@runuai/host 0.9.147 → 0.9.149

package/images/standard/Dockerfile

@@ -30,12 +30,20 @@ FROM debian:bookworm-slim
 # asdf release to clone. Pinned for reproducible builds; bump deliberately.
 ENV ASDF_VERSION=v0.14.1
 
+# Qualified agent builds. These are execution-contract pins: per-command env
+# freshness is requalified before any of them moves.
+ENV UAI_CODEX_CLI_VERSION=0.157.0
+ENV UAI_CURSOR_AGENT_VERSION=2026.08.25-3e8eec8
+ENV UAI_GROK_CLI_VERSION=1.0.5
+
 # ---------------------------------------------------------------------------
 # 1. System packages.
 #
 # build-essential + the -dev libs cover what asdf's nodejs/python/ruby/rust
 # build plugins need to compile a runtime from source on first use. unzip is
 # needed by several asdf plugins; gnupg + ca-certificates for the gh apt repo.
+# iptables is for the secrets proxy's NAT chain (ADR-153); only the runner's
+# one privileged exec runs it, and ca-certificates also installs its CA.
 # ---------------------------------------------------------------------------
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -48,6 +56,7 @@ RUN apt-get update \
       direnv \
       git \
       gnupg \
+      iptables \
       jq \
       libbz2-dev \
       libffi-dev \
@@ -236,13 +245,14 @@ RUN bash -lc '\
   . /opt/asdf/asdf.sh; \
   COREPACK_VERSION="$(sed -n "1p" /usr/local/share/uai/corepack-version)"; \
   printf "%s" "$COREPACK_VERSION" | grep -Eq "^[0-9]+\\.[0-9]+\\.[0-9]+$"; \
-  npm install -g @anthropic-ai/claude-code @openai/codex "corepack@$COREPACK_VERSION" \
+  npm install -g @anthropic-ai/claude-code "@openai/codex@$UAI_CODEX_CLI_VERSION" "corepack@$COREPACK_VERSION" \
     --registry=https://registry.npmjs.org/ \
     --userconfig=/dev/null \
     --globalconfig=/dev/uai-empty-npmrc; \
   corepack enable; \
   curl -fsSL https://code-server.dev/install.sh | sh -s -- --method standalone --prefix /home/node/.local; \
   asdf reshim nodejs; \
+  test "$(codex --version)" = "codex-cli $UAI_CODEX_CLI_VERSION"; \
 '
 
 # Optional agent CLIs — installed ONLY when the host has them configured
@@ -259,8 +269,16 @@ RUN if [ "$INSTALL_KIMI" = "1" ]; then \
 
 ARG INSTALL_GROK=0
 RUN if [ "$INSTALL_GROK" = "1" ]; then \
-      bash -lc 'curl -fsSL https://x.ai/cli/install.sh | bash' \
-        || echo "[warn] grok install failed — grok engine unavailable in this image"; \
+      bash -lc 'set -e; \
+        curl -fsSL https://x.ai/cli/install.sh | bash -s -- "$UAI_GROK_CLI_VERSION"; \
+        case "$("$HOME/.grok/bin/grok" --version)" in \
+          "grok $UAI_GROK_CLI_VERSION "*) ;; \
+          *) exit 1 ;; \
+        esac' \
+        || { \
+          rm -rf -- "$HOME/.grok/bin" "$HOME/.grok/downloads"; \
+          echo "[warn] grok install failed — grok engine unavailable in this image"; \
+        }; \
     fi
 
