@runuai/host 0.9.0 → 0.9.2

package/lib/orchestrator.ts

@@ -35,7 +35,7 @@ import {
 } from "./agents/types";
 import { ACTIVE_STATUSES } from "./task-status";
 import { getHostTask, upsertHostTask } from "./runtime-state";
-import { clearRefresh, setupTaskGithub } from "./github-tokens";
+import { clearRefresh, reconcileTaskGitAuth } from "./github-tokens";
 import { ensureTaskSshIdentity, setupTaskGitIdentity } from "./git-identity";
 import { dockerCli } from "./docker-exec";
 import {
@@ -82,6 +82,9 @@ export type HostEventSubscriber = (event: HostEvent) => void;
 interface Channel {
   taskId: string;
   roster: Roster;
+  /** ADR-083: host-derived role assignment for execution-profile enforcement. */
+  mode: "open" | "secretary";
+  secretaryAgentId?: string;
   sessions: Map<string, AgentSession>;
   /** Session-spawn inputs, kept so sessions can be started lazily. */
   containerName: string;
@@ -299,6 +302,33 @@ export class Orchestrator {
   // -- channel lifecycle ----------------------------------------------------
 
   registerChannelSpec(spec: ChannelEnsureInput): void {
+    // Host-side fail closed. The cloud validates this too, but the adapter's
+    // advertised communicator guarantee must not depend on every caller
+    // spelling the id correctly: an unmatched designation would otherwise
+    // make `executionProfileFor` return undefined and spawn a full-access
+    // process in a task explicitly marked Secretary.
+    if (!hasValidSecretarySelection(spec)) {
+      throw new Error(
+        "secretary mode requires exactly one roster agent matching secretaryAgentId",
+      );
+    }
+    const channel = this.channels.get(spec.taskId);
+    const nextMode = spec.mode === "secretary" ? "secretary" : "open";
+    if (
+      channel &&
+      (channel.mode !== nextMode ||
+        (nextMode === "secretary" &&
+          channel.secretaryAgentId !== spec.secretaryAgentId))
+    ) {
+      // v0 makes mode/role creation-time only. More importantly, a live
+      // Open→Secretary rewrite cannot be applied as ordinary roster refresh:
+      // the designated agent may already be a durable full-access process.
+      // Changing these fields without recycling that exact session would
+      // advertise a communicator boundary the running process does not have.
+      throw new Error(
+        "a live channel cannot change secretary mode or designation",
+      );
+    }
     this.channelSpecs.set(spec.taskId, spec);
     if (this.blockedTasks.has(spec.taskId)) return;
     // ADR-049: the cloud re-sends the spec on every message AND right after a
@@ -306,7 +336,6 @@ export class Orchestrator {
     // fold the fresh spec in: append new roster agents (their sessions spawn
     // in the reconcile pass of ensureSessions) and rebuild every preamble so
     // a later respawn briefs agents with the CURRENT roster + humans.
