🤖 ci: stabilize integration suite (DockerRuntime contract tests)

- Add DockerRuntime to runtime contract integration matrix (reusing ssh fixture container)
- Make runtime contract tests sequential for remote fixtures to avoid timeouts
- Avoid global bun module mocks leaking across tests
- Make lockfile failure test deterministic in CI
- Reduce sendMessage heavy test flake

---
_Generated with `mux` • Model: `openai:gpt-5.2` • Thinking: `xhigh`_

Author: ammar-agent

src/browser/hooks/useDraftWorkspaceSettings.test.ts

@@ -0,0 +1,128 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { act, cleanup, renderHook, waitFor } from "@testing-library/react";
+import { GlobalWindow } from "happy-dom";
+import React from "react";
+import { APIProvider, type APIClient } from "@/browser/contexts/API";
+import { ModeProvider } from "@/browser/contexts/ModeContext";
+import { ThinkingProvider } from "@/browser/contexts/ThinkingContext";
+import { updatePersistedState } from "@/browser/hooks/usePersistedState";
+import { getLastRuntimeConfigKey } from "@/common/constants/storage";
+import { useDraftWorkspaceSettings } from "./useDraftWorkspaceSettings";
+
+function createStubApiClient(): APIClient {
+  // useModelLRU() only needs providers.getConfig + providers.onConfigChanged.
+  // Provide a minimal stub so tests can run without spinning up a real oRPC client.
+  async function* empty() {
+    // no-op
+  }
+
+  return {
+    providers: {
+      getConfig: () => Promise.resolve({}),
+      onConfigChanged: () => Promise.resolve(empty()),
+    },
+  } as unknown as APIClient;
+}
+
+describe("useDraftWorkspaceSettings", () => {
+  beforeEach(() => {
+    globalThis.window = new GlobalWindow() as unknown as Window & typeof globalThis;
+    globalThis.document = globalThis.window.document;
+    globalThis.localStorage = globalThis.window.localStorage;
+    globalThis.localStorage.clear();
+  });
+
+  afterEach(() => {
+    cleanup();
+    globalThis.window = undefined as unknown as Window & typeof globalThis;
+    globalThis.document = undefined as unknown as Document;
+  });
+
+  test("does not reset selected runtime to the default while editing SSH host", async () => {
+    const projectPath = "/tmp/project";
+
+    const wrapper: React.FC<{ children: React.ReactNode }> = (props) => (
+      <APIProvider client={createStubApiClient()}>
+        <ModeProvider projectPath={projectPath}>
+          <ThinkingProvider projectPath={projectPath}>{props.children}</ThinkingProvider>
+        </ModeProvider>
+      </APIProvider>
+    );
+
+    const { result } = renderHook(() => useDraftWorkspaceSettings(projectPath, ["main"], "main"), {
+      wrapper,
+    });
+
+    act(() => {
+      result.current.setSelectedRuntime({ mode: "ssh", host: "dev@host" });
+    });
+
+    await waitFor(() => {
+      expect(result.current.settings.selectedRuntime).toEqual({ mode: "ssh", host: "dev@host" });
+    });
+  });
+
+  test("seeds SSH host from the remembered value when switching modes", async () => {
+    const projectPath = "/tmp/project";
+
+    updatePersistedState(getLastRuntimeConfigKey(projectPath), {
+      ssh: { host: "remembered@host" },
+    });
+
+    const wrapper: React.FC<{ children: React.ReactNode }> = (props) => (
+      <APIProvider client={createStubApiClient()}>
+        <ModeProvider projectPath={projectPath}>
+          <ThinkingProvider projectPath={projectPath}>{props.children}</ThinkingProvider>
+        </ModeProvider>
+      </APIProvider>
+    );
+
+    const { result } = renderHook(() => useDraftWorkspaceSettings(projectPath, ["main"], "main"), {
+      wrapper,
+    });
+
+    act(() => {
+      // Simulate UI switching into ssh mode with an empty field.
+      result.current.setSelectedRuntime({ mode: "ssh", host: "" });
+    });
+
+    await waitFor(() => {
+      expect(result.current.settings.selectedRuntime).toEqual({
+        mode: "ssh",
+        host: "remembered@host",
+      });
+    });
+  });
+
+  test("seeds Docker image from the remembered value when switching modes", async () => {
+    const projectPath = "/tmp/project";
+
+    updatePersistedState(getLastRuntimeConfigKey(projectPath), {
+      docker: { image: "ubuntu:22.04" },
+    });
+
+    const wrapper: React.FC<{ children: React.ReactNode }> = (props) => (
+      <APIProvider client={createStubApiClient()}>
+        <ModeProvider projectPath={projectPath}>
+          <ThinkingProvider projectPath={projectPath}>{props.children}</ThinkingProvider>
+        </ModeProvider>
+      </APIProvider>
+    );
+
+    const { result } = renderHook(() => useDraftWorkspaceSettings(projectPath, ["main"], "main"), {
+      wrapper,
+    });
+
+    act(() => {
+      // Simulate UI switching into docker mode with an empty field.
+      result.current.setSelectedRuntime({ mode: "docker", image: "" });
+    });
+
+    await waitFor(() => {
+      expect(result.current.settings.selectedRuntime).toEqual({
+        mode: "docker",
+        image: "ubuntu:22.04",
+      });
+    });
+  });
+});

