@moondeck/station 0.0.1 → 1.0.0

package/images/standard/container/uai-init

@@ -0,0 +1,704 @@
+#!/bin/bash
+# uai-init — prepare a standard-image task container (ADR-022).
+#
+# Runs INSIDE the container (Linux, bash 5 — may use anything). Invoked by
+# the host via `docker exec <app> /usr/local/bin/uai-init` after compose up.
+# Spec: ../../../docs/runtime.md §uai-init.
+#
+# Workspace layout (ADR-022): /workspace/<project-slug>/ — one git worktree
+# per selected project. A 0-project (scratchpad) task has an empty /workspace.
+#
+# Responsibilities:
+#   1. For each /workspace/<slug>/ project, run a dependency-install heuristic
+#      for the folder's stack. task-up has already materialized and verified
+#      its declared runtimes or the image's root defaults before this task
+#      container starts; this script never mutates the shared asdf volume.
+#   2. Launch code-server on 0.0.0.0:8080 (auth disabled — reached only via
+#      the authenticated tunnel), opening /workspace.
+#
+# Best-effort + idempotent: an ordinary failing folder logs and is skipped.
+# Re-running when things are already up is a no-op. A host runtime-authority
+# violation exits 78 so task-up/recovery can quarantine the task instead of
+# starting agents against a runtime context that was never proved.
+
+set -uo pipefail
+
+WORKSPACE="${UAI_WORKSPACE:-/workspace}"
+RUNTIME_PROJECTS="${UAI_RUNTIME_PROJECTS:-/run/uai/runtime-projects}"
+
+# Compose owns runtime/cache selection. Reassert it here for rolling recovery
+# and remove every inherited asdf/Corepack/npm authority variable before any
+# dependency command resolves a runtime. No command in this script installs or
+# reshims. Direct source-tree tests may prepend stubs; the packaged path never
+# honors those test-only seams. Bash does not import environment names that
+# contain `-`, but npm treats LOGS-DIR and LOGS_DIR as the same setting. Strip
+# every owned spelling with GNU/BSD env before continuing, then export only
+# Uai's exact canonical names. Unrelated registry/auth npm config survives.
+npm_sanitize_args=()
+while IFS= read -r -d '' environment_entry; do
+  environment_name=${environment_entry%%=*}
+  case "$environment_name" in
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Ll][Oo][Gg][Ss][_-][Dd][Ii][Rr] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Uu][Mm][Aa][Ss][Kk])
+      npm_sanitize_args+=( -u "$environment_name" )
+      ;;
+  esac
+done < <(/usr/bin/env -0)
+if [ "${#npm_sanitize_args[@]}" -gt 0 ]; then
+  exec /usr/bin/env "${npm_sanitize_args[@]}" \
+    /bin/bash "${BASH_SOURCE[0]}" "$@"
+fi
+
+# Parse the role only after the one-time sanitized re-exec above. Parsing it
+# first would shift away --dependency-worker, causing the clean process to
+# restart as the main/editor role whenever inherited npm authority was
+# present (the normal task environment).
+UAI_INIT_ROLE=main
+case ${1-} in
+  --dependency-worker)
+    UAI_INIT_ROLE=dependency-worker
+    shift
+    ;;
+  "") ;;
+  *)
+    printf '%s\n' 'uai-init: invalid invocation' >&2
+    exit 64
+    ;;
+esac
+[ "$#" -eq 0 ] || {
+  printf '%s\n' 'uai-init: invalid invocation' >&2
+  exit 64
+}
+
+for runtime_var in $(compgen -A variable 2>/dev/null); do
+  case "$runtime_var" in
+    ASDF_* | COREPACK_* | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Pp][Rr][Ee][Ff][Ii][Xx] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Cc][Aa][Cc][Hh][Ee] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Ll][Oo][Gg][Ss]_[Dd][Ii][Rr] | \
