@runuai/host 0.9.13 → 0.9.42

package/lib/agent-cli.ts

@@ -11,16 +11,31 @@
  * verifies it. Agents invoke the CLI as `node /workspace/.uai/cli.mjs <cmd>`
  * (surfaced in the system preamble).
  */
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { resolve } from "node:path";
 
 import { env, taskWorkspaceDir } from "./env";
+import { RUNTIME_AUTHORITY_ENV } from "./runtime-authority";
 import { signTaskToken } from "./task-token";
+import { assertSafeHostTaskId } from "./task-identity";
 import type { RosterAgent } from "./agents/types";
 
 /** Container path of the CLI — what the preamble tells agents to run. */
 export const CONTAINER_CLI_PATH = "/workspace/.uai/cli.mjs";
 
+/** Runtime/cache authority for every agent docker exec, including preserved
+ * pre-L4 containers whose Config.Env may still contain project-controlled
+ * PATH/asdf/Corepack/loader values. Callers merge engine-account credentials
+ * underneath this object so those credentials cannot replace host policy. */
+export const AGENT_RUNTIME_AUTHORITY_ENV = RUNTIME_AUTHORITY_ENV;
+
 // The task's cli secret lives HOST-PRIVATE (never the container), so it survives
 // host restarts without a DB migration. The cloud re-sends it on each task-up.
 function taskSecretPath(taskId: string): string {
@@ -46,6 +61,20 @@ export function loadTaskCliSecret(taskId: string): string | null {
   }
 }
 
+/** Orphan GC is an authority deletion, not best-effort housekeeping. */
+export function removeTaskCliSecretStrict(taskId: string): void {
+  assertSafeHostTaskId(taskId);
+  const path = taskSecretPath(taskId);
+  rmSync(path, { force: true });
+  try {
+    lstatSync(path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+  throw new Error("task CLI secret remains after removal");
+}
+
 /** The union used only to decide whether this task needs the shared CLI file. */
 export function rosterPermissions(roster: RosterAgent[]): string[] {
   return Array.from(new Set(roster.flatMap((a) => a.permissions ?? [])));
@@ -117,6 +146,7 @@ export function agentCliEnv(
   cliSecret: string | null,
   allowPermissionless = false,
 ): Record<string, string> {
+  const runtimeAuthority = { ...AGENT_RUNTIME_AUTHORITY_ENV };
   const permissions = agent.permissions ?? [];
   if (
     !ownerUserId ||
@@ -124,9 +154,10 @@ export function agentCliEnv(
     !cliSecret ||
     (permissions.length === 0 && !allowPermissionless)
   ) {
-    return {};
+    return runtimeAuthority;
   }
   return {
+    ...runtimeAuthority,
     UAI_TASK_TOKEN: signTaskToken(
       { taskId, userId: ownerUserId, permissions, agentId: agent.id },
       cliSecret,
@@ -168,6 +199,22 @@ function parseFlags(args) {
   return { flags, rest };
 }
 
