run-spaceapp 0.1.15-hostroot.0 → 0.1.15-hostroot.2

package/README.md

@@ -24,8 +24,9 @@ Windows, macOS, Ubuntu, Debian, Fedora, RHEL, and CentOS, or with native
 waits for Engine and Compose readiness before pulling images. Windows prefers
 Windows Package Manager's hash-pinned Docker Desktop
 manifest and retains a signed direct-download fallback. Docker Desktop license
-acceptance and Linux `docker` group membership require confirmation inside the
-same command. On Windows, approve any UAC prompt required by WSL2 or Docker
+acceptance still requires confirmation. On Linux, the same command explains
+the root-equivalent `docker` group and adds the current user automatically.
+On Windows, approve any UAC prompt required by WSL2 or Docker
 Desktop. Use the **Command Prompt** profile because a restricted PowerShell
 policy can block npm's `npx.ps1` before SpaceApp starts. On Docker Desktop's
 first launch, select **Skip** in the top-right of the **Welcome to Docker**
@@ -51,23 +52,16 @@ current user's platform config directory:
 
 Set `SPACEAPP_HOME` to an absolute path to use a dedicated installation root.
 
-Linux installations are isolated by default. A trusted single owner can opt
-into the personal host-root prerelease with:
+The `0.1.15-hostroot.2` personal candidate tests the complete x64 Linux
+host-root path:
 
 ```bash
 npx --yes run-spaceapp@personal install --access host-root
 ```
 
-This mounts the Linux `/` at `/host` read/write in the CLI service and runs CLI
-sessions as container root. The core service receives `/host` read-only. It can
-expose every host credential or make the operating system unbootable. It does
-not mount the Docker socket or enable a privileged container. Profiles control
-resources and managed Chromium, not access. Return to isolation without
-deleting persistent data with:
-
-```bash
-npx --yes run-spaceapp@personal install --access isolated
-```
+This candidate publishes matching `core` and `cli` images for `linux/amd64`
+and reuses the existing signed browser manifest without rebuilding it. npm
+rejects the package on arm64. Host-root is supported only on Linux.
 
 Use the same `npx --yes run-spaceapp@personal` prefix for follow-up commands
 while this prerelease is installed.

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "run-spaceapp",
-  "version": "0.1.15-hostroot.0",
+  "version": "0.1.15-hostroot.2",
+  "spaceappRuntimeVersion": "0.1.15-hostroot.2",
+  "spaceappHostRootRuntimeCompatible": true,
   "description": "Cross-platform Docker launcher for the SpaceApp self-hosted agent workspace",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,6 +30,9 @@
     "linux",
     "win32"
   ],
+  "cpu": [
+    "x64"
+  ],
   "scripts": {
     "test": "node --test tests/*.test.mjs",
     "check": "node --check bin/spaceapp.mjs && node --check src/package-info.mjs && node --check src/index.mjs && node --check src/cli.mjs && node --check src/prerequisites.mjs",
@@ -46,5 +51,5 @@
     "access": "public",
     "provenance": true
   },
-  "gitHead": "5a8c1b92709bbd9f88b5ed869adb7ddfaea9092f"
+  "gitHead": "61c72544f7cb348803e2f1f71e467bf5aa86ded3"
 }

package/src/cli.mjs

@@ -31,13 +31,18 @@ import {
   windowsPowerShellArgs
 } from "./prerequisites.mjs";
 import {
+  HOST_ROOT_RUNTIME_COMPATIBLE,
   PACKAGE_VERSION,
+  RUNTIME_VERSION,
   UNIVERSAL_COMMAND
 } from "./package-info.mjs";
 
