@runuai/host 0.9.1 → 0.9.3

package/scripts/agent/task-up.sh

@@ -38,6 +38,18 @@ ASDF_VOLUME="uai-asdf-data"
 PW_VOLUME="uai-playwright"
 DERIVED_IMAGE="uai-task-${task_id}"
 
+# Project-defined environment values arrive as one JSON object on stdin. They
+# are deliberately NOT part of this host process environment: names such as
+# BASH_ENV, PATH, GIT_CONFIG_*, and UAI_* must not influence task setup or the
+# credentialed host-side fetch. Values stay in shell memory until Compose reads
+# an override document from stdin; they are never written to disk.
+project_env_json=$(cat)
+[ -n "$project_env_json" ] || project_env_json='{}'
+if ! printf '%s' "$project_env_json" | jq -e 'type == "object"' >/dev/null 2>&1; then
+  emit_err "BAD_ARGS" "task environment payload must be a JSON object" "read task environment"
+fi
+project_env_json=$(printf '%s' "$project_env_json" | jq -c '.')
+
 # -----------------------------------------------------------------------------
 # Paths (mirror host-agent/lib/env.ts).
 # -----------------------------------------------------------------------------
@@ -49,6 +61,15 @@ projects_root="$UAI_WORKSPACE_ROOT/projects"
 compose_project=$(compose_project_for_task "$task_id")
 app_container=$(app_container_for_task "$task_id")
 
+reject_unsafe_host_directory() {
+  local path="$1" label="$2"
+  if [ -L "$path" ] || { [ -e "$path" ] && [ ! -d "$path" ]; }; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai refused $label because it is not a trusted directory: $path" \
+      "validate task workspace paths"
+  fi
+}
+
 mapped_host_port() {
   local container="$1" container_port="$2"
   docker port "$container" "$container_port" 2>/dev/null \
@@ -68,6 +89,31 @@ task_json=$(db_get_task "$task_id")
 
 task_branch=$(jq -r '.[0].branch' <<<"$task_json")
 
+# The standard container runs as node:node (1000:1000), while Docker Desktop
+# hosts commonly run as 501:20 and Linux hosts may use another uid/gid. Share
+# only this task's writable trees through the host's effective group. A root
+# host is the exception: never add the unprivileged container user to gid 0;
+# root can chgrp the task trees directly to node's gid instead.
+task_container_gid=$(id -g)
+if [ "$(id -u)" = "0" ]; then
+  task_container_gid=1000
+elif [ "$task_container_gid" = "0" ]; then
+  task_container_gid=""
+  for candidate_gid in $(id -G); do
+    if [ "$candidate_gid" != "0" ]; then
+      task_container_gid="$candidate_gid"
+      break
+    fi
+  done
+fi
+case "$task_container_gid" in
+  ''|*[!0-9]*)
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not resolve a safe host group for the task container" \
+      "resolve task container filesystem group"
+    ;;
+esac
+
 step "PROJECT_NOT_FOUND" "read task projects"
 projects_json=$(db_get_projects_for_task "$task_id")
 project_count=$(jq 'length' <<<"$projects_json")
@@ -88,38 +134,295 @@ db_update_task "$task_id" \
   "worktree_path='$(sql_escape "$task_dir")'" \
   "compose_project='$(sql_escape "$compose_project")'"
 
+# `.uai` is not container-mounted, but validate these host-owned parents before
+# using the previous compose file. The workspace itself is checked after the
+# old container is removed so it cannot race the check.
+reject_unsafe_host_directory "$task_dir" "the task storage root"
+reject_unsafe_host_directory "$task_uai_dir" "the task runtime directory"
+
+# A previous task container can write both its workspace and its task-private
+# Git repository. Remove it before the host parses either repository on resume.
+# This also cuts off legacy containers that still have the old shared
+# `repo.git` bind mount before we inspect their worktree layout below.
+step "COMPOSE_DOWN_FAILED" "remove prior task containers"
+if [ -f "$task_uai_dir/docker-compose.yml" ]; then
+  docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" \
+    down --remove-orphans >/dev/null 2>&1 || true
+else
+  docker compose -p "$compose_project" down --remove-orphans \
+    >/dev/null 2>&1 || true
+fi
+prior_containers=""
+if ! prior_containers=$(docker ps -aq \
+  --filter "label=com.docker.compose.project=$compose_project"); then
+  emit_err "COMPOSE_DOWN_FAILED" \
+    "could not verify removal of the previous task container" \
+    "remove prior task containers"
+fi
+if [ -n "$prior_containers" ]; then
+  emit_err "COMPOSE_DOWN_FAILED" \
+    "the previous task container is still running or stopped; Uai will not let the host access its writable Git repository until that container is removed" \
+    "remove prior task containers"
+fi
+reject_unsafe_host_directory "$task_workspace" "the task workspace"
+mkdir -p "$task_workspace"
+
 # -----------------------------------------------------------------------------
 # 3. Bare mirrors + worktrees, one per selected project.
 # -----------------------------------------------------------------------------
 
-# Use the uai-managed host identity for all git-over-SSH (ADR-015: git auth is
-# a host-resident credential). `IdentitiesOnly=yes` + `IdentityAgent=none` keep
-# it from falling through to the operator's personal SSH agent (e.g. 1Password),
-# which both leaks the wrong key and blocks unattended task-up on its approval
-# prompt. `BatchMode=yes` fails fast instead of prompting. Falls back to the
-# host default SSH when the identity hasn't been set up (`pnpm setup-identity`).
+# Prepare the optional SSH identity. Connected users fetch over HTTPS with
+# their per-host GitHub credential; SSH is used for Git transport only when the
+# task owner has not connected GitHub. `IdentitiesOnly=yes` +
+# `IdentityAgent=none` keep that fallback from silently selecting a different
+# personal key or blocking on an agent approval prompt.
 #
-# ADR-029: prefer the TASK CREATOR's per-user key (written to
-# $UAI_TASK_IDENTITY_DIR by the orchestrator) so the clone + push run as them,
-# not the operator. Fall back to the shared operator identity when the creator
-# has no key on this host (transitional / pre-ADR-029 users).
+# ADR-029: use only the TASK CREATOR's per-user key (written to
+# $UAI_TASK_IDENTITY_DIR by the orchestrator) so clone + push run as them. A
+# task must never borrow the operator's shared identity: that would authorize
+# one user as a different principal.
 if [ -n "${UAI_TASK_IDENTITY_DIR:-}" ] && [ -f "${UAI_TASK_IDENTITY_DIR}/id_ed25519" ]; then
   uai_identity_key="$UAI_TASK_IDENTITY_DIR/id_ed25519"
   log "git over SSH using the task creator's per-user key"
 else
-  uai_identity_key="$UAI_DATA_DIR/identity/id_ed25519"
+  uai_identity_key=""
 fi
-if [ -f "$uai_identity_key" ]; then
+uai_has_ssh_identity=0
+if [ -n "$uai_identity_key" ] && [ -f "$uai_identity_key" ]; then
+  uai_has_ssh_identity=1
   uai_known_hosts="$UAI_DATA_DIR/identity/known_hosts"
   GIT_SSH_COMMAND="ssh -i $uai_identity_key -o IdentitiesOnly=yes -o IdentityAgent=none -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
   [ -f "$uai_known_hosts" ] && GIT_SSH_COMMAND="$GIT_SSH_COMMAND -o UserKnownHostsFile=$uai_known_hosts"
   export GIT_SSH_COMMAND
   log "git over SSH using $uai_identity_key (1Password agent bypassed)"
 else
-  log "no uai identity key at $uai_identity_key — git uses host default SSH (run: pnpm setup-identity)"
+  log "no SSH identity for the task owner — SSH transport fallback unavailable"
 fi
 