-    const channel = this.channels.get(spec.taskId);
     if (channel) this.refreshChannel(channel, spec);
   }
 
@@ -335,6 +364,8 @@ export class Orchestrator {
       }
     }
     channel.humans = spec.humans ?? [];
+    channel.mode = spec.mode === "secretary" ? "secretary" : "open";
+    channel.secretaryAgentId = spec.secretaryAgentId;
     channel.browserTesting = spec.browserTesting === true;
     channel.sharedFiles = spec.sharedFiles ?? "ro";
     channel.mcpConnections = spec.mcpConnections ?? [];
@@ -358,6 +389,8 @@ export class Orchestrator {
           channel.humans,
           channel.browserTesting,
           channel.sharedFiles,
+          spec.mode,
+          spec.secretaryAgentId,
         ),
       );
     }
@@ -429,6 +462,8 @@ export class Orchestrator {
           spec.humans,
           spec.browserTesting,
           spec.sharedFiles ?? "ro",
+          spec.mode,
+          spec.secretaryAgentId,
         ),
       );
       // ADR-046: materialise this agent's skills to its per-agent SKILL.md in
@@ -447,6 +482,8 @@ export class Orchestrator {
     const channel: Channel = {
       taskId,
       roster,
+      mode: spec.mode === "secretary" ? "secretary" : "open",
+      secretaryAgentId: spec.secretaryAgentId,
       sessions: new Map(),
       containerName: `task-${taskId.toLowerCase()}-app-1`,
       preambles,
@@ -1163,6 +1200,7 @@ export class Orchestrator {
               agent,
               containerName: channel.containerName,
               systemPreamble: channel.preambles.get(agent.id) ?? "",
+              executionProfile: this.executionProfileFor(channel, agent.id),
               agentEnv: this.accountAgentEnv(
                 channel,
                 agent,
@@ -1186,6 +1224,21 @@ export class Orchestrator {
     }
   }
 
+  /**
+   * The browser stores only the task-level secretary identity. Derive the
+   * restricted adapter profile here so a roster entry can never self-assert a
+   * weaker/stronger execution policy through its JSON payload.
+   */
+  private executionProfileFor(
+    channel: Channel,
+    agentId: string,
+  ): "communicator" | undefined {
+    return channel.mode === "secretary" &&
+      channel.secretaryAgentId === agentId
+      ? "communicator"
+      : undefined;
+  }
+
   /**
    * ADR-076: per-agent exec env = the uai token base + the SELECTED engine
    * account's env. Picks the least-recently-used, non-cooling account for the
@@ -1309,27 +1362,31 @@ export class Orchestrator {
     const initialRoster = [...channel.roster];
 
     // Set the task creator's git author identity in the container (ADR-029).
-    // The SSH key itself is installed earlier by task-up.sh (host clone +
-    // container), using the creator's per-user key. Best-effort. Awaited but
+    // The optional SSH signing/fallback key is installed earlier by
+    // task-up.sh using the creator's per-user key. Best-effort. Awaited but
     // async (docker exec via dockerCli) so it doesn't block the event loop —
     // this runs on every channel ensure, including each post-restart reconnect.
     await setupTaskGitIdentity(channel.taskId, task.ownerName, task.ownerEmail);
     if (!this.isActiveChannel(channel)) return false;
 
-    // GitHub auth for `gh` (ADR-027): mint + inject the access token and
-    // (re)start its refresh schedule. Done here — not only at task-up — so it
-    // survives a host restart: recovery recreates the channel and re-runs
-    // ensureSessions, whereas the in-memory refresh timer from the original
-    // task-up is gone. Guarded + best-effort + non-blocking; the token lands
-    // before the agents (spawned just below) make their first `gh` call.
+    // GitHub auth for both `gh` and HTTPS Git (ADR-027): inject the token,
+    // configure gh's credential helper, and (re)start refresh. Await the
+    // serialized reconcile so agents cannot race their first fetch/push after
+    // task creation, reconnect, or host recovery.
     if (task.ownerUserId) {
-      void setupTaskGithub(channel.taskId, task.ownerUserId);
+      await reconcileTaskGitAuth(channel.taskId, task.ownerUserId);
     }
 
-    // SSH push identity + its git config, re-asserted like the gh token above
-    // (one-shot at task-up proved fragile — recreated containers lose the key
-    // silently; live 2026-07-21). Best-effort + non-blocking.
-    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId);
+    // SSH signing identity, re-asserted independently of transport. Connected
+    // users still push through gh over HTTPS; disconnected users select the
+    // SSH transport fallback inside the reconcile above.
