@runuai/host 0.9.7 → 0.9.9

package/lib/engines.ts

@@ -296,18 +296,104 @@ function defaultPtyWrap(bin: string, args: string[]): PtyCommand | null {
  * harmless — every installer this module runs lands in a candidate dir,
  * which is checked before the probe.
  */
-async function probeLoginShellPath(): Promise<string | null> {
-  const now = Date.now();
+export async function probeLoginShellPath(
+  budgetMs: number = LOGIN_PATH_PROBE_BUDGET_MS,
+  seams: Partial<LoginShellProbeSeams> = {},
+): Promise<string | null> {
+  const { runShell, now: clock } = { ...defaultProbeSeams(), ...seams };
+  const now = clock();
   if (loginPathCache && now - loginPathCache.at < LOGIN_PATH_CACHE_MS) {
     return loginPathCache.value;
   }
-  const value = (await shellPath("-lic")) ?? (await shellPath("-lc"));
+  // ONE deadline for the pair. A per-spawn timeout bounds each attempt but not
+  // the request: two 8s attempts is a 16s stall on a live /api/engines poll.
+  //
+  // The pair shares the budget, but `-lic` may not SPEND it all: the reserve
+  // below keeps the `-lc` retry reachable. Sharing one deadline outright would
+  // starve the fallback in exactly the case it exists for — see the reserve.
+  const deadline = now + budgetMs;
+  const value =
+    (await runBounded(
+      runShell,
+      clock,
+      "-lic",
+      deadline - fallbackReserve(budgetMs),
+    )) ?? (await runBounded(runShell, clock, "-lc", deadline));
   loginPathCache = { value, at: now };
   return value;
 }
 
+/**
+ * Convert the remaining slice of the shared budget into one attempt's timeout,
+ * skipping the spawn entirely when a previous attempt already consumed it.
+ */
+async function runBounded(
+  runShell: LoginShellProbeSeams["runShell"],
+  clock: LoginShellProbeSeams["now"],
+  flags: string,
+  deadline: number,
+): Promise<string | null> {
+  const remaining = deadline - clock();
+  if (remaining <= 0) return null;
+  return runShell(flags, remaining);
+}
+
+/** Drop the memoized login PATH. Exported for tests (module-level cache). */
+export function resetLoginShellPathCache(): void {
+  loginPathCache = null;
+}
+
 let loginPathCache: { value: string | null; at: number } | null = null;
 const LOGIN_PATH_CACHE_MS = 5 * 60_000;
+/**
+ * Total wall-clock budget for the login-shell PATH probe, across BOTH
+ * attempts. `/api/engines` awaits this on a cold cache, so the bound has to
+ * be on the pair — see probeLoginShellPath.
+ */
+const LOGIN_PATH_PROBE_BUDGET_MS = 8_000;
+/**
+ * Slice of the budget held back so the `-lc` retry can always run.
+ *
+ * The interactive attempt is the one that stalls — it sources `.zshrc`, which
+ * is what makes it slow — and that is precisely when the non-interactive
+ * fallback is worth trying, because `-lc` skips that file. Letting `-lic`
+ * spend the whole budget therefore starves the fallback in the one case it
+ * exists for, and the probe resolves null: NOT "no login PATH" but "we gave
+ * up", cached as the former for LOGIN_PATH_CACHE_MS. `/api/engines` then
+ * reports every CLI absent for five minutes on a box where they are installed.
+ *
+ * Bounding the pair and keeping the fallback are not in tension: the total is
+ * still `budgetMs`, it is just no longer spendable entirely by the attempt
+ * most likely to hang.
+ */
+const LOGIN_PATH_FALLBACK_RESERVE_MS = 3_000;
+
+/**
+ * Never larger than half the budget, so a caller-shrunk budget (tests) still
+ * gives both attempts a real slice instead of collapsing one to zero.
+ */
+function fallbackReserve(budgetMs: number): number {
+  return Math.min(LOGIN_PATH_FALLBACK_RESERVE_MS, Math.floor(budgetMs / 2));
+}
+
+/**
+ * The probe's two side effects, injectable like every other seam in this file.
+ *
+ * Budget arithmetic is the whole point of this code and it is a function of
+ * elapsed time, so a test that races real `sleep`s against a real clock is
+ * measuring the runner's load, not the logic — it fails on a busy self-hosted
+ * runner exactly like the stall it was written to prevent. Pin both and the
+ * assertions become the timeouts handed to each attempt.
+ */
+export interface LoginShellProbeSeams {
+  /** Run `$SHELL <flags> /usr/bin/env`, bounded by `timeoutMs`. */
+  runShell: (flags: string, timeoutMs: number) => Promise<string | null>;
+  now: () => number;
+}
+
+function defaultProbeSeams(): LoginShellProbeSeams {
+  return { runShell: shellPath, now: Date.now };
+}
 