-mkdir -p "$task_workspace"
+# Only the non-secret path reaches this script. The task owner's token lives in
+# a private per-task `git credential-cache` daemon and is never placed in the
+# environment, argv, remote URL, mirror config, Compose, or logs.
+github_credential_socket="${UAI_GITHUB_CREDENTIAL_SOCKET:-}"
+unset UAI_GITHUB_CREDENTIAL_SOCKET
+if [ -n "$github_credential_socket" ]; then
+  uai_git_transport="https"
+else
+  # Refined after each GitHub fetch below: select SSH only when it was the
+  # mode that actually worked. A present-but-unregistered key must not turn a
+  # successfully anonymous public clone into broken SSH inside the container.
+  uai_git_transport="anonymous"
+fi
+uai_used_ssh_transport=0
+
+git_with_github_credential() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  # If a container ever poisoned a shared mirror's URL config, fail closed
+  # instead of silently switching this operation to an SSH principal.
+  GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
+    -c core.hooksPath=/dev/null \
+    -c core.fsmonitor=false \
+    -c http.extraHeader= \
+    -c http.sslVerify=true \
+    -c credential.helper= \
+    -c "credential.helper=cache --socket=$github_credential_socket" \
+    "$@"
+)
+
+# Command-scoped rewrite: the shared origin remains canonical HTTPS while this
+# one task uses its SSH fallback identity.
+git_with_github_ssh() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  GIT_TERMINAL_PROMPT=0 git \
+    -c core.hooksPath=/dev/null \
+    -c core.fsmonitor=false \
+    -c 'url.git@github.com:.insteadOf=https://github.com/' \
+    "$@"
+)
+
+# Clear every ambient credential helper so a public fallback cannot borrow the
+# host operator's GitHub identity.
+git_anonymous_https() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
+    -c core.hooksPath=/dev/null \
+    -c core.fsmonitor=false \
+    -c http.extraHeader= \
+    -c http.sslVerify=true \
+    -c credential.helper= \
+    "$@"
+)
+
+# Host-only Git control plane. New task containers see only their self-contained
+# private repo; the shared mirror is a setup-time fetch cache and is never
+# mounted. Before every host operation we still rebuild its config from trusted
+# project data and discard hooks, both to heal legacy tasks and to fail closed
+# after a crash.
+git_host_control() (
+  unset GIT_ASKPASS SSH_ASKPASS SSH_AUTH_SOCK GIT_CONFIG \
+    GIT_CONFIG_PARAMETERS GIT_TRACE GIT_TRACE2 GIT_TRACE_CURL \
+    GIT_TRACE_PACKET GIT_TRACE_REDACT GIT_CONFIG_COUNT \
+    GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1
+  export LC_ALL=C GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1
+  # This helper is for local repository bookkeeping and public/local remotes.
+  # It must never inherit the operator's SSH agent or credential helper. Every
+  # authenticated GitHub fetch goes through one of the explicit helpers above.
+  GIT_CONFIG_COUNT=2 \
+  GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/dev/null \
+  GIT_CONFIG_KEY_1=core.fsmonitor GIT_CONFIG_VALUE_1=false \
+  GIT_SSH_COMMAND=/bin/false GIT_TERMINAL_PROMPT=0 git \
+    -c credential.helper= \
+    "$@"
+)
+
+assert_bare_repo_tree_safe() {
+  local repo="$1" code="$2" label="$3" bad_entry=""
+  if [ -L "$repo" ] || [ ! -d "$repo" ]; then
+    emit_err "$code" \
+      "Uai refused the $label because its repository root is missing or is a symbolic link: $repo" \
+      "validate $label"
+  fi
+  # Git should only ever create regular files and directories in these control
+  # trees. Reject links, FIFOs, sockets, and devices before any Git process can
+  # follow or block on a container-created entry.
+  if ! bad_entry=$(find "$repo" ! -type f ! -type d -print -quit 2>/dev/null); then
+    emit_err "$code" \
+      "Uai could not validate the $label before host Git access" \
+      "validate $label"
+  fi
+  if [ -n "$bad_entry" ]; then
+    emit_err "$code" \
+      "Uai refused the $label because it contains an unsafe non-file entry at $bad_entry. The task container has been removed; inspect or recreate the task before retrying." \
+      "validate $label"
+  fi
+}
+
+# Make a host-created task tree writable by the container's uid-1000 node user
+# without making it world-writable or changing ownership away from the host.
+# `find` deliberately does not follow repository symlinks. Setgid directories
+# keep Git-created descendants in the shared group; core.sharedRepository
+# below makes Git's own files group-writable as well.
+set_task_entry_container_access() {
+  local entry="$1"
+  chgrp "$task_container_gid" "$entry" || return 1
+  if [ -d "$entry" ]; then
+    chmod ug+rwx,g+s "$entry" || return 1
+  else
+    chmod ug+rw "$entry" || return 1
+  fi
+}
+
+share_task_entry_with_container() {
+  local entry="$1" label="$2"
+  if ! set_task_entry_container_access "$entry"; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not share the $label with the task container" \
+      "set task filesystem permissions"
+  fi
+}
+
+share_task_tree_with_container() {
+  local root="$1" label="$2" entry entry_list failed_entry=""
+  [ -d "$root" ] || return 0
+
+  entry_list=$(mktemp "/tmp/uai-task-tree.XXXXXX")
+  if ! find "$root" \( -type d -o -type f \) -print0 > "$entry_list"; then
+    rm -f "$entry_list"
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not enumerate the complete $label before sharing it with the task container" \
+      "enumerate task filesystem"
+  fi
+  while IFS= read -r -d '' entry; do
+    if ! set_task_entry_container_access "$entry"; then
+      failed_entry="$entry"
+      break
+    fi
+  done < "$entry_list"
+  rm -f "$entry_list"
+  if [ -n "$failed_entry" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai could not share the complete $label with the task container" \
+      "set task filesystem permissions"
+  fi
+}
+
+sanitize_mirror_control_plane() {
+  local mirror="$1" origin="$2" config_tmp
+  assert_bare_repo_tree_safe "$mirror" "FETCH_FAILED" "host repository cache"
+  # Stage outside the bare repo so a predictable in-repo temporary path cannot
+  # be redirected even if a previous host operation crashed midway.
+  config_tmp=$(mktemp "$(dirname "$mirror")/.uai-config.XXXXXX")
+  git_host_control config --file "$config_tmp" core.repositoryformatversion 0
+  git_host_control config --file "$config_tmp" core.filemode true
+  git_host_control config --file "$config_tmp" core.bare true
+  git_host_control config --file "$config_tmp" remote.origin.url "$origin"
+  git_host_control config --file "$config_tmp" remote.origin.fetch \
+    '+refs/heads/*:refs/remotes/origin/*'
+  git_host_control config --file "$config_tmp" remote.pushDefault origin
+  git_host_control config --file "$config_tmp" push.autoSetupRemote true
+  mv -f "$config_tmp" "$mirror/config"
+  rm -rf "$mirror/hooks"
+  mkdir -p "$mirror/hooks"
+}
+
+sanitize_task_repo_control_plane() {
+  local repo="$1" origin="$2" branch="$3" bare="${4:-true}" config_tmp
+  local branch_remote="origin" branch_merge="refs/heads/$branch" candidate
+  assert_bare_repo_tree_safe "$repo" "WORKTREE_FAILED" \
+    "task-private repository"
+
+  # Preserve only the current branch's safe upstream from the container-
+  # writable config. Includes are disabled, the remote must remain `origin`,
+  # and the merge target must be a valid heads ref. Everything executable or
+  # host-sensitive (hooks, includes, helpers, fsmonitor) is rebuilt below.
+  if [ -f "$repo/config" ]; then
+    candidate=$(git_host_control config --no-includes --file "$repo/config" \
+      --get "branch.$branch.remote" 2>/dev/null || true)
+    [ "$candidate" = "origin" ] && branch_remote="$candidate"
+    candidate=$(git_host_control config --no-includes --file "$repo/config" \
+      --get "branch.$branch.merge" 2>/dev/null || true)
+    case "$candidate" in
+      refs/heads/*)
+        if git_host_control check-ref-format "$candidate" >/dev/null 2>&1; then
+          branch_merge="$candidate"
+        fi
+        ;;
+    esac
+  fi
+
+  config_tmp=$(mktemp "$(dirname "$repo")/.uai-task-config.XXXXXX")
+  git_host_control config --file "$config_tmp" core.repositoryformatversion 0
+  git_host_control config --file "$config_tmp" core.filemode true
+  git_host_control config --file "$config_tmp" core.bare "$bare"
+  git_host_control config --file "$config_tmp" core.sharedRepository group
+  git_host_control config --file "$config_tmp" remote.origin.url "$origin"
+  git_host_control config --file "$config_tmp" remote.origin.fetch \
+    '+refs/heads/*:refs/remotes/origin/*'
+  git_host_control config --file "$config_tmp" remote.pushDefault origin
+  git_host_control config --file "$config_tmp" push.autoSetupRemote true
+  git_host_control config --file "$config_tmp" \
+    "branch.$branch.remote" "$branch_remote"
+  git_host_control config --file "$config_tmp" \
+    "branch.$branch.merge" "$branch_merge"
+  mv -f "$config_tmp" "$repo/config"
+  rm -rf "$repo/hooks"
+  mkdir -p "$repo/hooks"
+  # mktemp is intentionally 0600. Once its trusted contents are atomically in
+  # place, grant only the selected task group access; this must run on every
+  # resume even after the one-time tree migration marker exists.
+  share_task_entry_with_container "$repo/config" \
+    "task-private Git config"
+  share_task_entry_with_container "$repo/hooks" \
+    "task-private Git hooks directory"
+}
 
