@runuai/host 0.9.120 → 0.9.122

package/lib/agents/transport.ts

@@ -55,6 +55,7 @@ import {
   type ExitHandler,
   type LineHandler,
 } from "./proc";
+import { isEnvironmentTransportProvider } from "../task-environment/types";
 
 /** The shared surface adapters program against (LineProcess's shape). */
 export interface LineTransport {
@@ -124,7 +125,7 @@ export function createAgentTransport(opts: AgentTransportOptions): LineTransport
   // the container-runtime preflight is a docker/apple concern a machine task
   // must not trip over, and the host-FS durable flow below polls files a
   // machine does not share. Machine durability uses the ssh-tail backend.
-  if (opts.environment.descriptor.locator.provider === "machine") {
+  if (isEnvironmentTransportProvider(opts.environment.descriptor.locator.provider)) {
     // The session env was assembled with the CONTAINER runtime authority
     // (asdf/corepack pins to shared read-only volumes) — on a machine those
     // paths do not exist and the pins actively break package managers.

package/lib/browser-testing.ts

@@ -56,6 +56,7 @@ import {
 } from "./runtime-authority";
 import { STANDARD_DEFAULT_NODE_VERSION } from "./standard-image";
 import type { TaskEnvironmentHandle } from "./task-environment/types";
+import { isEnvironmentTransportProvider } from "./task-environment/types";
 
 const SERVER_DISPLAY = ":99";
 /**
@@ -1112,7 +1113,7 @@ export async function setupBrowserTesting(
   // browser (and every npx-launched server) for the session's whole lifetime
   // while Claude's 30s survives — live 2026-08-28, first codex machine task.
   const authorityEnv =
-    environment?.descriptor?.locator.provider === "machine"
+    isEnvironmentTransportProvider(environment?.descriptor?.locator.provider)
       ? MACHINE_RUNTIME_AUTHORITY_ENV
       : RUNTIME_AUTHORITY_ENV;
   let ready = false;

package/lib/credential-store.ts

@@ -22,6 +22,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { env } from "./env";
+import { leaseAwsEnv } from "./lease";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 
@@ -90,6 +91,9 @@ export function defaultAwsCliRunner(region: string): AwsCliRunner {
       let settled = false;
       const child = spawn("aws", ["--region", region, "--output", "json", ...args], {
         stdio: ["ignore", "pipe", "pipe"],
+        // ADR-133: a task machine acts under its lease (empty elsewhere — an
+        // owned or Uai-operated host keeps its own instance role).
+        env: { ...process.env, ...leaseAwsEnv() },
       });
       const settle = (status: number | null): void => {
         if (settled) return;