-const APPLICATION_READY_WAIT_MS = 3 * 60 * 1_000;
+const APPLICATION_READY_WAIT_MINUTES = 10;
+const APPLICATION_READY_WAIT_MS = APPLICATION_READY_WAIT_MINUTES * 60 * 1_000;
 const APPLICATION_READY_POLL_MS = 2_000;
 const APPLICATION_READY_MAX_ATTEMPTS = APPLICATION_READY_WAIT_MS / APPLICATION_READY_POLL_MS;
+const APPLICATION_READY_PROGRESS_ATTEMPTS = 30_000 / APPLICATION_READY_POLL_MS;
+const APPLICATION_READY_LOG_INTERVAL_SECONDS = 120;
 const SETUP_STATUS_TIMEOUT_MS = 10_000;
 const trustedCommands = new Set([
   "codesign",
@@ -72,11 +77,13 @@ export async function run(argv, {
   prepareDockerPath = prepareDockerCliPath,
   request = globalThis.fetch,
   sleep = wait,
-  persistSetupToken = writeSetupToken
+  persistSetupToken = writeSetupToken,
+  launcherVersion = PACKAGE_VERSION,
+  runtimeVersion = RUNTIME_VERSION,
+  hostRootRuntimeCompatible = HOST_ROOT_RUNTIME_COMPATIBLE
 } = {}) {
   const [command = "help", ...args] = argv;
   const root = resolveSpaceAppHome({ env, platform });
-  const version = PACKAGE_VERSION;
 
   if (command !== "install") {
     await prepareDockerPath({ platform, env });
@@ -86,13 +93,15 @@ export async function run(argv, {
     return 0;
   }
   if (command === "--version" || command === "-v") {
-    stdout.write(`${version}\n`);
+    stdout.write(`${launcherVersion}\n`);
     return 0;
   }
   if (command === "install") {
     return installCommand(args, {
       root,
-      version,
+      launcherVersion,
+      runtimeVersion,
+      hostRootRuntimeCompatible,
       platform,
       arch,
       env,
@@ -110,7 +119,7 @@ export async function run(argv, {
   }
   if (command === "init") {
     assertNoArgs(args, "init");
-    const result = await initializeInstallation(root, { version });
+    const result = await initializeInstallation(root, { version: runtimeVersion });
     stdout.write(`SpaceApp initialized at ${root}\n`);
     if (result.setupToken) {
       stdout.write(`One-time setup token: ${result.setupToken}\n`);
@@ -163,7 +172,15 @@ export async function run(argv, {
     return ownerCommand(args, { root, config, stdin, stdout, stderr, execute: runtimeExecute });
   }
   if (command === "update") {
-    return updateCommand(args, { root, config, version, stdin, stdout, stderr, execute: runtimeExecute });
+    return updateCommand(args, {
+      root,
+      config,
+      version: runtimeVersion,
+      stdin,
+      stdout,
+      stderr,
+      execute: runtimeExecute
+    });
   }
   if (command === "rollback") {
     assertNoArgs(args, "rollback");
@@ -265,7 +282,9 @@ export async function run(argv, {
 
 async function installCommand(args, {
   root,
-  version,
+  launcherVersion,
+  runtimeVersion,
+  hostRootRuntimeCompatible,
   platform,
   arch,
   env,
@@ -289,6 +308,11 @@ async function installCommand(args, {
   if (accessMode === "host-root" && platform !== "linux") {
     throw new Error("Host-root access is supported only on Linux.");
   }
+  if (accessMode === "host-root" && !hostRootRuntimeCompatible) {
+    throw new Error(
+      "Host-root access is disabled for this launcher-only candidate because its runtime images were not rebuilt. Use --access isolated."
+    );
+  }
   await prepareDockerPath({ platform, env });
   const resources = await inspectResources(root);
   const profile = resolveInstallProfile(requestedProfile, resources.totalMemoryBytes);
@@ -297,11 +321,15 @@ async function installCommand(args, {
       "WARNING: host-root access lets SpaceApp CLI sessions read and modify the entire Linux host through /host, including credentials and system files.\n"
     );
   }
-  const result = await prepareInstallation(root, { version, profile, accessMode });
+  const result = await prepareInstallation(root, {
+    version: runtimeVersion,
+    profile,
+    accessMode
+  });
 