 # ADR-062 shared files: two host-resident roots mounted into the container
 # when the task's mode isn't "off". Created here so Docker doesn't create
@@ -139,6 +442,8 @@ if [ "$shared_files_mode" != "off" ]; then
   [ -n "$shared_owner_user" ] && mkdir -p "$shared_root/users/$shared_owner_user"
   # Marker for the preamble: only containers that actually carry the mounts
   # get the "## Shared files" briefing (pre-feature containers don't).
+  reject_unsafe_host_directory "$task_workspace/.uai" \
+    "the task workspace marker directory"
   mkdir -p "$task_workspace/.uai"
   : > "$task_workspace/.uai/files-mounted"
 fi
@@ -150,11 +455,93 @@ while IFS= read -r project_obj; do
 
   project_id=$(jq -r '.id' <<<"$project_obj")
   project_slug=$(jq -r '.slug' <<<"$project_obj")
-  repo_url=$(jq -r '.repo_url' <<<"$project_obj")
+  case "$project_slug" in
+    ''|.|..|*/*|*\\*)
+      emit_err "WORKTREE_FAILED" \
+        "Uai refused an invalid project workspace component: $project_slug" \
+        "validate task worktree ($project_id)"
+      ;;
+  esac
+  acquire_project_lock "$projects_root" "$project_id"
+  repo_url_input=$(jq -r '.repo_url' <<<"$project_obj")
+  repo_is_github=0
+  if is_github_hosted_url "$repo_url_input"; then
+    repo_is_github=1
+  fi
+  # The mirror is fetched HERE, before the task container exists. GitHub URLs
+  # stay canonical HTTPS: a connected user's private credential socket
+  # authenticates them; users without a connection get the SSH fallback. The
+  # token never becomes part of this shared mirror or its remote URL.
+  repo_url=$(normalize_github_repo_url "$repo_url_input")
+  github_https_url=$(github_https_repo_url "$repo_url")
+  if [ "$repo_is_github" = "1" ] && [ -z "$github_https_url" ]; then
+    emit_err "CLONE_FAILED" \
+      "Uai refused the malformed GitHub repository URL '$repo_url_input'. Use https://github.com/OWNER/REPOSITORY.git and retry." \
+      "validate GitHub repository URL ($project_id)"
+  fi
   tool_versions=$(jq -r '.tool_versions // ""' <<<"$project_obj")
 
-  mirror_dir="$projects_root/$project_id/repo.git"
+  # `repo.git` was historically bind-mounted RW into every task container.
+  # Never reuse it as trusted host input: running legacy tasks can still hold
+  # that old bind mount. The new cache path has never entered a container.
+  mirror_dir="$projects_root/$project_id/host-cache.git"
+  task_repo_dir="$task_uai_dir/repos/$project_id.git"
   worktree_target="$task_workspace/$project_slug"
+  reject_unsafe_host_directory "$worktree_target" \
+    "the project worktree for $project_slug"
+  # Check before remote/cache Git: a dangling symlink makes `-e` false and the
+  # later seed write would otherwise follow it outside the workspace.
+  if [ -L "$worktree_target/.tool-versions" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai refused a symbolic-link .tool-versions for $project_slug" \
+      "validate task worktree ($project_id)"
+  fi
+  worktree_exists=0
+  standalone_worktree=0
+  if [ -e "$worktree_target/.git" ] || [ -L "$worktree_target/.git" ]; then
+    worktree_exists=1
+    if [ -L "$worktree_target/.git" ]; then
+      emit_err "WORKTREE_FAILED" \
+        "Uai refused to resume $project_slug because its .git path is a symbolic link. The previous container was removed; inspect or recreate the task before retrying." \
+        "validate task worktree ($project_id)"
+    elif [ -d "$worktree_target/.git" ]; then
+      # Empty remotes use a standalone repository inside the workspace.
+      standalone_worktree=1
+      assert_bare_repo_tree_safe "$worktree_target/.git" "WORKTREE_FAILED" \
+        "standalone task repository"
+    elif [ -f "$worktree_target/.git" ]; then
+      gitdir_lines=$(awk 'END { print NR }' "$worktree_target/.git")
+      gitdir_value=$(sed -n 's/^gitdir: //p' "$worktree_target/.git")
+      case "$gitdir_value" in
+        "$task_repo_dir"/worktrees/*) ;;
+        *)
+          emit_err "WORKTREE_FAILED" \
+            "This task uses Uai's legacy shared Git layout. Its container has been removed so it can no longer write the shared mirror. Preserve any uncommitted changes from $worktree_target, then recreate the task to migrate safely." \
+            "legacy task repository requires recreation ($project_id)"
+          ;;
+      esac
+      gitdir_leaf=${gitdir_value#"$task_repo_dir"/worktrees/}
+      case "$gitdir_leaf" in
+        ''|.|..|*/*)
+          emit_err "WORKTREE_FAILED" \
+            "Uai refused an invalid task Git metadata path for $project_slug" \
+            "validate task worktree ($project_id)"
+          ;;
+      esac
+      if [ "$gitdir_lines" != "1" ] || [ ! -d "$gitdir_value" ] \
+         || [ -L "$gitdir_value" ]; then
+        emit_err "WORKTREE_FAILED" \
+          "Uai refused invalid or missing task Git metadata for $project_slug. The previous container was removed; inspect or recreate the task before retrying." \
+          "validate task worktree ($project_id)"
+      fi
+      assert_bare_repo_tree_safe "$task_repo_dir" "WORKTREE_FAILED" \
+        "task-private repository"
+    else
+      emit_err "WORKTREE_FAILED" \
+        "Uai refused an unsupported .git entry for $project_slug" \
+        "validate task worktree ($project_id)"
+    fi
+  fi
 