+// A punchlist item's text is prose, and prose written in THIS repo contains
+// --id and --text. parseFlags is global and greedy, so routing todo text
+// through it silently rewrote the request: "todo edit aaaaaa the --id flag"
+// resolved to { ref: "flag", text: "aaaaaa the" } and edited a different item,
+// and a valueless --text became the literal string "true" — an item
+// overwritten with garbage, or worse, the wrong item overwritten at all. Todo
+// text is therefore read from the raw argv tail and never flag-parsed. The
+// --id <ref> form survives only in leading position, where it cannot be
+// mistaken for prose.
+function todoRef(args) {
+  return args[0] === "--id"
+    ? { ref: args[1], tail: args.slice(2) }
+    : { ref: args[0] && !args[0].startsWith("--") ? args[0] : "", tail: args.slice(1) };
+}
+function todoText(args) { return args.join(" ").trim(); }
+
 async function api(method, path, body) {
   const res = await fetch(API_URL + path, {
     method,
@@ -292,14 +339,30 @@ async function main() {
       break;
     }
     case "todo add": {
-      const text = pos.join(" ") || flags.text || "";
+      const text = todoText(rest);
       if (!text) { console.error("uai: todo add needs text"); process.exit(1); }
       const t = (await api("POST", "/api/agent/todos", { op: "add", text })).todo;
       out("added #" + t.shortId + ": " + t.text);
       break;
     }
+    case "todo edit": {
+      const { ref, tail } = todoRef(rest);
+      const text = todoText(tail);
+      if (!ref) { console.error("uai: todo edit needs an item id (see 'uai todo list')"); process.exit(1); }
+      if (!text) { console.error("uai: todo edit needs replacement text"); process.exit(1); }
+      const t = (await api("POST", "/api/agent/todos", { op: "edit", ref, text })).todo;
+      out("edited #" + t.shortId + ": " + t.text);
+      break;
+    }
+    case "todo remove": {
+      const { ref } = todoRef(rest);
+      if (!ref) { console.error("uai: todo remove needs an item id (see 'uai todo list')"); process.exit(1); }
+      await api("POST", "/api/agent/todos", { op: "remove", ref });
+      out("removed #" + String(ref).replace(/^#/, ""));
+      break;
+    }
     case "todo claim": case "todo done": case "todo reopen": case "todo unclaim": {
-      const ref = pos[0] || flags.id;
+      const { ref } = todoRef(rest);
       if (!ref) { console.error("uai: todo " + action + " needs an item id (see 'uai todo list')"); process.exit(1); }
       const t = (await api("POST", "/api/agent/todos", { op: action, ref })).todo;
       out(action + " #" + t.shortId + ": " + t.text);
@@ -359,6 +422,8 @@ async function main() {
         "  uai memory delete <id>",
         "  uai todo list",
         "  uai todo add <text>",
+        "  uai todo edit <#id> <text>",
+        "  uai todo remove <#id>",
         "  uai todo claim|done|reopen|unclaim <#id>",
         "  uai preview add <name> <containerPort>",
         "  uai project create --name <n> --repo <git-url> [--prompt <p>]",

package/lib/agent.ts

@@ -16,24 +16,28 @@
  */
 
 import { spawn } from "node:child_process";
-import { dirname, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { z } from "zod";
 
 import {
+  createTaskEnvironmentDownCommandDb,
   createTaskDownCommandDb,
   createTaskStatusCommandDb,
   createTaskUpCommandDb,
   removeCommandDb,
 } from "./command-db";
 import { env } from "./env";
+import { containerRuntimeStandardAssetsRoot } from "./container-runtime";
 import { getDecryptedForProject } from "./host-env";
 import { PreviewPortRuntimesSchema } from "./preview-ports";
 import { getHostTask } from "./runtime-state";
 import { removeTaskIdentity, writeTaskIdentity } from "./ssh";
 import type { TaskDownInput, TaskLaunchInput } from "../src/protocol";
 
-interface TaskUpCredentials {
+export type { TaskLaunchInput } from "../src/protocol";
+
+export interface TaskUpCredentials {
   /** Path to the task owner's private, ephemeral Git credential cache. */
   githubCredentialSocket?: string;
 }
@@ -151,6 +155,9 @@ async function runAgent<T extends z.ZodTypeAny>(
       ...process.env,
       UAI_DB_PATH: commandDbPath,
       UAI_DATA_DIR: env.dataDir,
+      UAI_STANDARD_CONTAINER_ASSETS_DIR:
+        containerRuntimeStandardAssetsRoot() ??
+        join(packageAgentScriptsDir(), "..", "..", "images", "standard", "container"),
       ...extraEnv,
     },
   });
@@ -191,13 +198,9 @@ async function runAgent<T extends z.ZodTypeAny>(
     if (parsed) {
       const failure = FailureEnvelope.safeParse(parsed);
       if (failure.success) {
-        // Prefer the actual tool output over the bash envelope's generic
-        // "agent step failed" — the docker/git/apt error is what the operator
-        // needs, and it must reach the cloud, not just the host log.
-        const detail = toolStderrDetail(stderrBuf);
         throw new AgentError(
           failure.data.error.code,
-          detail || failure.data.error.message,
+          composeFailureMessage(failure.data.error.message, stderrBuf),
           {
             step: failure.data.error.step,
             exitCode: failure.data.error.exit_code ?? exitCode,
@@ -262,6 +265,23 @@ function tryParseLastJsonLine(buf: string): unknown {
  * host is a remote user's machine (live 2026-07-22, "compose_up_failed" with
  * no why). Bounded to the last few lines so a build log doesn't flood the UI.
  */
+/**
+ * The operator-facing failure text: the envelope's message LEADS and the
+ * tool output follows. The scripts' emit_err messages are curated
+ * instructions ("close another running task, then press Resume") —
+ * replacing them with the stderr tail buried exactly the sentence the
+ * operator needed under VZ/git noise (live 2026-08-17, twice in one day).
+ * The tool detail still ships, because a message alone can lack the WHY
+ * (the 2026-07-22 lesson the old detail-first ordering encoded).
+ */
+export function composeFailureMessage(
+  envelopeMessage: string,
+  stderrBuf: string,
+): string {
+  const detail = toolStderrDetail(stderrBuf);
+  return detail ? `${envelopeMessage}\n${detail}` : envelopeMessage;
+}
+
 export function toolStderrDetail(stderr: string): string {
   const lines = stderr
     .split(/\r?\n/)
@@ -345,6 +365,25 @@ export const agent = {
     }
   },
 