package/lib/lease.ts

@@ -0,0 +1,216 @@
+/**
+ * ADR-133 task leases — the sidecar's AWS credentials.
+ *
+ * A task machine holds no long-lived AWS credential. At connect (and ten
+ * minutes before every expiry) the sidecar sends `lease.request` over the
+ * bridge; the cloud checks that this host row is the machine of a running
+ * task, assumes the `uai-task-machine` role with session tags for the task's
+ * workspace and owner, and answers `lease.grant` with the STS session. The
+ * session is held here in memory and handed to exactly two consumers:
+ *
+ *  - the credential store's `aws` CLI calls (Parameter Store reads for engine
+ *    accounts, GitHub tokens, MCP secrets, project env) through `leaseAwsEnv()`;
+ *  - Mountpoint for Amazon S3 (shared files) through a `credential_process`
+ *    that prints the current session — so a refreshed lease reaches a mount
+ *    that is already up without remounting.
+ *
+ * Revocation is the next refresh being denied: `onDenied` fires and the
+ * sidecar exits, and the cloud's sweep terminates the machine. A lease is
+ * bound to one task and one machine; nothing here can ask for another's.
+ */
+import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+
+import type { TaskLease } from "../src/protocol";
+
+/** Re-request this long before the session expires. */
+export const LEASE_REFRESH_LEAD_MS = 10 * 60_000;
+/** A denied or unanswered request is retried this often until it lands. */
+export const LEASE_RETRY_MS = 30_000;
+/** The cloud must answer within this window or the request is retried. */
+export const LEASE_REQUEST_TIMEOUT_MS = 20_000;
+
+/** Where the `credential_process` helper reads the live session. Root-only:
+ * the agents run as `node` and never see it. */
+export const LEASE_CREDENTIALS_FILE = "/run/uai/lease-credentials.json";
+/** The AWS config Mountpoint is pointed at (`AWS_CONFIG_FILE`). */
+export const LEASE_AWS_CONFIG_FILE = "/run/uai/aws-config";
+/** The helper itself — a shell script so it needs nothing but `cat`. */
+export const LEASE_CREDENTIAL_PROCESS = "/run/uai/lease-credential-process";
+
+export interface LeaseSender {
+  (frame: { kind: "lease.request"; opId: string; taskId: string }): boolean;
+}
+
+export interface LeaseManagerOptions {
+  taskId: string;
+  send: LeaseSender;
+  /** First grant — the store reconciles and the S3 mount wait for this. */
+  onFirstGrant?: (lease: TaskLease) => void;
+  /** Every grant, including refreshes. */
+  onGrant?: (lease: TaskLease) => void;
+  /** The cloud refused: the task is no longer ours. */
+  onDenied?: (error: string) => void;
+  /** Test seam: skip the /run/uai files. */
+  writeFiles?: boolean;
+  now?: () => number;
+  setTimer?: typeof setTimeout;
+  clearTimer?: typeof clearTimeout;
+}
+
+let current: TaskLease | null = null;
+
+/** The AWS environment for a child process that should act under the lease
+ * (the credential store's CLI runner). Empty when no lease is held — the
+ * caller then runs with whatever the process has, which on a task machine
+ * is nothing. */
+export function leaseAwsEnv(): Record<string, string> {
+  if (!current) return {};
+  return {
+    AWS_ACCESS_KEY_ID: current.accessKeyId,
+    AWS_SECRET_ACCESS_KEY: current.secretAccessKey,
+    AWS_SESSION_TOKEN: current.sessionToken,
+    AWS_REGION: current.region,
+    AWS_DEFAULT_REGION: current.region,
+  };
+}
+
+export function currentLease(): TaskLease | null {
+  return current;
+}
+
+/** Test seam. */
+export function setCurrentLeaseForTesting(lease: TaskLease | null): void {
+  current = lease;
+}
+
+/** The JSON shape the AWS SDK credential_process contract expects. */
+export function credentialProcessOutput(lease: TaskLease): string {
+  return JSON.stringify({
+    Version: 1,
+    AccessKeyId: lease.accessKeyId,
+    SecretAccessKey: lease.secretAccessKey,
+    SessionToken: lease.sessionToken,
+    Expiration: new Date(lease.expiresAt).toISOString(),
+  });
+}
+
+function writeLeaseFiles(lease: TaskLease): void {
