@runuai/host 0.9.79 → 0.9.80

package/lib/browser-testing.ts

@@ -50,6 +50,7 @@ import {
 } from "./task-container-cli";
 import { MCP_CONFIG_LOCK_PATH } from "./mcp-config-lock";
 import {
+  MACHINE_RUNTIME_AUTHORITY_ENV,
   RUNTIME_AUTHORITY_ENV,
   runtimeAuthorityDockerExecArgs,
 } from "./runtime-authority";
@@ -994,8 +995,19 @@ export async function setupBrowserTesting(
   containerName: string,
   hasCodex: boolean,
   codexHomes: readonly string[] = hasCodex ? [DEFAULT_CODEX_HOME] : [],
-  environment?: Pick<TaskEnvironmentHandle, "exec" | "launchDetachedSession">,
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "launchDetachedSession"> &
+    Partial<Pick<TaskEnvironmentHandle, "descriptor">>,
 ): Promise<BrowserSetup> {
+  // Machine sessions run under MACHINE_RUNTIME_AUTHORITY_ENV, so every setup
+  // exec here must too — the prewarm in particular. Warming npx under the
+  // CONTAINER authority (private NPM_CONFIG_CACHE) leaves the session-default
+  // npm cache cold, and Codex's 10s MCP startup deadline then kills the
+  // browser (and every npx-launched server) for the session's whole lifetime
+  // while Claude's 30s survives — live 2026-08-28, first codex machine task.
+  const authorityEnv =
+    environment?.descriptor?.locator.provider === "machine"
+      ? MACHINE_RUNTIME_AUTHORITY_ENV
+      : RUNTIME_AUTHORITY_ENV;
   let ready = false;
   let configured = false;
   let changed = false;
@@ -1029,7 +1041,7 @@ export async function setupBrowserTesting(
       if (environment) {
         await environment.launchDetachedSession({
           argv: ["sh", "-c", step],
-          env: RUNTIME_AUTHORITY_ENV,
+          env: authorityEnv,
           maxOutputBytes: 64 * 1024,
           launchTimeoutMs: 10_000,
         });
@@ -1067,14 +1079,14 @@ export async function setupBrowserTesting(
           await environment.exec({
             argv: ["/usr/bin/chown", "node:node", "/opt/pw-browsers"],
             user: "root",
-            env: RUNTIME_AUTHORITY_ENV,
+            env: authorityEnv,
             timeoutMs: 5_000,
             maxOutputBytes: 64 * 1024,
           });
           return environment.exec({
             argv: ["sh", "-lc", PREWARM_CMD],
             cwd: "/workspace",
-            env: RUNTIME_AUTHORITY_ENV,
+            env: authorityEnv,
             timeoutMs: INSTALL_TIMEOUT_MS,
             maxOutputBytes: 256 * 1024,
           });
@@ -1140,7 +1152,7 @@ export async function setupBrowserTesting(
       (10 + Math.max(45, 15 + selectedCodexHomes.length * 12) + 5 + 10) *
       1_000;
     const writeEnv = {
-      ...RUNTIME_AUTHORITY_ENV,
+      ...authorityEnv,
       UAI_BROWSER_DEF: JSON.stringify(SERVER_DEF),
       UAI_MCP_PATH: MCP_CONFIG_PATH,
       UAI_CLAUDE_SETTINGS_PATH: CLAUDE_SETTINGS_PATH,
@@ -1276,7 +1288,7 @@ export async function setupBrowserTesting(
     ].join("; ");
 
     const rootWorkerEnv = {
-      ...RUNTIME_AUTHORITY_ENV,
+      ...authorityEnv,
       NPM_CONFIG_CACHE: "/tmp/uai-root-npm-cache",
       npm_config_cache: "/tmp/uai-root-npm-cache",
       NPM_CONFIG_LOGS_DIR: "/tmp/uai-root-npm-cache/_logs",

package/lib/machine-provider-aws.ts

@@ -42,8 +42,14 @@ export interface AwsMachineConfig {
   /** Override the size ladder; the default picks the smallest Graviton
    * type satisfying both cpu and memory. */
   instanceType?: (spec: MachineSpec) => string;
+  /** Root EBS volume size. The AMI snapshot default (8 GiB Debian) starves
+   * real work — a monorepo install plus a browser left ~36 MB free live
+   * (2026-08-28). cloud-init's growpart expands the filesystem on boot. */
+  diskGiB?: number;
 }
 
