@runuai/host 0.9.58 → 0.9.60

package/lib/engine-login.ts

@@ -555,20 +555,34 @@ export class EngineLoginManager {
   /** Validate and replay a Codex callback only to this operation's listener. */
   async callback(opId: string, value: string): Promise<boolean> {
     const operation = this.operations.get(opId);
-    if (
-      !operation ||
-      !this.isCurrent(operation) ||
-      operation.engine !== "codex" ||
-      operation.stage !== "awaiting_callback" ||
-      operation.callbackUsed ||
-      operation.finishing ||
-      !operation.process ||
-      !operation.callbackTarget
-    ) {
+    // Same named-rejection contract as input() (0.9.51): every silent exit
+    // here left an operator staring at "Waiting for the host…" with zero
+    // evidence on either side (live 2026-08-21 — the callback path was the
+    // last breadcrumb-free room in the login pipeline).
+    const refuse = (reason: string): false => {
+      console.log(
+        `[engine-login] callback refused for ${opId}: ${reason}`,
+      );
       return false;
+    };
+    if (!operation) return refuse("unknown opId");
+    if (!this.isCurrent(operation)) return refuse("superseded operation");
+    if (operation.engine !== "codex") return refuse("wrong engine");
+    if (operation.stage !== "awaiting_callback") {
+      return refuse(`wrong stage (${operation.stage})`);
     }
+    if (operation.callbackUsed) return refuse("callback already used");
+    if (operation.finishing) return refuse("operation finishing");
+    if (!operation.process) return refuse("no login process");
+    if (!operation.callbackTarget) return refuse("no callback target");
+    console.log(
+      `[engine-login] callback accepted for ${opId} (${value.length} chars); validating`,
+    );
     const query = validateCodexCallback(value, operation.callbackTarget);
     if (!query) {
+      console.warn(
+        `[engine-login] callback failed validation for ${opId} (state/shape mismatch with this attempt's authorize URL)`,
+      );
       await this.fail(
         operation,
         "invalid_callback",
@@ -576,6 +590,9 @@ export class EngineLoginManager {
       );
       return false;
     }
+    console.log(
+      `[engine-login] callback validated for ${opId}; replaying into the login container`,
+    );
     operation.callbackUsed = true;
     const callbackUrl = callbackReplayUrl(operation.callbackTarget, query);
     const replay = (async () => {
@@ -584,6 +601,9 @@ export class EngineLoginManager {
           operation.process!.containerName,
           callbackUrl,
         );
+        console.log(
+          `[engine-login] callback replay delivered for ${operation.opId}; waiting for the CLI to finish`,
+        );
       } catch {
         if (this.isCurrent(operation)) {
           await this.fail(
@@ -801,6 +821,12 @@ export class EngineLoginManager {
     if (operation.stage === "starting") {
       const authorization = findCodexAuthorization(operation.outputTail);
       if (authorization) {
+        // Symmetric with the claude branch: this breadcrumb's ABSENCE was
+        // unreadable during the 2026-08-21 hunt — silence meant either "no
+        // output arrived" or "detection fired, codex just never says so".
+        console.log(
+          `[engine-login] codex authorize URL found for ${operation.opId}; awaiting the callback URL`,
+        );
         operation.callbackTarget = authorization.target;
         operation.stage = "awaiting_callback";
         safeEmit(
@@ -1613,10 +1639,121 @@ function callbackReplayUrl(
   return callback.toString();
 }
 