   # Ensure the bare mirror exists with **remote-tracking refs**. Plain
   # `git clone --bare` copies upstream heads straight into refs/heads/*
@@ -166,37 +553,254 @@ while IFS= read -r project_obj; do
   if [ ! -d "$mirror_dir" ]; then
     step "CLONE_FAILED" "bare-clone ($project_id)"
     mkdir -p "$(dirname "$mirror_dir")"
-    git init --bare "$mirror_dir" >/dev/null
-    git -C "$mirror_dir" remote add origin "$repo_url"
+    git_host_control init --bare "$mirror_dir" >/dev/null
     needs_initial_fetch=1
   fi
 
-  # Always (re-)assert the remote-tracking refspec. Self-heals mirrors
-  # created before this script learned the right refspec — idempotent.
-  git -C "$mirror_dir" config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'
+  # Replace all container-writable/legacy config before host Git reads the
+  # mirror. This also heals SSH origins to the canonical credential-free URL.
+  sanitize_mirror_control_plane "$mirror_dir" "$repo_url"
+
+  github_fetch_mode=""
 
   if [ "$needs_initial_fetch" = "1" ]; then
     # First fetch on a brand-new mirror — required. Bail and clean up so
     # the next attempt starts fresh rather than re-using a half-init.
-    if ! git -C "$mirror_dir" fetch origin; then
+    fetch_err=""
+    fetch_failed=0
+    if [ -n "$github_https_url" ] && [ -n "$github_credential_socket" ]; then
+      github_fetch_mode="token"
+      if ! fetch_err=$(git_with_github_credential \
+        -C "$mirror_dir" fetch origin 2>&1); then
+        fetch_failed=1
+      fi
+    elif [ -n "$github_https_url" ]; then
+      if [ "$uai_has_ssh_identity" = "1" ]; then
+        github_fetch_mode="ssh"
+        if ! fetch_err=$(git_with_github_ssh \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          fetch_failed=1
+          # github.com requires an authenticated SSH handshake even for public
+          # repositories. Preserve the no-credential public-repo path.
+          if git_anonymous_https -C "$mirror_dir" fetch origin \
+            >/dev/null 2>&1; then
+            github_fetch_mode="anonymous"
+            fetch_failed=0
+            fetch_err=""
+          fi
+        fi
+      else
+        github_fetch_mode="none"
+        if ! fetch_err=$(git_anonymous_https \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          fetch_failed=1
+        else
+          github_fetch_mode="anonymous"
+        fi
+      fi
+    elif ! fetch_err=$(git_host_control -C "$mirror_dir" fetch origin 2>&1); then
+      fetch_failed=1
+    fi
+
+    if [ "$fetch_failed" = "1" ]; then
+      [ -n "$fetch_err" ] || fetch_err="git fetch failed without details"
       rm -rf "$mirror_dir"
-      emit_err "CLONE_FAILED" "initial fetch from $repo_url failed" "bare-clone ($project_id)"
+      # GitHub deliberately uses the same 404 for a missing private repository
+      # and a credential that cannot see it. Name the credential path Uai
+      # actually chose so the recovery action is truthful.
+      case "$fetch_err" in
+        *"Repository not found"*|*"repository not found"*|\
+*"Permission denied"*|*"access rights"*|*"could not read Username"*|\
+*"Authentication failed"*|*"Invalid username or password"*|*"HTTP 401"*|\
+*"HTTP 403"*|*"HTTP 404"*|*"requested URL returned error: 401"*|\
+*"requested URL returned error: 403"*|*"requested URL returned error: 404"*)
+          if [ "$github_fetch_mode" = "token" ]; then
+            emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
+              "GitHub denied the connected user's access to $repo_url. Confirm that the Uai GitHub App is installed on the owning account or organization, this repository is included in its grant, and the connected user can write to it. Then retry the task." \
+              "bare-clone ($project_id)"
+          elif [ "$github_fetch_mode" = "ssh" ]; then
+            emit_err "GITHUB_SSH_ACCESS_DENIED" \
+              "GitHub is not connected on this host, so Uai tried its SSH fallback for $repo_url, but GitHub denied that key. Connect GitHub on this host, or register its public SSH key with an account that can read the repository (and authorize it for SAML SSO when required)." \
+              "bare-clone ($project_id)"
+          elif [ "$github_fetch_mode" = "none" ]; then
+            emit_err "GITHUB_CONNECTION_REQUIRED" \
+              "This host has neither a GitHub connection nor an SSH fallback key that can read $repo_url. Connect GitHub on this host, or configure its optional SSH key, then retry the task." \
+              "bare-clone ($project_id)"
+          else
+            case "$repo_url" in
+              git@*|ssh://*)
+                emit_err "CLONE_FAILED" \
+                  "The git server denied this host's SSH key access to $repo_url. Confirm the repository exists and add that host's public key to an account that can read it." \
+                  "bare-clone ($project_id)"
+                ;;
+              *)
+                emit_err "CLONE_FAILED" \
+                  "Access to $repo_url was denied. Configure the matching credential on this host, then retry the task." \
+                  "bare-clone ($project_id)"
+                ;;
+            esac
+          fi
+          ;;
+        *)
+          emit_err "CLONE_FAILED" \
+            "initial fetch from $repo_url failed: $fetch_err" \
+            "bare-clone ($project_id)"
+          ;;
+      esac
     fi
   else
-    # Existing mirror — refresh best-effort. Offline / network blip
-    # shouldn't break task-up.
+    # Existing mirror — refresh best-effort. Offline / network blips should not
+    # destroy a task that already has cached refs, but never switch principals.
     step "FETCH_FAILED" "git fetch origin ($project_id)"
-    if ! git -C "$mirror_dir" fetch origin >/dev/null 2>&1; then
-      log "warning: git fetch failed for $project_id ($repo_url); using cached refs"
+    fetch_ok=0
+    fetch_err=""
+    if [ -n "$github_https_url" ] && [ -n "$github_credential_socket" ]; then
+      github_fetch_mode="token"
+      if fetch_err=$(git_with_github_credential \
+        -C "$mirror_dir" fetch origin 2>&1); then
+        fetch_ok=1
+      fi
+    elif [ -n "$github_https_url" ]; then
+      if [ "$uai_has_ssh_identity" = "1" ]; then
+        github_fetch_mode="ssh"
+        if fetch_err=$(git_with_github_ssh \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          fetch_ok=1
+        fi
+      else
+        github_fetch_mode="none"
+      fi
+      if [ "$fetch_ok" != "1" ]; then
+        anonymous_err=""
+        if anonymous_err=$(git_anonymous_https \
+          -C "$mirror_dir" fetch origin 2>&1); then
+          github_fetch_mode="anonymous"
+          fetch_ok=1
+          fetch_err=""
+        elif [ "$github_fetch_mode" = "none" ]; then
+          fetch_err="$anonymous_err"
+        fi
+      fi
+    elif fetch_err=$(git_host_control -C "$mirror_dir" fetch origin 2>&1); then
+      fetch_ok=1
+    fi
+    if [ "$fetch_ok" != "1" ]; then
+      case "$fetch_err" in
+        *"Repository not found"*|*"repository not found"*|\
+*"Permission denied"*|*"access rights"*|*"could not read Username"*|\
+*"Authentication failed"*|*"Invalid username or password"*|*"HTTP 401"*|\
+*"HTTP 403"*|*"HTTP 404"*|*"requested URL returned error: 401"*|\
+*"requested URL returned error: 403"*|*"requested URL returned error: 404"*)
+          case "$github_fetch_mode" in
+            token)
+              emit_err "GITHUB_TOKEN_ACCESS_DENIED" \
+                "GitHub denied the connected user's access to $repo_url. Confirm that the Uai GitHub App grant still includes this repository and the connected user can write to it, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+            ssh)
+              emit_err "GITHUB_SSH_ACCESS_DENIED" \
+                "GitHub is not connected on this host, and it denied the SSH fallback for $repo_url. Connect GitHub or fix this host's SSH key access, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+            none)
+              emit_err "GITHUB_CONNECTION_REQUIRED" \
+                "This host has neither a GitHub connection nor an SSH fallback key that can read $repo_url. Connect GitHub on this host, or configure its optional SSH key, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+            *)
+              emit_err "FETCH_FAILED" \
+                "The configured credential no longer has access to $repo_url. Restore access, then retry the task." \
+                "git fetch origin ($project_id)"
+              ;;
+          esac
+          ;;
+        *)
+          if [ "$worktree_exists" = "1" ]; then
+            # Resume is the only safe stale-cache case: this same task already
+            # owns the checkout. A new task/user must prove current access
+            # before any shared cached code is materialized into its workspace.
+            log "warning: git fetch failed for $project_id ($repo_url); resuming this task's existing worktree with cached refs"
+          else
+            emit_err "FETCH_FAILED" \
+              "could not verify the task creator's current access to $repo_url: ${fetch_err:-git fetch failed}. Retry when the remote is reachable." \
+              "git fetch origin ($project_id)"
+          fi
+          ;;
+      esac
+    fi
+  fi
+
+  if [ "$github_fetch_mode" = "ssh" ]; then
+    if [ "$needs_initial_fetch" = "1" ] && [ "$fetch_failed" = "0" ]; then
+      uai_used_ssh_transport=1
+    elif [ "$needs_initial_fetch" != "1" ] && [ "$fetch_ok" = "1" ]; then
+      uai_used_ssh_transport=1
     fi
   fi
 
