@runuai/host 0.9.147 → 0.9.149

package/lib/agent.ts

@@ -32,14 +32,24 @@ import { containerRuntimeStandardAssetsRoot } from "./container-runtime";
 import { getDecryptedForProject } from "./host-env";
 import { PreviewPortRuntimesSchema } from "./preview-ports";
 import { getHostTask } from "./runtime-state";
+import { activeSecretsProxy } from "./secrets-proxy/host";
+import { closeTaskUpTrustSteps, finishTaskUpTrustSteps, writeTaskUpTrustSteps } from "./secrets-proxy/task-trust";
 import { removeTaskIdentity, writeTaskIdentity } from "./ssh";
-import type { TaskDownInput, TaskLaunchInput } from "../src/protocol";
+import { taskGatewayHost } from "./mcp-gateway";
+import type { ProjectEnvMode } from "./task-environment/types";
+import { isProjectEnvSchemaObservation, type ProjectEnvSchemaObservation, type TaskDownInput, type TaskLaunchInput } from "../src/protocol";
 
 export type { TaskLaunchInput } from "../src/protocol";
 
 export interface TaskUpCredentials {
   /** Path to the task owner's private, ephemeral Git credential cache. */
   githubCredentialSocket?: string;
+  /** Fresh ADR-153 generation credential. The raw bytes are forwarded only
+   * over stdin and are never serialized into a task row, argv, or env. */
+  taskGateway?: {
+    generation: string;
+    secret: Uint8Array;
+  };
 }
 
 // ---------------------------------------------------------------------------
@@ -86,6 +96,13 @@ const TaskUpData = z.object({
   previewPorts: PreviewPortRuntimesSchema.optional(),
   /** Degraded start: uai-init failed twice; surfaced as a feed system note. */
   initWarning: z.string().optional(),
+  /** ADR-153: whether this start put the secrets proxy's CA, and its pins,
+   *  into the task. Absent from a task-up that predates them. */
+  secretsProxyTrust: z.enum(["installed", "failed", "skipped"]).optional(),
+  secretsProxyPins: z.enum(["installed", "failed", "skipped"]).optional(),
+  /** ADR-153 §4: each project's schema observation, as the runner stored it
+   *  before anything in the task started (a task machine reports its own). */
+  envSchemas: z.array(z.custom<ProjectEnvSchemaObservation>(isProjectEnvSchemaObservation)).optional(),
 });
 export type TaskUpResult = z.infer<typeof TaskUpData>;
 