+    [Nn][Pp][Mm]_[Cc][Oo][Nn][Ff][Ii][Gg]_[Uu][Mm][Aa][Ss][Kk])
+      unset "$runtime_var"
+      ;;
+  esac
+done
+unset LD_PRELOAD LD_AUDIT LD_LIBRARY_PATH NODE_OPTIONS NODE_PATH PS4 BASH_ENV ENV
+case "${BASH_SOURCE[0]}" in
+  /usr/local/bin/uai-init | /uai-init-current) export HOME=/home/node ;;
+esac
+export XDG_CONFIG_HOME="$HOME/.config"
+export XDG_DATA_HOME="$HOME/.local/share"
+export XDG_CACHE_HOME="$HOME/.cache"
+export ASDF_DIR=/opt/asdf
+export ASDF_DATA_DIR=/opt/asdf-data
+export ASDF_CONFIG_FILE=/dev/null
+export ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions
+export ASDF_NODEJS_VERSION=
+export ASDF_PYTHON_VERSION=
+export ASDF_GOLANG_VERSION=
+export ASDF_RUBY_VERSION=
+export ASDF_RUST_VERSION=
+export ASDF_SKIP_RESHIM=1
+export COREPACK_HOME=/opt/asdf-data/corepack
+export COREPACK_DEFAULT_TO_LATEST=0
+export COREPACK_ENV_FILE=0
+export COREPACK_NPM_REGISTRY=https://registry.npmjs.org
+export COREPACK_ENABLE_NETWORK=0
+export COREPACK_ENABLE_AUTO_PIN=0
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export COREPACK_ENABLE_PROJECT_SPEC=1
+export COREPACK_ENABLE_STRICT=1
+export COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0
+export COREPACK_INTEGRITY_CHECK=1
+export NPM_CONFIG_PREFIX="$HOME/.local/share/uai-npm"
+export npm_config_prefix="$NPM_CONFIG_PREFIX"
+export NPM_CONFIG_CACHE="$HOME/.cache/uai-npm"
+export npm_config_cache="$NPM_CONFIG_CACHE"
+export NPM_CONFIG_LOGS_DIR="$NPM_CONFIG_CACHE/_logs"
+export npm_config_logs_dir="$NPM_CONFIG_LOGS_DIR"
+export NPM_CONFIG_UMASK=0002
+export npm_config_umask=0002
+export NODE_OPTIONS=
+export NODE_PATH=
+export PATH="/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$NPM_CONFIG_PREFIX/bin"
+# Fixed here, not from the environment: the packaged path must not let a
+# forged mount table or lower path defeat the shared-cache backstop below.
+UAI_PROC_MOUNTS=/proc/mounts
+UAI_ASDF_LOWER_DIR=/run/uai/asdf-lower
+case "${BASH_SOURCE[0]}" in
+  /usr/local/bin/uai-init | /uai-init-current) ;;
+  *)
+    if [ -n "${UAI_INIT_TEST_ASDF_DATA_DIR:-}" ]; then
+      export ASDF_DATA_DIR="$UAI_INIT_TEST_ASDF_DATA_DIR"
+      export COREPACK_HOME="$ASDF_DATA_DIR/corepack"
+    fi
+    if [ -n "${UAI_INIT_TEST_PATH:-}" ]; then
+      export PATH="$UAI_INIT_TEST_PATH:$PATH"
+    fi
+    if [ -n "${UAI_INIT_TEST_PROC_MOUNTS:-}" ]; then
+      UAI_PROC_MOUNTS="$UAI_INIT_TEST_PROC_MOUNTS"
+    fi
+    if [ -n "${UAI_INIT_TEST_ASDF_LOWER_DIR:-}" ]; then
+      UAI_ASDF_LOWER_DIR="$UAI_INIT_TEST_ASDF_LOWER_DIR"
+    fi
+    ;;
+esac
+UAI_ENV_EXEC=/usr/local/bin/uai-env-exec
+UAI_ENV_HOOK_FILE=/usr/local/share/uai/env-hook.sh
+MANAGED_ENV_KEYS=/run/uai/managed-env-keys
+UAI_INIT_SELF=/usr/local/bin/uai-init
+case "${BASH_SOURCE[0]}" in
+  /usr/local/bin/uai-init | /uai-init-current) ;;
+  *)
+    UAI_INIT_SELF=${BASH_SOURCE[0]}
+    [ -z "${UAI_INIT_TEST_ENV_EXEC:-}" ] \
+      || UAI_ENV_EXEC=$UAI_INIT_TEST_ENV_EXEC
+    [ -z "${UAI_INIT_TEST_ENV_HOOK:-}" ] \
+      || UAI_ENV_HOOK_FILE=$UAI_INIT_TEST_ENV_HOOK
+    [ -z "${UAI_INIT_TEST_MANAGED_ENV_KEYS:-}" ] \
+      || MANAGED_ENV_KEYS=$UAI_INIT_TEST_MANAGED_ENV_KEYS
+    ;;
+esac
+ASDF_SH="$ASDF_DIR/asdf.sh"
+
+log() { echo "uai-init: $*"; }
+
+reject_writable_shared_runtime_cache() {
+  # The host proves the Docker mount metadata before invoking us. Keep an
+  # in-container backstop as well so a current initializer staged into a
+  # legacy/recovered container cannot become a shared-cache writer. This is a
+  # metadata/access check only: never create even a temporary shared file.