-  # Resolve the remote default branch (best-effort) — fall back to main.
-  git -C "$mirror_dir" remote set-head origin -a >/dev/null 2>&1 || true
-  project_default=$(git -C "$mirror_dir" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null \
+  # Resolve the remote default branch with the same task credential
+  # (best-effort) — fall back to main.
+  case "$github_fetch_mode" in
+    token)
+      git_with_github_credential -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    ssh)
+      git_with_github_ssh -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    anonymous)
+      git_anonymous_https -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    none)
+      git_anonymous_https -C "$mirror_dir" remote set-head origin -a \
+        >/dev/null 2>&1 || true
+      ;;
+    *)
+      git_host_control -C "$mirror_dir" remote set-head origin -a >/dev/null 2>&1 || true
+      ;;
+  esac
+  project_default=$(git_host_control -C "$mirror_dir" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null \
     | sed 's#^origin/##' || true)
   [ -n "$project_default" ] || project_default="main"
 
+  # Each linked worktree gets its own writable Git control plane (config,
+  # hooks, refs, metadata, and objects). It borrows the host-only cache only
+  # while being prepared, then repacks every reachable object locally and
+  # removes the alternate before the container starts.
+  worktree_repo_dir="$task_repo_dir"
+  if [ "$standalone_worktree" = "1" ]; then
+    worktree_repo_dir="$worktree_target/.git"
+    sanitize_task_repo_control_plane "$worktree_repo_dir" "$repo_url" \
+      "$task_branch" false
+  else
+    if [ ! -d "$task_repo_dir" ]; then
+      mkdir -p "$(dirname "$task_repo_dir")"
+      git_host_control init --bare "$task_repo_dir" >/dev/null
+    fi
+    sanitize_task_repo_control_plane "$task_repo_dir" "$repo_url" \
+      "$task_branch" true
+    rm -rf "$task_repo_dir/objects/info"
+    mkdir -p "$task_repo_dir/objects/info"
+    printf '%s\n' "$mirror_dir/objects" \
+      > "$task_repo_dir/objects/info/alternates"
+    # Copy only refs/objects from the trusted host mirror. The task repo's
+    # remote remains canonical GitHub HTTPS from the sanitizer above.
+    if ! git_host_control -C "$task_repo_dir" fetch "$mirror_dir" \
+      '+refs/remotes/origin/*:refs/remotes/origin/*' >/dev/null 2>&1; then
+      emit_err "WORKTREE_FAILED" \
+        "could not copy the fetched refs into the task repository for $repo_url" \
+        "copy task repository refs ($project_id)"
+    fi
+    if ! git_host_control -C "$task_repo_dir" repack -a -d >/dev/null; then
+      emit_err "WORKTREE_FAILED" \
+        "could not make the task repository self-contained for $repo_url" \
+        "copy task repository objects ($project_id)"
+    fi
+    rm -f "$task_repo_dir/objects/info/alternates"
+  fi
+
   mkdir -p "$(dirname "$worktree_target")"
   if [ -e "$worktree_target/.git" ]; then
     # Resume (ADR-028): the task worktree survived the stop — reuse it as-is
@@ -206,21 +810,22 @@ while IFS= read -r project_obj; do
     # (found live 2026-07-21). The task branch and any uncommitted work are
     # exactly what the user expects back.
     log "worktree for $project_slug already present — resuming with it"
-    # Self-heal an ORPHANED worktree. The bare mirror is shared by every task
-    # on this project, so a prune of it (auto-gc, or a sibling's task-down)
-    # can delete THIS worktree's admin dir (repo.git/worktrees/<name>) while
-    # its working tree is momentarily unreachable — e.g. the re-mount window on
-    # resume. The .git file is then a dangling pointer and every in-container
-    # git op dies "fatal: not a git repository" (found live 2026-07-24, a
-    # blocked agent unable to commit). `git worktree repair` rebuilds the admin
-    # dir from the intact working tree; it is a no-op when the link is healthy.
-    git -C "$mirror_dir" worktree repair "$worktree_target" 2>/dev/null || true
-  elif git -C "$mirror_dir" rev-parse --verify --quiet \
+    if [ "$standalone_worktree" != "1" ]; then
+      # Repair only after the task-private repository and its gitdir pointer
+      # have passed the host boundary checks above.
+      git_host_control -C "$worktree_repo_dir" worktree repair \
+        "$worktree_target" 2>/dev/null || true
+    fi
+  elif git_host_control -C "$worktree_repo_dir" rev-parse --verify --quiet \
        "refs/remotes/origin/$project_default" >/dev/null 2>&1; then
     # Normal case: branch the task worktree off origin/<defaultBranch>.
     step "WORKTREE_FAILED" "git worktree add ($project_id)"
-    git -C "$mirror_dir" worktree add "$worktree_target" \
-      -b "$task_branch" "origin/$project_default"
+    if ! git_host_control -C "$worktree_repo_dir" worktree add "$worktree_target" \
+      -b "$task_branch" "origin/$project_default"; then
+      emit_err "WORKTREE_FAILED" \
+        "could not create the task worktree for $repo_url" \
+        "git worktree add ($project_id)"
+    fi
   else
     # Empty / branchless remote — there's no origin/<default> to branch from.
     # Don't fail the whole task over it (the old behaviour: "invalid reference"
@@ -231,10 +836,12 @@ while IFS= read -r project_obj; do
     log "warning: $repo_url has no '$project_default' branch (empty repo?); starting an empty workspace for $project_slug"
     rm -rf "$worktree_target"
     mkdir -p "$worktree_target"
-    git -C "$worktree_target" init -q -b "$project_default" 2>/dev/null \
-      || { git -C "$worktree_target" init -q \
-           && git -C "$worktree_target" symbolic-ref HEAD "refs/heads/$project_default"; }
-    git -C "$worktree_target" remote add origin "$repo_url" 2>/dev/null || true
+    git_host_control -C "$worktree_target" init -q -b "$project_default" 2>/dev/null \
+      || { git_host_control -C "$worktree_target" init -q \
+           && git_host_control -C "$worktree_target" symbolic-ref HEAD "refs/heads/$project_default"; }
+    git_host_control -C "$worktree_target" remote add origin "$repo_url" 2>/dev/null || true
+    sanitize_task_repo_control_plane "$worktree_target/.git" "$repo_url" \
+      "$project_default" false
     printf '%s\n' \
       "# Empty repository" \
       "" \
@@ -253,12 +860,72 @@ while IFS= read -r project_obj; do
   # Tool-version seeding: only when the worktree has no checked-in
   # .tool-versions AND the project declares one. Never overwrite a file
   # the repo already ships.
+  if [ -L "$worktree_target/.tool-versions" ]; then
+    emit_err "WORKTREE_FAILED" \
+      "Uai refused a symbolic-link .tool-versions for $project_slug" \
+      "validate task worktree ($project_id)"
+  fi
   if [ ! -e "$worktree_target/.tool-versions" ] \
      && [ -n "$tool_versions" ] && [ "$tool_versions" != "null" ]; then
     printf '%s\n' "$tool_versions" > "$worktree_target/.tool-versions"
   fi
+  if [ -d "$worktree_target/.git" ] && [ ! -L "$worktree_target/.git" ]; then
+    share_task_tree_with_container "$worktree_target/.git" \
+      "standalone task Git repository"
+  fi
+
+  release_project_lock
 done < <(jq -c '.[]' <<<"$projects_json")
 