 /**
  * Run `$SHELL <flags> /usr/bin/env` and pull PATH out. `/usr/bin/env` (not
@@ -315,13 +401,13 @@ const LOGIN_PATH_CACHE_MS = 5 * 60_000;
  * shell — fish's `$PATH` is a list and would echo space-joined — and the
  * LAST `PATH=` line wins so profile echo noise can't spoof it.
  */
-function shellPath(flags: string): Promise<string | null> {
+function shellPath(flags: string, timeoutMs: number): Promise<string | null> {
   return new Promise((resolve) => {
     const shell = process.env.SHELL?.trim() || "/bin/zsh";
     nodeExecFile(
       shell,
       [flags, "/usr/bin/env"],
-      { timeout: 8_000 },
+      { timeout: timeoutMs },
       (err, stdout) => {
         if (err) return resolve(null);
         const lines = String(stdout)
@@ -366,8 +452,18 @@ export async function engineCliStatuses(
   seams: Partial<EngineSeams> = {},
 ): Promise<Record<EngineKind, boolean>> {
   const s = withDefaults(seams);
+  // Resolve the login PATH at most ONCE per call. Every kind that isn't in a
+  // candidate dir falls through to the probe, so six kinds would otherwise
+  // await it six times — bounding each probe wouldn't bound the request. The
+  // default seam memoizes for 5 min, but the per-request bound must not
+  // depend on that cache being warm.
+  let loginOnce: Promise<string | null> | null = null;
+  const scoped: EngineSeams = {
+    ...s,
+    loginShellPath: () => (loginOnce ??= s.loginShellPath()),
+  };
   const out = {} as Record<EngineKind, boolean>;
-  for (const kind of ORDER) out[kind] = await engineCliFound(kind, s);
+  for (const kind of ORDER) out[kind] = await engineCliFound(kind, scoped);
   return out;
 }
 

package/lib/orchestrator.ts

@@ -1634,11 +1634,27 @@ export class Orchestrator {
     return remaining;
   }
 
-  /** Retire turn-local state owned by a runner generation before replacement. */
+  /**
+   * Retire turn-local state owned by a runner generation before replacement.
+   *
+   * A replacement's identity guard suppresses the old runner's eventual
+   * terminal event. If the human already stopped that turn, close its cloud
+   * boundary here and discard its replay prompt; otherwise credential refresh
+   * could silently restart canceled work on the new generation.
+   */
   private retireRunnerGeneration(channel: Channel, agentId: string): void {
+    const aborted = channel.interrupted.delete(agentId);
     channel.activeTurns.delete(agentId);
     channel.openTurns.delete(agentId);
-    channel.interrupted.delete(agentId);
+    if (aborted) {
+      channel.lastPrompt.delete(agentId);
+      this.emitHost({
+        kind: "agent.turn_complete",
+        taskId: channel.taskId,
+        agentId,
+        aborted: true,
+      });
+    }
   }
 
   private startPrompt(
@@ -1766,9 +1782,12 @@ export class Orchestrator {
     // An interrupted turn is a half-turn — its eventual turn_complete must not
     // hand the buffered fragment to @-mentioned peers. Flag it so the boundary
     // goes out `aborted` and the cloud discards the buffer. Only when the turn
-    // actually streamed output (openTurns): an idle-agent ESC must not mark
-    // the NEXT legitimate turn as aborted.
-    if (channel.openTurns.has(agentId)) channel.interrupted.add(agentId);
+    // is actually in flight (activeTurns): an idle-agent ESC must not mark the
+    // NEXT legitimate turn as aborted, while a stop before the first output is
+    // still a cancellation and must not be replayed by runner replacement.
+    if ((channel.activeTurns.get(agentId) ?? 0) > 0) {
+      channel.interrupted.add(agentId);
+    }
     void session.interrupt();
     this.emitSystemNote(taskId, `Stopped @${agentId}.`);
     return { ok: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",

package/src/ui/server.ts

@@ -37,6 +37,7 @@ import {
   engineCatalog,
   engineStatuses,
   isEngineKind,
+  type EngineSeams,
 } from "../../lib/engines";
 import {
   addEngineAccount,
@@ -86,6 +87,12 @@ export interface UiServerOptions {
    * Optional (tests omit it).
    */
   stopTask?: (taskId: string) => Promise<{ ok: boolean; error?: string }>;
+  /**
+   * Engine probe seams for /api/engines. Production omits this and gets the
+   * real filesystem + login-shell probes; tests pin `loginShellPath` so the
+   * endpoint never spawns a login shell (which is bounded, but real, I/O).
+   */
+  engineSeams?: Partial<EngineSeams>;
 }
 
 export interface UiServerHandle {
@@ -199,7 +206,7 @@ async function handle(
       case "/api/users":
         return sendJson(res, UsersResponse, usersBody(opts));
       case "/api/engines":
-        return sendJson(res, EnginesResponse, await enginesBody());
+        return sendJson(res, EnginesResponse, await enginesBody(opts.engineSeams));
     }
     if (path.startsWith("/api/")) {
       return sendError(res, 404, `no such endpoint: ${path}`);
@@ -215,15 +222,17 @@ async function handle(
 /** Engine kinds that participate in the multi-account model (ADR-076). */
 const ACCOUNT_KINDS = ["claude", "codex", "opencode"] as const;
 
-async function enginesBody(): Promise<EnginesResponse> {
+async function enginesBody(
+  seams: Partial<EngineSeams> = {},
+): Promise<EnginesResponse> {
   const accounts: Record<string, ReturnType<typeof listEngineAccounts>> = {};
   for (const kind of ACCOUNT_KINDS) {
     accounts[kind] = listEngineAccounts(kind);
   }
   return {
     catalog: engineCatalog(),
-    statuses: engineStatuses(),
-    cli: await engineCliStatuses(),
+    statuses: engineStatuses(seams),
+    cli: await engineCliStatuses(seams),
     accounts,
   };
 }