-async function startLoginContainer(
+const LOGS_FOLLOW_ATTEMPTS = 20;
+const LOGS_FOLLOW_RETRY_MS = 200;
+const LOGS_FOLLOW_ATTACH_PROBE_MS = 500;
+
+function delayMs(ms: number): Promise<void> {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    unrefTimer(timer);
+  });
+}
+
+/**
+ * Stream a login container's output via `docker logs --follow`, which
+ * replays from byte zero — immune to the run/attach race that loses the
+ * container's first burst (see startLoginContainer). The container may not
+ * exist yet when the first attempt fires, and the client's own
+ * "No such container" stderr must never leak into the operation's output
+ * tail, so each attempt buffers until it is provably attached: container
+ * stdout, or survival past a probe window, count as proof; a quick exit
+ * with the not-found error is a retry.
+ */
+async function followLoginContainerLogs(
+  containerName: string,
+  runChild: { once(event: "close", listener: () => void): unknown },
+  onOutput: (chunk: string, stream?: "stdout" | "stderr") => void,
+): Promise<void> {
+  let runClosed = false;
+  runChild.once("close", () => {
+    runClosed = true;
+  });
+  for (let attempt = 0; attempt < LOGS_FOLLOW_ATTEMPTS; attempt += 1) {
+    const outcome = await followLoginContainerLogsOnce(
+      containerName,
+      onOutput,
+    );
+    if (outcome === "done") return;
+    // The container is absent. Before it ever starts that means "retry";
+    // after the run child closed it means the container already exited and
+    // was removed — nothing will ever appear.
+    if (runClosed) return;
+    await delayMs(LOGS_FOLLOW_RETRY_MS);
+  }
+}
+
+function followLoginContainerLogsOnce(
+  containerName: string,
+  onOutput: (chunk: string, stream?: "stdout" | "stderr") => void,
+): Promise<"done" | "absent"> {
+  return new Promise((resolve) => {
+    const follower = spawn(
+      engineLoginBackend().command,
+      ["logs", "--follow", containerName],
+      { shell: false, stdio: ["ignore", "pipe", "pipe"] },
+    );
+    follower.stdout.setEncoding("utf8");
+    follower.stderr.setEncoding("utf8");
+    const buffered: Array<{ chunk: string; stream: "stdout" | "stderr" }> = [];
+    let stderrTail = "";
+    let attached = false;
+    const flush = (): void => {
+      attached = true;
+      for (const entry of buffered) onOutput(entry.chunk, entry.stream);
+      buffered.length = 0;
+    };
+    const deliver = (chunk: string, stream: "stdout" | "stderr"): void => {
+      if (attached) {
+        onOutput(chunk, stream);
+        return;
+      }
+      buffered.push({ chunk, stream });
+      if (buffered.length > 256) buffered.shift();
+    };
+    follower.stdout.on("data", (chunk: string) => {
+      // Container stdout is proof of attachment — the docker client itself
+      // never writes to stdout here.
+      if (!attached) flush();
+      onOutput(chunk, "stdout");
+    });
+    follower.stderr.on("data", (chunk: string) => {
+      stderrTail = appendUtf8Tail(stderrTail, chunk, 4_096);
+      deliver(chunk, "stderr");
+    });
+    const probe = setTimeout(() => {
+      // Still running after the probe window: the client accepted the
+      // container and is following; anything buffered is container stderr.
+      if (follower.exitCode === null) flush();
+    }, LOGS_FOLLOW_ATTACH_PROBE_MS);
+    unrefTimer(probe);
+    follower.once("error", () => {
+      clearTimeout(probe);
+      resolve("absent");
+    });
+    follower.once("close", () => {
+      clearTimeout(probe);
+      if (
+        !attached &&
+        /no such container|dead or marked for removal/i.test(stderrTail)
+      ) {
+        resolve("absent");
+        return;
+      }
+      // A real follow that ended (container exited): deliver whatever was
+      // buffered — a fast-crashing container's stderr arrives exactly here.
+      if (!attached) flush();
+      resolve("done");
+    });
+  });
+}
+
+/** Exported for the follower-path tests and live harnesses. */
+export async function startLoginContainer(
   request: EngineLoginContainerRequest,
   onOutput: (chunk: string, stream?: "stdout" | "stderr") => void,
 ): Promise<EngineLoginProcess> {
+  const apple = engineLoginBackend().apple;
   const args = engineLoginContainerArgs(request);
   const child = spawn(engineLoginBackend().command, args, {
     shell: false,
@@ -1624,8 +1761,41 @@ async function startLoginContainer(
   });
   child.stdout.setEncoding("utf8");
   child.stderr.setEncoding("utf8");
-  child.stdout.on("data", (chunk: string) => onOutput(chunk, "stdout"));
-  child.stderr.on("data", (chunk: string) => onOutput(chunk, "stderr"));
+  if (apple) {
+    // The Apple CLI keeps the attach-stdio path: its behavior differs from
+    // Docker's and the claude flow's continuous TUI repaint has proven it
+    // live; the transcript fallback covers its noise-corruption cases.
+    child.stdout.on("data", (chunk: string) => onOutput(chunk, "stdout"));
+    child.stderr.on("data", (chunk: string) => onOutput(chunk, "stderr"));
+  } else {
+    // Docker: the attached stream can MISS the container's first output
+    // burst — `docker run` starts the container and the attach stream races
+    // its earliest writes. codex login prints its authorize URL within
+    // milliseconds and then goes silent, so a lost burst is a dead login
+    // (live 2026-08-21 on the first Linux hosts: dockerd had the URL,
+    // `docker logs` showed it, the attached client never relayed a byte).
+    // Output truth therefore comes from `docker logs --follow`, which
+    // replays from byte zero; the run child keeps ONLY stdin and lifecycle.
+    // Its stdio still drains so the client can never block on backpressure.
+    child.stdout.on("data", () => {});
+    child.stderr.on("data", () => {});
+    const logsDone = followLoginContainerLogs(
+      request.containerName,
+      child,
+      onOutput,
+    );
+    // Without `--rm`, the exited container outlives the run child so the
+    // follower can finish its replay; remove it once the follower is done
+    // (bounded — a wedged follower must not leak containers).
+    child.once("close", () => {
+      void (async () => {
+        await Promise.race([logsDone, delayMs(2_000)]);
+        await removeEngineLoginContainer(request.containerName).catch(
+          () => undefined,
+        );
+      })();
+    });
+  }
   child.stdin.on("error", () => {});
 