+  /** ADR-101 Phase C: idempotent teardown from a durable environment locator.
+   * Cloud command metadata is intentionally unnecessary at this boundary. */
+  async taskEnvironmentDown(taskId: string): Promise<TaskDownResult> {
+    const commandDbPath = createTaskEnvironmentDownCommandDb(
+      taskId,
+      getHostTask(taskId),
+    );
+    try {
+      return await runAgent(
+        "task-down.sh",
+        [taskId],
+        TaskDownData,
+        commandDbPath,
+      );
+    } finally {
+      removeCommandDb(commandDbPath);
+    }
+  },
+
   async taskStatus(taskId: string): Promise<TaskStatusResult> {
     const commandDbPath = createTaskStatusCommandDb(taskId, getHostTask(taskId));
     try {

package/lib/agents/claude.ts

@@ -1,10 +1,9 @@
 /**
  * ClaudeSession — a real AgentSession backed by the Claude Code CLI in
- * stream-json mode, run inside the task container (ADR-010).
+ * stream-json mode, run inside the task environment (ADR-010).
  *
- *   docker exec -i task-<id>-app-1 \
- *     claude --print --input-format stream-json --output-format stream-json \
- *            --verbose --no-session-persistence
+ *   claude --print --input-format stream-json --output-format stream-json \
+ *          --verbose --no-session-persistence
  *
  * The CLI is a persistent bidirectional process: uai writes one JSON
  * line per user turn to stdin and reads a stream of JSON event lines
@@ -20,6 +19,8 @@
  * those fixups stay in one place.
  */
 
+import { requireContainerRuntimeOperational } from "../runtime-guard";
+import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
 import { newId } from "../ulid";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { isRateLimitMessage } from "./rate-limit";
@@ -437,7 +438,7 @@ export class ClaudeSession implements AgentSession {
   constructor(args: {
     taskId: string;
     agent: RosterAgent;
-    containerName: string;
+    environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     executionProfile?: "communicator";
     attachCompatibilityKey?: string;
@@ -494,7 +495,7 @@ export class ClaudeSession implements AgentSession {
     this.proc = createAgentTransport({
       taskId: args.taskId,
       agentId: this.agentId,
-      containerName: args.containerName,
+      environment: args.environment,
       cli: "claude",
       cliArgs,
       passEnv: ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
@@ -635,6 +636,10 @@ export class ClaudeSession implements AgentSession {
 
   async send(text: string): Promise<void> {
     if (this.closed) return;
+    // The transport can outlive the command that created it. Gate each new
+    // turn at its actual runner boundary, while still allowing interrupt and
+    // close traffic during runtime recovery.
+    requireContainerRuntimeOperational();
     this.proc.writeLine({
       type: "user",
       message: { role: "user", content: text },
@@ -711,7 +716,7 @@ register({
   create: async ({
     taskId,
     agent,
-    containerName,
+    environment,
     systemPreamble,
     executionProfile,
     attachCompatibilityKey,
@@ -720,7 +725,7 @@ register({
     new ClaudeSession({
       taskId,
       agent,
-      containerName,
+      environment,
       systemPreamble,
       executionProfile,
       attachCompatibilityKey,

package/lib/agents/codex.ts

@@ -1,8 +1,8 @@
 /**
  * CodexSession — a real AgentSession backed by `codex app-server`, run
- * inside the task container (ADR-010):
+ * inside the task environment (ADR-010):
  *
- *   docker exec -i task-<id>-app-1 codex app-server
+ *   codex app-server
  *
  * JSON-RPC 2.0 over stdio, newline-delimited. The protocol below is
  * verified against `codex app-server generate-json-schema` (the
@@ -35,6 +35,8 @@ import { join } from "node:path";
 import { and, eq } from "drizzle-orm";
 