 # Cursor Agent (Anysphere) — installs to /home/node/.local/bin/cursor-agent.
@@ -268,8 +286,24 @@ RUN if [ "$INSTALL_GROK" = "1" ]; then \
 # task-up — just the binary.
 ARG INSTALL_CURSOR=0
 RUN if [ "$INSTALL_CURSOR" = "1" ]; then \
-      bash -lc 'curl https://cursor.com/install -fsS | bash' \
-        || echo "[warn] cursor install failed — cursor engine unavailable in this image"; \
+      bash -lc 'set -e; \
+        case "$(uname -m)" in \
+          x86_64|amd64) cursor_arch=x64 ;; \
+          aarch64|arm64) cursor_arch=arm64 ;; \
+          *) echo "unsupported Cursor architecture: $(uname -m)" >&2; exit 1 ;; \
+        esac; \
+        cursor_dir="$HOME/.local/share/cursor-agent/versions/$UAI_CURSOR_AGENT_VERSION"; \
+        mkdir -p "$cursor_dir" "$HOME/.local/bin"; \
+        curl -fSL "https://downloads.cursor.com/lab/$UAI_CURSOR_AGENT_VERSION/linux/$cursor_arch/agent-cli-package.tar.gz" \
+          | tar --strip-components=1 -xzf - -C "$cursor_dir"; \
+        ln -sfn "$cursor_dir/cursor-agent" "$HOME/.local/bin/agent"; \
+        ln -sfn "$cursor_dir/cursor-agent" "$HOME/.local/bin/cursor-agent"; \
+        test "$("$HOME/.local/bin/cursor-agent" --version)" = "$UAI_CURSOR_AGENT_VERSION"' \
+        || { \
+          rm -f -- "$HOME/.local/bin/agent" "$HOME/.local/bin/cursor-agent"; \
+          rm -rf -- "$HOME/.local/share/cursor-agent/versions/$UAI_CURSOR_AGENT_VERSION"; \
+          echo "[warn] cursor install failed — cursor engine unavailable in this image"; \
+        }; \
     fi
 
 # OpenCode (ADR-077) — multi-provider CLI. Installs to /home/node/.opencode/bin;
@@ -290,7 +324,11 @@ ENV PATH=/home/node/.local/bin:$PATH
 USER root
 
 COPY --chown=root:root container/uai-init /usr/local/bin/uai-init
-RUN chmod 0755 /usr/local/bin/uai-init
+RUN node_version="$(awk '$1 == "nodejs" { print $2; exit }' /home/node/.tool-versions)" \
+ && test -n "$node_version" \
+ && test -x "/opt/asdf-data/installs/nodejs/$node_version/bin/node" \
+ && ln -s "/opt/asdf-data/installs/nodejs/$node_version/bin/node" /usr/local/bin/node \
+ && chmod 0755 /usr/local/bin/uai-init
 
 # Curated code-server defaults. uai-init seeds these into the per-task User
 # settings dir when none exists (slim chrome, telemetry off, trust off).

package/images/standard/container/uai-init

@@ -51,6 +51,27 @@ if [ "${#npm_sanitize_args[@]}" -gt 0 ]; then
     /bin/bash "${BASH_SOURCE[0]}" "$@"
 fi
 
+# Parse the role only after the one-time sanitized re-exec above. Parsing it
+# first would shift away --dependency-worker, causing the clean process to
+# restart as the main/editor role whenever inherited npm authority was
+# present (the normal task environment).
+UAI_INIT_ROLE=main
+case ${1-} in
+  --dependency-worker)
+    UAI_INIT_ROLE=dependency-worker
+    shift
+    ;;
+  "") ;;
+  *)
+    printf '%s\n' 'uai-init: invalid invocation' >&2
+    exit 64
+    ;;
+esac
+[ "$#" -eq 0 ] || {
+  printf '%s\n' 'uai-init: invalid invocation' >&2
+  exit 64
+}
+
 for runtime_var in $(compgen -A variable 2>/dev/null); do
   case "$runtime_var" in
     ASDF_* | COREPACK_* | \
@@ -123,6 +144,22 @@ case "${BASH_SOURCE[0]}" in
     fi
     ;;
 esac
+UAI_ENV_EXEC=/usr/local/bin/uai-env-exec
+UAI_ENV_HOOK_FILE=/usr/local/share/uai/env-hook.sh
+MANAGED_ENV_KEYS=/run/uai/managed-env-keys
+UAI_INIT_SELF=/usr/local/bin/uai-init
+case "${BASH_SOURCE[0]}" in
+  /usr/local/bin/uai-init | /uai-init-current) ;;
+  *)
+    UAI_INIT_SELF=${BASH_SOURCE[0]}
+    [ -z "${UAI_INIT_TEST_ENV_EXEC:-}" ] \
+      || UAI_ENV_EXEC=$UAI_INIT_TEST_ENV_EXEC
+    [ -z "${UAI_INIT_TEST_ENV_HOOK:-}" ] \
+      || UAI_ENV_HOOK_FILE=$UAI_INIT_TEST_ENV_HOOK
+    [ -z "${UAI_INIT_TEST_MANAGED_ENV_KEYS:-}" ] \
+      || MANAGED_ENV_KEYS=$UAI_INIT_TEST_MANAGED_ENV_KEYS
+    ;;
+esac
 ASDF_SH="$ASDF_DIR/asdf.sh"
 
 log() { echo "uai-init: $*"; }
@@ -291,6 +328,7 @@ fi
 #    useful in either mode for commit/tag signing.
 # ---------------------------------------------------------------------------
 