+  mkdirSync(dirname(LEASE_CREDENTIALS_FILE), { recursive: true, mode: 0o700 });
+  writeFileSync(LEASE_CREDENTIALS_FILE, credentialProcessOutput(lease), { mode: 0o600 });
+  chmodSync(LEASE_CREDENTIALS_FILE, 0o600);
+  writeFileSync(
+    LEASE_CREDENTIAL_PROCESS,
+    `#!/bin/sh\nexec cat ${LEASE_CREDENTIALS_FILE}\n`,
+    { mode: 0o700 },
+  );
+  chmodSync(LEASE_CREDENTIAL_PROCESS, 0o700);
+  writeFileSync(
+    LEASE_AWS_CONFIG_FILE,
+    `[default]\nregion = ${lease.region}\ncredential_process = ${LEASE_CREDENTIAL_PROCESS}\n`,
+    { mode: 0o600 },
+  );
+  chmodSync(LEASE_AWS_CONFIG_FILE, 0o600);
+}
+
+export class LeaseManager {
+  readonly #opts: Required<Pick<LeaseManagerOptions, "now" | "setTimer" | "clearTimer">> &
+    LeaseManagerOptions;
+  #pending: { opId: string; timer: ReturnType<typeof setTimeout> } | null = null;
+  #refresh: ReturnType<typeof setTimeout> | null = null;
+  #granted = false;
+  #stopped = false;
+  #sequence = 0;
+
+  constructor(opts: LeaseManagerOptions) {
+    this.#opts = {
+      ...opts,
+      now: opts.now ?? Date.now,
+      setTimer: opts.setTimer ?? setTimeout,
+      clearTimer: opts.clearTimer ?? clearTimeout,
+    };
+  }
+
+  /** Ask now. Idempotent while a request is in flight. */
+  request(): void {
+    if (this.#stopped || this.#pending) return;
+    const opId = `lease-${this.#opts.taskId}-${++this.#sequence}-${this.#opts.now()}`;
+    const sent = this.#opts.send({ kind: "lease.request", opId, taskId: this.#opts.taskId });
+    const timer = this.#opts.setTimer(() => {
+      // Unanswered (the socket dropped, the cloud was mid-deploy): try again.
+      this.#pending = null;
+      this.#armRetry();
+    }, LEASE_REQUEST_TIMEOUT_MS);
+    timer.unref?.();
+    this.#pending = { opId, timer };
+    if (!sent) {
+      // Nothing on the wire; retry once the socket is back.
+      this.#opts.clearTimer(timer);
+      this.#pending = null;
+      this.#armRetry();
+    }
+  }
+
+  /** Bridge dispatch hands every `lease.*` frame here. */
+  handle(frame: { kind: "lease.grant"; opId: string; lease: TaskLease } | { kind: "lease.deny"; opId: string; error: string }): void {
+    if (!this.#pending || this.#pending.opId !== frame.opId) return;
+    this.#opts.clearTimer(this.#pending.timer);
+    this.#pending = null;
+    if (frame.kind === "lease.deny") {
+      current = null;
+      this.#opts.onDenied?.(frame.error);
+      return;
+    }
+    current = frame.lease;
+    if (this.#opts.writeFiles !== false) {
+      try {
+        writeLeaseFiles(frame.lease);
+      } catch (error) {
+        console.warn(
+          `[lease] could not write the credential_process files: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      }
+    }
+    const first = !this.#granted;
+    this.#granted = true;
+    this.#armRefresh(frame.lease);
+    if (first) this.#opts.onFirstGrant?.(frame.lease);
+    this.#opts.onGrant?.(frame.lease);
+  }
+
+  /** The socket reconnected: whatever was pending is void; ask again. */
+  reconnected(): void {
+    if (this.#pending) {
+      this.#opts.clearTimer(this.#pending.timer);
+      this.#pending = null;
+    }
+    this.request();
+  }
+
+  stop(): void {
+    this.#stopped = true;
+    if (this.#pending) this.#opts.clearTimer(this.#pending.timer);
+    if (this.#refresh) this.#opts.clearTimer(this.#refresh);
+    this.#pending = null;
+    this.#refresh = null;
+  }
+
+  #armRefresh(lease: TaskLease): void {
+    if (this.#refresh) this.#opts.clearTimer(this.#refresh);
+    const delay = Math.max(1_000, lease.expiresAt - LEASE_REFRESH_LEAD_MS - this.#opts.now());
+    this.#refresh = this.#opts.setTimer(() => {
+      this.#refresh = null;
+      this.request();
+    }, delay);
+    this.#refresh.unref?.();
+  }
+
+  #armRetry(): void {
+    if (this.#stopped || this.#refresh) return;
+    this.#refresh = this.#opts.setTimer(() => {
+      this.#refresh = null;
+      this.request();
+    }, LEASE_RETRY_MS);
+    this.#refresh.unref?.();
+  }
+}

