@runuai/host 0.9.127 → 0.9.129

package/lib/credential-store-pickup.ts

@@ -10,6 +10,7 @@
  */
 
 import { configuredCredentialStore, credentialStorePrefix } from "./credential-store";
+import { engineAccountListPaths } from "./credential-store-scope";
 import {
   applyStoredEngineAccount,
   engineAccountHostId,
@@ -45,8 +46,8 @@ export async function pickupChangedCredentials(): Promise<PickupSummary> {
   const summary: PickupSummary = { skipped: false, listed: 0, changed: 0, applied: 0, errors: 0 };
   if (!store) return { ...summary, skipped: true };
   const prefix = credentialStorePrefix();
-  const hostId = engineAccountHostId();
-  const paths = [`${prefix}/orgs`, ...(hostId ? [`${prefix}/hosts/${hostId}`] : [])];
+  const paths = engineAccountListPaths(prefix, engineAccountHostId());
+  if (paths === null) return { ...summary, skipped: true };
   const current = new Map<string, number>();
   for (const path of paths) {
     try {

package/lib/credential-store-scope.ts

@@ -0,0 +1,85 @@
+/**
+ * Which credential store paths this runner may list.
+ *
+ * An owned or shared host reads whole trees (`/uai/orgs`, `/uai/users`,
+ * `/uai/projects`, its own `/uai/hosts/<id>`). A sidecar (ADR-133) holds a
+ * task lease whose IAM policy is scoped by session tag — it may list exactly
+ * `/uai/orgs/<org>` and `/uai/users/<user>` and nothing above them, so the
+ * tree listings answer AccessDenied on every path (2026-09-10, smoke 6: zero
+ * engine accounts and no GitHub token on the first live task machine). The
+ * lease carries the two ids; a lease without them (an older cloud) means the
+ * store is not read at all rather than listed where it cannot be.
+ *
+ * Project env stays unread on a task machine: the policy grants project
+ * parameters by an `org` tag the mirror never writes (put-parameter's
+ * Overwrite excludes tags), so no listing shape can reach them until the
+ * store layout or the mirror changes (hostless-implementation.md).
+ */
+import { isParameterPathSegment } from "./credential-store";
+import { leaseScope } from "./lease";
+import { sidecarMode } from "./sidecar";
+
+export type StoreListScope =
+  | { kind: "host" }
+  | { kind: "lease"; orgId: string | null; userId: string }
+  | { kind: "none"; reason: string };
+
+export function storeListScope(): StoreListScope {
+  if (!sidecarMode()) return { kind: "host" };
+  const scope = leaseScope();
+  if (!scope) return { kind: "none", reason: "the lease carries no org/user scope" };
+  return { kind: "lease", orgId: scope.orgId, userId: scope.userId };
+}
+
+const warned = new Set<string>();
+function warnOnce(tag: string, line: string): void {
+  if (warned.has(tag)) return;
+  warned.add(tag);
+  console.warn(`[${tag}] credential store: ${line}`);
+}
+/** Test seam. */
+export function resetStoreScopeWarningsForTesting(): void {
+  warned.clear();
+}
+
+/** The paths an engine-account listing walks, or null when this runner
+ * must not list at all (a sidecar without a scoped lease). */
+export function engineAccountListPaths(prefix: string, hostId: string | null): string[] | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") {
+    const paths = [`${prefix}/orgs`];
+    if (hostId && isParameterPathSegment(hostId)) paths.push(`${prefix}/hosts/${hostId}`);
+    return paths;
+  }
+  if (scope.kind === "none") {
+    warnOnce("engine-accounts", `${scope.reason} — not listed on this task machine`);
+    return null;
+  }
+  // No host path: a task machine's host row owns no accounts, and the policy
+  // denies the path anyway.
+  if (scope.orgId === null || !isParameterPathSegment(scope.orgId)) return [];
+  return [`${prefix}/orgs/${scope.orgId}`];
+}
+
+/** The path a user-credential listing walks, or null to skip. */
+export function userCredentialListPath(prefix: string): string | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") return `${prefix}/users`;
+  if (scope.kind === "none") {
+    warnOnce("user-credentials", `${scope.reason} — not listed on this task machine`);
+    return null;
+  }
+  if (!isParameterPathSegment(scope.userId)) return null;
+  return `${prefix}/users/${scope.userId}`;
+}
+
+/** The path a project-env listing walks, or null to skip. */
+export function projectEnvListPath(prefix: string): string | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") return `${prefix}/projects`;
+  warnOnce(
+    "project-env",
+    "not read on a task machine — the lease policy grants no project parameters (they carry no org tag)",
+  );
+  return null;
+}