+if [ "$UAI_INIT_ROLE" = main ]; then
 if [ "${UAI_SKIP_GIT_TRANSPORT:-0}" = "1" ]; then
   # Recovery/connect/disconnect reconciles the current credential immediately
   # before invoking us. Do not overwrite that live decision with the static
@@ -343,6 +381,7 @@ if [ ! -f "$cc_settings" ]; then
   printf '{\n  "includeCoAuthoredBy": false\n}\n' > "$cc_settings"
   log "seeded ~/.claude/settings.json (includeCoAuthoredBy: false)"
 fi
+fi
 
 # ---------------------------------------------------------------------------
 # 1. Per-folder dependency install (runtimes are already materialized).
@@ -468,6 +507,18 @@ run_workspace_installs() {
   return 0
 }
 
+# The detached worker is the only uai-init role that receives project env.
+# Its caller has already used uai-env-exec to perform one authenticated
+# refresh; this role does no editor or Git-control-plane work and exits after
+# the installs. Paths are repeated here because a fresh process cannot inherit
+# the parent's shell locals.
+if [ "$UAI_INIT_ROLE" = dependency-worker ]; then
+  deps_state_dir="$WORKSPACE/.uai/init"
+  deps_status_file="$deps_state_dir/deps-status"
+  run_workspace_installs
+  exit $?
+fi
+
 if [ -d "$WORKSPACE" ] && [ -f "$RUNTIME_PROJECTS" ] \
    && [ ! -L "$RUNTIME_PROJECTS" ]; then
   deps_state_dir="$WORKSPACE/.uai/init"
@@ -506,7 +557,15 @@ if [ -d "$WORKSPACE" ] && [ -f "$RUNTIME_PROJECTS" ] \
     (
       trap 'rm -rf "$deps_lock_dir"' EXIT
       deps_rc=0
-      run_workspace_installs || deps_rc=$?
+      if [ "${UAI_ENV_MODE:-baked}" = loader ]; then
+        UAI_ENV_HOOK=1 \
+        BASH_ENV="$UAI_ENV_HOOK_FILE" \
+        SHELL=/usr/bin/zsh \
+          "$UAI_ENV_EXEC" "$UAI_INIT_SELF" --dependency-worker \
+          || deps_rc=$?
+      else
+        run_workspace_installs || deps_rc=$?
+      fi
       if [ "$deps_rc" -eq 0 ]; then
         printf 'done\n' > "$deps_status_file"
         log "workspace dependency install complete"
@@ -605,7 +664,31 @@ else
       [ -z "$test_code_server_bin" ] || code_server_bin="$test_code_server_bin"
       ;;
   esac
-  nohup "$code_server_bin" \
+  code_server_env=()
+  if [ "${UAI_ENV_MODE:-baked}" = loader ]; then
+    if [ -L "$MANAGED_ENV_KEYS" ] || [ ! -f "$MANAGED_ENV_KEYS" ]; then
+      log "error: managed env key list is unavailable; refusing editor startup"
+      exit 78
+    fi
+    code_server_env=(/usr/bin/env)
+    while IFS= read -r managed_name || [ -n "$managed_name" ]; do
+      case $managed_name in
+        ''|[!A-Za-z_]*|*[!A-Za-z0-9_]*)
+          log "error: managed env key list is invalid; refusing editor startup"
+          exit 78
+          ;;
+      esac
+      code_server_env+=( -u "$managed_name" )
+    done < "$MANAGED_ENV_KEYS"
+    code_server_env+=(
+      -u __UAI_ENV_KEYS
+      -u __UAI_ENV_ETAG
+      UAI_ENV_HOOK=1
+      "BASH_ENV=$UAI_ENV_HOOK_FILE"
+      SHELL=/usr/bin/zsh
+    )
+  fi
+  nohup "${code_server_env[@]}" "$code_server_bin" \
     --user-data-dir "$cs_data_dir" \
     --disable-workspace-trust \
     --auth none \

