feat(#1116): stream nixos-container create/update output live into build_logs

hive-priv/src/main.rs

@@ -22,9 +22,10 @@ use std::path::{Path, PathBuf};
 use anyhow::{Context as _, Result, bail};
 use hive_sh4re::priv_proto::{
     AGENT_PREFIX, BindMount, JournalOutput, MANAGER_NAME, META_DIR, NetworkIsolation, PRIV_SOCK,
-    PrivRequest, PrivResponse, SIBLING_CONTAINERS,
+    PrivEvent, PrivRequest, PrivResponse, PrivStream, PrivStreamLine, SIBLING_CONTAINERS,
 };
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::unix::OwnedWriteHalf;
 use tokio::net::{UnixListener, UnixStream};
 use tokio::process::Command;
 
@@ -100,8 +101,12 @@ async fn handle(stream: UnixStream) {
     let (reader, mut writer) = stream.into_split();
     let mut lines = BufReader::new(reader).lines();
     while let Ok(Some(line)) = lines.next_line().await {
-        let resp = dispatch(&line).await;
-        let mut json = serde_json::to_string(&resp).unwrap_or_else(|e| {
+        let resp = dispatch(&line, &mut writer).await;
+        // Write the terminal PrivResponse as a PrivEvent::Done. Wire-identical
+        // to a bare PrivResponse (untagged), so old hive-c0re callers that
+        // deserialise directly to PrivResponse continue to work.
+        let event = PrivEvent::Done(resp);
+        let mut json = serde_json::to_string(&event).unwrap_or_else(|e| {
             format!("{{\"ok\":false,\"stdout\":\"\",\"stderr\":\"\",\"error\":\"serialise failed: {e}\"}}")
         });
         json.push('\n');
@@ -112,9 +117,9 @@ async fn handle(stream: UnixStream) {
     }
 }
 
-async fn dispatch(line: &str) -> PrivResponse {
+async fn dispatch(line: &str, writer: &mut OwnedWriteHalf) -> PrivResponse {
     match serde_json::from_str::<PrivRequest>(line) {
-        Ok(req) => match exec(req).await {
+        Ok(req) => match exec(req, writer).await {
             Ok((stdout, stderr)) => PrivResponse {
                 ok: true,
                 stdout,
@@ -137,8 +142,26 @@ async fn dispatch(line: &str) -> PrivResponse {
     }
 }
 
+/// Write one `PrivEvent::Line` to the client. Best-effort: a write
+/// failure is logged but doesn't abort the running subprocess.
+async fn write_line_event(writer: &mut OwnedWriteHalf, stream: PrivStream, data: &str) {
+    let event = PrivEvent::Line(PrivStreamLine {
+        stream,
+        data: data.to_owned(),
+    });
+    if let Ok(mut json) = serde_json::to_string(&event) {
+        json.push('\n');
+        if let Err(e) = writer.write_all(json.as_bytes()).await {
+            tracing::warn!(error = %e, "write_line_event: write failed");
+        }
+    }
+}
+
 /// Execute a validated `PrivRequest`. Returns `(stdout, stderr)` on success.
-async fn exec(req: PrivRequest) -> Result<(String, String)> {
+/// For streaming ops (`CreateContainer`/`UpdateContainer` with `stream: true`)
+/// output lines are forwarded to `writer` as `PrivEvent::Line` messages and
+/// the returned strings are empty.
+async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String, String)> {
     match req {
         PrivRequest::StartContainer { ref name } => {
             validate_container_name(name)?;
@@ -155,28 +178,36 @@ async fn exec(req: PrivRequest) -> Result<(String, String)> {
             container_run(&["kill", &container_system_name(name)]).await
         }
 
-        PrivRequest::UpdateContainer { ref name } => {
+        PrivRequest::UpdateContainer { ref name, stream } => {
             validate_container_name(name)?;
             let flake_ref = agent_flake_ref(name);
-            container_run(&[
+            let args = [
                 "update",
                 &container_system_name(name),
                 "--flake",
                 &flake_ref,
-            ])
-            .await
+            ];
+            if stream {
+                container_run_streaming(&args, writer).await
+            } else {
+                container_run(&args).await
+            }
         }
 