@@ -303,46 +320,94 @@ export const agent = {
   async taskUp(
     input: TaskLaunchInput,
     credentials: TaskUpCredentials = {},
+    envMode: ProjectEnvMode = "baked",
   ): Promise<TaskUpResult> {
     const commandDbPath = createTaskUpCommandDb(input);
     // Materialize the creator's per-user SSH key for commit signing and the
     // explicit no-GitHub-connection transport fallback (ADR-029).
     const identityDir = writeTaskIdentity(input.task.id, input.task.ownerUserId);
-    // Per-(project, key) env values must NEVER enter task-up's host process
-    // environment. Besides ordinary app names, projects can declare names such
-    // as BASH_ENV, PATH, GIT_CONFIG_*, or UAI_*; exposing those before the host
-    // clone would let container-owned configuration influence host commands or
-    // read another credential boundary. Send one JSON object over stdin
-    // instead. task-up feeds it directly to Compose as an in-memory override,
-    // so values reach only the task container and are never written to disk.
-    // On a key collision the LEAD project (position 0) wins: iterate in
-    // descending position order so position-0 assignments apply last.
-    const projectEnv: Record<string, string> = {};
-    const orderedProjects = [...input.projects].sort(
-      (a, b) => b.position - a.position,
-    );
-    for (const project of orderedProjects) {
-      Object.assign(projectEnv, getDecryptedForProject(project.id));
-    }
-    const extraEnv: Record<string, string> = {};
-    if (identityDir) extraEnv.UAI_TASK_IDENTITY_DIR = identityDir;
-    // Only a non-secret socket path crosses into Bash. The token itself was
-    // seeded over stdin and never enters argv, env, project data, Compose, or
-    // the task container.
-    if (credentials.githubCredentialSocket) {
-      extraEnv.UAI_GITHUB_CREDENTIAL_SOCKET =
-        credentials.githubCredentialSocket;
-    }
     try {
-      return await runAgent(
-        "task-up.sh",
-        [input.task.id],
-        TaskUpData,
-        commandDbPath,
-        extraEnv,
-        JSON.stringify(projectEnv),
-      );
+      // Per-(project, key) env values must NEVER enter task-up's host process
+      // environment. Besides ordinary app names, projects can declare names such
+      // as BASH_ENV, PATH, GIT_CONFIG_*, or UAI_*; exposing those before the host
+      // clone would let container-owned configuration influence host commands or
+      // read another credential boundary. Send one JSON object over stdin
+      // instead. task-up feeds it directly to Compose as an in-memory override,
+      // so values reach only the task container and are never written to disk.
+      // On a key collision the LEAD project (position 0) wins: iterate in
+      // descending position order so position-0 assignments apply last.
+      const projectEnv: Record<string, string> = {};
+      if (envMode === "baked") {
+        const orderedProjects = [...input.projects].sort(
+          (a, b) => b.position - a.position,
+        );
+        for (const project of orderedProjects) {
+          Object.assign(projectEnv, getDecryptedForProject(project.id));
+        }
+      }
+      const extraEnv: Record<string, string> = {
+        UAI_PROJECT_ENV_MODE: envMode,
+      };
+      if (identityDir) extraEnv.UAI_TASK_IDENTITY_DIR = identityDir;
+      // Only a non-secret socket path crosses into Bash. The token itself was
+      // seeded over stdin and never enters argv, env, project data, Compose, or
+      // the task container.
+      if (credentials.githubCredentialSocket) {
+        extraEnv.UAI_GITHUB_CREDENTIAL_SOCKET =
+          credentials.githubCredentialSocket;
+      }
+      let stdinPayload: string;
+      if (envMode === "loader") {
+        const gateway = credentials.taskGateway;
+        if (!gateway || gateway.secret.byteLength !== 32) {
+          throw new Error(
+            "loader task is missing its gateway generation credential",
+          );
+        }
+        extraEnv.UAI_TASK_GATEWAY_GENERATION = gateway.generation;
+        extraEnv.UAI_TASK_GATEWAY_HOST = await taskGatewayHost();
+        // ADR-153: what task-up installs before anything runs in the task.
+        // Public material only; absent under the kill switch.
+        // The start holds the task's root writes until its result is
+        // recorded, so no older writer (a recovery, a re-pin) lands over
+        // them while uai-init runs.
+        const secretsProxy = activeSecretsProxy();
+        if (secretsProxy !== null) {
+          // task-up reports each step's outcome into it as it goes, so the
+          // task's readiness is exact even while uai-init already runs.
+          const stepsDir = await writeTaskUpTrustSteps(env.dataDir, input.task.id, secretsProxy.runtime);
+          if (stepsDir !== null) extraEnv.UAI_SECRETS_PROXY_DIR = stepsDir;
+        }
+        const secretCopy = Buffer.from(gateway.secret);
+        try {
+          stdinPayload = secretCopy.toString("base64");
+        } finally {
+          secretCopy.fill(0);
+        }
+      } else {
+        stdinPayload = JSON.stringify(projectEnv);
+      }
+      let result: TaskUpResult;
+      try {
+        result = await runAgent(
+          "task-up.sh",
+          [input.task.id],
+          TaskUpData,
+          commandDbPath,
+          extraEnv,
+          stdinPayload,
+        );
+      } catch (error) {
+        finishTaskUpTrustSteps(env.dataDir, input.task.id, null);
+        throw error;
+      }
+      // What this start actually installed. A start that did not get the CA
+      // in is retried by the trust watcher once the task runs.
+      finishTaskUpTrustSteps(env.dataDir, input.task.id, result);
+      if (result.secretsProxyTrust === "failed") activeSecretsProxy()?.runtime.requestTrustDelivery();
+      return result;
     } finally {
+      closeTaskUpTrustSteps(env.dataDir, input.task.id);
       removeCommandDb(commandDbPath);
       removeTaskIdentity(input.task.id);
     }