package/images/standard/container/uai-task-forwarder.mjs

@@ -0,0 +1,303 @@
+#!/usr/bin/env node
+
+/**
+ * Task-local authenticated stream forwarder (ADR-153).
+ *
+ * The generation secret is read as exactly 32 raw bytes from stdin, converted
+ * to a KeyObject, and never placed in argv, the environment, a file or a
+ * network frame. The runner proves each connection with a fresh nonce/HMAC.
+ */
+
+import { createHmac, createSecretKey } from "node:crypto";
+import { createConnection, createServer } from "node:net";
+import { pathToFileURL } from "node:url";
+
+const PREAMBLE_MAGIC = Buffer.from([
+  0x00, 0x55, 0x41, 0x49, 0x46, 0x57, 0x44, 0x01,
+]);
+const CHALLENGE_MAGIC = Buffer.from("UAICHL01", "ascii");
+const RESPONSE_MAGIC = Buffer.from("UAIRES01", "ascii");
+const ACCEPT_MAGIC = Buffer.from("UAIOK001", "ascii");
+const HMAC_DOMAIN = Buffer.from("uai-task-forwarder-v1\0", "ascii");
+const FIELD_SEPARATOR = Buffer.from([0]);
+
+const SECRET_BYTES = 32;
+const NONCE_BYTES = 32;
+const FORWARDER_UID = 65_532;
+const PREAUTH_TIMEOUT_MS = 3_000;
+const SECRET_INPUT_TIMEOUT_MS = 5_000;
+const MAX_PENDING_PREAUTH = 64;
+const MAX_TASK_ID_BYTES = 128;
+const MAX_GENERATION_BYTES = 64;
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function parsePort(value, name) {
+  if (!/^\d+$/.test(value ?? "")) fail(`invalid ${name}`);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65_535) {
+    fail(`invalid ${name}`);
+  }
+  return parsed;
+}
+
+export function parseForwarderArgs(argv) {
+  const values = new Map();
+  for (let index = 0; index < argv.length; index += 2) {
+    const flag = argv[index];
+    const value = argv[index + 1];
+    if (!flag?.startsWith("--") || value === undefined || values.has(flag)) {
+      fail("invalid forwarder arguments");
+    }
+    values.set(flag, value);
+  }
+  const taskId = values.get("--task-id") ?? "";
+  const generation = values.get("--generation") ?? "";
+  const gatewayHost = values.get("--gateway-host") ?? "";
+  const allowed = new Set([
+    "--task-id",
+    "--generation",
+    "--gateway-host",
+    "--gateway-port",
+    "--listen-port",
+  ]);
+  if ([...values.keys()].some((key) => !allowed.has(key))) {
+    fail("invalid forwarder arguments");
+  }
+  if (
+    !/^[a-z0-9][a-z0-9_-]*$/.test(taskId) ||
+    Buffer.byteLength(taskId) > MAX_TASK_ID_BYTES ||
+    !/^[A-Za-z0-9_-]{16,64}$/.test(generation) ||
+    Buffer.byteLength(generation) > MAX_GENERATION_BYTES ||
+    gatewayHost.length < 1 ||
+    gatewayHost.length > 255 ||
+    /[\0\s]/.test(gatewayHost)
+  ) {
+    fail("invalid forwarder arguments");
+  }
+  return {
+    taskId,
+    generation,
+    gatewayHost,
+    gatewayPort: parsePort(values.get("--gateway-port") ?? "5877", "gateway port"),
+    listenPort: parsePort(values.get("--listen-port") ?? "5877", "listen port"),
+  };
+}
+
+function encodePreamble(taskId, generation) {
+  const task = Buffer.from(taskId, "utf8");
+  const generationBytes = Buffer.from(generation, "ascii");
+  return Buffer.concat([
+    PREAMBLE_MAGIC,
+    Buffer.from([task.length, generationBytes.length]),
+    task,
+    generationBytes,
+  ]);
+}
+
+function responseMac(secret, taskId, generation, nonce) {
+  return createHmac("sha256", secret)
+    .update(HMAC_DOMAIN)
+    .update(taskId, "utf8")
+    .update(FIELD_SEPARATOR)
+    .update(generation, "ascii")
+    .update(FIELD_SEPARATOR)
+    .update(nonce)
+    .digest();
+}
+
+async function readExact(socket, length, timeoutMs) {
+  return await new Promise((resolve, reject) => {
+    const chunks = [];
+    let received = 0;
+    let done = false;
+    const finish = (error, value) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      socket.pause();
+      socket.off("data", onData);
+      socket.off("error", onError);
+      socket.off("end", onEnd);
+      socket.off("close", onClose);
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const onData = (chunk) => {
+      received += chunk.length;
+      if (received > length) {
+        finish(new Error("oversized forwarder handshake frame"));
+        return;
+      }
+      chunks.push(chunk);
+      if (received === length) finish(null, Buffer.concat(chunks, length));
+    };
+    const onError = () => finish(new Error("forwarder handshake socket error"));
+    const onEnd = () => finish(new Error("truncated forwarder handshake frame"));
+    const onClose = () => finish(new Error("forwarder handshake socket closed"));
+    const timer = setTimeout(
+      () => finish(new Error("forwarder handshake timed out")),
+      timeoutMs,
+    );
+    timer.unref();
+    socket.on("data", onData);
+    socket.once("error", onError);
+    socket.once("end", onEnd);
+    socket.once("close", onClose);
+    socket.resume();
+  });
+}
+
+async function readSecret(input) {
+  const chunks = [];
+  let size = 0;