+  if [ ! -d "$ASDF_DATA_DIR" ]; then
+    log "error: shared runtime cache is missing; refusing dependency or editor startup"
+    return 1
+  fi
+  # ADR-108 (apple): /opt/asdf-data is an in-guest overlay — writable BY
+  # DESIGN, with every write landing in the task-private upper layer. That is
+  # safe exactly when the overlay is real (this mount table, not trust) and
+  # its lower is the read-only shared attachment; the shared volume then
+  # still cannot be written from this container. Any other writable shape
+  # remains the violation it always was.
+  # /usr/bin paths: present on both merged-usr Debian (in-container) and
+  # macOS (the direct source-tree test harness). Token-exact matching against
+  # comma-delimited mount options — substring matching accepted
+  # lowerdir=<lower>-evil — plus exactly ONE effective mount at the merged
+  # path (a later mount would shadow the proven one).
+  local overlay_lines="" any_lines="" overlay_opts=""
+  overlay_lines=$(/usr/bin/grep -c "^overlay ${ASDF_DATA_DIR} overlay " \
+    "$UAI_PROC_MOUNTS" 2>/dev/null) || overlay_lines=0
+  if [ "$overlay_lines" != "0" ]; then
+    if [ "$overlay_lines" != "1" ]; then
+      log "error: expected exactly one shared runtime cache overlay, found $overlay_lines; refusing dependency or editor startup"
+      return 1
+    fi
+    any_lines=$(/usr/bin/grep -c " ${ASDF_DATA_DIR} " "$UAI_PROC_MOUNTS" \
+      2>/dev/null) || any_lines=0
+    if [ "$any_lines" != "1" ]; then
+      log "error: unexpected extra mounts at the shared runtime cache; refusing dependency or editor startup"
+      return 1
+    fi
+    overlay_opts=$(/usr/bin/grep "^overlay ${ASDF_DATA_DIR} overlay " \
+      "$UAI_PROC_MOUNTS" | /usr/bin/cut -d" " -f4)
+    case ",$overlay_opts," in
+      *",lowerdir=${UAI_ASDF_LOWER_DIR},"*) ;;
+      *)
+        log "error: shared runtime cache overlay has a foreign lower; refusing dependency or editor startup"
+        return 1
+        ;;
+    esac
+    case ",$overlay_opts," in
+      *",upperdir=/var/lib/uai/asdf-upper,"*) ;;
+      *)
+        log "error: shared runtime cache overlay has a foreign upper; refusing dependency or editor startup"
+        return 1
+        ;;
+    esac
+    case ",$overlay_opts," in
+      *",workdir=/var/lib/uai/asdf-work,"*) ;;
+      *)
+        log "error: shared runtime cache overlay has a foreign workdir; refusing dependency or editor startup"
+        return 1
+        ;;
+    esac
+    if [ ! -d "$UAI_ASDF_LOWER_DIR" ]; then
+      log "error: shared runtime cache lower attachment is missing; refusing dependency or editor startup"
+      return 1
+    fi
+    if [ -w "$UAI_ASDF_LOWER_DIR" ]; then
+      log "error: shared runtime cache lower attachment is writable; refusing dependency or editor startup"
+      return 1
+    fi
+    return 0
+  fi
+  if [ -w "$ASDF_DATA_DIR" ]; then
+    log "error: shared runtime cache is writable in the task container; refusing dependency or editor startup"
+    return 1
+  fi
+}
+
+prepare_private_npm_authority() {
+  local path prefix_probe="" cache_probe="" logs_probe=""
+
+  # These directories live in the task container layer, never on the shared
+  # asdf volume. Reject redirects before mkdir, then prove both exact write
+  # targets. The task has not started any agents yet, so there is no concurrent
+  # task process that can race these checks.