package/lib/agents/attach-compatibility.ts

@@ -0,0 +1,51 @@
+/**
+ * Compatibility for the v0.9.147 -> v0.9.148 durable-session key rollout.
+ *
+ * Older hosts could not receive live roster edits and persisted only the
+ * execution-policy key: null for crew, or one of the Secretary policy
+ * constants. v0.9.148 adds kind/model/effort to that key. Treat the old row as
+ * compatible with the richer desired key only when its policy is unchanged;
+ * the transition is deliberately one-way so future/unknown keys remain exact.
+ */
+
+const LEGACY_SECRETARY_POLICY_KEYS = new Set([
+  "secretary-normal-tools-v1",
+  "secretary-communicator-v1",
+]);
+
+function rosterLaunchPolicy(key: string | null): string | null | undefined {
+  if (key === null) return undefined;
+  try {
+    const parsed: unknown = JSON.parse(key);
+    if (
+      !Array.isArray(parsed) ||
+      parsed.length !== 5 ||
+      parsed[0] !== "roster-launch-v1" ||
+      typeof parsed[1] !== "string" ||
+      typeof parsed[2] !== "string" ||
+      typeof parsed[3] !== "string" ||
+      typeof parsed[4] !== "string"
+    ) {
+      return undefined;
+    }
+    return parsed[4] === "" ? null : parsed[4];
+  } catch {
+    return undefined;
+  }
+}
+
+export function attachCompatibilityKeysMatch(
+  stored: string | null | undefined,
+  desired: string | null | undefined,
+): boolean {
+  const storedKey = stored ?? null;
+  const desiredKey = desired ?? null;
+  if (storedKey === desiredKey) return true;
+
+  const desiredPolicy = rosterLaunchPolicy(desiredKey);
+  if (storedKey === null) return desiredPolicy === null;
+  return (
+    LEGACY_SECRETARY_POLICY_KEYS.has(storedKey) &&
+    desiredPolicy === storedKey
+  );
+}

package/lib/agents/codex.ts

@@ -32,12 +32,13 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-import { and, eq } from "drizzle-orm";
+import { and, eq, isNull } from "drizzle-orm";
 
 import { getDb, schema } from "../db";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
 import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
 import { newId } from "../ulid";
+import { attachCompatibilityKeysMatch } from "./attach-compatibility";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { isRateLimitMessage } from "./rate-limit";
 import { register } from "./registry";
@@ -233,11 +234,21 @@ const delay = (ms: number): Promise<void> =>
 // Thread persistence (ADR-078) — resume the SAME thread across a host restart.
 // ---------------------------------------------------------------------------
 