+# Git and the checked-out files were created by the host. Reconcile their
+# group/modes only after every host Git operation and before Compose exposes
+# them to uid 1000. The host-only marker avoids recursively walking a large
+# workspace (for example node_modules) on every resume, while its gid payload
+# forces a fresh pass if the task moves to a differently-grouped host. This
+# first pass self-heals 0.9.2 task repos whose mktemp config was mode 0600 on a
+# uid-501 macOS host. The sanitizer above repairs its rewritten control files
+# on every later resume.
+step "WORKTREE_FAILED" "share task files with container"
+mkdir -p "$task_uai_dir"
+# The shared group may be a broad host group (for example macOS `staff`). Keep
+# its writable leaves behind host-only parents; Docker bind-mounts the exact
+# workspace/repository roots, so node does not need host-path traversal here.
+chmod 700 "$task_dir" "$task_uai_dir"
+filesystem_group_marker="$task_uai_dir/container-filesystem-group-v1"
+marked_container_gid=""
+if [ -L "$filesystem_group_marker" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Uai refused a symbolic-link task filesystem marker" \
+    "share task files with container"
+elif [ -f "$filesystem_group_marker" ]; then
+  marked_container_gid=$(cat "$filesystem_group_marker" 2>/dev/null || true)
+elif [ -e "$filesystem_group_marker" ]; then
+  emit_err "WORKTREE_FAILED" \
+    "Uai refused a non-file task filesystem marker" \
+    "share task files with container"
+fi
+if [ "$marked_container_gid" != "$task_container_gid" ]; then
+  share_task_tree_with_container "$task_workspace" "task workspace"
+  filesystem_group_marker_tmp=$(mktemp \
+    "$task_uai_dir/.container-filesystem-group.XXXXXX")
+  printf '%s\n' "$task_container_gid" > "$filesystem_group_marker_tmp"
+  chmod 600 "$filesystem_group_marker_tmp"
+  mv -f "$filesystem_group_marker_tmp" "$filesystem_group_marker"
+else
+  # A container may have changed a mount root's mode. These two O(1) repairs
+  # keep entry into the already-normalized trees reliable without walking them.
+  share_task_entry_with_container "$task_workspace" "task workspace root"
+fi
+# Task repos are repacked, so this tree stays small; normalize it every time.
+# Unlike the workspace pass, this covers Git metadata created during the host
+# refresh and any loose objects/locks written by the prior container.
+share_task_tree_with_container "$task_uai_dir/repos" \
+  "task-private Git repositories"
+
+if [ -z "$github_credential_socket" ] && [ "$uai_used_ssh_transport" = "1" ]; then
+  uai_git_transport="ssh"
+fi
+
 # -----------------------------------------------------------------------------
 # 4. Generate .uai/docker-compose.yml (bash). Union preview ports + env keys
 #    across the selected projects; one app service. Derived Dockerfile only
@@ -338,20 +1005,24 @@ fi
     printf '    pull_policy: never\n'
   fi
   printf '    init: true\n'
+  # Give node the one host group that owns this task's bind-mounted files.
+  # Numeric group_add works even when the group has a different name (or no
+  # name) in the image. Root hosts use node's existing gid 1000 above.
+  printf '    group_add:\n'
+  printf '      - "%s"\n' "$task_container_gid"
   printf '    working_dir: /workspace\n'
   printf '    volumes:\n'
   printf '      - "%s:/workspace"\n' "$task_workspace"
-  # Identical-host-path binds so each git worktree's absolute gitdir pointer
-  # (-> projects/<id>/repo.git/worktrees/<slug>) resolves INSIDE the container
-  # (ADR-014). Without them in-container git sees a dangling .git and every
-  # commit fails with "not a git repository". The mirror is bound rw because
-  # commits write objects back into the shared object store.
+  # Identical-host-path binds keep each linked worktree's absolute gitdir
+  # pointer valid in-container (ADR-014). Only the self-contained task-private
+  # repository is mounted; the host cache never enters a container. Legacy
+  # worktrees fail closed before Compose rendering and must be recreated.
   printf '      - "%s:%s"\n' "$task_workspace" "$task_workspace"
   while IFS= read -r vol_obj; do
     [ -n "$vol_obj" ] || continue
     vol_pid=$(jq -r '.id' <<<"$vol_obj")
-    printf '      - "%s/%s/repo.git:%s/%s/repo.git"\n' \
-      "$projects_root" "$vol_pid" "$projects_root" "$vol_pid"
+    printf '      - "%s/repos/%s.git:%s/repos/%s.git"\n' \
+      "$task_uai_dir" "$vol_pid" "$task_uai_dir" "$vol_pid"
   done < <(jq -c '.[]' <<<"$projects_json")
   printf '      - "%s:/opt/asdf-data"\n' "$ASDF_VOLUME"
   # ADR-053: host-wide Playwright browser cache. Always mounted (harmless
@@ -378,6 +1049,13 @@ fi
   # sidecar attached to the compose network, so nothing is exposed by default.
   printf '      - "127.0.0.1::8080"\n'
   printf '    environment:\n'
+  # Non-secret transport marker for uai-init. The actual GitHub token is
+  # injected later into gh's private config and never enters Compose.
+  printf '      UAI_GIT_TRANSPORT: "%s"\n' "$uai_git_transport"
+  # Uai owns GitHub auth inside the task container. Keep gh's config outside
+  # the bind-mounted workspace and independent of project-defined XDG/HOME
+  # values so its credential helper always resolves the connected user.
+  printf '      GH_CONFIG_DIR: "/home/node/.config/gh"\n'
   # Host-resident Claude auth (ADR-021). Headless `claude --print` no longer
   # uses the interactive subscription/keychain path, so it needs a token from
   # `claude setup-token`. Interpolated from the host-agent env at up-time, so
@@ -398,22 +1076,27 @@ fi
   # an env var over its stored credentials, which blocks the per-user
   # `gh auth login --with-token` the host runs (and would re-attribute every PR
   # to the env token — breaking multi-user). The host's GitHub token reaches
-  # `gh` through its config file instead (lib/github-tokens.ts); git rides the
-  # per-user SSH identity, not an HTTPS token (uai-init routes remotes over SSH).
-  # A project may declare GH_TOKEN/GITHUB_TOKEN as an env key, so skip them here
-  # rather than trust callers — this is where the rule is enforced.
+  # `gh` through its config file instead (lib/github-tokens.ts), and gh serves
+  # as Git's HTTPS credential helper. SSH remains a disconnected-user fallback.
+  # Projects may declare managed names, so skip them here rather than trust
+  # callers. They are also removed from the in-memory Compose override below.
   #
-  # The decrypted per-(project, key) env VALUES live in this script's process
-  # env (injected by lib/agent.ts from the host store). The `${KEY:-}`
-  # pass-throughs below resolve to them via docker's interpolation at up-time —
-  # the value is never written into the YAML (mirrors CLAUDE_CODE_OAUTH_TOKEN),
-  # so this stays secret-blind end to end (ADR-015).
+  # Project values never enter the host environment. Emit an explicit empty
+  # default for every declared key; the stdin-only Compose override supplies
+  # decrypted values at `compose up` time.
   while IFS= read -r ekey; do
     [ -n "$ekey" ] || continue
     case "$ekey" in
-      GH_TOKEN | GITHUB_TOKEN) continue ;;
+      GH_TOKEN | GITHUB_TOKEN | GH_CONFIG_DIR | GH_HOST | \
+      GIT_CONFIG* | GIT_DIR | GIT_WORK_TREE | GIT_COMMON_DIR | \
+      GIT_OBJECT_DIRECTORY | GIT_ALTERNATE_OBJECT_DIRECTORIES | \
+      GIT_INDEX_FILE | GIT_EXEC_PATH | GIT_ASKPASS | SSH_ASKPASS | \
+      GIT_SSH | GIT_SSH_COMMAND | HOME | XDG_CONFIG_HOME | \
+      BASH_ENV | ENV | UAI_GIT_TRANSPORT | \
+      CLAUDE_CODE_OAUTH_TOKEN | ANTHROPIC_API_KEY | \
+      ANTHROPIC_AUTH_TOKEN | XAI_API_KEY | PLAYWRIGHT_BROWSERS_PATH) continue ;;
     esac
-    printf '      %s: "${%s:-}"\n' "$ekey" "$ekey"
+    printf '      %s: ""\n' "$ekey"
   done < <(jq -r '.[]' <<<"$union_env_keys_json")
   # Preview-URL env vars (ADR-025): cloud-computed PUBLIC preview URLs exposed
   # under operator-chosen names (e.g. EXPO_PACKAGER_PROXY_URL). Non-secret, so
@@ -468,10 +1151,53 @@ if ! docker image inspect "$STANDARD_IMAGE" >/dev/null 2>&1; then
 fi
 