+  for path in \
+    "$HOME/.local" \
+    "$HOME/.local/share" \
+    "$NPM_CONFIG_PREFIX" \
+    "$HOME/.cache" \
+    "$NPM_CONFIG_CACHE" \
+    "$NPM_CONFIG_LOGS_DIR"
+  do
+    if [ -L "$path" ] || { [ -e "$path" ] && [ ! -d "$path" ]; }; then
+      log "error: private npm authority path is unsafe: $path"
+      return 1
+    fi
+  done
+
+  if ! /bin/mkdir -p -- \
+    "$NPM_CONFIG_PREFIX/bin" "$NPM_CONFIG_CACHE" "$NPM_CONFIG_LOGS_DIR"; then
+    log "error: could not prepare the private npm prefix/cache"
+    return 1
+  fi
+  for path in \
+    "$NPM_CONFIG_PREFIX" \
+    "$NPM_CONFIG_PREFIX/bin" \
+    "$NPM_CONFIG_CACHE" \
+    "$NPM_CONFIG_LOGS_DIR"
+  do
+    if [ -L "$path" ] || [ ! -d "$path" ]; then
+      log "error: private npm authority path changed during preparation: $path"
+      return 1
+    fi
+  done
+
+  prefix_probe=$(/usr/bin/mktemp \
+    "$NPM_CONFIG_PREFIX/.uai-write-probe.XXXXXX") || {
+      log "error: private npm prefix is not writable"
+      return 1
+    }
+  cache_probe=$(/usr/bin/mktemp \
+    "$NPM_CONFIG_CACHE/.uai-write-probe.XXXXXX") || {
+      /bin/rm -f -- "$prefix_probe"
+      log "error: private npm cache is not writable"
+      return 1
+    }
+  logs_probe=$(/usr/bin/mktemp \
+    "$NPM_CONFIG_LOGS_DIR/.uai-write-probe.XXXXXX") || {
+      /bin/rm -f -- "$prefix_probe" "$cache_probe"
+      log "error: private npm logs directory is not writable"
+      return 1
+    }
+  /bin/rm -f -- "$prefix_probe" "$cache_probe" "$logs_probe"
+}
+
+reject_workspace_runtime_shadow() {
+  local shadow="$WORKSPACE/.tool-versions"
+  # The root is never a selected project. Any entry here changes asdf lookup
+  # for no-manifest projects without being part of the pre-start proof. Check
+  # metadata only so a FIFO/socket/device cannot block initialization.
+  if [ -L "$shadow" ] || [ -e "$shadow" ]; then
+    log "error: workspace-root .tool-versions appeared after runtime proof; refusing dependency or editor startup"
+    return 1
+  fi
+}
+
+# Fail before sourcing asdf or executing any project input if this is an old
+# writable task mount, or if task-private npm state redirects somewhere else.
+reject_writable_shared_runtime_cache || exit 78
+prepare_private_npm_authority || exit 78
+
+# Make asdf + its shims available to this non-interactive shell. A bare
+# `docker exec` sources no profile, so source asdf explicitly here.
+if [ -f "$ASDF_SH" ]; then
+  # shellcheck disable=SC1090
+  . "$ASDF_SH"
+else
+  log "warning: asdf not found at $ASDF_SH; dependency runtime resolution may fail"
+fi
+
+# ---------------------------------------------------------------------------
+# 0. Git transport selection (ADR-027). A connected user's App token is the
+#    primary clone/fetch/push credential over HTTPS; the host writes it into
+#    gh's private config and runs `gh auth setup-git` before agents start. SSH
+#    transport is only the no-GitHub-connection fallback. The SSH key remains
+#    useful in either mode for commit/tag signing.
+# ---------------------------------------------------------------------------
+
+if [ "$UAI_INIT_ROLE" = main ]; then
+if [ "${UAI_SKIP_GIT_TRANSPORT:-0}" = "1" ]; then
+  # Recovery/connect/disconnect reconciles the current credential immediately
+  # before invoking us. Do not overwrite that live decision with the static
+  # transport marker captured when Compose was first created.
+  log "keeping the reconciled GitHub transport"
+elif [ "${UAI_GIT_TRANSPORT:-anonymous}" = "ssh" ]; then
+  # Remove a prior token-mode reverse rewrite if this container is being
+  # repaired after disconnect, then route canonical HTTPS origins over SSH.