-/** The Codex thread id persisted for (task, agent), or null if none yet. */
-function readCodexThreadId(taskId: string, agentId: string): string | null {
+/** The compatible Codex thread id persisted for (task, agent), or null. */
+function readCodexThreadId(
+  taskId: string,
+  agentId: string,
+  attachCompatibilityKey: string | undefined,
+): string | null {
   try {
     const row = getDb()
-      .select({ id: schema.hostAgentSessions.codexThreadId })
+      .select({
+        id: schema.hostAgentSessions.codexThreadId,
+        kind: schema.hostAgentSessions.kind,
+        sessionDir: schema.hostAgentSessions.sessionDir,
+        attachCompatibilityKey:
+          schema.hostAgentSessions.attachCompatibilityKey,
+      })
       .from(schema.hostAgentSessions)
       .where(
         and(
@@ -246,6 +257,31 @@ function readCodexThreadId(taskId: string, agentId: string): string | null {
         ),
       )
       .get();
+    if (
+      row?.kind !== "codex" ||
+      !attachCompatibilityKeysMatch(
+        row.attachCompatibilityKey,
+        attachCompatibilityKey,
+      )
+    ) {
+      // Transport will promote the row to the new launch key while preserving
+      // codexThreadId. Clear the incompatible id first so a crash between that
+      // upsert and thread/started cannot make the next host resume it.
+      if (row?.id && row.sessionDir) {
+        getDb()
+          .update(schema.hostAgentSessions)
+          .set({ codexThreadId: null, updatedAt: Date.now() })
+          .where(
+            and(
+              eq(schema.hostAgentSessions.taskId, taskId),
+              eq(schema.hostAgentSessions.agentId, agentId),
+              eq(schema.hostAgentSessions.sessionDir, row.sessionDir),
+            ),
+          )
+          .run();
+      }
+      return null;
+    }
     return row?.id ?? null;
   } catch {
     return null;
@@ -258,15 +294,57 @@ function readCodexThreadId(taskId: string, agentId: string): string | null {
  * thread (today's behavior). The transport's session-row upsert never clears
  * this column, so it survives the kill+respawn of a host restart.
  */
-function saveCodexThreadId(taskId: string, agentId: string, threadId: string): void {
+function saveCodexThreadId(
+  taskId: string,
+  agentId: string,
+  threadId: string,
+  sessionDir: string | undefined,
+  attachCompatibilityKey: string | undefined,
+): void {
+  if (!sessionDir) return;
   try {
-    getDb()
+    const db = getDb();
+    const row = db
+      .select({
+        kind: schema.hostAgentSessions.kind,
+        sessionDir: schema.hostAgentSessions.sessionDir,
+        attachCompatibilityKey:
+          schema.hostAgentSessions.attachCompatibilityKey,
+      })
+      .from(schema.hostAgentSessions)
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, taskId),
+          eq(schema.hostAgentSessions.agentId, agentId),
+        ),
+      )
+      .get();
+    const persistedKey = row?.attachCompatibilityKey ?? null;
+    if (
+      row?.kind !== "codex" ||
+      row.sessionDir !== sessionDir ||
+      !attachCompatibilityKeysMatch(
+        row.attachCompatibilityKey,
+        attachCompatibilityKey,
+      )
+    ) {
+      return;
+    }
+    db
       .update(schema.hostAgentSessions)
       .set({ codexThreadId: threadId, updatedAt: Date.now() })
       .where(
         and(
           eq(schema.hostAgentSessions.taskId, taskId),
           eq(schema.hostAgentSessions.agentId, agentId),
+          eq(schema.hostAgentSessions.kind, "codex"),
+          eq(schema.hostAgentSessions.sessionDir, sessionDir),
+          persistedKey === null
+            ? isNull(schema.hostAgentSessions.attachCompatibilityKey)
+            : eq(
+                schema.hostAgentSessions.attachCompatibilityKey,
+                persistedKey,
+              ),
         ),
       )
       .run();
@@ -302,6 +380,7 @@ export class CodexSession implements AgentSession {
 
   private threadId: string | null = null;
   private readonly ready: Promise<void>;
+  private readonly attachCompatibilityKey: string | undefined;
 
   constructor(args: {
     taskId: string;
@@ -309,15 +388,21 @@ export class CodexSession implements AgentSession {
     environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
+    attachCompatibilityKey?: string;
     /** ADR-128: `-c key=value` overrides a delegating adapter prepends. */
     cliConfigOverrides?: string[];
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
     this.taskId = args.taskId;
+    this.attachCompatibilityKey = args.attachCompatibilityKey;
     // ADR-078: read BEFORE createAgentTransport (whose session-row upsert
     // preserves this column). Non-null → a host restart; resume the thread.
-    this.resumeThreadId = readCodexThreadId(args.taskId, args.agent.id);
+    this.resumeThreadId = readCodexThreadId(
+      args.taskId,
+      args.agent.id,
+      args.attachCompatibilityKey,
+    );
 