 step "COMPOSE_UP_FAILED" "docker compose up -d"
+# Limit the supplied values to keys the selected projects actually declare,
+# then remove Uai-managed names and preview URL names. JSON is valid YAML, so
+# Compose can merge this secret-bearing override directly from stdin without a
+# temporary env/YAML file and without exporting any value to host commands.
+preview_env_raw=$(jq -r '.[0].preview_env // "{}"' <<<"$task_json")
+compose_env_override=$(printf '%s' "$project_env_json" | jq -c \
+  --argjson declared "$union_env_keys_json" \
+  --argjson preview "$preview_env_raw" '
+    .
+    | with_entries(.key as $key | select($declared | index($key)))
+    | with_entries(select(.key | test("^GIT_CONFIG($|_)") | not))
+    | del(
+        .GH_TOKEN,
+        .GITHUB_TOKEN,
+        .GH_CONFIG_DIR,
+        .GH_HOST,
+        .GIT_DIR,
+        .GIT_WORK_TREE,
+        .GIT_COMMON_DIR,
+        .GIT_OBJECT_DIRECTORY,
+        .GIT_ALTERNATE_OBJECT_DIRECTORIES,
+        .GIT_INDEX_FILE,
+        .GIT_EXEC_PATH,
+        .GIT_ASKPASS,
+        .SSH_ASKPASS,
+        .GIT_SSH,
+        .GIT_SSH_COMMAND,
+        .HOME,
+        .XDG_CONFIG_HOME,
+        .BASH_ENV,
+        .ENV,
+        .UAI_GIT_TRANSPORT,
+        .CLAUDE_CODE_OAUTH_TOKEN,
+        .ANTHROPIC_API_KEY,
+        .ANTHROPIC_AUTH_TOKEN,
+        .XAI_API_KEY,
+        .PLAYWRIGHT_BROWSERS_PATH
+      )
+    | delpaths($preview | keys | map([.]))
+    | {services:{app:{environment:.}}}
+  ')
 if [ "$has_derived" = "1" ]; then
-  docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" up -d --build >/dev/null
+  printf '%s\n' "$compose_env_override" | docker compose -p "$compose_project" \
+    -f "$task_uai_dir/docker-compose.yml" -f - up -d --build >/dev/null
 else
-  docker compose -p "$compose_project" -f "$task_uai_dir/docker-compose.yml" up -d >/dev/null
+  printf '%s\n' "$compose_env_override" | docker compose -p "$compose_project" \
+    -f "$task_uai_dir/docker-compose.yml" -f - up -d >/dev/null
 fi
 
 # -----------------------------------------------------------------------------
@@ -480,6 +1206,123 @@ fi
 
 step "CONTAINER_INIT_FAILED" "uai-init (deps + code-server)"
 