   let stopped = false;
@@ -1800,9 +1970,13 @@ export function engineLoginContainerArgs(
       ...command,
     ];
   }
+  // No `--rm` in the Docker dialect: output truth comes from
+  // `docker logs --follow` (see startLoginContainer), and an auto-removed
+  // fast-exiting container would take its logs with it. The host removes
+  // the container explicitly when the run child closes; the labeled stale
+  // reconcile sweeps anything a crash leaves behind.
   return [
     "run",
-    "--rm",
     "--name",
     request.containerName,
     "--label",
@@ -1882,6 +2056,13 @@ export function codexCallbackReplayDockerRequest(
       "--fail",
       "--silent",
       "--show-error",
+      // Follow the callback's redirect to the CLI's /success page: codex
+      // writes auth.json on the callback but EXITS only after serving that
+      // page — a real browser follows; a replay that stops at the redirect
+      // leaves a completed login waiting forever (live 2026-08-24: the
+      // first-ever completed pane codex login needed a manual /success
+      // fetch to let the CLI exit).
+      "--location",
       "--max-time",
       "10",
       "--output",

package/lib/mcp-gateway.ts

@@ -73,21 +73,25 @@ function gatewayPort(value: string | undefined): number {
 export const MCP_GATEWAY_PORT = gatewayPort(
   process.env.UAI_MCP_GATEWAY_PORT,
 );
-/** Loopback for Docker (Desktop/OrbStack forward host.docker.internal to it).
- * Apple vmnet guests cannot reach host loopback at all, so the apple backend
- * defaults to all interfaces — the unguessable per-task path token remains
- * the auth (same posture the operator override has always allowed). Resolved
- * per call: the runtime pin lands before the production listener starts, and
- * a pin never changes within a process. */
+/** Loopback works only where the container runtime forwards
+ * host.docker.internal INTO the host loopback — macOS Docker
+ * (Desktop/OrbStack). Native Linux docker resolves host.docker.internal to
+ * the bridge gateway IP, where a loopback bind is unreachable: every task's
+ * MCP config carried a dead URL and the gateway showed connection-refused
+ * from inside containers (live 2026-08-24, first Linux host with an MCP
+ * connection). Apple vmnet guests cannot reach host loopback either. Both
+ * non-mac-docker cases therefore bind all interfaces — the unguessable
+ * per-task path token remains the auth (same posture the operator override
+ * has always allowed). Resolved per call: the runtime pin lands before the
+ * production listener starts, and a pin never changes within a process. */
 function gatewayBindAddress(): string {
   const configured = process.env.UAI_MCP_GATEWAY_BIND;
   if (configured) return configured;
   // The pin, not the ready-gated identity: the production listener starts
   // during boot while activation still reports `checking`, and a loopback
   // bind chosen then would strand every vmnet guest.
-  return pinnedContainerRuntimeProvider() === "apple-container"
-    ? "0.0.0.0"
-    : "127.0.0.1";
+  if (pinnedContainerRuntimeProvider() === "apple-container") return "0.0.0.0";
+  return process.platform === "darwin" ? "127.0.0.1" : "0.0.0.0";
 }
 