+  /usr/bin/git config --global --unset-all url."https://github.com/".insteadOf \
+    >/dev/null 2>&1 || true
+  /usr/bin/git config --global url."git@github.com:".insteadOf "https://github.com/"
+  /usr/bin/git config --global core.sshCommand "/usr/bin/ssh -o StrictHostKeyChecking=accept-new"
+  log "using SSH as the GitHub transport fallback"
+else
+  # Heal containers created by the old SSH-only policy. Canonical origins are
+  # HTTPS; reverse legacy SSH URLs (including submodules) through gh as well.
+  /usr/bin/git config --global --unset-all url."git@github.com:".insteadOf \
+    >/dev/null 2>&1 || true
+  /usr/bin/git config --global --unset-all core.sshCommand >/dev/null 2>&1 || true
+  /usr/bin/git config --global --replace-all url."https://github.com/".insteadOf \
+    "git@github.com:"
+  /usr/bin/git config --global --add url."https://github.com/".insteadOf \
+    "ssh://git@github.com/"
+  if [ "${UAI_GIT_TRANSPORT:-}" = "https" ]; then
+    log "using the connected GitHub credential for HTTPS Git"
+  else
+    log "using anonymous HTTPS Git for public repositories"
+  fi
+fi
+
+# Signed commits (policy): when the uai SSH identity is present, configure git
+# to SSH-sign every commit + tag with it. The pubkey is registered on GitHub
+# so commits show as Verified. Signing is independent of Git transport.
+if [ -f "$HOME/.ssh/id_ed25519.pub" ]; then
+  log "enabling SSH commit signing with the uai identity"
+  /usr/bin/git config --global gpg.format ssh
+  /usr/bin/git config --global user.signingkey "$HOME/.ssh/id_ed25519.pub"
+  /usr/bin/git config --global commit.gpgsign true
+  /usr/bin/git config --global tag.gpgsign true
+fi
+
+# Attribution policy: never co-author with the agents. Claude Code honors
+# `includeCoAuthoredBy: false` (drops the "Co-Authored-By: Claude" commit
+# trailer and the "Generated with Claude Code" PR footer). Seed it into the
+# per-task Claude user settings if absent. Codex is covered by the
+# orchestrator's system preamble.
+cc_settings="$HOME/.claude/settings.json"
+if [ ! -f "$cc_settings" ]; then
+  mkdir -p "$HOME/.claude"
+  printf '{\n  "includeCoAuthoredBy": false\n}\n' > "$cc_settings"
+  log "seeded ~/.claude/settings.json (includeCoAuthoredBy: false)"
+fi
+fi
+
+# ---------------------------------------------------------------------------
+# 1. Per-folder dependency install (runtimes are already materialized).
+# ---------------------------------------------------------------------------
+
+install_node_deps() {
+  # Pick the package manager from the packageManager field, else a lockfile,
+  # else npm. corepack provisions pnpm/yarn from the packageManager field.
+  local pm=""
+  if [ -f package.json ]; then
+    pm=$(jq -r '.packageManager // ""' package.json 2>/dev/null | sed 's/@.*//')
+  fi
+  if [ -z "$pm" ]; then
+    if [ -f pnpm-lock.yaml ]; then pm="pnpm"
+    elif [ -f yarn.lock ]; then pm="yarn"
+    elif [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then pm="npm"
+    elif [ -f bun.lockb ] || [ -f bun.lock ]; then pm="bun"
+    else pm="npm"
+    fi
+  fi
+
+  case "$pm" in
+    pnpm) log "pnpm install"; pnpm install ;;
+    yarn) log "yarn install"; yarn install ;;
+    bun)  log "bun install";  bun install ;;
+    *)    log "npm install";  npm install --no-audit --no-fund ;;
+  esac
+}
+
+install_python_deps() {
+  # uv handles both requirements.txt and pyproject.toml; create a project .venv
+  # so the install is isolated to the folder. Pin uv to ASDF's Python (the
+  # version asdf just resolved from the in-scope .tool-versions) so the venv
+  # matches the project's declared runtime. uv otherwise selects via
+  # .python-version / requires-python, which can disagree with .tool-versions
+  # (or be junk, e.g. a stray pyenv-virtualenv name) — asdf is the authority.
+  local py
+  py="$(asdf which python 2>/dev/null || true)"
+  if [ -f pyproject.toml ]; then
+    log "uv sync (pyproject.toml)${py:+ — asdf python $py}"
+    if [ -n "$py" ]; then uv sync --python "$py"; else uv sync; fi
+  elif [ -f requirements.txt ]; then
+    log "uv venv + pip install -r requirements.txt${py:+ — asdf python $py}"
+    if [ -n "$py" ]; then uv venv --python "$py"; else uv venv; fi \
+      && uv pip install -r requirements.txt
+  fi
+}
+
+install_folder_deps() {
+  local dir="$1" name
+  name=$(basename "$dir")
+
+  # Enter the folder; asdf auto-resolves either its already-materialized local
+  # declarations or the already-proven root image defaults.