package/lib/mcp-gateway.ts

@@ -55,6 +55,7 @@ import { authHeaderFor, getConnection } from "./mcp-connections";
 import { agentClisReady } from "./standard-image";
 import { isSafeHostTaskId, assertSafeHostTaskId } from "./task-identity";
 import type { McpGatewayCapability } from "../src/protocol";
+import { isEnvironmentTransportProvider } from "./task-environment/types";
 
 export type { McpGatewayCapability } from "../src/protocol";
 
@@ -1098,7 +1099,7 @@ export async function setupMcpTaskConfig(
     // (machine-gateway-tunnel.ts). host.docker.internal / vmnet addresses
     // are container topology a machine can never route.
     const gatewayHost =
-      environment?.descriptor?.locator.provider === "machine"
+      isEnvironmentTransportProvider(environment?.descriptor?.locator.provider)
         ? "127.0.0.1"
         : await taskGatewayHost();
     const urlFor = (slug: string): string =>

package/lib/orchestrator.ts

@@ -142,6 +142,7 @@ import {
   MAX_SECRETARY_DISPATCH_ID_CHARS,
   SECRETARY_TYPED_DISPATCH_PROTOCOL_FEATURE,
 } from "../src/protocol";
+import { isEnvironmentTransportProvider } from "./task-environment/types";
 
 export type HostEventSubscriber = (event: HostEvent) => void;
 
@@ -1426,7 +1427,7 @@ export class Orchestrator {
         // ADR-121: machine workspaces are only reachable through the
         // environment handle — the docker-exec cold-start default would
         // dial a container that does not exist. Settle the handle first.
-        if (task.environmentProvider === "machine") {
+        if (isEnvironmentTransportProvider(task.environmentProvider)) {
           await this.agentEnvironment(channel).catch(() => {});
           if (!this.isActiveChannel(channel)) return;
         }
@@ -1859,7 +1860,7 @@ export class Orchestrator {
     // handle. Settle it before any materialization step below, so identity,
     // skills, browser, and MCP writes all ride the provider surface instead
     // of dialing a compose container that does not exist.
-    if (task.environmentProvider === "machine") {
+    if (isEnvironmentTransportProvider(task.environmentProvider)) {
       await this.agentEnvironment(channel).catch(() => {});
       if (!this.isActiveChannel(channel)) return false;
     }
@@ -5927,7 +5928,7 @@ async function materializeAgentCli(
   apiUrl: string | null,
   allowPermissionless: boolean,
 ): Promise<boolean> {
-  if (task.environmentProvider === "machine") {
+  if (isEnvironmentTransportProvider(task.environmentProvider)) {
     try {
       const environment = await reconstructPersistedTaskEnvironment(task);
       if (environment === null) return false;