 import { getDb, schema } from "../db";
+import { requireContainerRuntimeOperational } from "../runtime-guard";
+import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
 import { newId } from "../ulid";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { isRateLimitMessage } from "./rate-limit";
@@ -303,7 +305,7 @@ export class CodexSession implements AgentSession {
   constructor(args: {
     taskId: string;
     agent: RosterAgent;
-    containerName: string;
+    environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
   }) {
@@ -335,7 +337,7 @@ export class CodexSession implements AgentSession {
     this.proc = createAgentTransport({
       taskId: args.taskId,
       agentId: this.agentId,
-      containerName: args.containerName,
+      environment: args.environment,
       cli: "codex",
       cliArgs: codexArgs,
       passEnv: [],
@@ -630,6 +632,9 @@ export class CodexSession implements AgentSession {
       return;
     }
 
+    // `ready` may have waited across a runtime generation change. Recheck at
+    // the turn/start write rather than trusting session construction time.
+    requireContainerRuntimeOperational();
     this.fireRequest("turn/start", {
       threadId: this.threadId,
       input: [{ type: "text", text }],
@@ -689,6 +694,6 @@ register({
     existsSync(
       join(process.env.UAI_OWNER_HOME?.trim() || homedir(), ".codex", "auth.json"),
     ),
-  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
-    new CodexSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+  create: async ({ taskId, agent, environment, systemPreamble, agentEnv }) =>
+    new CodexSession({ taskId, agent, environment, systemPreamble, agentEnv }),
 });

package/lib/agents/cursor.ts

@@ -1,9 +1,8 @@
 /**
  * CursorSession — a real AgentSession backed by **Cursor Agent** (`cursor-agent`),
- * run inside the task container:
+ * run inside the task environment:
  *
- *   docker exec -i -e CURSOR_API_KEY=… task-<id>-app-1 \
- *     /home/node/.local/bin/cursor-agent -p "<prompt>" \
+ *   CURSOR_API_KEY=… /home/node/.local/bin/cursor-agent -p "<prompt>" \
  *     --output-format stream-json --stream-partial-output --force --trust \
  *     -m <model> [--resume <sessionId>]
  *
@@ -27,10 +26,18 @@
  * `--trust` (skip the workspace-trust prompt). Cursor has no system-prompt
  * flag, so the briefing folds into the first turn's prompt.
  */
-import { spawn, type ChildProcess } from "node:child_process";
-
+import { requireContainerRuntimeOperational } from "../runtime-guard";
+import type {
+  TaskEnvironmentAgentSessionSurface,
+  TaskEnvironmentSessionRequest,
+} from "../task-environment/types";
 import { newId } from "../ulid";
 import { register } from "./registry";
+import {
+  AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+  spawnEnvironmentProcess,
+  type AgentEnvironmentProcess,
+} from "./proc";
 import { extractResultUsage } from "./usage";
 import type {
   AgentEvent,
@@ -147,15 +154,15 @@ export function mapCursorLine(line: string): MappedCursorLine {
 // Session
 // ---------------------------------------------------------------------------
 
-export type Spawner = (args: string[]) => ChildProcess;
-const defaultSpawn: Spawner = (args) =>
-  spawn("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+export type Spawner = (
+  request: TaskEnvironmentSessionRequest,
+) => AgentEnvironmentProcess;
 
 export class CursorSession implements AgentSession {
   readonly agentId: string;
   readonly kind: AgentKind = "cursor";
 
-  private readonly containerName: string;
+  private readonly environment: TaskEnvironmentAgentSessionSurface;
   private readonly model?: string;
   private readonly systemPreamble: string;
   private readonly agentEnv: Record<string, string>;
@@ -164,7 +171,7 @@ export class CursorSession implements AgentSession {
 
   private readonly handlers = new Set<AgentEventHandler>();
   private sessionId: string | null = null;
-  private current: ChildProcess | null = null;
+  private current: AgentEnvironmentProcess | null = null;
   private queue: Promise<void> = Promise.resolve();
   private sentPreamble = false;
   private closed = false;
@@ -172,18 +179,19 @@ export class CursorSession implements AgentSession {
   constructor(args: {
     taskId: string;
     agent: RosterAgent;
-    containerName: string;
+    environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
     spawner?: Spawner;
     apiKey?: string;
   }) {
     this.agentId = args.agent.id;
-    this.containerName = args.containerName;
+    this.environment = args.environment;
     this.model = args.agent.model;
     this.systemPreamble = args.systemPreamble;
     this.agentEnv = args.agentEnv ?? {};
-    this.spawner = args.spawner ?? defaultSpawn;
+    this.spawner =
+      args.spawner ?? ((request) => spawnEnvironmentProcess(this.environment, request));
     this.apiKey = args.apiKey ?? process.env.CURSOR_API_KEY ?? "";
   }
 