+    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId).catch((err) =>
+      console.warn(
+        `[ssh] task ${channel.taskId}: signing identity reconciliation failed: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      ),
+    );
 
     // ADR-047: install any package skills (native Claude Agent Skills) into the
     // container BEFORE spawning agents, so they're discoverable on the first
@@ -1380,9 +1437,10 @@ export class Orchestrator {
           {
             taskId: channel.taskId,
             agent,
-            containerName: channel.containerName,
-            systemPreamble: channel.preambles.get(agent.id) ?? "",
-            agentEnv: this.accountAgentEnv(
+          containerName: channel.containerName,
+          systemPreamble: channel.preambles.get(agent.id) ?? "",
+          executionProfile: this.executionProfileFor(channel, agent.id),
+          agentEnv: this.accountAgentEnv(
               channel,
               agent,
               agentCliEnv(
@@ -1525,7 +1583,7 @@ export class Orchestrator {
     // Cancel any armed auto-retry chain so this manual attempt runs fresh
     // (setup's duplicate-chain guard would otherwise no-op it).
     clearRefresh(taskId);
-    const ok = await setupTaskGithub(taskId, owner);
+    const ok = await reconcileTaskGitAuth(taskId, owner);
     this.emitSystemNote(
       taskId,
       ok
@@ -1785,6 +1843,7 @@ export class Orchestrator {
         agent,
         containerName: channel.containerName,
         systemPreamble: channel.preambles.get(agentId) ?? "",
+        executionProfile: this.executionProfileFor(channel, agentId),
         agentEnv: boundAccount
           ? { ...base, ...boundAccount.execEnv }
           : this.accountAgentEnv(channel, agent, base),
@@ -1903,6 +1962,7 @@ export class Orchestrator {
           agent,
           containerName: channel.containerName,
           systemPreamble: channel.preambles.get(agentId) ?? "",
+          executionProfile: this.executionProfileFor(channel, agentId),
           agentEnv: { ...base, ...next.execEnv },
         },
       );
@@ -2096,6 +2156,18 @@ export class Orchestrator {
   }
 }
 
+/** Exact host-wire role validation; never trims or canonicalises agent ids. */
+export function hasValidSecretarySelection(
+  spec: Pick<ChannelEnsureInput, "mode" | "secretaryAgentId" | "agents">,
+): boolean {
+  if (spec.mode !== "secretary") return true;
+  if (!spec.secretaryAgentId) return false;
+  return (
+    spec.agents.filter((agent) => agent.id === spec.secretaryAgentId).length ===
+    1
+  );
+}
+
 // ---------------------------------------------------------------------------
 // `@mention` addressing.
 // ---------------------------------------------------------------------------
@@ -2295,6 +2367,8 @@ export function buildSystemPreamble(
   humans?: ChannelHuman[],
   browserTesting?: boolean,
   sharedFiles?: string,
+  mode?: "open" | "secretary",
+  secretaryAgentId?: string,
 ): string {
   const channelList = roster
     .map((a) =>
@@ -2343,6 +2417,139 @@ export function buildSystemPreamble(
           (p) =>
             `- \`${workspacePath}/${p.slug}\` — git worktree on \`${taskBranch}\``,
         );
+  const isSecretary =
+    mode === "secretary" && secretaryAgentId === agent.id;
+  const transcriptBrief =
+    mode !== "secretary"
+      ? [
+          // Keep open-mode briefing byte-identical to the legacy preamble.
