
     .replace(/\r/g, "\n");
 }
 
+const SCREEN_MAX_ROWS = 200;
+const SCREEN_MAX_COLS = 600;
+
+/**
+ * Rebuild the visible terminal screen from raw TUI output. The login CLI's
+ * renderer diffs frames: a repainted line SKIPS cells that already show the
+ * right character and jumps the cursor over them. The minted token paints
+ * over the "Paste code here if prompted >" prompt, whose `code` leaves an
+ * 'o' exactly where `sk-ant-oat01-`'s 'o' lands — so the byte stream carries
+ * `sk-ant-` ESC[10G `at01-…` and NEVER the contiguous token (live
+ * 2026-08-21, first Linux host; the Air's earlier "corrupted" capture was
+ * the same hole, not stderr interleave). Only a spatial reconstruction sees
+ * what the operator sees, so the credential scan reads this rendering, never
+ * the raw stream. Cells no frame painted stay spaces — a hole can only be
+ * filled by content some frame actually painted there, never closed up.
+ */
+export function renderTerminalScreenText(value: string): string {
+  const rows: (string[] | undefined)[] = [];
+  let row = 0;
+  let col = 0;
+  let savedRow = 0;
+  let savedCol = 0;
+  const clamp = () => {
+    row = Math.min(Math.max(row, 0), SCREEN_MAX_ROWS - 1);
+    col = Math.min(Math.max(col, 0), SCREEN_MAX_COLS);
+  };
+  const line = (): string[] => (rows[row] ??= []);
+  const pattern =
+    // OSC | CSI(params, final) | charset | bare ESC final | CR | LF | text
+    /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b\[([0-9;:?<=>]*)[!-/]*([@-~])|\x1b[()][0-9A-B]|\x1b([78=>DEHM])|(\r)|(\n)|([^\x1b\r\n\x00-\x1f\x7f]+)|[\s\S]/g;
+  for (const part of value.matchAll(pattern)) {
+    const [, csiParams, csiFinal, escFinal, cr, lf, text] = part;
+    if (text !== undefined) {
+      const cells = line();
+      for (const ch of text) {
+        if (col < SCREEN_MAX_COLS) cells[col] = ch;
+        col += 1;
+      }
+      clamp();
+      continue;
+    }
+    if (cr !== undefined) {
+      col = 0;
+      continue;
+    }
+    if (lf !== undefined) {
+      row += 1;
+      clamp();
+      continue;
+    }
+    if (escFinal !== undefined) {
+      if (escFinal === "7") [savedRow, savedCol] = [row, col];
+      else if (escFinal === "8") [row, col] = [savedRow, savedCol];
+      else if (escFinal === "D" || escFinal === "E") row += 1;
+      else if (escFinal === "M") row -= 1;
+      if (escFinal === "E") col = 0;
+      clamp();
+      continue;
+    }
+    if (csiFinal === undefined) continue;
+    const params = csiParams ?? "";
+    // Private-parameter sequences (kitty keyboard pops, DEC modes) are not
+    // cursor movement — never let e.g. `ESC[<u` restore a stale cursor.
+    if (/[?<=>]/.test(params)) continue;
+    const numbers = params.split(";").map((entry) => Number.parseInt(entry, 10));
+    const n = (index: number, fallback: number): number => {
+      const parsed = numbers[index];
+      return Number.isFinite(parsed) && parsed! > 0 ? parsed! : fallback;
+    };
+    switch (csiFinal) {
+      case "G":
+        col = n(0, 1) - 1;
+        break;
+      case "A":
+        row -= n(0, 1);
+        break;
+      case "B":
+        row += n(0, 1);
+        break;
+      case "C":
+        col += n(0, 1);
+        break;
+      case "D":
+        col -= n(0, 1);
+        break;
+      case "E":
+        row += n(0, 1);
+        col = 0;
+        break;
+      case "F":
+        row -= n(0, 1);
+        col = 0;
+        break;
+      case "d":
+        row = n(0, 1) - 1;
+        break;
+      case "H":
+      case "f":
+        row = n(0, 1) - 1;
+        col = n(1, 1) - 1;
+        break;
+      case "s":
+        [savedRow, savedCol] = [row, col];
+        break;
+      case "u":
+        [row, col] = [savedRow, savedCol];
+        break;
+      case "K": {
+        const cells = line();
+        const mode = Number.isFinite(numbers[0]) ? numbers[0]! : 0;
+        if (mode === 0) cells.length = Math.min(cells.length, col);
+        else if (mode === 1) {
+          for (let i = 0; i <= col && i < cells.length; i += 1) cells[i] = " ";
+        } else if (mode === 2) cells.length = 0;
+        break;
+      }
+      case "J": {
+        const mode = Number.isFinite(numbers[0]) ? numbers[0]! : 0;
+        if (mode === 0) {
+          line().length = Math.min(line().length, col);
+          rows.length = Math.min(rows.length, row + 1);
+        } else if (mode === 1) {
+          for (let i = 0; i < row; i += 1) rows[i] = undefined;
+          const cells = line();
+          for (let i = 0; i <= col && i < cells.length; i += 1) cells[i] = " ";
+        } else {
+          rows.length = 0;
+        }
+        break;
+      }
+      default:
+        break;
+    }
+    clamp();
+  }
+  return rows
+    .map((cells) => Array.from(cells ?? [], (cell) => cell ?? " ").join(""))
+    .join("\n");
+}
+
 function candidateHttpsUrls(value: string): string[] {
   const plain = stripTerminalControl(value);
   return [...plain.matchAll(/https:\/\/[^\s<>"'\x00-\x1f]+/g)]
@@ -1269,13 +1466,13 @@ export function findSafeHttpsUrl(value: string): string | null {
 export function extractClaudeOAuthToken(value: string): string | null {
   const plain = stripTerminalControl(value);
   // The FULL `sk-ant-oat01-` prefix and a realistic minimum length are both
-  // load-bearing: the login CLI's stderr (the Apple runtime's XPC chatter is
-  // full of the word "token") interleaves with stdout in the captured tail,
-  // and a permissive scan once matched a corrupted hybrid — `sk-ant-at01-…`,
-  // one character short, token-shaped, wrong — which persisted as a
-  // "successful" login whose agents then 401'd forever (live 2026-08-21).
-  // A strict prefix makes a mangled interleave a non-match, and the CLI
-  // prints the token again on its plain summary line, which then matches.
+  // load-bearing: the TUI's diff renderer skips screen cells that already
+  // hold the right character, so naive control-stripping glues the runs into
+  // `sk-ant-at01-…` — one character short, token-shaped, wrong — which a
+  // permissive scan once persisted as a "successful" login whose agents then
+  // 401'd forever (live 2026-08-21). The strict prefix makes any mangled
+  // capture a non-match; the actual token match happens against the
+  // reconstructed screen (renderTerminalScreenText), where it is contiguous.
   const match =
     /(?:^|[^A-Za-z0-9_-])(sk-ant-oat01-[A-Za-z0-9_-]{64,4096})(?![A-Za-z0-9_-])/.exec(
       plain,
@@ -1956,6 +2153,11 @@ export async function createEngineLoginTempDir(
     await marker.sync();
     await marker.close();
     marker = null;
+    // The container is told HOME and CODEX_HOME live under the leaf, and
+    // codex refuses to start when CODEX_HOME does not exist (claude
+    // self-creates its HOME). Create both up front.
+    await mkdir(join(path, "home"), { mode: 0o700 });
+    await mkdir(join(path, "codex"), { mode: 0o700 });
     await syncDirectory(path);
     return path;
   } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.56",
+  "version": "0.9.58",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",