@runuai/host 0.9.65 → 0.9.67

package/lib/container-runtime.ts

@@ -883,14 +883,21 @@ export async function detectContainerRuntime(
         appleUnavailable(preference, selectedAppleRuntime(deps) === null, deps)
       );
     }
-    // ADR-106: prefer the bundled runtime wherever it can run — ambient
-    // Docker existing is not a reason to skip it. A failed activation falls
-    // through to Docker rather than degrading a machine that has one.
+    // ADR-119 (inverting ADR-106): a present, healthy ambient Docker/OrbStack
+    // daemon wins — it is the battle-tested path, and `auto` must never
+    // migrate a machine off a working daemon it already trusts. The bundled
+    // runtime is the zero-dependency fallback for machines with no daemon:
+    // an absent/remote/unanswering Docker on a machine that never chose
+    // Docker is not an error to surface. One probe serves both outcomes —
+    // its rendered state is reused if the bundled runtime also fails.
+    const ambient = await detectAmbientDockerCore(preference, deps);
+    if (ambient.usable) return ambient.state;
     const selected = await probeAndSelectApple(preference, deps);
     if (selected !== null) return selected;
+    return ambient.state;
   }
 
-  return detectAmbientDocker(preference, deps);
+  return (await detectAmbientDockerCore(preference, deps)).state;
 }
 
 function appleUnavailable(
@@ -915,10 +922,19 @@ function appleUnavailable(
   };
 }
 
-async function detectAmbientDocker(
+/**
+ * Ambient-Docker detection. `usable: false` marks the ADR-119 fall-through
+ * verdicts — an absent daemon, a remote endpoint, an unresolvable context —
+ * so `auto` can try the bundled runtime instead of surfacing Docker's
+ * errors on a machine that never chose Docker, while still carrying the
+ * rendered state for callers that need it (explicit `docker`, and auto once
+ * the bundled runtime also failed). A ready selection and a pin conflict
+ * are both `usable: true`: neither may fall through.
+ */
+async function detectAmbientDockerCore(
   preference: "auto" | "docker",
   deps: RuntimeDetectionDeps,
-): Promise<ContainerRuntimeState> {
+): Promise<{ usable: boolean; state: ContainerRuntimeState }> {
   // A successful ambient `docker info` is not a durable selection: collapse a
   // named context to its exact local endpoint before publishing DOCKER_HOST.
   const selection =
@@ -929,24 +945,30 @@ async function detectAmbientDocker(
         : null;
   if (selection && !isLocalDockerEndpoint(selection.host)) {
     return {
-      status: "no-runtime",
-      preference,
-      message:
-        "The selected Docker endpoint is remote. " +
-        "Uai Host requires a local Unix-socket daemon for workspace mounts and loopback tunnels. " +
-        `Select a local Docker context, then run \`${RUNTIME_RESTART_COMMAND}\`.`,
-      action: RUNTIME_RESTART_COMMAND,
+      usable: false,
+      state: {
+        status: "no-runtime",
+        preference,
+        message:
+          "The selected Docker endpoint is remote. " +
+          "Uai Host requires a local Unix-socket daemon for workspace mounts and loopback tunnels. " +
+          `Select a local Docker context, then run \`${RUNTIME_RESTART_COMMAND}\`.`,
+        action: RUNTIME_RESTART_COMMAND,
+      },
     };
   }
 
   if (deps.dockerInfo === undefined && selection === null) {
     return {
-      status: "no-runtime",
-      preference,
-      message:
-        "Uai Host could not resolve the selected Docker context to a local endpoint. " +
-        `Select a local Docker context and run \`${RUNTIME_RECHECK_COMMAND}\`.`,
-      action: RUNTIME_RECHECK_COMMAND,
+      usable: false,
+      state: {
+        status: "no-runtime",
+        preference,
+        message:
+          "Uai Host could not resolve the selected Docker context to a local endpoint. " +
+          `Select a local Docker context and run \`${RUNTIME_RECHECK_COMMAND}\`.`,
+        action: RUNTIME_RECHECK_COMMAND,
+      },
     };
   }
 
@@ -954,20 +976,26 @@ async function detectAmbientDocker(
   if (proof !== null) {
     if (selection) {
       if (!pinRuntime("docker", selection.host, proof.engineId)) {
-        return pinnedRuntimeUnavailable(preference);
+        return { usable: true, state: pinnedRuntimeUnavailable(preference) };
       }
     }
-    return { status: "ready", preference, provider: "docker" };
+    return {
+      usable: true,
+      state: { status: "ready", preference, provider: "docker" },
+    };
   }
   return {
-    status: "no-runtime",
-    preference,
-    message:
-      preference === "docker"
-        ? "No working Docker runtime was found. Install or start Docker, then run " +
-          `\`${RUNTIME_RECHECK_COMMAND}\`.`
-        : NO_RUNTIME_MESSAGE,
-    action: RUNTIME_RECHECK_COMMAND,
+    usable: false,
+    state: {
+      status: "no-runtime",
+      preference,
+      message:
+        preference === "docker"
+          ? "No working Docker runtime was found. Install or start Docker, then run " +
+            `\`${RUNTIME_RECHECK_COMMAND}\`.`
+          : NO_RUNTIME_MESSAGE,
+      action: RUNTIME_RECHECK_COMMAND,
+    },
   };
 }
 