     // The agent's model / effort (when set) are selected via config overrides
     // (`-c model=<model>`, `-c model_reasoning_effort=<effort>`) on the
@@ -333,7 +418,15 @@ export class CodexSession implements AgentSession {
     for (const override of args.cliConfigOverrides ?? []) {
       codexArgs.push("-c", override);
     }
-    codexArgs.push("app-server");
+    // These are two independent features in Codex 0.157. Append after every
+    // user override so task env can never be frozen into an on-disk snapshot.
+    codexArgs.push(
+      "--disable",
+      "shell_snapshot",
+      "--disable",
+      "shell_snapshot_v2",
+      "app-server",
+    );
     // ADR-061: the CLI is owned by an in-container runner (durable across
     // host restarts); legacy pipes behind UAI_DURABLE_SESSIONS=0. Codex
     // re-handshakes per host process (initialize + thread/start live in this
@@ -349,6 +442,7 @@ export class CodexSession implements AgentSession {
       passEnv: [],
       explicitEnv: args.agentEnv ?? {},
       allowAttach: false,
+      attachCompatibilityKey: args.attachCompatibilityKey,
       kind: "codex",
       debugLabel: `codex:${this.agentId}`,
     });
@@ -387,6 +481,10 @@ export class CodexSession implements AgentSession {
   // -- JSON-RPC plumbing ----------------------------------------------------
 
   private onLine(line: string): void {
+    // close() severs this generation before the durable runner necessarily
+    // exits. Ignore buffered notifications so a late thread/started cannot
+    // restore the resume id that a live roster edit just cleared.
+    if (this.closed) return;
     let msg: unknown;
     try {
       msg = JSON.parse(line);
@@ -439,7 +537,7 @@ export class CodexSession implements AgentSession {
         const thread = msg.params.thread;
         if (isObj(thread) && typeof thread.id === "string") {
           this.threadId = thread.id;
-          saveCodexThreadId(this.taskId, this.agentId, thread.id);
+          this.persistThreadId(thread.id);
         }
       }
       for (const ev of mapCodexNotification(method, msg.params)) {
@@ -568,7 +666,7 @@ export class CodexSession implements AgentSession {
     if (isObj(result) && isObj(result.thread)) {
       const id = str(result.thread.id) || this.threadId;
       this.threadId = id;
-      if (id) saveCodexThreadId(this.taskId, this.agentId, id);
+      if (id) this.persistThreadId(id);
     }
   }
 
@@ -594,7 +692,7 @@ export class CodexSession implements AgentSession {
             ? str(result.thread.id)
             : threadId;
         this.threadId = id;
-        saveCodexThreadId(this.taskId, this.agentId, id);
+        this.persistThreadId(id);
         return true;
       } catch (err) {
         const code = (err as { rpcCode?: number }).rpcCode;
@@ -615,6 +713,16 @@ export class CodexSession implements AgentSession {
 
   // -- AgentSession ---------------------------------------------------------
 
+  private persistThreadId(threadId: string): void {
+    saveCodexThreadId(
+      this.taskId,
+      this.agentId,
+      threadId,
+      this.proc.durableSessionDir,
+      this.attachCompatibilityKey,
+    );
+  }
+
   onEvent(handler: AgentEventHandler): () => void {
     this.handlers.add(handler);
     return () => this.handlers.delete(handler);
@@ -704,6 +812,22 @@ register({
   // provider block rides it, and this destructuring silently dropped it on
   // the first live gpt-5-mini smoke (2026-09-12, host 0.9.136 — codex still
   // dialed api.openai.com).
-  create: async ({ taskId, agent, environment, systemPreamble, agentEnv, cliConfigOverrides }) =>
-    new CodexSession({ taskId, agent, environment, systemPreamble, agentEnv, cliConfigOverrides }),
+  create: async ({
+    taskId,
+    agent,
+    environment,
+    systemPreamble,
+    agentEnv,
+    attachCompatibilityKey,
+    cliConfigOverrides,
+  }) =>
+    new CodexSession({
+      taskId,
+      agent,
+      environment,
+      systemPreamble,
+      agentEnv,
+      attachCompatibilityKey,
+      cliConfigOverrides,
+    }),
 });

