@runuai/host 0.9.57 → 0.9.58

package/lib/engine-login.ts

@@ -66,6 +66,8 @@ const LOGIN_MOUNT = "/run/uai-engine-login";
 const LOGIN_HOME = `${LOGIN_MOUNT}/home`;
 const CODEX_HOME = `${LOGIN_MOUNT}/codex`;
 const MAX_OUTPUT_TAIL_BYTES = 64 * 1_024;
+/** script(1) transcripts of a login run a few KB; 1MB is a hostile-file cap. */
+const MAX_TRANSCRIPT_BYTES = 1_024 * 1_024;
 const MAX_CODEX_AUTH_BYTES = 1024 * 1024;
 const DOCKER_CONTROL_TIMEOUT_MS = 15_000;
 const DOCKER_CLEANUP_TIMEOUT_MS = 5_000;
@@ -132,6 +134,14 @@ export interface EngineLoginSeams {
     callbackUrl: string,
   ): Promise<void>;
   reconcileStaleContainers(): Promise<void>;
+  /**
+   * Read the script(1) PTY transcript from the login leaf (null when absent
+   * or unreadable). The transcript is written INSIDE the container, so it is
+   * the pure PTY byte stream — structurally free of the container runtime's
+   * own stdio chatter, which on the Apple CLI painted XPC noise over the
+   * very cells the TUI's diff renderer skipped (live 2026-08-21).
+   */
+  readTranscript(tempDir: string): Promise<string | null>;
   persistClaudeToken(token: string): Promise<void>;
   persistCodexAuth(sourceFile: string): Promise<void>;
   /** ADR-116: labeled extra-account captures (never the default slots). */
@@ -272,6 +282,17 @@ function defaultSeams(options: EngineLoginManagerOptions): EngineLoginSeams {
     replayCodexCallback,
     reconcileStaleContainers: () =>
       reconcileStaleEngineLoginResources({ tempRoot }),
+    readTranscript: async (tempDir) => {
+      try {
+        const body = await readBoundedRegularFile(
+          join(tempDir, "typescript"),
+          MAX_TRANSCRIPT_BYTES,
+        );
+        return body.toString("utf8");
+      } catch {
+        return null;
+      }
+    },
     persistClaudeToken: (token) => persistClaudeTokenAtomic(token),
     persistCodexAuth: (sourceFile) => persistCodexAuthAtomic(sourceFile),
     addClaudeAccount: (label, token) =>
@@ -807,6 +828,37 @@ export class EngineLoginManager {
       if (operation.finishPromise) await operation.finishPromise;
       return;
     }
+    if (
+      operation.engine === "claude" &&
+      result.code === 0 &&
+      operation.inputUsed &&
+      operation.tempDir
+    ) {
+      // A clean exit after the code went in means the CLI almost certainly
+      // minted and printed the token — a stream capture that saw nothing is
+      // the capture's failure, not the login's. The relayed stream can be
+      // polluted by the container runtime's own chatter (the Apple CLI's XPC
+      // noise painted characters over the cells the TUI's diff renderer
+      // skipped, corrupting the reconstructed screen — live 2026-08-21 on
+      // the Air, straight after the Linux fix). The PTY transcript is
+      // written inside the container and cannot contain that noise, so it
+      // gets the authoritative re-read before this operation is failed.
+      const transcript = await this.seams.readTranscript(operation.tempDir);
+      if (!this.isCurrent(operation) || operation.finishing) return;
+      const token = transcript
+        ? extractClaudeOAuthToken(renderTerminalScreenText(transcript))
+        : null;
+      if (token) {
+        console.log(
+          `[engine-login] token recovered from the PTY transcript for ${operation.opId}; persisting`,
+        );
+        operation.outputTail = "";
+        operation.stdoutTail = "";
+        this.beginClaudeFinish(operation, token);
+        if (operation.finishPromise) await operation.finishPromise;
+        return;
+      }
+    }
     const evidence = lastSignificantOutputLine(operation.outputTail);
     console.warn(
       `[engine-login] login process for ${operation.opId} ended (exit ${result.code ?? "spawn-failed"}) before completion` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.57",
+  "version": "0.9.58",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",