+# `docker exec` inherits the project environment from Compose. Override loader
+# and config variables before the first executable starts, then use `env -i`
+# plus absolute command paths so a project value cannot redirect this managed
+# credential operation to workspace code or another config directory.
+managed_gh_config_dir="/home/node/.config/gh"
+managed_exec_env=(
+  -e "HOME=/home/node"
+  -e "GH_CONFIG_DIR=$managed_gh_config_dir"
+  -e "PATH=/usr/bin:/bin"
+  -e "XDG_CONFIG_HOME="
+  -e "LD_PRELOAD="
+  -e "LD_LIBRARY_PATH="
+  -e "DYLD_INSERT_LIBRARIES="
+  -e "DYLD_LIBRARY_PATH="
+  -e "BASH_ENV="
+  -e "ENV="
+  -e "GIT_CONFIG="
+  -e "GIT_CONFIG_GLOBAL="
+  -e "GIT_CONFIG_SYSTEM="
+  -e "GIT_CONFIG_NOSYSTEM="
+  -e "GIT_CONFIG_COUNT=0"
+  -e "GIT_EXEC_PATH="
+  -e "GIT_SSH="
+  -e "GIT_SSH_COMMAND="
+  -e "GIT_ASKPASS="
+  -e "SSH_ASKPASS="
+  -e "GH_TOKEN="
+  -e "GITHUB_TOKEN="
+)
+managed_clean_env=(
+  /usr/bin/env -i
+  "HOME=/home/node"
+  "GH_CONFIG_DIR=$managed_gh_config_dir"
+  "PATH=/usr/bin:/bin"
+)
+
+# Git rejects a repository owned by another uid even when its shared group is
+# writable. Trust only the selected worktrees in this task container—never `*`
+# and never the host cache. The task-private ~/.gitconfig makes these entries
+# local to this container, and the read-before-add keeps resumes idempotent.
+step "CONTAINER_INIT_FAILED" "trust task Git worktrees"
+container_safe_dirs=$(docker exec -u node "${managed_exec_env[@]}" \
+  "$app_container" "${managed_clean_env[@]}" /usr/bin/git config --global \
+  --get-all safe.directory 2>/dev/null || true)
+while IFS= read -r safe_project; do
+  [ -n "$safe_project" ] || continue
+  safe_project_id=$(jq -r '.id' <<<"$safe_project")
+  safe_project_slug=$(jq -r '.slug' <<<"$safe_project")
+  for safe_worktree in \
+    "/workspace/$safe_project_slug" \
+    "$task_workspace/$safe_project_slug" \
+    "$task_uai_dir/repos/$safe_project_id.git"; do
+    if ! printf '%s\n' "$container_safe_dirs" \
+      | grep -Fqx -- "$safe_worktree"; then
+      if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
+        "${managed_clean_env[@]}" /usr/bin/git config --global --add \
+        safe.directory "$safe_worktree" >/dev/null; then
+        emit_err "CONTAINER_INIT_FAILED" \
+          "Uai could not mark $safe_worktree as this task's trusted Git path" \
+          "trust task Git worktrees"
+      fi
+      container_safe_dirs="${container_safe_dirs}"$'\n'"${safe_worktree}"
+    fi
+  done
+done < <(jq -c '.[]' <<<"$projects_json")
+
+# A failed/retried start can preserve a container that still holds a previous
+# account. Erase that Uai-managed state first for both connected and
+# disconnected starts; otherwise a no-credential resume could briefly reuse a
+# stale token before the asynchronous reconciler catches up.
+if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
+  "${managed_clean_env[@]}" /bin/sh -c '
+    set -eu
+    /bin/rm -f "$GH_CONFIG_DIR/hosts.yml"
+    for key in \
+      credential.https://github.com.helper \
+      credential.https://gist.github.com.helper
+    do
+      /usr/bin/git config --file "$HOME/.gitconfig" --unset-all "$key" \
+        >/dev/null 2>&1 || true
+      if /usr/bin/git config --file "$HOME/.gitconfig" --get-all "$key" \
+        >/dev/null 2>&1; then
+        exit 1
+      fi
+    done
+    test ! -e "$GH_CONFIG_DIR/hosts.yml"
+  ' >/dev/null; then
+  emit_err "GITHUB_AUTH_UNAVAILABLE" \
+    "Uai could not clear the previous managed GitHub credential from the task container. Retry the task before doing GitHub work." \
+    "clear container GitHub credential"
+fi
+
+# The task container must have the same connected GitHub principal BEFORE
+# uai-init runs package managers: private Git submodules/dependencies may be
+# fetched during install. Read the token back from the private cache and stream
+# only its password field directly into `gh auth login`; it never enters argv,
+# environment, a shell variable, Compose, or disk.
+if [ -n "$github_credential_socket" ]; then
+  if ! printf 'protocol=https\nhost=github.com\n\n' \
+    | git_with_github_credential credential fill \
+    | sed -n 's/^password=//p' \
+    | docker exec -i -u node "${managed_exec_env[@]}" "$app_container" \
+        "${managed_clean_env[@]}" /usr/bin/gh auth login --with-token \
+        --hostname github.com --git-protocol https >/dev/null; then
+    emit_err "GITHUB_AUTH_UNAVAILABLE" \
+      "GitHub is connected on this host, but Uai could not install that credential in the task container. Retry the task; if it persists, reconnect GitHub on this host." \
+      "configure container GitHub credential"
+  fi
+  if ! docker exec -u node "${managed_exec_env[@]}" "$app_container" \
+    "${managed_clean_env[@]}" /usr/bin/gh auth setup-git \
+    --hostname github.com >/dev/null; then
+    emit_err "GITHUB_AUTH_UNAVAILABLE" \
+      "GitHub is connected on this host, but Uai could not configure Git HTTPS in the task container. Retry the task; if it persists, reconnect GitHub on this host." \
+      "configure container Git credential helper"
+  fi
+fi
+
 # Copy `.claude.json` into the container instead of bind-mounting it.
 # Single-file bind mounts on Docker Desktop macOS are fragile — claude
 # CLI atomically rewrites the file on every start, which can invalidate
@@ -571,11 +1414,10 @@ done
 docker exec -u root "$app_container" \
   chown -R node:node /home/node/.local/share/opencode >/dev/null 2>&1 || true
 
-# Copy the same resolved SSH identity (task creator's per-user key when present,
-# else the operator identity — see above) into the container, so the agent signs
-# + pushes with the key whose .pub the user registered on GitHub. ADR-027 drops
-# the HTTPS/GH_TOKEN path; uai-init routes every GitHub remote over SSH.
-# Best-effort: signing + SSH push just stay off if the identity is absent —
+# Copy the resolved SSH identity into the container for commit/tag signing and
+# as the no-GitHub-connection transport fallback. Connected users clone, fetch,
+# and push over HTTPS through their gh credential instead.
+# Best-effort: signing + the SSH fallback stay off if the identity is absent —
 # but every failure is LOGGED (a silent miss here reads as a GitHub
 # permissions problem hours later; live 2026-07-21). The channel-ensure path
 # (ensureTaskSshIdentity) re-asserts all of this on reconnects.
@@ -585,7 +1427,7 @@ if [ -f "$uai_identity_key" ]; then
     || log "warning: ssh setup: mkdir ~/.ssh failed in $app_container"
   docker cp "$uai_identity_key" \
     "$app_container":/home/node/.ssh/id_ed25519 >/dev/null 2>&1 \
-    || log "warning: ssh setup: key copy failed — pushes will fall back to HTTPS"
+    || log "warning: ssh setup: key copy failed — signing and SSH fallback unavailable"
   docker cp "${uai_identity_key}.pub" \
     "$app_container":/home/node/.ssh/id_ed25519.pub >/dev/null 2>&1 \
     || log "warning: ssh setup: pubkey copy failed (signing will be off)"