-  stdout.write(`Launcher version: ${version}\n`);
+  stdout.write(`Launcher version: ${launcherVersion}\n`);
   stdout.write(
-    `SpaceApp version: ${existingConfig?.version ?? "not installed"} -> ${result.config.version}\n`
+    `Runtime image version: ${existingConfig?.version ?? "not installed"} -> ${result.config.version}\n`
   );
   stdout.write(
     `Profile: ${existingConfig?.profile ?? "not configured"} -> ${result.config.profile}\n`
@@ -313,7 +341,7 @@ async function installCommand(args, {
     ? "Preserved existing data, workspaces, credentials, secrets, and persistent Docker volumes.\n"
     : "Future refreshes preserve data, workspaces, credentials, secrets, and persistent Docker volumes.\n");
   stdout.write(
-    `Selected profile: ${profile} (${formatGigabytes(resources.totalMemoryBytes)} GB system memory detected).\n`
+    `Selected profile: ${profile} (${formatGibibytes(resources.totalMemoryBytes)} GiB system memory detected).\n`
   );
   stdout.write(`SpaceApp installation root: ${root}\n`);
   if (installResourceChecks(resources).some((check) => !check.ok)) {
@@ -343,12 +371,13 @@ async function installCommand(args, {
     execute,
     installArgs: { root, requestedProfile, requestedAccessMode, noOpen }
   });
-  if (prerequisiteResult.reexecuted || prerequisiteResult.code !== 0) {
-    if (prerequisiteResult.code !== 0) {
-      stderr.write(
-        `Installation stopped before downloading images. Fix the failed checks and run "${UNIVERSAL_COMMAND} install" again.\n`
-      );
-    }
+  if (prerequisiteResult.reexecuted) {
+    return prerequisiteResult.code;
+  }
+  if (prerequisiteResult.code !== 0) {
+    stderr.write(
+      `Installation stopped before downloading images. Fix the failed checks and run "${UNIVERSAL_COMMAND} install" again.\n`
+    );
     return prerequisiteResult.code;
   }
 
@@ -373,6 +402,16 @@ async function installCommand(args, {
   let runtimeMutationAttempted = false;
   const failAfterRuntimeMutation = async (code) => {
     if (runtimeMutationAttempted) {
+      await reportInstallDiagnostics({
+        root,
+        stateRoot: stagedStateRoot,
+        profile,
+        platform,
+        stdin,
+        stdout,
+        stderr,
+        execute
+      });
       await restoreRuntimeAfterFailedInstall({
         root,
         stagedStateRoot,
@@ -390,8 +429,12 @@ async function installCommand(args, {
   };
   try {
     await commitInstallation(stagedStateRoot, result.config);
-    const stagedComposeCommand = (action) =>
-      composeCommand(action, root, { profile, stateRoot: stagedStateRoot });
+    const stagedComposeCommand = (action, options = {}) =>
+      composeCommand(action, root, {
+        profile,
+        stateRoot: stagedStateRoot,
+        ...options
+      });
     const pullCode = await executeWithDockerDiagnostics(
       execute,
       stagedComposeCommand("pull"),
@@ -409,16 +452,60 @@ async function installCommand(args, {
     if (upCode !== 0) return await failAfterRuntimeMutation(upCode);
 