+  cd "$dir" || { log "cannot cd into $name — skipping"; return; }
+
+  # Dependency-install heuristic. Run every matcher that applies (a polyglot
+  # folder may have more than one); each is independently best-effort.
+  if [ -f package.json ]; then
+    install_node_deps || log "node deps failed in $name — continuing"
+  fi
+  if [ -f pyproject.toml ] || [ -f requirements.txt ]; then
+    install_python_deps || log "python deps failed in $name — continuing"
+  fi
+  if [ -f Cargo.toml ]; then
+    log "cargo build ($name)"
+    cargo build || log "cargo build failed in $name — continuing"
+  fi
+  if [ -f go.mod ]; then
+    log "go mod download ($name)"
+    go mod download || log "go mod download failed in $name — continuing"
+  fi
+}
+
+reject_workspace_runtime_shadow || exit 78
+
+# ADR-122: dependency installs leave the task-start critical path. The loop
+# below runs in a DETACHED background process so uai-init (and with it
+# task-up) returns as soon as the cheap, provable work is done — the editor
+# and the agents start immediately, warm or cold. Progress is observable in
+# the workspace itself:
+#
+#   $WORKSPACE/.moondeck/init/deps-status   running | done | failed | authority-violation
+#   $WORKSPACE/.moondeck/init/deps.log      the full install transcript
+#
+# The runtime-authority posture narrows deliberately: the synchronous
+# workspace-shadow proofs above and below still exit 78 (task-up
+# quarantines), but a shadow that APPEARS MID-INSTALL can no longer stop the
+# task — agents are already running by then, and an agent could author the
+# same shadow a second later anyway. The runner still refuses to run any
+# further dependency command under a shadowed root and records
+# `authority-violation`; the shared asdf volume stays read-only-proven
+# regardless.
+run_workspace_installs() {
+  local seen_runtime_projects="|" project_slug folder git_marker
+  while IFS= read -r project_slug || [ -n "$project_slug" ]; do
+    if [[ ! "$project_slug" =~ ^[a-z0-9-]{1,64}$ ]]; then
+      log "warning: unsafe runtime-project allowlist entry — skipping"
+      continue
+    fi
+    case "$seen_runtime_projects" in
+      *"|$project_slug|"*)
+        log "warning: duplicate runtime-project entry $project_slug — skipping"
+        continue
+        ;;
+    esac
+    seen_runtime_projects="${seen_runtime_projects}${project_slug}|"
+    folder="$WORKSPACE/$project_slug"
+    git_marker="$folder/.git"
+    if [ -L "$folder" ] || [ ! -d "$folder" ] || [ -L "$git_marker" ] \
+       || { [ ! -f "$git_marker" ] && [ ! -d "$git_marker" ]; }; then
+      log "warning: allowlisted project $project_slug is not a safe Git worktree — skipping"
+      continue
+    fi
+    if ! reject_workspace_runtime_shadow; then
+      printf 'authority-violation\n' > "$deps_status_file"
+      return 78
+    fi
+    # Run in a subshell so a `cd` (or a failing command under the relaxed
+    # error mode) in one folder never leaks into the next.
+    ( install_folder_deps "$folder" )
+  done < "$RUNTIME_PROJECTS"
+  return 0
+}
+
+# The detached worker is the only uai-init role that receives project env.
+# Its caller has already used uai-env-exec to perform one authenticated
+# refresh; this role does no editor or Git-control-plane work and exits after
+# the installs. Paths are repeated here because a fresh process cannot inherit
+# the parent's shell locals.
+if [ "$UAI_INIT_ROLE" = dependency-worker ]; then
+  deps_state_dir="$WORKSPACE/.moondeck/init"
+  deps_status_file="$deps_state_dir/deps-status"
+  run_workspace_installs
+  exit $?