package/lib/agents/cursor.ts

@@ -50,6 +50,13 @@ import type {
 
 const CURSOR_BIN = "/home/node/.local/bin/cursor-agent";
 
+// Cursor replays its captured sandbox environment immediately before it
+// evaluates each shell command. In loader tasks this restore hook is the last
+// step in that replay, so the command sees the current project environment
+// rather than Cursor's stale launch snapshot.
+export const CURSOR_SANDBOX_ENV_RESTORE =
+  ". /usr/local/share/uai/env-hook.sh; __uai_env_sync";
+
 // A curated slice of Cursor's ~32 models (full ids from `cursor-agent
 // --list-models`). `auto` lets Cursor pick; the rest are the frontier. The UI
 // also accepts any typed id (unverified round-trip). UPDATE as Cursor's lineup
@@ -233,8 +240,15 @@ export class CursorSession implements AgentSession {
     if (this.sessionId) argv.push("--resume", this.sessionId);
     return {
       argv: argv as [string, ...string[]],
+      projectEnvProfile: "task",
       user: "node",
-      env: { ...this.agentEnv, CURSOR_API_KEY: this.apiKey },
+      env: {
+        ...this.agentEnv,
+        CURSOR_API_KEY: this.apiKey,
+        ...(this.environment.descriptor.envMode === "loader"
+          ? { __CURSOR_SANDBOX_ENV_RESTORE: CURSOR_SANDBOX_ENV_RESTORE }
+          : {}),
+      },
       maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,
     };
   }

package/lib/agents/durable-proc.ts

@@ -72,6 +72,7 @@ interface RunnerMeta {
 }
 
 export class DurableProcess {
+  readonly durableSessionDir: string;
   private readonly dir: string;
   private readonly outboxPath: string;
   private readonly inboxPath: string;
@@ -95,6 +96,7 @@ export class DurableProcess {
   private readonly debug: string | null;
 
   constructor(opts: DurableProcessOptions) {
+    this.durableSessionDir = opts.hostSessionDir;
     this.dir = opts.hostSessionDir;
     this.outboxPath = join(this.dir, "outbox.jsonl");
     this.inboxPath = join(this.dir, "inbox.jsonl");

package/lib/agents/grok.ts

@@ -52,6 +52,7 @@ import type {
 } from "./types";
 
 const GROK_BIN = "/home/node/.grok/bin/grok";
+export const GROK_LOADER_LOGIN_ENV = "0";
 
 // `grok models` lists what the account can run. grok-4.5 is the current
 // default; UPDATE WHEN xAI CHANGES the lineup.
@@ -181,6 +182,7 @@ export class GrokSession implements AgentSession {
     if (this.sessionId) argv.push("-r", this.sessionId);
     return {
       argv: argv as [string, ...string[]],
+      projectEnvProfile: "task",
       user: "node",
       inheritEnv,
       env: {
@@ -193,6 +195,12 @@ export class GrokSession implements AgentSession {
         // the same reasoning as --permission-mode bypassPermissions above
         // (live 2026-09-08, first Grok agents with MCP servers).
         GROK_FOLDER_TRUST: "0",
+        // grok 1.0.5 otherwise captures a login-shell environment once and
+        // reuses that static state for LocalNonPersistent commands. Loader
+        // tasks refresh per command, so disable that stale snapshot path.
+        ...(this.environment.descriptor.envMode === "loader"
+          ? { GROK_LOGIN_ENV: GROK_LOADER_LOGIN_ENV }
+          : {}),
       },
       maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,
     };