package/lib/engine-accounts.ts

@@ -53,6 +53,7 @@ import {
   settleStoreWrites,
   type CredentialStore,
 } from "./credential-store";
+import { engineAccountListPaths } from "./credential-store-scope";
 import { getDb, schema } from "./db";
 import { brokeredFilesFor } from "./token-broker";
 import {
@@ -1452,8 +1453,8 @@ export async function reconcileEngineAccountsFromStore(
   const prefix = credentialStorePrefix();
   const warn = (line: string): void => console.warn(`[engine-accounts] credential store: ${line}`);
 
-  const paths = [`${prefix}/orgs`];
-  if (hostId && isParameterPathSegment(hostId)) paths.push(`${prefix}/hosts/${hostId}`);
+  const paths = engineAccountListPaths(prefix, hostId);
+  if (paths === null) return { ...result, skipped: true };
   const listed: Array<{ name: string; value: string }> = [];
   const listedPrefixes: string[] = [];
   for (const path of paths) {

package/lib/git-identity.ts

@@ -11,6 +11,7 @@
  */
 
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
 import { eq } from "drizzle-orm";
@@ -62,6 +63,30 @@ function managedTaskExecArgs(
   ];
 }
 
+/** A task environment we can exec in (machine or sidecar): the ssh steps run
+ * there as `node` under the runtime authority, key material over stdin. */
+type EnvironmentExec = Pick<TaskEnvironmentHandle, "exec">;
+
+async function environmentStep(
+  environment: EnvironmentExec,
+  argv: [string, ...string[]],
+  stdin?: Uint8Array,
+): Promise<{ status: number | null; stdout: string; stderr: string }> {
+  const result = await environment.exec({
+    argv,
+    user: "node",
+    env: RUNTIME_AUTHORITY_ENV,
+    ...(stdin ? { stdin } : {}),
+    timeoutMs: EXEC_TIMEOUT_MS,
+    maxOutputBytes: 64 * 1024,
+  });
+  return {
+    status: result.exitCode,
+    stdout: Buffer.from(result.stdout).toString("utf8"),
+    stderr: Buffer.from(result.stderr).toString("utf8"),
+  };
+}
+
 export async function setupTaskGitIdentity(
   taskId: string,
   name: string | null,
@@ -164,7 +189,35 @@ export async function injectSshIdentity(
   taskId: string,
   keyPath: string,
   exec: DockerExec = defaultExec,
+  environment?: EnvironmentExec,
 ): Promise<boolean> {
+  if (environment) {
+    // ADR-121/133: no container and no `docker cp` on a machine — the key
+    // pair rides stdin into files node owns from the start, so there is no
+    // chown race and nothing for the machine's other users to read. Before
+    // this branch every task machine logged `mkdir ~/.ssh failed: spawn
+    // docker ENOENT` on session start and signed nothing (2026-09-10).
+    const privateKey = readFileSync(keyPath);
+    const publicKey = readFileSync(`${keyPath}.pub`);
+    const steps: ReadonlyArray<readonly [string, [string, ...string[]], Uint8Array?]> = [
+      ["mkdir ~/.ssh", ["/bin/sh", "-c", "/bin/mkdir -p /home/node/.ssh && /bin/chmod 700 /home/node/.ssh"]],
+      ["copy key", ["/bin/sh", "-c", "umask 077 && /bin/cat > /home/node/.ssh/id_ed25519"], privateKey],
+      ["copy pubkey", ["/bin/sh", "-c", "umask 022 && /bin/cat > /home/node/.ssh/id_ed25519.pub"], publicKey],
+      ["own + chmod", ["/bin/sh", "-c", "/bin/chmod 700 /home/node/.ssh && /bin/chmod 600 /home/node/.ssh/id_ed25519"]],
+      ["SSH signing config", ["/bin/sh", "-c", SSH_SIGNING_CONFIG]],
+    ];
+    for (const [label, argv, stdin] of steps) {
+      const res = await environmentStep(environment, argv, stdin);
+      if (res.status !== 0) {
+        console.warn(
+          `[ssh] task ${taskId}: ${label} failed: ${res.stderr.trim() || `exit ${res.status}`}`,
+        );
+        return false;
+      }
+    }
+    console.log(`[ssh] task ${taskId}: signing identity + git signing config asserted`);
+    return true;
+  }
   const container = taskAppContainerName(taskId);
   const steps: ReadonlyArray<readonly [string, string[]]> = [
     [
@@ -269,12 +322,16 @@ async function sshKeyHealthy(
   taskId: string,
   expectedPublicKey: string,
   exec: DockerExec,
+  environment?: EnvironmentExec,
 ): Promise<boolean> {
-  const res = await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), [
+  const probe: [string, ...string[]] = [
     "/bin/sh",
     "-c",
     "test -r /home/node/.ssh/id_ed25519 && /bin/cat /home/node/.ssh/id_ed25519.pub",
-  ]));
+  ];
+  const res = environment
+    ? await environmentStep(environment, probe)
+    : await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), probe));
   const expectedFingerprint = sshPublicKeyFingerprint(expectedPublicKey);
   const actualFingerprint = sshPublicKeyFingerprint(res.stdout ?? "");
   return (
@@ -287,6 +344,9 @@ async function sshKeyHealthy(
 interface EnsureTaskSshIdentityDeps {
   publicKeyForUser?: (userId: string) => string | null;
   writeIdentity?: typeof writeTaskIdentity;
+  /** The task's environment when it is a machine or sidecar (no container to
+   * exec into or `docker cp` to). Null/undefined = the container path. */
+  environment?: () => EnvironmentExec | null | undefined;
 }
 