     const url = `http://${result.config.bindHost}:${result.config.port}`;
-    stdout.write("Waiting for SpaceApp services to become ready...\n");
+    stdout.write(
+      `Waiting up to ${APPLICATION_READY_WAIT_MINUTES} minutes for SpaceApp services to become ready...\n`
+    );
     const ready = await waitForApplicationReady({
       url,
       request,
-      sleep
+      sleep,
+      onProgress: async ({ elapsedSeconds }) => {
+        stdout.write(
+          `Still waiting for SpaceApp services (${elapsedSeconds} seconds elapsed; ` +
+          `up to ${APPLICATION_READY_WAIT_MINUTES} minutes)...\n`
+        );
+        try {
+          const statusCode = await executeWithDockerDiagnostics(
+            execute,
+            stagedComposeCommand("status"),
+            { stdin, stdout, stderr },
+            { platform, stderr }
+          );
+          if (statusCode !== 0) {
+            stderr.write(`SpaceApp service status check failed with Docker exit ${statusCode}.\n`);
+          }
+        } catch (error) {
+          stderr.write(
+            `SpaceApp could not collect status diagnostics: ${error?.message || String(error)}.\n`
+          );
+        }
+        if (
+          elapsedSeconds % APPLICATION_READY_LOG_INTERVAL_SECONDS === 0 &&
+          elapsedSeconds < APPLICATION_READY_WAIT_MINUTES * 60
+        ) {
+          stdout.write(`Showing recent startup logs after ${elapsedSeconds} seconds...\n`);
+          try {
+            const logsCode = await executeWithDockerDiagnostics(
+              execute,
+              stagedComposeCommand("logs", { lines: 50 }),
+              { stdin, stdout, stderr },
+              { platform, stderr }
+            );
+            if (logsCode !== 0) {
+              stderr.write(`SpaceApp startup log check failed with Docker exit ${logsCode}.\n`);
+            }
+          } catch (error) {
+            stderr.write(
+              `SpaceApp could not collect logs diagnostics: ${error?.message || String(error)}.\n`
+            );
+          }
+        }
+      }
     });
     if (!ready) {
       stderr.write(
-        "SpaceApp containers started, but the application did not become ready within 3 minutes.\n" +
-        `Run "${UNIVERSAL_COMMAND} status" and "${UNIVERSAL_COMMAND} logs", then run "${UNIVERSAL_COMMAND} install" again.\n`
+        `SpaceApp containers started, but the application did not become ready within ` +
+        `${APPLICATION_READY_WAIT_MINUTES} minutes.\n`
       );
       return await failAfterRuntimeMutation(1);
     }
@@ -512,6 +599,42 @@ async function installCommand(args, {
   }
 }
 
+async function reportInstallDiagnostics({
+  root,
+  stateRoot,
+  profile,
+  platform,
+  stdin,
+  stdout,
+  stderr,
+  execute
+}) {
+  stderr.write("Collecting SpaceApp service status and recent logs before rollback...\n");
+  for (const action of ["status", "logs"]) {
+    try {
+      const code = await executeWithDockerDiagnostics(
+        execute,
+        composeCommand(action, root, {
+          profile,
+          stateRoot,
+          lines: 200
+        }),
+        { stdin, stdout, stderr },
+        { platform, stderr }
+      );
+      if (code !== 0) {
+        stderr.write(
+          `SpaceApp could not collect ${action} diagnostics (Docker exit ${code}).\n`
+        );
+      }
+    } catch (error) {
+      stderr.write(
+        `SpaceApp could not collect ${action} diagnostics: ${error?.message || String(error)}.\n`
+      );
+    }
+  }
+}
+
 async function restoreRuntimeAfterFailedInstall({
   root,
   stagedStateRoot,
@@ -739,8 +862,8 @@ async function ownerCommand(args, { root, config, stdin, stdout, stderr, execute
     );
   }
   const password = await readSecret(stdin, stdout, "New owner password: ");
-  if (password.length < 12) {
-    throw new Error("Owner password must be at least 12 characters.");
+  if (password.length < 6) {
+    throw new Error("Owner password must be at least 6 characters.");
   }
   return execute(composeCommand("resetOwnerPassword", root, { profile: config.profile }), {
     stdin,
@@ -755,11 +878,13 @@ async function updateCommand(args, { root, config, version, stdin, stdout, stder
     throw new Error(`Usage: ${UNIVERSAL_COMMAND} update [version]`);
   }
   const targetVersion = args[0] || version;
-  const updated = {
-    ...config,
-    version: targetVersion,
-    previousVersion: config.version
-  };
+  const updated = targetVersion === config.version
+    ? config
+    : {
+      ...config,
+      version: targetVersion,
+      previousVersion: config.version
+    };
   await writeRuntimeFiles(root, updated);
   const pullCode = await execute(composeCommand("pull", root, { profile: updated.profile }), { stdin, stdout, stderr });
   if (pullCode !== 0) {
@@ -847,6 +972,7 @@ async function waitForApplicationReady({
   url,
   request,
   sleep,
+  onProgress,
   maxAttempts = APPLICATION_READY_MAX_ATTEMPTS
 }) {
   if (typeof request !== "function") {
@@ -876,6 +1002,15 @@ async function waitForApplicationReady({
       }
       if (attempt < maxAttempts && !controller.signal.aborted) {
         await sleep(APPLICATION_READY_POLL_MS);
+        const completedAttempts = attempt + 1;
+        if (
+          typeof onProgress === "function" &&
+          completedAttempts % APPLICATION_READY_PROGRESS_ATTEMPTS === 0
+        ) {
+          await onProgress({
+            elapsedSeconds: completedAttempts * APPLICATION_READY_POLL_MS / 1_000
+          });
+        }
       }
     }
     return false;
@@ -1108,7 +1243,7 @@ function dockerEngineHelp(platform) {
   return `Start Docker Engine, verify the current user can access it, then run "${UNIVERSAL_COMMAND} doctor" again.`;
 }
 