+          "Because your input is only what you're addressed, you may be missing",
+          "context from messages between the human and the other agents. The full",
+          "channel transcript — every message + who wrote it (no tool calls) — is",
+          "logged at `/workspace/.uai/chat.md`. Read it whenever you need that",
+          "context (e.g. the human shared a file or instruction with another",
+          "agent); it's appended live, so re-read it for the latest.",
+        ]
+      : isSecretary
+        ? [
+            "Because your input is only what you're addressed, you may be missing",
+            "context from messages elsewhere in the channel. Secretary mode keeps",
+            "two live transcripts: the backstage crew conversation is logged at",
+            "`/workspace/.uai/chat.md`, and the frontstage human conversation is",
+            "logged at `/workspace/.uai/chat-front.md`. Read BOTH whenever you need",
+            "to catch up; each is appended live, so re-read them for the latest.",
+          ]
+        : [
+            "Because your input is only what you're addressed, you may be missing",
+            "context from the crew conversation. The backstage transcript — crew",
+            "messages + who wrote them (no tool calls) — is logged at",
+            "`/workspace/.uai/chat.md`. Read it whenever you need that context;",
+            "it's appended live, so re-read it for the latest.",
+          ];
+  const secretaryRoleBrief = isSecretary
+    ? [
+        "## Secretary role",
+        "",
+        "You are the channel's sole human-facing communicator. Answer the human",
+        "directly when the transcripts and read-only inspection are sufficient.",
+        "When crew work is needed, address each recipient by @id with a concrete",
+        "instruction; Uai delivers that instruction backstage. Synthesize the",
+        "crew's replies for the human instead of forwarding a pile of raw updates.",
+        "",
+        "Your communicator execution profile is enforced by the engine: you can",
+        "read and search the workspace, but you cannot edit files, run shell",
+        "commands, write git state, deploy, or invoke arbitrary extensions. Do not",
+        "claim that you performed a mutation; dispatch it to a crew agent instead.",
+        "",
+      ]
+    : [];
+  const groupMessageBrief = isSecretary
+    ? [
+        "When a human message names one or more crew agents, those names are",
+        "routing hints for you — the crew has NOT been notified yet. Decide what",
+        "work is actually needed, then dispatch a concrete @id instruction to each",
+        "crew member you need. Do not merely say that someone else will answer.",
+      ]
+    : [
+        "When a message already @-mentions several participants at once (the",
+        "human asking the whole group, or a peer addressing multiple agents),",
+        "it's a group broadcast — this is a GROUP CHAT and everyone named has",
+        "ALREADY been notified and will answer for themselves. Just answer for",
+        "YOUR part. Do NOT re-@-mention the others to prompt them, hand the",
+        "question to them, or wait on them — no `I'll let @x speak`, `@x your",
+        "turn`, or `still waiting on @x`. Re-mentioning someone who already got",
+        "the message only wakes them again and spirals into duplicate replies.",
+        "Say your piece and stop.",
+      ];
+  const handoffBrief = isSecretary
+    ? [
+        "When crew work finishes, synthesize the outcome for the human and make",
+        "the next decision or blocker explicit. Do not abandon an unresolved",
+        "request silently, and do not wake a peer for acknowledgments alone.",
+      ]
+    : [
+        "Hand off when you finish your part of the work. When you've made",
+        "and committed your changes, or completed a review, end your reply by",
+        "@-mentioning the agent who should act next and telling them what you",
+        "did and what you need (e.g. `@codex changes committed on <branch> —",
+        "please review`, or `@claude review done, N issues to fix`). Don't",
+        "abandon unfinished work silently — but once your part is done and no",
+        "peer needs to act, it's fine to stop; only @-mention @you if you need",
+        "their input or are handing back finished work for them to act on. Don't",