package/lib/shared-files-s3.ts

@@ -0,0 +1,153 @@
+/**
+ * ADR-133 shared files on a task machine: S3 prefixes mounted with Mountpoint
+ * for Amazon S3 (`mount-s3`) at /workspace/files/{org,me}.
+ *
+ * Containers bind-mount a host directory; a machine over ssh got a
+ * point-in-time tar copy; the sidecar mounts the live prefix, so any number
+ * of task machines see one workspace's files at once and writes land in the
+ * bucket as they happen. Credentials come from the task lease through the
+ * `credential_process` config lib/lease.ts maintains — a refreshed lease
+ * reaches a mount that is already up.
+ *
+ * Mountpoint's semantics (whole-file writes, no rename) are the documented
+ * caveat of hostless-implementation.md decision 4; EFS is the swap if they
+ * bite, and this module is the only place that would change.
+ */
+import type { TaskEnvironmentHandle } from "./task-environment/types";
+import { LEASE_AWS_CONFIG_FILE, currentLease } from "./lease";
+
+export const MOUNT_S3_BIN = "/usr/bin/mount-s3";
+export const SHARED_FILES_UID = 1000;
+export const SHARED_FILES_GID = 1000;
+
+export type SharedFilesMode = "off" | "ro" | "rw";
+
+export interface SharedFilesMountPlan {
+  bucket: string;
+  prefix: string;
+  directory: string;
+  mode: "ro" | "rw";
+  region: string;
+}
+
+/** The mount-s3 argv for one prefix. Exported for the test that pins it. */
+export function mountS3Argv(plan: SharedFilesMountPlan): [string, ...string[]] {
+  return [
+    MOUNT_S3_BIN,
+    "--prefix",
+    plan.prefix,
+    "--region",
+    plan.region,
+    // Owned by the task user so agents and the editor can use it; the mount
+    // is performed by the root sidecar.
+    "--allow-other",
+    "--uid",
+    String(SHARED_FILES_UID),
+    "--gid",
+    String(SHARED_FILES_GID),
+    "--dir-mode",
+    "0755",
+    "--file-mode",
+    "0644",
+    ...(plan.mode === "ro" ? ["--read-only"] : ["--allow-delete", "--allow-overwrite"]),
+    plan.bucket,
+    plan.directory,
+  ];
+}
+
+/** The mounts a task wants, from its shared-files mode and lease. */
+export function sharedFilesMountPlans(
+  workspacePath: string,
+  mode: SharedFilesMode,
+  lease: { region: string; files: { bucket: string; orgPrefix: string | null; userPrefix: string } },
+): SharedFilesMountPlan[] {
+  if (mode === "off") return [];
+  const plans: SharedFilesMountPlan[] = [];
+  if (lease.files.orgPrefix) {
+    plans.push({
+      bucket: lease.files.bucket,
+      prefix: lease.files.orgPrefix,
+      directory: `${workspacePath}/files/org`,
+      mode,
+      region: lease.region,
+    });
+  }
+  plans.push({
+    bucket: lease.files.bucket,
+    prefix: lease.files.userPrefix,
+    directory: `${workspacePath}/files/me`,
+    mode,
+    region: lease.region,
+  });
+  return plans;
+}
+
+/**
+ * Mount the task's shared files. Returns a warning string when something
+ * could not be mounted (the task still starts, like the machine copy path),
+ * null when clean or when there is nothing to mount.
+ */
+export async function mountSharedFilesFromLease(
+  handle: TaskEnvironmentHandle<unknown>,
+  workspacePath: string,
+  task: { sharedFiles?: string },
+): Promise<string | null> {
+  const mode: SharedFilesMode =
+    task.sharedFiles === "rw" ? "rw" : task.sharedFiles === "off" ? "off" : "ro";
+  if (mode === "off") return null;
+  const lease = currentLease();
+  if (!lease) {
+    return "shared files: no lease yet — /workspace/files is not mounted";
+  }
+  const warnings: string[] = [];
+  let mountedAny = false;
+  for (const plan of sharedFilesMountPlans(workspacePath, mode, lease)) {
+    const result = await handle.exec({
+      argv: [
+        "/bin/sh",
+        "-c",
+        // Idempotent: an already-mounted directory is left alone.
+        'mkdir -p "$1" && chown 1000:1000 "$1"; if mountpoint -q "$1"; then exit 0; fi; shift; exec "$@"',
+        "mount",
+        plan.directory,
+        ...mountS3Argv(plan),
+      ],
+      user: "root",
+      env: { AWS_CONFIG_FILE: LEASE_AWS_CONFIG_FILE },
+      timeoutMs: 60_000,
+      maxOutputBytes: 64 * 1024,
+    });
+    if (result.exitCode === 0) {
+      mountedAny = true;
+    } else {
+      warnings.push(
+        `shared files: could not mount ${plan.directory}: ${Buffer.from(result.stderr).toString("utf8").trim() || `exit ${result.exitCode}`}`,
+      );
+    }
+  }
+  if (mountedAny) {
+    // The same marker the container and machine paths write: it gates the
+    // "## Shared files" briefing in every agent's preamble.
+    await handle
+      .writeWorkspaceFile(`${workspacePath}/.uai/files-mounted`, Buffer.from(""))
+      .catch(() => {});
+  }
+  return warnings.length > 0 ? warnings.join("\n") : null;
+}
+
+/** Unmount both directories; tolerant of never-mounted paths. */
+export async function unmountSharedFiles(
+  handle: TaskEnvironmentHandle<unknown>,
+  workspacePath: string,
+): Promise<void> {
+  for (const directory of [`${workspacePath}/files/org`, `${workspacePath}/files/me`]) {
+    await handle
+      .exec({
+        argv: ["/bin/sh", "-c", 'mountpoint -q "$1" && umount "$1" || true', "umount", directory],
+        user: "root",
+        timeoutMs: 30_000,
+        maxOutputBytes: 4 * 1024,
+      })
+      .catch(() => {});
+  }
+}