@@ -199,17 +207,13 @@ export class CursorSession implements AgentSession {
 
   async send(text: string): Promise<void> {
     if (this.closed) return;
-    this.queue = this.queue.then(() => this.runTurn(text));
-    return this.queue;
+    const turn = this.queue.catch(() => {}).then(() => this.runTurn(text));
+    this.queue = turn;
+    return turn;
   }
 
-  private buildArgs(prompt: string): string[] {
-    const args = ["exec", "-i", "-u", "node", "-e", `CURSOR_API_KEY=${this.apiKey}`];
-    for (const [k, v] of Object.entries(this.agentEnv)) {
-      args.push("-e", `${k}=${v}`);
-    }
-    args.push(
-      this.containerName,
+  private buildRequest(prompt: string): TaskEnvironmentSessionRequest {
+    const argv = [
       CURSOR_BIN,
       "-p",
       prompt,
@@ -219,14 +223,20 @@ export class CursorSession implements AgentSession {
       "--force", // container is the sandbox — auto-run tools
       "--trust", // skip the workspace-trust prompt in headless
       "--approve-mcps", // load the gateway MCP servers from ~/.cursor/mcp.json (ADR-057)
-    );
-    if (this.model && this.model !== "auto") args.push("-m", this.model);
-    if (this.sessionId) args.push("--resume", this.sessionId);
-    return args;
+    ];
+    if (this.model && this.model !== "auto") argv.push("-m", this.model);
+    if (this.sessionId) argv.push("--resume", this.sessionId);
+    return {
+      argv: argv as [string, ...string[]],
+      user: "node",
+      env: { ...this.agentEnv, CURSOR_API_KEY: this.apiKey },
+      maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,
+    };
   }
 
   private async runTurn(text: string): Promise<void> {
     if (this.closed) return;
+    requireContainerRuntimeOperational();
     // No system-prompt flag — fold the briefing into the first turn; later
     // turns carry it via the resumed session.
     const prompt =
@@ -235,7 +245,7 @@ export class CursorSession implements AgentSession {
         : text;
     this.sentPreamble = true;
 
-    const child = this.spawner(this.buildArgs(prompt));
+    const child = this.spawner(this.buildRequest(prompt));
     this.current = child;
 
     let acc = "";
@@ -352,6 +362,6 @@ register({
   // Gated on a Cursor API key in the host env (loaded from .env.local); the
   // adapter injects it into the container. No key → engine not advertised.
   available: () => Boolean(process.env.CURSOR_API_KEY),
-  create: async ({ taskId, agent, containerName, systemPreamble, agentEnv }) =>
-    new CursorSession({ taskId, agent, containerName, systemPreamble, agentEnv }),
+  create: async ({ taskId, agent, environment, systemPreamble, agentEnv }) =>
+    new CursorSession({ taskId, agent, environment, systemPreamble, agentEnv }),
 });

package/lib/agents/durable-proc.ts

@@ -18,7 +18,6 @@
  * LineProcess gave them.
  */
 
-import { spawn } from "node:child_process";
 import {
   closeSync,
   fstatSync,
@@ -47,12 +46,11 @@ export function runnerScriptPath(): string {
 export interface DurableProcessOptions {
   /** Session dir as seen FROM THE HOST (on the workspace bind mount). */
   hostSessionDir: string;
-  /**
-   * Command that launches the runner (e.g. `docker exec -d … node
-   * /opt/uai/runner.mjs <containerSessionDir> -- claude …`). Omit to ATTACH
-   * to a runner that is already alive (boot reconciliation).
-   */
-  spawnCommand?: { command: string; args: string[] };
+  /** Provider-owned detached launch. Omit to attach to an existing runner. */
+  launch?: () => Promise<{
+    exitCode: number | null;
+    stderr: Uint8Array;
+  }>;
   /** Resume consumption from this outbox byte offset (attach path). */
   initialOutboxOffset?: number;
   /** Called after each poll batch whose lines were delivered — persist this
@@ -109,26 +107,21 @@ export class DurableProcess {
 
     mkdirSync(this.dir, { recursive: true });
 