 /**
@@ -342,6 +402,7 @@ export async function ensureTaskSshIdentity(
     expectedPublicKey,
     exec,
     deps.writeIdentity ?? writeTaskIdentity,
+    deps.environment?.() ?? undefined,
   );
   const entry = { fingerprint: expectedFingerprint, promise: pending };
   sshEnsureInFlight.set(taskId, entry);
@@ -365,19 +426,15 @@ async function ensureTaskSshIdentityOnce(
   expectedPublicKey: string,
   exec: DockerExec,
   writeIdentity: typeof writeTaskIdentity,
+  environment?: EnvironmentExec,
 ): Promise<boolean> {
   // Fast path: the DB-authoritative key is already good → re-assert only the
   // cheap signing config and skip docker cp churn.
-  if (await sshKeyHealthy(taskId, expectedPublicKey, exec)) {
-    const configured = await exec(managedTaskExecArgs(
-      "node",
-      taskAppContainerName(taskId),
-      [
-        "/bin/sh",
-        "-c",
-        SSH_SIGNING_CONFIG,
-      ],
-    ));
+  if (await sshKeyHealthy(taskId, expectedPublicKey, exec, environment)) {
+    const config: [string, ...string[]] = ["/bin/sh", "-c", SSH_SIGNING_CONFIG];
+    const configured = environment
+      ? await environmentStep(environment, config)
+      : await exec(managedTaskExecArgs("node", taskAppContainerName(taskId), config));
     return configured.status === 0;
   }
 
@@ -388,7 +445,7 @@ async function ensureTaskSshIdentityOnce(
   }
   const keyPath = resolve(dir, "id_ed25519");
   try {
-    return await injectSshIdentity(taskId, keyPath, exec);
+    return await injectSshIdentity(taskId, keyPath, exec, environment);
   } finally {
     // Host hygiene (same as task-up): the materialized private key never
     // outlives the injection.