 /** Host address a task container dials to reach this gateway. Docker guests

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.58",
+  "version": "0.9.60",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/_common.sh

@@ -43,12 +43,37 @@ agent_required_bins="sqlite3 jq git"
 if [ "${UAI_TASK_RUNTIME:-docker}" != "apple-container" ]; then
   agent_required_bins="$agent_required_bins docker"
 fi
+# Collect EVERY missing tool before failing: reporting them one at a time
+# cost one full fix-and-Resume round trip per binary on a fresh Amazon
+# Linux box (sqlite3, then jq — live 2026-08-21). Bash 3.2: plain string
+# accumulation, no arrays.
+missing_bins=""
 for bin in $agent_required_bins; do
   if ! command -v "$bin" >/dev/null 2>&1; then
-    printf '{"ok":false,"error":{"code":"MISSING_DEPENDENCY","message":"%s not found on PATH"}}\n' "$bin" >&2
-    exit 127
+    missing_bins="$missing_bins $bin"
   fi
 done
+if [ -n "$missing_bins" ]; then
+  missing_bins="${missing_bins# }"
+  printf '{"ok":false,"error":{"code":"MISSING_DEPENDENCY","message":"missing on PATH: %s — install with your package manager (dnf/apt/brew), then Resume"}}\n' "$missing_bins" >&2
+  exit 127
+fi
+
+
+# The docker BINARY existing does not make `docker compose` work: the v2
+# compose plugin ships separately, and a bare-engine install (Amazon Linux
+# 2023's docker package) answers `docker compose` with the top-level help
+# text — the operator saw exactly that as their task error (live
+# 2026-08-21). Called LAZILY by the task scripts right before their first
+# compose use, never at source time: argument validation must precede any
+# docker invocation (the task-down/task-up tests enforce that ordering).
+uai_require_compose_plugin() {
+  [ "${UAI_TASK_RUNTIME:-docker}" = "apple-container" ] && return 0
+  if ! docker compose version >/dev/null 2>&1; then
+    printf '{"ok":false,"error":{"code":"MISSING_DEPENDENCY","message":"missing on PATH: docker-compose-plugin — install the Docker Compose v2 plugin, then Resume"}}\n' >&2
+    exit 127
+  fi
+}
 
 # ---------------------------------------------------------------------------
 # Logger. All log lines go to stderr so stdout stays reserved for JSON.

package/scripts/agent/task-down.sh

@@ -91,6 +91,7 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
       "container verification after cleanup"
   fi
 else
+  uai_require_compose_plugin
   step "COMPOSE_DOWN_FAILED" "docker compose down -v --rmi local"
   if [ ! -L "$task_dir" ] && [ -f "$task_dir/.uai/docker-compose.yml" ]; then
     docker compose -p "$compose_project" -f "$task_dir/.uai/docker-compose.yml" \

package/scripts/agent/task-up.sh

@@ -519,6 +519,7 @@ if [ "$TASK_RUNTIME_MODE" = "apple-container" ]; then
       "remove prior task containers"
   fi
 else
+  uai_require_compose_plugin
   if [ -f "$task_uai_dir/docker-compose.yml" ]; then
     docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" \
       down --remove-orphans >/dev/null 2>&1 || true