src/browser/hooks/useDraftWorkspaceSettings.test.tsx

@@ -190,11 +190,27 @@ export class DockerRuntime extends RemoteRuntime {
     return { process };
   }
 
+  /**
+   * Override buildWriteCommand to preserve symlinks and file permissions.
+   *
+   * This matches SSHRuntime behavior: write through the symlink to the final target,
+   * while keeping the symlink itself intact.
+   */
+  protected buildWriteCommand(quotedPath: string, quotedTempPath: string): string {
+    return `RESOLVED=$(readlink -f ${quotedPath} 2>/dev/null || echo ${quotedPath}) && PERMS=$(stat -c '%a' "$RESOLVED" 2>/dev/null || echo 600) && mkdir -p $(dirname "$RESOLVED") && cat > ${quotedTempPath} && chmod "$PERMS" ${quotedTempPath} && mv ${quotedTempPath} "$RESOLVED"`;
+  }
   // ===== Runtime interface implementations =====
 
   resolvePath(filePath: string): Promise<string> {
-    // Inside container, paths are already absolute
-    // Just return as-is since we use fixed /src path
+    // DockerRuntime uses a fixed workspace base (/src), but we still want reasonable shell-style
+    // behavior for callers that pass "~" or "~/...".
+    if (filePath === "~") {
+      return Promise.resolve("/root");
+    }
+    if (filePath.startsWith("~/")) {
+      return Promise.resolve(path.posix.join("/root", filePath.slice(2)));
+    }
+
     return Promise.resolve(
       filePath.startsWith("/") ? filePath : path.posix.join(CONTAINER_SRC_DIR, filePath)
     );

src/node/runtime/DockerRuntime.ts

@@ -77,22 +77,19 @@ describe("ServerService.startServer", () => {
   }
 
   test("cleans up server when lockfile acquisition fails", async () => {
-    // Skip on Windows where chmod doesn't work the same way
-    if (process.platform === "win32") {
-      return;
-    }
-
     const service = new ServerService();
 
-    // Make muxHome read-only so lockfile.acquire() will fail
-    await fs.chmod(tempDir, 0o444);
+    // Use a muxHome path that is a FILE (not a directory) so lockfile.acquire() fails
+    // after the server has started.
+    const muxHome = path.join(tempDir, "not-a-dir");
+    await fs.writeFile(muxHome, "not a directory");
 
     let thrownError: Error | null = null;
 
     try {
       // Start server - this should fail when trying to write lockfile
       await service.startServer({
-        muxHome: tempDir,
+        muxHome,
         context: stubContext as ORPCContext,
         authToken: "test-token",
         port: 0, // random port
@@ -103,7 +100,7 @@ describe("ServerService.startServer", () => {
 
     // Verify that an error was thrown
     expect(thrownError).not.toBeNull();
-    expect(thrownError!.message).toMatch(/EACCES|permission denied/i);
+    expect(thrownError!.message).toMatch(/ENOTDIR|not a directory|EACCES|permission denied/i);
 
     // Verify the server is NOT left running
     expect(service.isServerRunning()).toBe(false);

src/node/services/serverService.test.ts

@@ -41,8 +41,8 @@ describeIntegration("sendMessage heavy/load tests", () => {
         await withSharedWorkspace(provider, async ({ env, workspaceId, collector }) => {
           // Build up large conversation history to exceed context limit
           // This approach is model-agnostic - it keeps sending until we've built up enough history
-          const largeMessage = "x".repeat(50_000);
-          for (let i = 0; i < 10; i++) {
+          const largeMessage = "x".repeat(70_000);
+          for (let i = 0; i < 8; i++) {
             await sendMessageWithModel(
               env,
               workspaceId,
@@ -101,7 +101,7 @@ describeIntegration("sendMessage heavy/load tests", () => {
           await collector.waitForEvent("stream-end", 30000);
         });
       },
-      180000 // 3 minute timeout for building large history and API calls
+      300000 // 5 minute timeout for building large history and API calls
     );
   });