@runuai/host 0.9.59 → 0.9.61

package/lib/engine-login.ts

@@ -169,7 +169,11 @@ export interface EngineLoginManagerOptions {
   seams?: Partial<EngineLoginSeams>;
 }
 
-type OperationStage = "starting" | "awaiting_input" | "awaiting_callback";
+type OperationStage =
+  | "starting"
+  | "awaiting_input"
+  | "awaiting_callback"
+  | "awaiting_confirmation";
 
 interface CodexCallbackTarget {
   readonly origin: string;
@@ -555,20 +559,34 @@ export class EngineLoginManager {
   /** Validate and replay a Codex callback only to this operation's listener. */
   async callback(opId: string, value: string): Promise<boolean> {
     const operation = this.operations.get(opId);
-    if (
-      !operation ||
-      !this.isCurrent(operation) ||
-      operation.engine !== "codex" ||
-      operation.stage !== "awaiting_callback" ||
-      operation.callbackUsed ||
-      operation.finishing ||
-      !operation.process ||
-      !operation.callbackTarget
-    ) {
+    // Same named-rejection contract as input() (0.9.51): every silent exit
+    // here left an operator staring at "Waiting for the host…" with zero
+    // evidence on either side (live 2026-08-21 — the callback path was the
+    // last breadcrumb-free room in the login pipeline).
+    const refuse = (reason: string): false => {
+      console.log(
+        `[engine-login] callback refused for ${opId}: ${reason}`,
+      );
       return false;
+    };
+    if (!operation) return refuse("unknown opId");
+    if (!this.isCurrent(operation)) return refuse("superseded operation");
+    if (operation.engine !== "codex") return refuse("wrong engine");
+    if (operation.stage !== "awaiting_callback") {
+      return refuse(`wrong stage (${operation.stage})`);
     }
+    if (operation.callbackUsed) return refuse("callback already used");
+    if (operation.finishing) return refuse("operation finishing");
+    if (!operation.process) return refuse("no login process");
+    if (!operation.callbackTarget) return refuse("no callback target");
+    console.log(
+      `[engine-login] callback accepted for ${opId} (${value.length} chars); validating`,
+    );
     const query = validateCodexCallback(value, operation.callbackTarget);
     if (!query) {
+      console.warn(
+        `[engine-login] callback failed validation for ${opId} (state/shape mismatch with this attempt's authorize URL)`,
+      );
       await this.fail(
         operation,
         "invalid_callback",
@@ -576,6 +594,9 @@ export class EngineLoginManager {
       );
       return false;
     }
+    console.log(
+      `[engine-login] callback validated for ${opId}; replaying into the login container`,
+    );
     operation.callbackUsed = true;
     const callbackUrl = callbackReplayUrl(operation.callbackTarget, query);
     const replay = (async () => {
@@ -584,6 +605,9 @@ export class EngineLoginManager {
           operation.process!.containerName,
           callbackUrl,
         );
+        console.log(
+          `[engine-login] callback replay delivered for ${operation.opId}; waiting for the CLI to finish`,
+        );
       } catch {
         if (this.isCurrent(operation)) {
           await this.fail(
@@ -799,6 +823,25 @@ export class EngineLoginManager {
     }
 
     if (operation.stage === "starting") {
+      const device = findCodexDeviceAuthorization(operation.outputTail);
+      if (device) {
+        console.log(
+          `[engine-login] codex device authorization found for ${operation.opId}; awaiting operator confirmation`,
+        );
+        operation.stage = "awaiting_confirmation";
+        safeEmit(
+          operation.emit,
+          authorizeEvent(operation, device.verificationUrl),
+        );
+        safeEmit(operation.emit, {
+          kind: "engine.login.event",
+          opId: operation.opId,
+          engine: operation.engine,
+          phase: "awaiting_confirmation",
+          message: `Enter code ${device.userCode} on the verification page. Nothing to paste here — this completes on its own.`,
+        });
+        return;
+      }
       const authorization = findCodexAuthorization(operation.outputTail);
       if (authorization) {
         // Symmetric with the claude branch: this breadcrumb's ABSENCE was
@@ -1469,6 +1512,24 @@ export function findSafeHttpsUrl(value: string): string | null {
   return null;
 }
 