package/lib/sidecar.ts

@@ -0,0 +1,58 @@
+/**
+ * ADR-133 sidecar mode: this runner process lives ON the task's machine and
+ * is that one task's host. Selected by the environment the machine image's
+ * `uai-sidecar.service` writes from EC2 user-data (hostless-implementation.md
+ * §8/§9). Everything the coordinator shape needed and a single-task machine
+ * does not — the local UI, the container runtime, host-level engine accounts,
+ * the machine provider, recovery sweeps over many tasks — asks here and
+ * stays off. Owned runners never set it.
+ */
+
+export function sidecarTaskId(): string | null {
+  const value = process.env.UAI_SIDECAR_TASK?.trim();
+  return value && /^[a-z0-9]{1,32}$/i.test(value) ? value : null;
+}
+
+export function sidecarMode(): boolean {
+  return sidecarTaskId() !== null;
+}
+
+/**
+ * A sidecar is ready to run its task only once it holds a lease AND the
+ * credential store has been reconciled under it — before that there is no
+ * engine account, GitHub token, or project env on the machine, and a task-up
+ * that raced the first grant would clone without credentials and spawn
+ * agents that cannot sign in (the dispatch arrives the moment the bridge
+ * connects; the lease answer is one round trip behind it). Resolved by
+ * main.ts after the first grant's reconciles settle; never on an owned host.
+ */
+let markReady: (() => void) | null = null;
+let ready = false;
+export const sidecarReady: Promise<void> = new Promise<void>((resolve) => {
+  markReady = resolve;
+});
+export function markSidecarReady(): void {
+  if (ready) return;
+  ready = true;
+  markReady?.();
+  markReady = null;
+}
+export function isSidecarReady(): boolean {
+  return ready;
+}
+/** How long a task-up waits for the lease before giving up. */
+export const SIDECAR_READY_TIMEOUT_MS = 3 * 60_000;
+export function awaitSidecarReady(timeoutMs = SIDECAR_READY_TIMEOUT_MS): Promise<void> {
+  if (!sidecarMode() || ready) return Promise.resolve();
+  return new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(
+      () => reject(new Error("the task's machine has no credentials yet (no lease granted)")),
+      timeoutMs,
+    );
+    timer.unref?.();
+    void sidecarReady.then(() => {
+      clearTimeout(timer);
+      resolve();
+    });
+  });
+}

package/lib/standard-image.ts

@@ -1107,6 +1107,13 @@ function notifyAgentClisReadyListener(listener: AgentClisReadyListener): void {
   }
 }
 
+/** ADR-133 sidecar mode: the agent CLIs are baked into the task machine's
+ * image, so there is no standard-image pass to wait on — boot declares them
+ * ready. Never called on a host that owns a container runtime. */
+export function declareAgentClisReady(): void {
+  markAgentClisReady();
+}
+
 function markAgentClisReady(): void {
   if (agentClisReadyLatched) return;
   // Publish the synchronous capability state before resolving the promise:

package/lib/task-environment/index.ts

@@ -28,7 +28,6 @@ import { ensureMachineKeyPair } from "../machine-keys";
 import { requestAccessToken } from "../github-tokens";
 import {
   createMachineTaskEnvironmentProvider,
-  MACHINE_TASK_ENVIRONMENT_PROVIDER,
 } from "./machine";
 import { createMachineHostTaskEnvironmentProvider } from "./machine-task-up";
 import { TaskEnvironmentRegistry } from "./registry";
@@ -37,6 +36,7 @@ import {
   type TaskEnvironmentHandle,
   type TaskEnvironmentLocator,
   type TaskEnvironmentProvisioned,
+  isEnvironmentTransportProvider,
 } from "./types";
 