+fi
+
+if [ -d "$WORKSPACE" ] && [ -f "$RUNTIME_PROJECTS" ] \
+   && [ ! -L "$RUNTIME_PROJECTS" ]; then
+  deps_state_dir="$WORKSPACE/.moondeck/init"
+  deps_status_file="$deps_state_dir/deps-status"
+  deps_log_file="$deps_state_dir/deps.log"
+  deps_lock_dir="$deps_state_dir/deps.lock.d"
+  mkdir -p "$deps_state_dir"
+
+  # One runner at a time. uai-init is re-runnable (task-up retry, recovery),
+  # and each re-run SHOULD refresh dependencies — but never concurrently.
+  # mkdir is the portable atomic lock; a pid that no longer answers marks a
+  # crashed runner whose lock is stale and may be stolen.
+  deps_spawn=1
+  if mkdir "$deps_lock_dir" 2>/dev/null; then
+    # Hold the lock as ourselves until the runner's pid replaces it, so a
+    # concurrent uai-init never reads an empty pid file as a stale lock.
+    printf '%s\n' "$$" > "$deps_lock_dir/pid"
+  else
+    deps_holder=$(cat "$deps_lock_dir/pid" 2>/dev/null || true)
+    if [ -n "$deps_holder" ] && kill -0 "$deps_holder" 2>/dev/null; then
+      log "dependency install already running (pid $deps_holder) — leaving it be"
+      deps_spawn=0
+    else
+      rm -rf "$deps_lock_dir"
+      if mkdir "$deps_lock_dir" 2>/dev/null; then
+        printf '%s\n' "$$" > "$deps_lock_dir/pid"
+      else
+        log "warning: could not acquire the dependency install lock — skipping installs"
+        deps_spawn=0
+      fi
+    fi
+  fi
+  if [ "$deps_spawn" -eq 1 ]; then
+    printf 'running\n' > "$deps_status_file"
+    log "installing workspace dependencies in the background (status: $deps_status_file, log: $deps_log_file)"
+    (
+      trap 'rm -rf "$deps_lock_dir"' EXIT
+      deps_rc=0
+      if [ "${UAI_ENV_MODE:-baked}" = loader ]; then
+        UAI_ENV_HOOK=1 \
+        BASH_ENV="$UAI_ENV_HOOK_FILE" \
+        SHELL=/usr/bin/zsh \
+          "$UAI_ENV_EXEC" "$UAI_INIT_SELF" --dependency-worker \
+          || deps_rc=$?
+      else
+        run_workspace_installs || deps_rc=$?
+      fi
+      if [ "$deps_rc" -eq 0 ]; then
+        printf 'done\n' > "$deps_status_file"
+        log "workspace dependency install complete"
+      elif [ "$deps_rc" -ne 78 ]; then
+        printf 'failed\n' > "$deps_status_file"
+        log "workspace dependency install failed (exit $deps_rc)"
+      fi
+    ) >>"$deps_log_file" 2>&1 </dev/null &
+    printf '%s\n' "$!" > "$deps_lock_dir/pid"
+    disown
+  fi
+elif [ ! -d "$WORKSPACE" ]; then
+  log "workspace $WORKSPACE missing — scratchpad/no-project task, skipping installs"
+else
+  log "warning: trusted runtime-project allowlist missing or unsafe — skipping installs"
+fi
+
+reject_workspace_runtime_shadow || exit 78
+
+# ---------------------------------------------------------------------------
+# 2. code-server — the Editor pane. Bound to 0.0.0.0:8080, auth disabled
+#    (reached only through the authenticated tunnel / editor proxy). Opens
+#    /workspace so all worktrees are visible at the top level. Idempotent:
+#    skips launch if already running.
+# ---------------------------------------------------------------------------
+
+editor_root="$WORKSPACE"
+[ -d "$editor_root" ] || editor_root="/home/node"
+
+# Keep code-server on Uai's managed data path even when a project declares
+# XDG_DATA_HOME. Otherwise code-server starts with a fresh profile elsewhere,
+# which restores the light theme and Workspace Trust prompt.
+cs_data_dir="$HOME/.local/share/code-server"
+cs_user_dir="$cs_data_dir/User"
+cs_seed="/usr/local/share/uai/code-server-settings.json"
+# The source-tree sibling keeps direct smoke tests and development runs on the
+# same seed as the packaged image; the image always uses the root-owned path.
+cs_source_seed="$(dirname "${BASH_SOURCE[0]}")/code-server-settings.json"
+if [ ! -f "$cs_seed" ] && [ -f "$cs_source_seed" ]; then
+  cs_seed="$cs_source_seed"
+fi
+
+# ADR-091: seed the Editor pane in the palette the task was created from.