-    if (opts.spawnCommand) {
-      if (this.debug) {
-        this.log(
-          `spawn: ${opts.spawnCommand.command} ${opts.spawnCommand.args.join(" ")}`,
-        );
-      }
-      const child = spawn(opts.spawnCommand.command, opts.spawnCommand.args, {
-        stdio: ["ignore", "ignore", "pipe"],
-      });
-      child.stderr?.setEncoding("utf8");
-      child.stderr?.on("data", (chunk: string) => {
-        this.stderrBuf = (this.stderrBuf + chunk).slice(-8192);
-      });
-      // `docker exec -d` exits 0 immediately on success; non-zero means the
-      // runner never started (bad container, bad mount) — fail loudly now.
-      child.on("exit", (code) => {
-        if (code !== null && code !== 0) this.finish(null);
-      });
-      child.on("error", () => this.finish(null));
-      child.unref();
+    if (opts.launch) {
+      void opts.launch().then(
+        (result) => {
+          const stderr = Buffer.from(result.stderr).toString("utf8");
+          if (stderr) this.stderrBuf = (this.stderrBuf + stderr).slice(-8192);
+          if (result.exitCode !== 0) this.finish(null);
+        },
+        (error: unknown) => {
+          this.stderrBuf = (
+            this.stderrBuf +
+            (error instanceof Error ? error.message : String(error))
+          ).slice(-8192);
+          this.finish(null);
+        },
+      );
     } else {
       this.sawSpawnMeta = true; // attach: the runner pre-exists
     }

package/lib/agents/factory.ts

@@ -8,10 +8,10 @@
  * change here. Unknown kinds fail loudly so a typo in a roster surfaces as an
  * error rather than silently falling back to the wrong CLI.
  *
- * Both adapters run their CLI inside the task container via `docker exec`
- * (ADR-010); the agent's `model` (if set) is passed through. Swapping mock ⇄
- * real is changing which factory the orchestrator is constructed with — see
- * `getOrchestrator`.
+ * Adapters run their CLI through the task environment's provider-owned
+ * session surface; the agent's `model` (if set) is passed through. Swapping
+ * mock ⇄ real is changing which factory the orchestrator is constructed with
+ * — see `getOrchestrator`.
  */
 
 // Side-effect imports: register the built-in adapters with the registry.
@@ -26,26 +26,6 @@ import { agentClisReady } from "../standard-image";
 import { factoryFor, supportsExecutionProfile } from "./registry";
 import type { AgentSession, AgentSessionFactory } from "./types";
 
-/** Cap the wait on agentClisReady so a spawn can never hang forever if the
- *  boot reconcile never signals (e.g. an unexpected code path). Generous —
- *  the reconcile normally settles in seconds; this only guards a stuck boot. */
-const CLIS_READY_TIMEOUT_MS = 90_000;
-
-/** Await the shared-volume CLI reconcile, bounded by a self-clearing timeout so
- *  neither a stuck boot nor a per-spawn timer leak can bite. */
-async function awaitAgentClisReady(): Promise<void> {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const bound = new Promise<void>((resolve) => {
-    timer = setTimeout(resolve, CLIS_READY_TIMEOUT_MS);
-    timer.unref?.();
-  });
-  try {
-    await Promise.race([agentClisReady, bound]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-
 export const realAgentFactory: AgentSessionFactory = {
   create: async (args): Promise<AgentSession> => {
     const factory = factoryFor(args.agent.kind);
@@ -66,7 +46,11 @@ export const realAgentFactory: AgentSessionFactory = {
     // at boot the CLI auto-upgrade briefly removes then reinstalls codex/claude,
     // and a resume that races that window dies with "No codex executable found
     // for nodejs X". Post-boot this is already resolved (instant).
-    await awaitAgentClisReady();
+    // Fail closed: the maintenance commands have their own process timeouts
+    // and settle this latch even on failure. A second timeout here would let a
+    // CLI spawn enter the shared volume while boot reconciliation still owns
+    // its remove/reinstall window.
+    await agentClisReady;
     return factory.create(args);
   },
 };