-        PrivRequest::CreateContainer { ref name } => {
+        PrivRequest::CreateContainer { ref name, stream } => {
             validate_container_name(name)?;
             let flake_ref = agent_flake_ref(name);
-            container_run(&[
+            let args = [
                 "create",
                 &container_system_name(name),
                 "--flake",
                 &flake_ref,
-            ])
-            .await
+            ];
+            if stream {
+                container_run_streaming(&args, writer).await
+            } else {
+                container_run(&args).await
+            }
         }
 
         PrivRequest::DestroyContainer { ref name } => {
@@ -332,6 +363,93 @@ async fn container_run(args: &[&str]) -> Result<(String, String)> {
     Ok((stdout, stderr))
 }
 
+/// Invoke `nixos-container` with the given args and forward output lines
+/// to the caller as `PrivEvent::Line` messages in real time, logging each
+/// line to journald as it arrives. Returns `(String::new(), String::new())`
+/// on success (all output was streamed); the error string includes stderr
+/// tail on failure.
+async fn container_run_streaming(
+    args: &[&str],
+    writer: &mut OwnedWriteHalf,
+) -> Result<(String, String)> {
+    use tokio::io::AsyncBufReadExt as _;
+    use tokio::process::Command;
+
+    let mut child = Command::new("nixos-container")
+        .args(args)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .context("invoke nixos-container (streaming)")?;
+
+    let stdout = child.stdout.take().expect("stdout piped");
+    let stderr = child.stderr.take().expect("stderr piped");
+
+    let mut stdout_lines = BufReader::new(stdout).lines();
+    let mut stderr_lines = BufReader::new(stderr).lines();
+
+    // Collect stderr for the error message; stream both to the client.
+    let mut stderr_buf = String::new();
+
+    // Drive stdout and stderr concurrently. `tokio::select!` interleaves
+    // them without bias — both streams drain at roughly the same rate
+    // as the subprocess produces output.
+    loop {
+        tokio::select! {
+            line = stdout_lines.next_line() => {
+                match line {
+                    Ok(Some(l)) => {
+                        tracing::info!(target: "nixos-container", "{l}");
+                        write_line_event(writer, PrivStream::Stdout, &l).await;
+                    }
+                    Ok(None) => break,
+                    Err(e) => {
+                        tracing::warn!(error = %e, "nixos-container stdout read error");
+                        break;
+                    }
+                }
+            }
+            line = stderr_lines.next_line() => {
+                match line {
+                    Ok(Some(l)) => {
+                        tracing::warn!(target: "nixos-container", "{l}");
+                        write_line_event(writer, PrivStream::Stderr, &l).await;
+                        if !stderr_buf.is_empty() {
+                            stderr_buf.push('\n');
+                        }
+                        stderr_buf.push_str(&l);
+                    }
+                    Ok(None) => {}
+                    Err(e) => {
+                        tracing::warn!(error = %e, "nixos-container stderr read error");
+                    }
+                }
+            }
+        }
+    }
+
+    // Drain any remaining stderr after stdout closed.
+    while let Ok(Some(l)) = stderr_lines.next_line().await {
+        tracing::warn!(target: "nixos-container", "{l}");
+        write_line_event(writer, PrivStream::Stderr, &l).await;
+        if !stderr_buf.is_empty() {
+            stderr_buf.push('\n');
+        }
+        stderr_buf.push_str(&l);
+    }
+
+    let status = child.wait().await.context("wait nixos-container")?;
+    if !status.success() {
+        bail!(
+            "nixos-container {} failed ({}): {}",
+            args.join(" "),
+            status,
+            stderr_buf.lines().last().unwrap_or("").trim()
+        );
+    }
+    Ok((String::new(), String::new()))
+}
+
 /// Read a container's journal as root via `journalctl -M`. Returns
 /// `(stdout, stderr)`. Unlike `container_run` a non-zero exit is *not* a
 /// hard error — journalctl's own diagnostic (folded into `stderr` with