+        "prolong an agent-to-agent exchange just to fill silence.",
+      ];
+  const checkInTranscriptBrief = isSecretary
+    ? [
+        "Read both transcript files named above, and speak ONLY if you have",
+        "something substantive to add; otherwise reply with exactly `PASS` — a",
+        "PASS reply is discarded and never shown to anyone, so it is always a",
+        "safe way to decline a turn.",
+      ]
+    : [
+        "Read the transcript, and speak ONLY if you have something substantive to",
+        "add; otherwise reply with exactly `PASS` — a PASS reply is discarded and",
+        "never shown to anyone, so it is always a safe way to decline a turn.",
+      ];
+  const workspaceBrief = isSecretary
+    ? [
+        "## Workspace layout",
+        "",
+        `Your read-only workspace root is \`${workspacePath}\`. It contains one`,
+        "project worktree per repository:",
+        "",
+        ...projectLines,
+        "",
+        `Those worktrees are on \`${taskBranch}\`. Inspect files when that helps`,
+        "you answer or scope a dispatch. Your profile cannot edit, commit, push,",
+        "or open a PR; send that work to a crew agent.",
+        "",
+        "The `.uai/` directory is Uai scaffolding. Read the two transcript files",
+        "there as described above; do not treat the rest as project content.",
+        "",
+      ]
+    : [
+        "## Workspace layout",
+        "",
+        `Your shell starts in \`${workspacePath}\` (the task workspace).`,
+        "That directory is **not** itself a git repo — it holds one git",
+        "worktree per project this task spans. Every project below is on the",
+        "same task branch. To run git commands, **`cd` into one of the",
+        "project directories first**:",
+        "",
+        ...projectLines,
+        "",
+        `The task branch is \`${taskBranch}\`. Push with \`git push -u origin`,
+        `${taskBranch}\` from inside the project, then open a PR with \`gh pr`,
+        "create` (the container has gh authenticated). For multi-project",
+        "tasks, each project's PR is independent — open one per project whose",
+        "worktree you actually changed.",
+        "",
+        "The `.uai/` directory under each task is uai's own scaffolding",
+        "(rendered Dockerfile, compose file, container scripts) — it is NOT",
+        "part of the project. Never review, edit, stage, commit, or flag it;",
+        "treat it as ignored, even though git may show it as untracked.",
+        "",
+      ];
   const comms = [
     "## uai task channel",
     "",
@@ -2378,63 +2585,21 @@ export function buildSystemPreamble(
     "you're waiting on the human), answer briefly and then wait — you don't",
     "need to @-mention anyone (including @you); they can see the channel.",
     "",
-    "When a message already @-mentions several participants at once (the",
-    "human asking the whole group, or a peer addressing multiple agents),",
-    "it's a group broadcast — this is a GROUP CHAT and everyone named has",
-    "ALREADY been notified and will answer for themselves. Just answer for",
-    "YOUR part. Do NOT re-@-mention the others to prompt them, hand the",
-    "question to them, or wait on them — no `I'll let @x speak`, `@x your",
-    "turn`, or `still waiting on @x`. Re-mentioning someone who already got",
-    "the message only wakes them again and spirals into duplicate replies.",
-    "Say your piece and stop.",
+    ...groupMessageBrief,
     "",
-    "Because your input is only what you're addressed, you may be missing",
-    "context from messages between the human and the other agents. The full",
-    "channel transcript — every message + who wrote it (no tool calls) — is",
-    "logged at `/workspace/.uai/chat.md`. Read it whenever you need that",
-    "context (e.g. the human shared a file or instruction with another",
-    "agent); it's appended live, so re-read it for the latest.",
+    ...transcriptBrief,
     "",
+    ...secretaryRoleBrief,
     "Two channel conventions (ADR-050): (1) If your reply @-mentions nobody,",
     "uai hands it back to whoever prompted you — so when you're ANSWERING,",
     "just answer plainly; you don't need to re-mention the asker. Mention",
     "someone only to bring them in or hand work off. (2) You may occasionally",
     "receive a `[channel check-in]` asking you to catch up on the channel.",