package/lib/agents/kimi.ts

@@ -223,6 +223,7 @@ export class KimiSession implements AgentSession {
     if (this.sessionId) argv.push("-r", this.sessionId);
     return {
       argv: argv as [string, ...string[]],
+      projectEnvProfile: "task",
       user: "node",
       env: this.agentEnv,
       maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,

package/lib/agents/machine-durable.ts

@@ -59,6 +59,7 @@ async function execStep(
 ): Promise<{ exitCode: number | null; stdout: string; stderr: string }> {
   const result = await environment.exec({
     argv,
+    projectEnvProfile: "maintenance",
     ...(stdin ? { stdin } : {}),
     timeoutMs: STEP_TIMEOUT_MS,
     maxOutputBytes: STEP_OUTPUT_BYTES,
@@ -129,6 +130,7 @@ export interface MachineDurableOptions {
 }
 
 export class MachineDurableProcess implements LineTransport {
+  readonly durableSessionDir: string;
   readonly #environment: MachineSessionEnvironment;
   readonly #sessionDir: string;
   readonly #outboxPath: string;
@@ -158,6 +160,7 @@ export class MachineDurableProcess implements LineTransport {
   readonly #debug: string | null;
 
   constructor(opts: MachineDurableOptions) {
+    this.durableSessionDir = opts.sessionDir;
     this.#environment = opts.environment;
     this.#sessionDir = opts.sessionDir;
     this.#outboxPath = posix.join(opts.sessionDir, "outbox.jsonl");
@@ -226,6 +229,7 @@ export class MachineDurableProcess implements LineTransport {
           String(this.#offset + 1),
           this.#outboxPath,
         ],
+        projectEnvProfile: "maintenance",
         maxOutputBytes: 8 * 1024 * 1024,
       });
     } catch {
@@ -563,3 +567,16 @@ export async function stopMachinePredecessor(
     // Dir gone / runner dead — nothing to stop.
   }
 }
+
+/** Removal/recovery variant: failure is not success because no later attach
+ * will provide the transport layer's usual predecessor-stop backstop. */
+export async function stopMachinePredecessorStrict(
+  environment: MachineSessionEnvironment,
+  sessionDir: string,
+): Promise<void> {
+  await appendEnvironmentFile(
+    environment,
+    posix.join(sessionDir, "inbox.jsonl"),
+    '{"__uai":"stop"}\n',
+  );
+}

package/lib/agents/opencode.ts

@@ -357,6 +357,7 @@ export class OpencodeSession implements AgentSession {
     argv.push(prompt);
     return {
       argv: argv as [string, ...string[]],
+      projectEnvProfile: "task",
       user: "node",
       env: this.agentEnv,
       maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,

package/lib/agents/proc.ts

@@ -7,6 +7,7 @@ import type {
   TaskEnvironmentProcess,
   TaskEnvironmentSessionRequest,
 } from "../task-environment/types";
+import { agentCliArgv } from "../agent-cli";
 
 export type LineHandler = (line: string) => void;
 export type ExitHandler = (code: number | null) => void;
@@ -168,6 +169,10 @@ export function spawnEnvironmentProcess(
   environment: TaskEnvironmentAgentSessionSurface,
   request: TaskEnvironmentSessionRequest,
 ): AgentEnvironmentProcess {
+  const launchRequest: TaskEnvironmentSessionRequest = {
+    ...request,
+    argv: agentCliArgv(environment, request.argv),
+  };
   class EnvironmentProcess extends EventEmitter implements AgentEnvironmentProcess {
     readonly stdout = new EventEmitter();
     readonly stderr = new EventEmitter();
@@ -176,7 +181,7 @@ export function spawnEnvironmentProcess(
 
     constructor() {
       super();
-      this.processPromise = environment.spawnSession(request);
+      this.processPromise = environment.spawnSession(launchRequest);
       void this.consume();
     }