+const DEFAULT_DISK_GIB = 50;
+
 type Runner = (args: string[]) => Promise<DockerResult>;
 
 const DEFAULT_TIMEOUT_MS = 60_000;
@@ -224,6 +230,41 @@ export function createAwsMachineProvider(
     return machineId.slice("uai-machine-".length);
   };
 
+  /** Root device name per AMI, resolved once per process. A failure throws:
+   * guessing the device would silently attach a blank second volume while
+   * the root stays at its 8 GiB snapshot size. */
+  const rootDeviceByImage = new Map<string, string>();
+  async function rootDeviceName(image: string): Promise<string> {
+    const cached = rootDeviceByImage.get(image);
+    if (cached) return cached;
+    const res = await runner([
+      "ec2",
+      "describe-images",
+      "--image-ids",
+      image,
+      "--query",
+      "Images[0].RootDeviceName",
+    ]);
+    if (res.status !== 0) {
+      throw new Error(
+        `could not resolve the root device of ${image}: ${
+          res.stderr.trim() || `exit ${res.status ?? "killed"}`
+        }`,
+      );
+    }
+    let device: unknown;
+    try {
+      device = JSON.parse(res.stdout);
+    } catch {
+      device = null;
+    }
+    if (typeof device !== "string" || !device.startsWith("/dev/")) {
+      throw new Error(`image ${image} reports no root device name`);
+    }
+    rootDeviceByImage.set(image, device);
+    return device;
+  }
+
   /** Resolve the logical machine id to its live instances via the tag. */
   async function resolveLive(
     machineId: string,
@@ -292,6 +333,12 @@ export function createAwsMachineProvider(
       // identical retry still cannot mint a second instance; a CHANGED
       // launch legitimately gets a fresh token, and the resume-aware
       // provision's describe-first step remains the guard against doubling
+      // The AMI snapshot's root volume (8 GiB on the Debian payload) starves
+      // real work; request a task-sized gp3 root instead. The mapping must
+      // name the AMI's actual root device — a wrong name would ADD a blank
+      // volume while the root stays small — so resolve it per image.
+      const diskGiB = config.diskGiB ?? DEFAULT_DISK_GIB;
+      const rootDevice = await rootDeviceName(spec.image);
       // a live machine.
       const launchFingerprint = createHash("sha256")
         .update(
@@ -302,6 +349,7 @@ export function createAwsMachineProvider(
             config.subnetId ?? null,
             config.securityGroupId ?? null,
             config.iamInstanceProfileArn ?? null,
+            diskGiB,
           ]),
         )
         .digest("hex")
@@ -321,6 +369,17 @@ export function createAwsMachineProvider(
         `${machineId}-${launchFingerprint}`.slice(0, 64),
         "--tag-specifications",
         `ResourceType=instance,Tags=[{Key=${AWS_MACHINE_TAG},Value=${spec.taskId}},{Key=Name,Value=${machineId}}]`,
+        "--block-device-mappings",
+        JSON.stringify([
+          {
+            DeviceName: rootDevice,
+            Ebs: {
+              VolumeSize: diskGiB,
+              VolumeType: "gp3",
+              DeleteOnTermination: true,
+            },
+          },
+        ]),
         ...(spec.authorizedPublicKey
           ? ["--user-data", awsUserData(spec.authorizedPublicKey)]
           : []),

package/lib/task-environment/index.ts

@@ -138,11 +138,13 @@ function machineBackend() {
     if (!region) {
       throw new Error("UAI_MACHINE_PROVIDER=aws requires UAI_AWS_REGION");
     }
+    const diskGiB = Number(process.env.UAI_MACHINE_DISK_GIB ?? "");
     return createAwsMachineProvider({
       region,
       subnetId: process.env.UAI_AWS_SUBNET_ID,
       securityGroupId: process.env.UAI_AWS_SECURITY_GROUP_ID,
       iamInstanceProfileArn: process.env.UAI_AWS_INSTANCE_PROFILE_ARN,
+      ...(Number.isInteger(diskGiB) && diskGiB > 0 ? { diskGiB } : {}),
     });
   }
   return createLocalMachineProvider();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.79",
+  "version": "0.9.80",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",