+/**
+ * Codex `--device-auth` banner: a verification URL plus a short one-time
+ * code ("AC57-MDV9G" shape). Both the phrase gate and the code shape are
+ * required so container names, hashes, or URL fragments cannot fake a
+ * device prompt. Reads the merged tail — codex prints to stderr.
+ */
+export function findCodexDeviceAuthorization(
+  value: string,
+): { verificationUrl: string; userCode: string } | null {
+  const plain = stripTerminalControl(value);
+  if (!/one-time code|device code/i.test(plain)) return null;
+  const verificationUrl = findSafeHttpsUrl(plain);
+  if (!verificationUrl) return null;
+  const code = /(?:^|\s)([A-Z0-9]{4,8}-[A-Z0-9]{4,10})(?:\s|$)/m.exec(plain);
+  if (!code) return null;
+  return { verificationUrl, userCode: code[1]! };
+}
+
 export function extractClaudeOAuthToken(value: string): string | null {
   const plain = stripTerminalControl(value);
   // The FULL `sk-ant-oat01-` prefix and a realistic minimum length are both
@@ -1901,7 +1962,12 @@ export function engineLoginContainerArgs(
           // because the typescript went to /dev/null.
           `${LOGIN_MOUNT}/typescript`,
         ]
-      : ["codex", "login"];
+      : // Device-code flow: no localhost callback, no paste — the CLI prints
+        // a verification URL + one-time code, the operator confirms on the
+        // provider's page, and the CLI polls to completion (ADR-116 v2,
+        // 2026-08-24). The callback machinery below stays as the fallback
+        // for CLIs that still print the localhost authorize URL.
+        ["codex", "login", "--device-auth"];
   if (engineLoginBackend().apple) {
     // Same containment contract, Apple dialect: read-only root, all caps
     // dropped, a plain tmpfs at /tmp (the Apple CLI takes no mount options —
@@ -2036,6 +2102,13 @@ export function codexCallbackReplayDockerRequest(
       "--fail",
       "--silent",
       "--show-error",
+      // Follow the callback's redirect to the CLI's /success page: codex
+      // writes auth.json on the callback but EXITS only after serving that
+      // page — a real browser follows; a replay that stops at the redirect
+      // leaves a completed login waiting forever (live 2026-08-24: the
+      // first-ever completed pane codex login needed a manual /success
+      // fetch to let the CLI exit).
+      "--location",
       "--max-time",
       "10",
       "--output",

package/lib/mcp-gateway.ts

@@ -73,21 +73,25 @@ function gatewayPort(value: string | undefined): number {
 export const MCP_GATEWAY_PORT = gatewayPort(
   process.env.UAI_MCP_GATEWAY_PORT,
 );
-/** Loopback for Docker (Desktop/OrbStack forward host.docker.internal to it).
- * Apple vmnet guests cannot reach host loopback at all, so the apple backend
- * defaults to all interfaces — the unguessable per-task path token remains
- * the auth (same posture the operator override has always allowed). Resolved
- * per call: the runtime pin lands before the production listener starts, and
- * a pin never changes within a process. */
+/** Loopback works only where the container runtime forwards
+ * host.docker.internal INTO the host loopback — macOS Docker
+ * (Desktop/OrbStack). Native Linux docker resolves host.docker.internal to
+ * the bridge gateway IP, where a loopback bind is unreachable: every task's
+ * MCP config carried a dead URL and the gateway showed connection-refused
+ * from inside containers (live 2026-08-24, first Linux host with an MCP
+ * connection). Apple vmnet guests cannot reach host loopback either. Both
+ * non-mac-docker cases therefore bind all interfaces — the unguessable
+ * per-task path token remains the auth (same posture the operator override
+ * has always allowed). Resolved per call: the runtime pin lands before the
+ * production listener starts, and a pin never changes within a process. */
 function gatewayBindAddress(): string {
   const configured = process.env.UAI_MCP_GATEWAY_BIND;
   if (configured) return configured;
   // The pin, not the ready-gated identity: the production listener starts
   // during boot while activation still reports `checking`, and a loopback
   // bind chosen then would strand every vmnet guest.
-  return pinnedContainerRuntimeProvider() === "apple-container"
-    ? "0.0.0.0"
-    : "127.0.0.1";
+  if (pinnedContainerRuntimeProvider() === "apple-container") return "0.0.0.0";
+  return process.platform === "darwin" ? "127.0.0.1" : "0.0.0.0";
 }
 
 /** Host address a task container dials to reach this gateway. Docker guests

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.59",
+  "version": "0.9.61",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/protocol.ts

@@ -345,6 +345,9 @@ export type EngineLoginEventFrame =
         | "starting"
         | "awaiting_input"
         | "awaiting_callback"
+        // Device-code flow (codex `--device-auth`): the operator confirms a
+        // short one-time code on the provider's page; nothing is pasted back.
+        | "awaiting_confirmation"
         | "succeeded"
         | "cancelled";
       url?: never;
@@ -787,6 +790,7 @@ export function isEngineLoginEventFrame(
     (frame.phase === "starting" ||
       frame.phase === "awaiting_input" ||
       frame.phase === "awaiting_callback" ||
+      frame.phase === "awaiting_confirmation" ||
       frame.phase === "succeeded" ||
       frame.phase === "cancelled") &&
     !Object.hasOwn(frame, "errorCode")