+  const timeout = setTimeout(() => input.destroy(), SECRET_INPUT_TIMEOUT_MS);
+  timeout.unref();
+  try {
+    for await (const chunk of input) {
+      const bytes = Buffer.from(chunk);
+      size += bytes.length;
+      if (size > SECRET_BYTES) fail("invalid forwarder secret input");
+      chunks.push(bytes);
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+  if (size !== SECRET_BYTES) fail("invalid forwarder secret input");
+  return Buffer.concat(chunks, SECRET_BYTES);
+}
+
+export function createTaskForwarder(options, secret, dependencies = {}) {
+  const identityPreamble = encodePreamble(options.taskId, options.generation);
+  const connectUpstream = dependencies.createConnection ?? createConnection;
+  const activeSockets = new Set();
+  let pendingPreauth = 0;
+
+  const server = createServer({ pauseOnConnect: true }, (local) => {
+    activeSockets.add(local);
+    local.once("close", () => activeSockets.delete(local));
+    if (pendingPreauth >= MAX_PENDING_PREAUTH) {
+      local.destroy();
+      return;
+    }
+    pendingPreauth += 1;
+    const upstream = connectUpstream({
+      host: options.gatewayHost,
+      port: options.gatewayPort,
+    });
+    const preauthTimer = setTimeout(() => {
+      local.destroy();
+      upstream.destroy();
+    }, PREAUTH_TIMEOUT_MS);
+    preauthTimer.unref();
+    activeSockets.add(upstream);
+    upstream.setNoDelay(true);
+    upstream.once("close", () => activeSockets.delete(upstream));
+    local.once("error", () => upstream.destroy());
+    local.once("close", () => upstream.destroy());
+    upstream.once("error", () => local.destroy());
+
+    void (async () => {
+      try {
+        await new Promise((resolve, reject) => {
+          let settled = false;
+          const finish = (error) => {
+            if (settled) return;
+            settled = true;
+            upstream.off("connect", onConnect);
+            upstream.off("error", onError);
+            upstream.off("close", onClose);
+            if (error) reject(error);
+            else resolve();
+          };
+          const onConnect = () => finish(null);
+          const onError = () => finish(new Error("forwarder upstream failed"));
+          const onClose = () => finish(new Error("forwarder upstream closed"));
+          upstream.once("connect", onConnect);
+          upstream.once("error", onError);
+          upstream.once("close", onClose);
+          if (upstream.readyState === "open") finish(null);
+          else if (upstream.destroyed) onClose();
+        });
+        upstream.write(identityPreamble);
+        const challenge = await readExact(
+          upstream,
+          CHALLENGE_MAGIC.length + NONCE_BYTES,
+          PREAUTH_TIMEOUT_MS,
+        );
+        if (!challenge.subarray(0, CHALLENGE_MAGIC.length).equals(CHALLENGE_MAGIC)) {
+          fail("invalid forwarder challenge");
+        }
+        const nonce = challenge.subarray(CHALLENGE_MAGIC.length);
+        const mac = responseMac(
+          secret,
+          options.taskId,
+          options.generation,
+          nonce,
+        );
+        upstream.write(Buffer.concat([RESPONSE_MAGIC, mac]));
+        const accepted = await readExact(
+          upstream,
+          ACCEPT_MAGIC.length,
+          PREAUTH_TIMEOUT_MS,
+        );
+        if (!accepted.equals(ACCEPT_MAGIC)) fail("forwarder authentication refused");
+        local.pipe(upstream);
+        upstream.pipe(local);
+        local.resume();
+        upstream.resume();
+      } catch {
+        local.destroy();
+        upstream.destroy();
+      } finally {
+        clearTimeout(preauthTimer);
+        pendingPreauth -= 1;
+      }
+    })();
+  });
+
+  server.shutdown = () => {
+    for (const socket of activeSockets) socket.destroy();
+    activeSockets.clear();
+    server.close();
+  };
+  return server;
+}
+
+async function main() {
+  // The launcher additionally applies no_new_privs and clears capabilities.
+  // Refuse a wiring regression that runs this secret holder as root or node.
+  if (
+    process.getuid?.() !== FORWARDER_UID ||
+    process.getgid?.() !== FORWARDER_UID
+  ) {
+    fail(`task forwarder must run as uid/gid ${FORWARDER_UID}`);
+  }
+  const options = parseForwarderArgs(process.argv.slice(2));
+  const rawSecret = await readSecret(process.stdin);
+  const secret = createSecretKey(rawSecret);
+  rawSecret.fill(0);
+  const server = createTaskForwarder(options, secret);
+  server.once("error", () => {
+    process.stderr.write("uai task forwarder could not start\n");
+    process.exitCode = 1;
+  });
+  server.listen(options.listenPort, "127.0.0.1", () => {
+    process.stdout.write("READY\n");
+  });
+  const stop = () => server.shutdown();
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  main().catch(() => {
+    process.stderr.write("uai task forwarder failed\n");
+    process.exitCode = 1;
+  });
+}