package/lib/github-tokens.ts

@@ -33,6 +33,7 @@ import {
   ensureTaskSshIdentity,
 } from "./git-identity";
 import type { TaskEnvironmentHandle } from "./task-environment/types";
+import { sidecarMode } from "./sidecar";
 import {
   MAX_GITHUB_INSTALLATIONS,
   MAX_GITHUB_REPOSITORIES_PER_INSTALLATION,
@@ -1940,6 +1941,13 @@ export async function removeGithubFromContainer(
   run: DockerCommand = taskContainerCli,
   admitContainerWork: () => void = requireContainerRuntimeOperational,
 ): Promise<boolean> {
+  // ADR-133: a task machine has no container runtime and no app container —
+  // the credential lives in the machine's own gh config, installed over the
+  // environment at task-up (`machineTaskGithubAuth`). Inspecting Docker here
+  // threw `spawn docker ENOENT` on every session start, so no agent ever
+  // came up on the first live hostless run (2026-09-10, smoke 6). Same answer
+  // a Docker host gives for a machine task: no container, nothing to scrub.
+  if (sidecarMode()) return false;
   const container = taskAppContainerName(taskId);
   admitContainerWork();
   const observed = await taskAppContainerState(container, run as never);
@@ -2086,9 +2094,12 @@ function enqueueTaskGitAuth(
       // ensuring the identity also keeps commit/tag signing available. Never
       // select SSH transport unless a usable identity was actually asserted.
       admitContainerWork();
-      const hasSshIdentity = await (
-        deps.ensureSsh ?? ensureTaskSshIdentity
-      )(taskId, userId);
+      const hasSshIdentity = deps.ensureSsh
+        ? await deps.ensureSsh(taskId, userId)
+        : await ensureTaskSshIdentity(taskId, userId, undefined, {
+            // Machine/sidecar tasks install the key over the environment.
+            environment: () => invocation.setupDeps?.environment?.() ?? null,
+          });
       if (!isCurrent()) return false;
       admitContainerWork();
       if (hasSshIdentity) {

package/lib/lease.ts

@@ -30,13 +30,21 @@ export const LEASE_RETRY_MS = 30_000;
 /** The cloud must answer within this window or the request is retried. */
 export const LEASE_REQUEST_TIMEOUT_MS = 20_000;
 
-/** Where the `credential_process` helper reads the live session. Root-only:
+/** Where the `credential_process` command reads the live session. Root-only:
  * the agents run as `node` and never see it. */
 export const LEASE_CREDENTIALS_FILE = "/run/uai/lease-credentials.json";
 /** The AWS config Mountpoint is pointed at (`AWS_CONFIG_FILE`). */
 export const LEASE_AWS_CONFIG_FILE = "/run/uai/aws-config";
-/** The helper itself — a shell script so it needs nothing but `cat`. */
-export const LEASE_CREDENTIAL_PROCESS = "/run/uai/lease-credential-process";
+/**
+ * The `credential_process` line: `cat` of the JSON, run by the AWS CLI and
+ * by Mountpoint's CRT profile provider through `/bin/sh -c`. NOT a script
+ * under /run — Debian mounts /run `noexec`, so a helper there fails with
+ * EACCES even for root and both clients fall through to the instance
+ * profile, which has no S3 rights (live 2026-09-10, hostless smoke 6: every
+ * mount answered "assumed-role/uai-task-machine-instance … is not
+ * authorized to perform: s3:ListBucket").
+ */
+export const LEASE_CREDENTIAL_PROCESS = `/bin/cat ${LEASE_CREDENTIALS_FILE}`;
 
 export interface LeaseSender {
   (frame: { kind: "lease.request"; opId: string; taskId: string }): boolean;
@@ -95,21 +103,28 @@ export function credentialProcessOutput(lease: TaskLease): string {
   });
 }
 
+/** The AWS config file content for a lease: default profile, region, and
+ * the `credential_process` that serves the live session. Exported for the
+ * test that pins it. */
+export function leaseAwsConfig(lease: Pick<TaskLease, "region">): string {
+  return `[default]\nregion = ${lease.region}\ncredential_process = ${LEASE_CREDENTIAL_PROCESS}\n`;
+}
+
+/** The org and user a lease was issued for — the credential store paths a
+ * sidecar may list (`/uai/orgs/<org>`, `/uai/users/<user>`; the task-machine
+ * policy grants nothing above them). Null on an owned host or before the
+ * first grant; `orgId` is null for a lease with no org scope. Absent from
+ * the lease when the cloud predates the field. */
+export function leaseScope(): { orgId: string | null; userId: string } | null {
+  if (!current || typeof current.userId !== "string") return null;
+  return { orgId: current.orgId ?? null, userId: current.userId };
+}
+
 function writeLeaseFiles(lease: TaskLease): void {
   mkdirSync(dirname(LEASE_CREDENTIALS_FILE), { recursive: true, mode: 0o700 });
   writeFileSync(LEASE_CREDENTIALS_FILE, credentialProcessOutput(lease), { mode: 0o600 });
   chmodSync(LEASE_CREDENTIALS_FILE, 0o600);
-  writeFileSync(
-    LEASE_CREDENTIAL_PROCESS,
-    `#!/bin/sh\nexec cat ${LEASE_CREDENTIALS_FILE}\n`,
-    { mode: 0o700 },
-  );
-  chmodSync(LEASE_CREDENTIAL_PROCESS, 0o700);
-  writeFileSync(
-    LEASE_AWS_CONFIG_FILE,
-    `[default]\nregion = ${lease.region}\ncredential_process = ${LEASE_CREDENTIAL_PROCESS}\n`,
-    { mode: 0o600 },
-  );
+  writeFileSync(LEASE_AWS_CONFIG_FILE, leaseAwsConfig(lease), { mode: 0o600 });
   chmodSync(LEASE_AWS_CONFIG_FILE, 0o600);
 }
 