-function formatGigabytes(bytes) {
+function formatGibibytes(bytes) {
   return Math.floor((bytes / 1024 ** 3) * 10) / 10;
 }
 

package/src/index.mjs

@@ -21,8 +21,8 @@ import { UNIVERSAL_COMMAND } from "./package-info.mjs";
 
 const CONFIG_SCHEMA_VERSION = 3;
 const MIN_INSTALL_CPU_COUNT = 4;
-const MIN_INSTALL_MEMORY_BYTES = 8_000_000_000;
-const MIN_INSTALL_MEMORY_LABEL = "8 GB";
+const MIN_INSTALL_MEMORY_BYTES = 7 * 1024 ** 3;
+const MIN_INSTALL_MEMORY_LABEL = "7 GiB usable (8 GB-class system)";
 const MIN_INSTALL_FREE_DISK_BYTES = 15 * 1024 ** 3;
 const PROFILE_RUNTIME_SETTINGS = Object.freeze({
   light: Object.freeze({
@@ -140,12 +140,12 @@ export function installResourceChecks(resources) {
     {
       name: "Memory",
       ok: totalMemoryBytes >= MIN_INSTALL_MEMORY_BYTES,
-      detail: `${formatGibibytes(totalMemoryBytes)} GB available; ${MIN_INSTALL_MEMORY_LABEL} required`
+      detail: `${formatGibibytes(totalMemoryBytes)} GiB available; ${MIN_INSTALL_MEMORY_LABEL} required`
     },
     {
       name: "Free disk",
       ok: freeDiskBytes >= MIN_INSTALL_FREE_DISK_BYTES,
-      detail: `${formatGibibytes(freeDiskBytes)} GB available; ${formatGibibytes(MIN_INSTALL_FREE_DISK_BYTES)} GB required`
+      detail: `${formatGibibytes(freeDiskBytes)} GiB available; ${formatGibibytes(MIN_INSTALL_FREE_DISK_BYTES)} GiB required`
     }
   ];
 }

package/src/package-info.mjs

@@ -4,7 +4,27 @@ const manifest = JSON.parse(
   readFileSync(new URL("../package.json", import.meta.url), "utf8")
 );
 
-export const PACKAGE_VERSION = manifest.version;
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+
+function requireVersion(value, field) {
+  if (typeof value !== "string" || !VERSION_PATTERN.test(value)) {
+    throw new Error(`run-spaceapp package.json must declare a valid ${field}.`);
+  }
+  return value;
+}
+
+export const PACKAGE_VERSION = requireVersion(manifest.version, "version");
+export const RUNTIME_VERSION = requireVersion(
+  manifest.spaceappRuntimeVersion,
+  "spaceappRuntimeVersion"
+);
+if (typeof manifest.spaceappHostRootRuntimeCompatible !== "boolean") {
+  throw new Error(
+    "run-spaceapp package.json must declare spaceappHostRootRuntimeCompatible as a boolean."
+  );
+}
+export const HOST_ROOT_RUNTIME_COMPATIBLE =
+  manifest.spaceappHostRootRuntimeCompatible;
 export const LAUNCHER_DIST_TAG = PACKAGE_VERSION.includes("-hostroot.")
   ? "personal"
   : "latest";