package/lib/orchestrator.ts

@@ -6199,6 +6199,31 @@ export async function recoverAppleTaskEnvironment(
     );
     return settleFromStatus(after);
   }
+  if (init.exitCode === 127) {
+    // Command-not-found from a read-only bind mount the guest cannot touch:
+    // the initializer itself is unrunnable — live 2026-08-26, containers
+    // whose versioned asset tree a host update had pruned looped here as
+    // "recovered with warnings" while the host sat in checking and the UI
+    // showed Running (so no Resume). An unrunnable initializer is a stopped
+    // task, not a degraded one: stop, settle the durable verdict, and let
+    // Resume recreate the container against current (task-scoped) assets.
+    await environment.stop();
+    const after = await environment.status();
+    if (after.state === "running" || after.state === "unknown") {
+      return {
+        outcome: "deferred",
+        detail:
+          "task initializer is unrunnable (exit 127) and the container could not be proven stopped",
+      };
+    }
+    if (!context.isCurrent()) {
+      return { outcome: "deferred", detail: "runtime generation superseded" };
+    }
+    console.error(
+      `[orchestrator] recovery: ${descriptor.taskId} initializer is unrunnable (exit 127 — usually a host update pruned the versioned assets this pre-0.9.67 container still mounts); task was stopped, Resume recreates it`,
+    );
+    return settleFromStatus(after);
+  }
   if (init.exitCode !== 0) {
     console.warn(
       `[orchestrator] recovery: ${descriptor.taskId} uai-init failed (exit ${init.exitCode}); container is up but Editor may be down`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.65",
+  "version": "0.9.67",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/scripts/agent/task-up.sh

@@ -1374,6 +1374,48 @@ if [ "$project_count" -gt 0 ]; then
   fi
 fi
 
+# Containers bind these assets for their whole life, but the packaged
+# sources live in the VERSIONED runtime tree and the updater keeps only
+# current+previous — a container surviving two updates found its mounts
+# pointing at deleted files (uai-init exec 127, recovery wedged the host in
+# "checking"; live 2026-08-26). Copy the assets into the task's own control
+# tree and mount THOSE: asset lifetime becomes task lifetime, and a Resume
+# refreshes the copies to the current version. Atomic rename so a resumed
+# container can never observe a half-written initializer.
+task_assets_dir="$task_uai_dir/assets"
+mkdir -p "$task_assets_dir"
+copy_task_asset() {
+  copy_src="$1"
+  copy_name="$2"
+  copy_mode="$3"
+  copy_tmp=$(mktemp "$task_assets_dir/.$copy_name.XXXXXX") || return 1
+  cp "$copy_src" "$copy_tmp" || { rm -f "$copy_tmp"; return 1; }
+  chmod "$copy_mode" "$copy_tmp" || { rm -f "$copy_tmp"; return 1; }
+  mv -f "$copy_tmp" "$task_assets_dir/$copy_name"
+}
+if ! copy_task_asset "$UAI_INIT_SOURCE" uai-init 0755; then
+  emit_err "CONTAINER_INIT_FAILED" \
+    "Uai could not stage the task initializer into this task's control tree. Check disk space and permissions under the Uai data directory, then retry." \
+    "stage task container assets"
+fi
+UAI_INIT_SOURCE="$task_assets_dir/uai-init"
+if [ -f "$RUNTIME_MATERIALIZER_SOURCE" ]; then
+  if ! copy_task_asset "$RUNTIME_MATERIALIZER_SOURCE" uai-materialize-runtimes 0755; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not stage the runtime materializer into this task's control tree. Check disk space and permissions under the Uai data directory, then retry." \
+      "stage task container assets"
+  fi
+  RUNTIME_MATERIALIZER_SOURCE="$task_assets_dir/uai-materialize-runtimes"
+fi
+if [ -f "$COREPACK_VERSION_SOURCE" ]; then
+  if ! copy_task_asset "$COREPACK_VERSION_SOURCE" corepack-version 0644; then
+    emit_err "CONTAINER_INIT_FAILED" \
+      "Uai could not stage the Corepack version pin into this task's control tree. Check disk space and permissions under the Uai data directory, then retry." \
+      "stage task container assets"
+  fi
+  COREPACK_VERSION_SOURCE="$task_assets_dir/corepack-version"
+fi
+
 # The host-authored allowlist is the single project-set authority shared by
 # pre-start runtime proof and task-local dependency installation. It lives in
 # the container-unmounted .uai control tree and is exposed only as this one