package/lib/orchestrator.ts

@@ -400,6 +400,25 @@ export function isClaudeAuthRevoked(message: string): boolean {
   return CLAUDE_AUTH_REVOKED_PATTERNS.some((re) => re.test(message));
 }
 
+/**
+ * ADR-121/133: on a machine or sidecar task the SSH signing identity is
+ * installed over the task environment (no container to exec into or
+ * `docker cp` to); a container task gets no environment and keeps the docker
+ * path. Recovery and resume have only the persisted task, so the environment
+ * is reconstructed here.
+ */
+async function sshIdentityDepsFor(task: {
+  taskId: string;
+  environmentProvider: string | null;
+}): Promise<{ environment: () => Pick<TaskEnvironmentHandle<unknown>, "exec"> | null }> {
+  if (!isEnvironmentTransportProvider(task.environmentProvider)) {
+    return { environment: () => null };
+  }
+  const persisted = getHostTask(task.taskId);
+  const environment = persisted ? await reconstructPersistedTaskEnvironment(persisted) : null;
+  return { environment: () => environment };
+}
+
 export class Orchestrator {
   private readonly channels = new Map<string, Channel>();
   private readonly channelSpecs = new Map<string, ChannelEnsureInput>();
@@ -1605,10 +1624,12 @@ export class Orchestrator {
     environmentProvider: string | null;
     projectIds?: string | null;
   }): Record<string, string> {
-    if (task.environmentProvider !== "machine") return {};
+    // Machine OR sidecar (ADR-133): neither has a compose env to ride.
+    if (!isEnvironmentTransportProvider(task.environmentProvider)) return {};
     return projectEnvForTask(hostTaskProjectIds(task));
   }
 
+
   /** Install a session with an event handler scoped to this exact generation. */
   private bindSession(
     channel: Channel,
@@ -1898,7 +1919,11 @@ export class Orchestrator {
     // SSH signing identity, re-asserted independently of transport. Connected
     // users still push through gh over HTTPS; disconnected users select the
     // SSH transport fallback inside the reconcile above.
-    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId).catch((err) =>
+    void ensureTaskSshIdentity(channel.taskId, task.ownerUserId, undefined, {
+      // A machine or sidecar task installs the key over its environment; a
+      // container task keeps the docker path (a null handle).
+      environment: () => channel.agentHandle,
+    }).catch((err) =>
       console.warn(
         `[ssh] task ${channel.taskId}: signing identity reconciliation failed: ${
           err instanceof Error ? err.message : String(err)
@@ -6820,7 +6845,9 @@ async function recoverOneDockerTask(
         ),
       );
     }
-    void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+    void sshIdentityDepsFor(task)
+      .then((deps) => ensureTaskSshIdentity(task.taskId, task.ownerUserId, undefined, deps))
+      .catch((err) =>
       console.warn(
         `[ssh] task ${task.taskId}: running recovery reconciliation failed: ${
           err instanceof Error ? err.message : String(err)
@@ -7087,7 +7114,9 @@ async function recoverOneDockerTask(
   db_setRuntime(task.taskId, {
     codeServerPort: port,
   });
-  void ensureTaskSshIdentity(task.taskId, task.ownerUserId).catch((err) =>
+  void sshIdentityDepsFor(task)
+    .then((deps) => ensureTaskSshIdentity(task.taskId, task.ownerUserId, undefined, deps))
+    .catch((err) =>
     console.warn(
       `[ssh] task ${task.taskId}: resumed signing identity reconciliation failed: ${
         err instanceof Error ? err.message : String(err)