+# UAI_EDITOR_THEME carries a VS Code theme LABEL ("Quiet Light"), already
+# resolved cloud-side from the theme registry — the container never maps a Uai
+# palette id and never sees a raw user string. Unset is the normal state for a
+# task created before this shipped or outside a browser; the seed's own baked
+# default then stands.
+#
+# Applied ONLY while seeding. An existing settings.json is still left entirely
+# alone, so a user's own editor tweaks survive a restart — which is also why
+# changing the app's palette later does not re-theme an already-created task
+# (docs/theming.md). If jq is missing or the filter fails, fall through to the
+# plain copy: a themed editor is worth less than an editor that starts.
+seed_code_server_settings() {
+  local seed="$1" dest="$2" theme="${UAI_EDITOR_THEME:-}"
+  if [ -n "$theme" ] && command -v jq >/dev/null 2>&1; then
+    if jq --arg theme "$theme" '.["workbench.colorTheme"] = $theme' \
+      "$seed" >"$dest.tmp" 2>/dev/null && [ -s "$dest.tmp" ]; then
+      mv "$dest.tmp" "$dest"
+      log "seeded code-server settings (theme: $theme)"
+      return 0
+    fi
+    rm -f "$dest.tmp"
+    log "warning: could not apply UAI_EDITOR_THEME=$theme; using image default"
+  fi
+  cp "$seed" "$dest" || return 1
+  log "seeded code-server settings"
+}
+
+if [ ! -f "$cs_user_dir/settings.json" ]; then
+  if [ ! -f "$cs_seed" ]; then
+    log "warning: code-server settings seed missing at $cs_seed"
+  elif mkdir -p "$cs_user_dir" &&
+    seed_code_server_settings "$cs_seed" "$cs_user_dir/settings.json"; then
+    :
+  else
+    log "warning: could not seed code-server settings at $cs_user_dir/settings.json"
+  fi
+fi
+
+if pgrep -f 'code-server.*--bind-addr' >/dev/null 2>&1; then
+  log "code-server already running"
+else
+  log "launching code-server on 0.0.0.0:8080"
+  # Compose deliberately replaces the image PATH with Uai's runtime authority
+  # path, which excludes task-writable home bins. code-server is an image-owned
+  # standalone install, so invoke its exact baked path instead of relying on
+  # PATH. A source-tree test invocation may resolve its isolated stub, but the
+  # two production destinations never consult PATH for this executable.
+  code_server_bin=/home/node/.local/bin/code-server
+  case "${BASH_SOURCE[0]}" in
+    /usr/local/bin/uai-init | /uai-init-current) ;;
+    *)
+      test_code_server_bin=$(command -v code-server 2>/dev/null || true)
+      [ -z "$test_code_server_bin" ] || code_server_bin="$test_code_server_bin"
+      ;;
+  esac
+  code_server_env=()
+  if [ "${UAI_ENV_MODE:-baked}" = loader ]; then
+    if [ -L "$MANAGED_ENV_KEYS" ] || [ ! -f "$MANAGED_ENV_KEYS" ]; then
+      log "error: managed env key list is unavailable; refusing editor startup"
+      exit 78
+    fi
+    code_server_env=(/usr/bin/env)
+    while IFS= read -r managed_name || [ -n "$managed_name" ]; do
+      case $managed_name in
+        ''|[!A-Za-z_]*|*[!A-Za-z0-9_]*)
+          log "error: managed env key list is invalid; refusing editor startup"
+          exit 78
+          ;;
+      esac
+      code_server_env+=( -u "$managed_name" )
+    done < "$MANAGED_ENV_KEYS"
+    code_server_env+=(
+      -u __UAI_ENV_KEYS
+      -u __UAI_ENV_ETAG
+      UAI_ENV_HOOK=1
+      "BASH_ENV=$UAI_ENV_HOOK_FILE"
+      SHELL=/usr/bin/zsh
+    )
+  fi
+  nohup "${code_server_env[@]}" "$code_server_bin" \
+    --user-data-dir "$cs_data_dir" \
+    --disable-workspace-trust \
+    --auth none \
+    --disable-telemetry \
+    --disable-update-check \
+    --bind-addr 0.0.0.0:8080 \
+    "$editor_root" \
+    >/tmp/code-server.log 2>&1 &
+  disown
+fi
+
+# Always succeed: the container is up and code-server has been (re)launched.
+exit 0