-    "Read the transcript, and speak ONLY if you have something substantive to",
-    "add; otherwise reply with exactly `PASS` — a PASS reply is discarded and",
-    "never shown to anyone, so it is always a safe way to decline a turn.",
-    "",
-    "Hand off when you finish your part of the work. When you've made",
-    "and committed your changes, or completed a review, end your reply by",
-    "@-mentioning the agent who should act next and telling them what you",
-    "did and what you need (e.g. `@codex changes committed on <branch> —",
-    "please review`, or `@claude review done, N issues to fix`). Don't",
-    "abandon unfinished work silently — but once your part is done and no",
-    "peer needs to act, it's fine to stop; only @-mention @you if you need",
-    "their input or are handing back finished work for them to act on. Don't",
-    "prolong an agent-to-agent exchange just to fill silence.",
-    "",
-    "## Workspace layout",
-    "",
-    `Your shell starts in \`${workspacePath}\` (the task workspace).`,
-    "That directory is **not** itself a git repo — it holds one git",
-    "worktree per project this task spans. Every project below is on the",
-    "same task branch. To run git commands, **`cd` into one of the",
-    "project directories first**:",
-    "",
-    ...projectLines,
-    "",
-    `The task branch is \`${taskBranch}\`. Push with \`git push -u origin`,
-    `${taskBranch}\` from inside the project, then open a PR with \`gh pr`,
-    "create` (the container has gh authenticated). For multi-project",
-    "tasks, each project's PR is independent — open one per project whose",
-    "worktree you actually changed.",
+    ...checkInTranscriptBrief,
     "",
-    "The `.uai/` directory under each task is uai's own scaffolding",
-    "(rendered Dockerfile, compose file, container scripts) — it is NOT",
-    "part of the project. Never review, edit, stage, commit, or flag it;",
-    "treat it as ignored, even though git may show it as untracked.",
+    ...handoffBrief,
     "",
+    ...workspaceBrief,
     // ADR-062: shared files — only when this container actually carries the
     // mounts (task-up drops a marker; pre-feature containers have none).
     ...(sharedFiles &&
@@ -2443,12 +2608,12 @@ export function buildSystemPreamble(
       ? [
           "## Shared files",
           "",
-          `Non-code files (${sharedFiles === "rw" ? "read-write" : "READ-ONLY"} for this task):`,
+          `Non-code files (${sharedFiles === "rw" && !isSecretary ? "read-write" : "READ-ONLY"} for this task):`,
           "- `/workspace/files/org` — the org's shared files (logos, specs,",
           "  datasets), visible to every task in the org on this host.",
           "- `/workspace/files/me` — the task owner's personal files, shared",
           "  across their tasks on this host.",
-          ...(sharedFiles === "rw"
+          ...(sharedFiles === "rw" && !isSecretary
             ? [
                 "When producing artifacts for humans, write them here (use a",
                 "subdirectory named after the task to avoid collisions).",
@@ -2475,7 +2640,8 @@ export function buildSystemPreamble(
     // ADR-047: package skills are native Claude Agent Skills installed into the
     // container's skills dir (Claude-only). List them so the agent knows they're
     // available even if headless auto-discovery is unreliable.
-    ...(agent.kind === "claude" &&
+    ...(!isSecretary &&
+    agent.kind === "claude" &&
     (agent.skills ?? []).some((s) => s.type === "package")
       ? [
           "## Installed skills",
@@ -2489,7 +2655,7 @@ export function buildSystemPreamble(
         ]
       : []),
     // ADR-053: the in-container browser, when the project opted in.
-    ...(browserTesting
+    ...(browserTesting && !isSecretary
       ? [
           "## Browser",
           "",
@@ -2512,7 +2678,11 @@ export function buildSystemPreamble(
         ]
       : []),
     // ADR-048: tell agents with permissions about their `uai` CLI.
-    ...((agent.permissions?.length ?? 0) > 0
+    // The communicator profile deliberately exposes no Bash or arbitrary MCP
+    // tool, so even a persona carrying CLI permissions cannot invoke cli.mjs.
+    // Do not advertise unusable commands; a future typed communicator tool can
+    // surface the safe task/todo subset without widening this boundary.