package/lib/shared-files-s3.ts

@@ -17,8 +17,46 @@ import type { TaskEnvironmentHandle } from "./task-environment/types";
 import { LEASE_AWS_CONFIG_FILE, currentLease } from "./lease";
 
 export const MOUNT_S3_BIN = "/usr/bin/mount-s3";
-export const SHARED_FILES_UID = 1000;
-export const SHARED_FILES_GID = 1000;
+/** The task user the mounts are owned by. Its ids are looked up on the
+ * machine, never assumed: the Debian cloud image the payload AMI is built
+ * from ships an `admin` user at uid 1000, so `node` lands on 1001 there
+ * and a hard-coded 1000 handed every mount to the wrong user (2026-09-10,
+ * smoke 6). */
+export const SHARED_FILES_USER = "node";
+/** What the lookup falls back to (the standard container image's ids). */
+export const SHARED_FILES_FALLBACK_UID = 1000;
+export const SHARED_FILES_FALLBACK_GID = 1000;
+
+export interface TaskUserIds {
+  uid: number;
+  gid: number;
+}
+
+/** `id -u`/`id -g` of the task user on this machine, through the root exec. */
+export async function resolveTaskUserIds(
+  handle: Pick<TaskEnvironmentHandle, "exec">,
+  user: string = SHARED_FILES_USER,
+): Promise<TaskUserIds> {
+  const fallback = { uid: SHARED_FILES_FALLBACK_UID, gid: SHARED_FILES_FALLBACK_GID };
+  try {
+    const result = await handle.exec({
+      argv: ["/bin/sh", "-c", 'id -u "$1" && id -g "$1"', "ids", user],
+      user: "root",
+      timeoutMs: 10_000,
+      maxOutputBytes: 1024,
+    });
+    if (result.exitCode !== 0) return fallback;
+    const [uid, gid] = Buffer.from(result.stdout)
+      .toString("utf8")
+      .trim()
+      .split(/\s+/)
+      .map((part) => Number.parseInt(part, 10));
+    if (!Number.isInteger(uid) || !Number.isInteger(gid) || uid! < 0 || gid! < 0) return fallback;
+    return { uid: uid!, gid: gid! };
+  } catch {
+    return fallback;
+  }
+}
 
 export type SharedFilesMode = "off" | "ro" | "rw";
 
@@ -31,7 +69,7 @@ export interface SharedFilesMountPlan {
 }
 
 /** The mount-s3 argv for one prefix. Exported for the test that pins it. */
-export function mountS3Argv(plan: SharedFilesMountPlan): [string, ...string[]] {
+export function mountS3Argv(plan: SharedFilesMountPlan, owner: TaskUserIds): [string, ...string[]] {
   return [
     MOUNT_S3_BIN,
     "--prefix",
@@ -42,9 +80,9 @@ export function mountS3Argv(plan: SharedFilesMountPlan): [string, ...string[]] {
     // is performed by the root sidecar.
     "--allow-other",
     "--uid",
-    String(SHARED_FILES_UID),
+    String(owner.uid),
     "--gid",
-    String(SHARED_FILES_GID),
+    String(owner.gid),
     "--dir-mode",
     "0755",
     "--file-mode",
@@ -101,16 +139,19 @@ export async function mountSharedFilesFromLease(
   }
   const warnings: string[] = [];
   let mountedAny = false;
+  const owner = await resolveTaskUserIds(handle);
   for (const plan of sharedFilesMountPlans(workspacePath, mode, lease)) {
     const result = await handle.exec({
       argv: [
         "/bin/sh",
         "-c",
         // Idempotent: an already-mounted directory is left alone.
-        'mkdir -p "$1" && chown 1000:1000 "$1"; if mountpoint -q "$1"; then exit 0; fi; shift; exec "$@"',
+        'mkdir -p "$1" && chown "$2:$3" "$1"; if mountpoint -q "$1"; then exit 0; fi; shift 3; exec "$@"',
         "mount",
         plan.directory,
-        ...mountS3Argv(plan),
+        String(owner.uid),
+        String(owner.gid),
+        ...mountS3Argv(plan, owner),
       ],
       user: "root",
       env: { AWS_CONFIG_FILE: LEASE_AWS_CONFIG_FILE },

