fix: log stderr from rootless permission repair and make chroot-home removal non-fatal

src/artifact-permissions.test.ts

@@ -39,6 +39,39 @@ describe('artifact-permissions', () => {
     }
   });
 
+  it('logs stderr when permission repair fails', () => {
+    const auditDir = makeTempDir();
+    let warnSpy: jest.SpyInstance | undefined;
+    try {
+      getuidSpy = jest.spyOn(process, 'getuid').mockReturnValue(1001);
+      warnSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+      mockExecaSync.mockReturnValue({ stdout: '', stderr: 'no such image: agent:latest', exitCode: 1 });
+      fixArtifactPermissionsForRootless([auditDir], undefined, undefined, undefined, undefined);
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('no such image: agent:latest'));
+    } finally {
+      warnSpy?.mockRestore();
+      fs.rmSync(auditDir, { recursive: true, force: true });
+    }
+  });
+
+  it('logs exit code without stderr when stderr is empty', () => {
+    const auditDir = makeTempDir();
+    let warnSpy: jest.SpyInstance | undefined;
+    try {
+      getuidSpy = jest.spyOn(process, 'getuid').mockReturnValue(1001);
+      warnSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+      mockExecaSync.mockReturnValue({ stdout: '', stderr: '', exitCode: 1 });
+      fixArtifactPermissionsForRootless([auditDir], undefined, undefined, undefined, undefined);
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringMatching(/failed.*exit 1/i));
+      // Should NOT contain a colon suffix when stderr is empty
+      const warnCall = warnSpy.mock.calls.find(c => typeof c[0] === 'string' && /exit 1/.test(c[0]));
+      expect(warnCall?.[0]).not.toMatch(/exit 1\):/);
+    } finally {
+      warnSpy?.mockRestore();
+      fs.rmSync(auditDir, { recursive: true, force: true });
+    }
+  });
+
   it('runs rootless permission repair with translated mount paths', () => {
     const auditDir = makeTempDir();
     try {

src/artifact-permissions.ts

@@ -34,7 +34,7 @@
   }
 
   const existingDirs = dirs.filter(
     (dir): dir is string => typeof dir === 'string' && dir.length > 0 && fs.existsSync(dir),
   );
   if (existingDirs.length === 0) {
     return;
@@ -65,9 +65,9 @@
           '--cap-add',
           'FOWNER',
           '-e',
           `TUID=${uid}`,
           '-e',
           `TGID=${gid}`,
           '-v',
           mount,
           imageRef,
@@ -79,7 +79,11 @@
       );
 
       if (typeof result.exitCode === 'number' && result.exitCode !== 0) {
-        logger.warn(`Rootless artifact permission repair failed for ${dir} (exit ${result.exitCode})`);
+        const stderr = result.stderr?.trim();
+        logger.warn(
+          `Rootless artifact permission repair failed for ${dir} (exit ${result.exitCode})` +
+            (stderr ? `: ${stderr}` : ''),
+        );
       }
     } catch (error) {
       logger.warn(`Rootless artifact permission repair failed for ${dir}:`, error);

src/artifact-preservation.ts

@@ -13,10 +13,10 @@
 export function preserveIptablesAudit(workDir: string, auditDir?: string): void {
   const iptablesAuditSrc = path.join(workDir, 'init-signal', 'iptables-audit.txt');
   const targetAuditDir = auditDir || path.join(workDir, 'audit');
   if (fs.existsSync(iptablesAuditSrc) && fs.existsSync(targetAuditDir)) {
     try {
       fs.copyFileSync(iptablesAuditSrc, path.join(targetAuditDir, 'iptables-audit.txt'));
       fs.chmodSync(path.join(targetAuditDir, 'iptables-audit.txt'), 0o644);
       logger.debug('Copied iptables audit state to audit directory');
     } catch (error) {
       logger.debug('Could not copy iptables audit file:', error);
@@ -55,7 +55,7 @@
 }: PreserveDirectoryOptions): void {
   if (runtimeDir) {
     const targetDir = runtimeSubdir ? path.join(runtimeDir, runtimeSubdir) : runtimeDir;
     if (!runtimeDirMustExist || fs.existsSync(targetDir)) {
       try {
         execa.sync('chmod', ['-R', 'a+rX', targetDir]);
         logger.info(`${availableLabel} available at: ${targetDir}`);
@@ -68,9 +68,9 @@
 
   const sourceDir = path.join(workDir, workSubdir);
   const destinationDir = path.join(os.tmpdir(), `${destinationBaseName}-${timestamp}`);
   if (fs.existsSync(sourceDir) && fs.readdirSync(sourceDir).length > 0) {
     try {
       fs.renameSync(sourceDir, destinationDir);
       if (chmodPreservedDir) {
         execa.sync('chmod', ['-R', 'a+rX', destinationDir]);
       }
@@ -248,10 +248,13 @@
         try {
           fs.rmSync(chrootHomeDir, { recursive: true, force: true });
         } catch (retryError) {
-          logger.warn('Failed to remove chroot home directory after permission repair:', retryError);
+          // Non-fatal: chroot-home will be cleaned by the post-step
+          // (install_copilot_cli.sh's sudo cleanup) or runner infrastructure.
+          logger.debug(`Could not remove chroot home directory after permission repair: ${chrootHomeDir}`, retryError);
         }
       } else {
-        logger.warn('Failed to remove chroot home directory:', error);
+        // Non-fatal: same reasoning — defer to post-step cleanup.
+        logger.debug('Failed to remove chroot home directory:', error);
       }
     }
   }