package/src/prerequisites.mjs

@@ -20,6 +20,8 @@ const MAC_DOCKER_DOWNLOADS = Object.freeze({
   x64: "https://desktop.docker.com/mac/main/amd64/Docker.dmg",
   arm64: "https://desktop.docker.com/mac/main/arm64/Docker.dmg"
 });
+const MAC_ADMIN_PASSWORD_PROMPT =
+  "SpaceApp Mac administrator password (input hidden): ";
 // Sources:
 // https://learn.microsoft.com/windows/package-manager/winget/install
 // https://github.com/microsoft/winget-pkgs/tree/master/manifests/d/Docker/DockerDesktop
@@ -444,8 +446,8 @@ async function ensureMacDocker({
       mounted = true;
       const signatureCode = await execute({
         command: "codesign",
-        args: ["--verify", "--deep", "--strict", "--verbose=2", mountedApplication]
-      }, { stdin, stdout: null, stderr });
+        args: ["--verify", "--deep", "--strict", mountedApplication]
+      }, { stdin, stdout: null, stderr: null });
       if (signatureCode !== 0) {
         stderr.write("The Docker Desktop application signature is not valid. Installation was stopped.\n");
         return { code: 1, reexecuted: false };
@@ -453,17 +455,33 @@ async function ensureMacDocker({
       const gatekeeperCode = await execute({
         command: "spctl",
         args: ["--assess", "--type", "execute", "--verbose=4", mountedApplication]
-      }, { stdin, stdout: null, stderr });
+      }, { stdin, stdout: null, stderr: null });
       if (gatekeeperCode !== 0) {
         stderr.write("macOS Gatekeeper did not accept Docker Desktop. Installation was stopped.\n");
         return { code: 1, reexecuted: false };
       }
+      stdout.write("Docker Desktop signature and macOS trust verification passed.\n");
+      stdout.write(
+        "macOS administrator authorization is required to install Docker Desktop.\n" +
+        "Enter the password for your Mac administrator account—not a Docker or SpaceApp password.\n" +
+        "Characters are not displayed while you type. SpaceApp does not read, store, or log this password.\n"
+      );
       const installCode = await execute({
         command: "sudo",
-        args: [installer, "--accept-license", `--user=${username}`]
+        args: [
+          "-p",
+          MAC_ADMIN_PASSWORD_PROMPT,
+          installer,
+          "--accept-license",
+          `--user=${username}`
+        ]
       }, { stdin, stdout, stderr });
       if (installCode !== 0) {
-        stderr.write("Docker Desktop installation failed before SpaceApp downloaded any images.\n");
+        stderr.write(
+          "macOS authorization failed. Docker Desktop must be installed by a Mac administrator account.\n" +
+          "Enter that account's password—not a Docker or SpaceApp password—and rerun the same SpaceApp install command.\n" +
+          "No SpaceApp images were downloaded.\n"
+        );
         return { code: installCode, reexecuted: false };
       }
     } finally {
@@ -553,24 +571,19 @@ async function ensureLinuxDocker({
     stderr.write("A valid non-root Linux username is required for Docker Engine access.\n");
     return { code: 1, reexecuted: false };
   }
-  const accepted = await confirmQuestion({
-    stdin,
-    stdout,
-    question: [
+  stdout.write(
+    [
       "Docker's official post-install flow uses the docker group.",
       "Membership grants root-level privileges on this host.",
-      `Add ${username} to the docker group and continue? [y/N] `
-    ].join("\n")
-  });
-  if (!accepted) {
-    stderr.write("Docker group membership was not changed.\n");
-    return { code: 1, reexecuted: false };
-  }
+      `Adding ${username} to the docker group automatically and continuing.`
+    ].join("\n") + "\n"
+  );
   const groupCode = await execute(
     { command: "sudo", args: ["usermod", "-aG", "docker", username] },
     { stdin, stdout, stderr }
   );
   if (groupCode !== 0) {
+    stderr.write(`SpaceApp could not add ${username} to the docker group.\n`);
     return { code: groupCode, reexecuted: false };
   }