package/lib/task-environment/self.ts

@@ -15,7 +15,7 @@
  * terminating the instance this process lives on.
  */
 import { spawn as nodeSpawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 
 import { buildRemoteCommand } from "../machine-exec";
@@ -63,6 +63,51 @@ export interface SelfTaskEnvironmentDeps {
   /** Whether this process may drop privileges with setpriv (root). Tests and
    * a non-root dev run keep everything as the current user. */
   privileged?: () => boolean;
+  /** The machine-wide environment every request runs under (beneath its own
+   * `env`). Defaults to /etc/environment — see `readEtcEnvironment`. */
+  etcEnvironment?: () => Readonly<Record<string, string>>;
+}
+
+/**
+ * /etc/environment, as pam_env reads it: `KEY=value` lines, optional
+ * `export`, optional single or double quotes, `#` comments. The machine
+ * provider gets these for free — sshd applies pam_env to every session — but
+ * a local `setpriv --reset-env … sh -lc` sees neither pam nor the file, so
+ * `PLAYWRIGHT_BROWSERS_PATH` from the payload image never reached an agent
+ * on the sidecar and every task re-downloaded Chromium (2026-09-10, smoke 6).
+ */
+export function parseEtcEnvironment(text: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!match) continue;
+    let value = match[2]!.trim();
+    if (
+      value.length >= 2 &&
+      ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'")))
+    ) {
+      value = value.slice(1, -1);
+    }
+    out[match[1]!] = value;
+  }
+  return out;
+}
+
+export const ETC_ENVIRONMENT_PATH = "/etc/environment";
+let etcEnvironmentCache: Record<string, string> | null = null;
+/** The parsed /etc/environment, read once per process (the image writes it
+ * at bake time; nothing edits it on a task machine). Empty when absent. */
+export function readEtcEnvironment(): Record<string, string> {
+  if (etcEnvironmentCache) return etcEnvironmentCache;
+  try {
+    etcEnvironmentCache = parseEtcEnvironment(readFileSync(ETC_ENVIRONMENT_PATH, "utf8"));
+  } catch {
+    etcEnvironmentCache = {};
+  }
+  return etcEnvironmentCache;
 }
 
 export function selfTaskEnvironmentLocator(
@@ -143,12 +188,14 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
   readonly #value: SelfTaskEnvironmentLocatorValue;
   readonly #spawn: typeof nodeSpawn;
   readonly #privileged: () => boolean;
+  readonly #etcEnvironment: () => Readonly<Record<string, string>>;
 
   constructor(locator: TaskEnvironmentLocator, deps: SelfTaskEnvironmentDeps) {
     this.#value = parseSelfTaskEnvironmentLocator(locator);
     this.#spawn = deps.spawn ?? nodeSpawn;
     this.#privileged =
       deps.privileged ?? (() => typeof process.getuid === "function" && process.getuid() === 0);
+    this.#etcEnvironment = deps.etcEnvironment ?? readEtcEnvironment;
     this.durableIdentity = `self:${this.#value.taskId}`;
     this.descriptor = {
       taskId: this.#value.taskId,
@@ -184,21 +231,34 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     }
   }
 
+  /** The request with the machine-wide environment beneath its own: what an
+   * ssh session on a machine task gets from pam_env, applied here by hand. */
+  #withMachineEnv<T extends { env?: Readonly<Record<string, string>> }>(request: T): T {
+    const base = this.#etcEnvironment();
+    if (Object.keys(base).length === 0) return request;
+    return { ...request, env: { ...base, ...request.env } };
+  }
+
   async exec(request: TaskEnvironmentExecRequest): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentProcessRequest(request);
-    const { command, args } = selfCommand(request, "interactive", this.#privileged());
-    return capturedCliExec(this.#spawn, command, args, request);
+    const scoped = this.#withMachineEnv(request);
+    const { command, args } = selfCommand(scoped, "interactive", this.#privileged());
+    return capturedCliExec(this.#spawn, command, args, scoped);
   }
 
   async spawn(request: TaskEnvironmentSpawnRequest): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentProcessRequest(request);
-    const { command, args } = selfCommand(request, "interactive", this.#privileged());
-    return streamingCliExec(this.#spawn, command, args, request);
+    const scoped = this.#withMachineEnv(request);
+    const { command, args } = selfCommand(scoped, "interactive", this.#privileged());
+    return streamingCliExec(this.#spawn, command, args, scoped);
   }
 