 export {
@@ -44,6 +44,9 @@ export {
   type LegacyTaskEnvironmentAdoptionDeps,
   type LegacyTaskEnvironmentAdoptionVerdict,
 } from "./legacy-adoption";
+import { sidecarMode } from "../sidecar";
+import { mountSharedFilesFromLease } from "../shared-files-s3";
+import { createSelfTaskEnvironmentProvider } from "./self";
 
 const registry = new TaskEnvironmentRegistry<
   TaskLaunchInput,
@@ -171,6 +174,22 @@ const machineProvider = createMachineHostTaskEnvironmentProvider({
 
 registry.register(machineProvider);
 
+// ADR-133 sidecar mode: the environment is this machine. Same task-up on top
+// (clone, editor, browser), a local-exec handle underneath; shared files
+// are mounted from S3 rather than copied from a host directory.
+const selfProvider = createMachineHostTaskEnvironmentProvider({
+  environment: createSelfTaskEnvironmentProvider(),
+  taskControlDir: (taskId) => taskDir(taskId),
+  machineImage: () => "self",
+  machineCpus: () => 0,
+  machineMemoryMiB: () => 0,
+  publishSsh: () => false,
+  githubToken: (userId) => requestAccessToken(userId),
+  sharedFiles: mountSharedFilesFromLease,
+});
+
+registry.register(selfProvider);
+
 /**
  * Bind the Docker provider's private recovery implementation. Kept as a
  * replaceable module seam so HMR can reload the orchestrator without leaving
@@ -187,9 +206,11 @@ export function provisionTaskEnvironment(
   credentials: TaskUpCredentials = {},
   onPrepared?: (locator: TaskEnvironmentLocator) => Promise<void>,
 ): Promise<TaskEnvironmentProvisioned<TaskUpResult, TaskDownResult>> {
-  const provider = machineTasksEnabled()
-    ? machineProvider
-    : requireMachineIdentity().backend === "apple-container"
+  const provider = sidecarMode()
+    ? selfProvider
+    : machineTasksEnabled()
+      ? machineProvider
+      : requireMachineIdentity().backend === "apple-container"
       ? appleProvider
       : dockerProvider;
   return provider.provision({
@@ -314,7 +335,7 @@ export function persistedTaskEnvironmentsMatchMachine(
     if (locator === null) continue;
     // ADR-121: machine locators name an ephemeral VM, not a container
     // daemon — no container-runtime identity claim to verify.
-    if (locator.provider === MACHINE_TASK_ENVIRONMENT_PROVIDER) continue;
+    if (isEnvironmentTransportProvider(locator.provider)) continue;
     try {
       const persisted = locatorMachineIdentity(locator);
       if (
@@ -384,7 +405,7 @@ export function hostTaskEnvironmentsAllowMachineSelection(
         throw new Error("task environment provider does not match its locator");
       }
       // ADR-121: machine rows make no container-runtime claim.
-      if (locator.provider === MACHINE_TASK_ENVIRONMENT_PROVIDER) continue;
+      if (isEnvironmentTransportProvider(locator.provider)) continue;
       const persisted = locatorMachineIdentity(locator);
       if (
         persisted.backend !== machine.backend ||

package/lib/task-environment/legacy-adoption.ts

@@ -21,6 +21,7 @@ import {
   parseTaskEnvironmentLocator,
   serializeTaskEnvironmentLocator,
   type TaskEnvironmentLocator,
+  isEnvironmentTransportProvider,
 } from "./types";
 
 const INSPECT_OUTPUT_LIMIT = 128 * 1024;
@@ -171,7 +172,7 @@ function legacyCandidate(
     // They must never wedge container-runtime selection (live 2026-08-27:
     // the first machine task quarantined the whole VM runtime on reconnect,
     // collapsing every host command into a retry storm).
-    if (locator.provider === "machine") return null;
+    if (isEnvironmentTransportProvider(locator.provider)) return null;
     let persistedMachine: HostMachineIdentity;
     if (locator.provider === "docker-compose") {
       persistedMachine = parseDockerTaskEnvironmentLocator(locator).machine;