package/lib/agent-cli.ts

@@ -22,10 +22,14 @@ import {
 import { resolve } from "node:path";
 
 import { env, taskWorkspaceDir } from "./env";
-import { RUNTIME_AUTHORITY_ENV } from "./runtime-authority";
+import {
+  PROJECT_ENV_EXEC_PATH,
+  RUNTIME_AUTHORITY_ENV,
+} from "./runtime-authority";
 import { signTaskToken } from "./task-token";
 import { assertSafeHostTaskId } from "./task-identity";
 import type { RosterAgent } from "./agents/types";
+import type { TaskEnvironmentAgentSessionSurface } from "./task-environment/types";
 
 /** Container path of the CLI — what the preamble tells agents to run. */
 export const CONTAINER_CLI_PATH = "/workspace/.uai/cli.mjs";
@@ -36,6 +40,19 @@ export const CONTAINER_CLI_PATH = "/workspace/.uai/cli.mjs";
  * underneath this object so those credentials cannot replace host policy. */
 export const AGENT_RUNTIME_AUTHORITY_ENV = RUNTIME_AUTHORITY_ENV;
 
+/**
+ * One rollout-aware argv policy for every agent CLI. The wrapper is installed
+ * only in PR2+ environments; legacy baked tasks must launch exactly as before.
+ */
+export function agentCliArgv(
+  environment: Pick<TaskEnvironmentAgentSessionSurface, "descriptor">,
+  argv: readonly [string, ...string[]],
+): [string, ...string[]] {
+  return environment.descriptor.envMode === "loader"
+    ? [PROJECT_ENV_EXEC_PATH, ...argv]
+    : [...argv];
+}
+
 // The task's cli secret lives HOST-PRIVATE (never the container), so it survives
 // host restarts without a DB migration. The cloud re-sends it on each task-up.
 function taskSecretPath(taskId: string): string {