   async spawnSession(request: TaskEnvironmentSessionRequest): Promise<TaskEnvironmentProcess> {
     assertTaskEnvironmentSessionRequest(request);
-    const session = { ...request, cwd: request.cwd ?? this.#value.workspacePath };
+    const session = this.#withMachineEnv({
+      ...request,
+      cwd: request.cwd ?? this.#value.workspacePath,
+    });
     const { command, args } = selfCommand(session, "interactive", this.#privileged());
     return streamingCliExec(this.#spawn, command, args, session);
   }
@@ -207,7 +267,10 @@ class SelfTaskEnvironmentHandle implements TaskEnvironmentHandle {
     request: TaskEnvironmentDetachedSessionRequest,
   ): Promise<TaskEnvironmentExecResult> {
     assertTaskEnvironmentSessionRequest(request);
-    const session = { ...request, cwd: request.cwd ?? this.#value.workspacePath };
+    const session = this.#withMachineEnv({
+      ...request,
+      cwd: request.cwd ?? this.#value.workspacePath,
+    });
     const { command, args } = selfCommand(session, "detached", this.#privileged());
     return capturedCliExec(this.#spawn, command, args, {
       ...session,

package/lib/user-credentials-store.ts

@@ -23,6 +23,7 @@ import {
   isParameterPathSegment,
   type CredentialStore,
 } from "./credential-store";
+import { projectEnvListPath, userCredentialListPath } from "./credential-store-scope";
 import {
   deleteToken as deleteGithubTokenLocal,
   githubTokenParameterName,
@@ -196,7 +197,8 @@ export async function reconcileUserCredentialsFromStore(): Promise<ReconcileUser
   const store = configuredCredentialStore();
   if (!store) return { ...result, skipped: true };
   const prefix = credentialStorePrefix();
-  const path = `${prefix}/users`;
+  const path = userCredentialListPath(prefix);
+  if (path === null) return { ...result, skipped: true };
   const warn = (line: string): void =>
     console.warn(`[user-credentials] credential store: ${line}`);
 
@@ -359,7 +361,8 @@ export async function reconcileProjectEnvFromStore(): Promise<ReconcileUserCrede
   const store = configuredCredentialStore();
   if (!store) return { ...result, skipped: true };
   const prefix = credentialStorePrefix();
-  const path = `${prefix}/projects`;
+  const path = projectEnvListPath(prefix);
+  if (path === null) return { ...result, skipped: true };
   const warn = (line: string): void => console.warn(`[project-env] credential store: ${line}`);
   let listed: Array<{ name: string; value: string }>;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.127",
+  "version": "0.9.129",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cli.ts

@@ -169,6 +169,13 @@ async function main(): Promise<void> {
       return cmdInstaller(cmd, dryRun);
     case "uninstall":
       return cmdUninstall(rest);
+    case "version":
+    case "-v":
+    case "--version":
+      // A bare version line: the sidecar's prepare step compares it with the
+      // pinned runner version, and any other flag prints the usage instead.
+      console.log(packageVersion());
+      return;
     case undefined:
     case "help":
     case "-h":

package/src/main.ts

@@ -2724,7 +2724,9 @@ function isTaskLease(value: unknown): value is TaskLease {
     typeof files === "object" &&
     typeof files.bucket === "string" &&
     (files.orgPrefix === null || typeof files.orgPrefix === "string") &&
-    typeof files.userPrefix === "string"
+    typeof files.userPrefix === "string" &&
+    (lease.orgId === undefined || lease.orgId === null || typeof lease.orgId === "string") &&
+    (lease.userId === undefined || typeof lease.userId === "string")
   );
 }
 

package/src/protocol.ts

@@ -1722,6 +1722,13 @@ export interface TaskLease {
     orgPrefix: string | null;
     userPrefix: string;
   };
+  /** The org and user the session is tagged with — the only credential
+   * store paths the sidecar may list (`/uai/orgs/<org>`, `/uai/users/<user>`).
+   * Optional on the wire: a cloud that predates the field sends neither, and
+   * the sidecar then skips the store instead of listing paths the policy
+   * denies. */
+  orgId?: string | null;
+  userId?: string;
 }
 
 export type McpOp =