+    ...((agent.permissions?.length ?? 0) > 0 && !isSecretary
       ? [
           "## The uai CLI",
           "",
@@ -2602,14 +2772,19 @@ export function buildSystemPreamble(
           "",
         ]
       : []),
-    "## Commit policy",
-    "",
-    "Commits are SSH-signed automatically (git is configured for it) — do",
-    "not disable or override signing. Do NOT add any `Co-Authored-By:`",
-    "trailers to commit messages, and do NOT add 'Generated with …' or any",
-    "tool/agent attribution footer to commit messages or PR/issue bodies.",
-    "Write commit messages and PR descriptions plainly, as the author, with",
-    "no agent attribution.",
+    ...(!isSecretary
+      ? [
+          "## Commit policy",
+          "",
+          "When this task has an optional SSH signing key configured, Git signs",
+          "commits automatically; do not disable or override it. Do NOT add any",
+          "`Co-Authored-By:`",
+          "trailers to commit messages, and do NOT add 'Generated with …' or any",
+          "tool/agent attribution footer to commit messages or PR/issue bodies.",
+          "Write commit messages and PR descriptions plainly, as the author, with",
+          "no agent attribution.",
+        ]
+      : []),
   ].join("\n");
 
   // Persona / mission layers, always-on so they apply to every turn:
@@ -2958,9 +3133,21 @@ async function recoverOneTask(
     // ~8h later. Cheap with the per-user access-token cache — one exchange
     // per user, every task re-injects from it. Best-effort.
     if (task.ownerUserId) {
-      void setupTaskGithub(task.taskId, task.ownerUserId);
+      void reconcileTaskGitAuth(task.taskId, task.ownerUserId).catch((err) =>
+        console.warn(
+          `[github] task ${task.taskId}: running recovery reconciliation failed: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        ),
+      );
     }
-    void ensureTaskSshIdentity(task.taskId, task.ownerUserId);
+    void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+      console.warn(
+        `[ssh] task ${task.taskId}: running recovery reconciliation failed: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      ),
+    );
     return true;
   }
 
@@ -2982,11 +3169,35 @@ async function recoverOneTask(
   // possibly host-uid-owned 0600 files Codex can't read. Failure is surfaced
   // by the inject itself and must not abort the task's recovery.
   await injectCodexIntoContainer(containerName);
+  // Establish the task owner's GitHub transport BEFORE uai-init performs any
+  // dependency-network work. This matters for package manifests that refer to
+  // private GitHub repositories: gh's credential helper must already be live
+  // when pnpm/npm/uv/cargo resolves them. Reconciliation is best-effort, just
+  // like the prior post-init call, but it is now ordered rather than raced.
+  if (task.ownerUserId) {
+    try {
+      await reconcileTaskGitAuth(task.taskId, task.ownerUserId);
+    } catch (err) {
+      console.warn(
+        `[orchestrator] recovery: ${task.taskId} GitHub auth setup failed before uai-init: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
+  }
   // uai-init reinstalls workspace deps (pnpm/npm install) — minutes on a big
   // repo. dockerCli's 30s default would SIGKILL it mid-install.
-  if (
-    !(await dockerExec(containerName, ["/usr/local/bin/uai-init"], 10 * 60_000))
-  ) {
+  const initResult = await dockerCli(
+    [
+      "exec",
+      "-e",
+      "UAI_SKIP_GIT_TRANSPORT=1",
+      containerName,
+      "/usr/local/bin/uai-init",
+    ],
+    { timeoutMs: 10 * 60_000 },
+  );
+  if (initResult.status !== 0) {
     console.warn(
       `[orchestrator] recovery: ${task.taskId} uai-init failed; container is up but Editor may be down`,
     );
@@ -2995,12 +3206,13 @@ async function recoverOneTask(
   db_setRuntime(task.taskId, {
     codeServerPort: port,
   });
-  // Same gh re-establish as the running branch — the restarted container's gh
-  // config is whatever it held when it exited.
-  if (task.ownerUserId) {
-    void setupTaskGithub(task.taskId, task.ownerUserId);
-  }
-  void ensureTaskSshIdentity(task.taskId, task.ownerUserId);
+  void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+    console.warn(
+      `[ssh] task ${task.taskId}: resumed signing identity reconciliation failed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    ),
+  );
   console.log(
     `[orchestrator] recovery: ${task.taskId} resumed (port ${port ?? "?"})`,
   );